Skip to content

Commit 8ce807a

Browse files
marainomaraino
committed
Modify errs.BadRequest() calls to always send an error to the client.
1 parent 8d229b9 commit 8ce807a

15 files changed

+74
-46
lines changed

‎api/api_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -403,9 +403,9 @@ func TestSignRequest_Validate(t *testing.T) {
403403
fields fields
404404
err error
405405
}{
406-
{"missing csr", fields{CertificateRequest{}, "foobarzar", time.Time{}, time.Time{}}, errors.New("missing csr")},
406+
{"missing csr", fields{CertificateRequest{}, "foobarzar", time.Time{}, time.Time{}}, errors.New("The request could not be completed: missing csr.")},
407407
{"invalid csr", fields{CertificateRequest{bad}, "foobarzar", time.Time{}, time.Time{}}, errors.New("invalid csr")},
408-
{"missing ott", fields{CertificateRequest{csr}, "", time.Time{}, time.Time{}}, errors.New("missing ott")},
408+
{"missing ott", fields{CertificateRequest{csr}, "", time.Time{}, time.Time{}}, errors.New("The request could not be completed: missing ott.")},
409409
}
410410
for _, tt := range tests {
411411
t.Run(tt.name, func(t *testing.T) {
@@ -1087,7 +1087,7 @@ func Test_caHandler_Provisioners(t *testing.T) {
10871087
t.Fatal(err)
10881088
}
10891089

1090-
expectedError400 := errs.BadRequest("force")
1090+
expectedError400 := errs.BadRequestErr(errors.New("force"))
10911091
expectedError400Bytes, err := json.Marshal(expectedError400)
10921092
assert.FatalError(t, err)
10931093
expectedError500 := errs.InternalServer("force")

‎api/rekey.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,8 @@ func (s *RekeyRequest) Validate() error {
2626

2727
// Rekey is similar to renew except that the certificate will be renewed with new key from csr.
2828
func (h *caHandler) Rekey(w http.ResponseWriter, r *http.Request) {
29-
3029
if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
31-
WriteError(w, errs.BadRequest("missing peer certificate"))
30+
WriteError(w, errs.BadRequest("missing client certificate"))
3231
return
3332
}
3433

‎api/renew.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
// new one.
1111
func (h *caHandler) Renew(w http.ResponseWriter, r *http.Request) {
1212
if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
13-
WriteError(w, errs.BadRequest("missing peer certificate"))
13+
WriteError(w, errs.BadRequest("missing client certificate"))
1414
return
1515
}
1616

‎api/revoke.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -80,12 +80,12 @@ func (h *caHandler) Revoke(w http.ResponseWriter, r *http.Request) {
8080
// the client certificate Serial Number must match the serial number
8181
// being revoked.
8282
if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
83-
WriteError(w, errs.BadRequest("missing ott or peer certificate"))
83+
WriteError(w, errs.BadRequest("missing ott or client certificate"))
8484
return
8585
}
8686
opts.Crt = r.TLS.PeerCertificates[0]
8787
if opts.Crt.SerialNumber.String() != opts.Serial {
88-
WriteError(w, errs.BadRequest("revoke: serial number in mtls certificate different than body"))
88+
WriteError(w, errs.BadRequest("serial number in client certificate different than body"))
8989
return
9090
}
9191
// TODO: should probably be checking if the certificate was revoked here.

‎api/revoke_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ func TestRevokeRequestValidate(t *testing.T) {
2828
tests := map[string]test{
2929
"error/missing serial": {
3030
rr: &RevokeRequest{},
31-
err: &errs.Error{Err: errors.New("missing serial"), Status: http.StatusBadRequest},
31+
err: &errs.Error{Err: errors.New("The request could not be completed: missing serial."), Status: http.StatusBadRequest},
3232
},
3333
"error/bad reasonCode": {
3434
rr: &RevokeRequest{
3535
Serial: "sn",
3636
ReasonCode: 15,
3737
Passive: true,
3838
},
39-
err: &errs.Error{Err: errors.New("reasonCode out of bounds"), Status: http.StatusBadRequest},
39+
err: &errs.Error{Err: errors.New("The request could not be completed: reasonCode out of bounds."), Status: http.StatusBadRequest},
4040
},
4141
"error/non-passive not implemented": {
4242
rr: &RevokeRequest{

‎authority/provisioner/sshpop.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -191,8 +191,7 @@ func (p *SSHPOP) AuthorizeSSHRevoke(ctx context.Context, token string) error {
191191
return errs.Wrap(http.StatusInternalServerError, err, "sshpop.AuthorizeSSHRevoke")
192192
}
193193
if claims.Subject != strconv.FormatUint(claims.sshCert.Serial, 10) {
194-
return errs.BadRequest("sshpop.AuthorizeSSHRevoke; sshpop token subject " +
195-
"must be equivalent to sshpop certificate serial number")
194+
return errs.BadRequest("sshpop token subject must be equivalent to sshpop certificate serial number")
196195
}
197196
return nil
198197
}
@@ -205,7 +204,7 @@ func (p *SSHPOP) AuthorizeSSHRenew(ctx context.Context, token string) (*ssh.Cert
205204
return nil, errs.Wrap(http.StatusInternalServerError, err, "sshpop.AuthorizeSSHRenew")
206205
}
207206
if claims.sshCert.CertType != ssh.HostCert {
208-
return nil, errs.BadRequest("sshpop.AuthorizeSSHRenew; sshpop certificate must be a host ssh certificate")
207+
return nil, errs.BadRequest("sshpop certificate must be a host ssh certificate")
209208
}
210209

211210
return claims.sshCert, nil
@@ -220,7 +219,7 @@ func (p *SSHPOP) AuthorizeSSHRekey(ctx context.Context, token string) (*ssh.Cert
220219
return nil, nil, errs.Wrap(http.StatusInternalServerError, err, "sshpop.AuthorizeSSHRekey")
221220
}
222221
if claims.sshCert.CertType != ssh.HostCert {
223-
return nil, nil, errs.BadRequest("sshpop.AuthorizeSSHRekey; sshpop certificate must be a host ssh certificate")
222+
return nil, nil, errs.BadRequest("sshpop certificate must be a host ssh certificate")
224223
}
225224
return claims.sshCert, []SignOption{
226225
// Validate public key

‎authority/provisioner/sshpop_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ func TestSSHPOP_AuthorizeSSHRevoke(t *testing.T) {
258258
p: p,
259259
token: tok,
260260
code: http.StatusBadRequest,
261-
err: errors.New("sshpop.AuthorizeSSHRevoke; sshpop token subject must be equivalent to sshpop certificate serial number"),
261+
err: errors.New("The request could not be completed: sshpop token subject must be equivalent to sshpop certificate serial number."),
262262
}
263263
},
264264
"ok": func(t *testing.T) test {
@@ -337,7 +337,7 @@ func TestSSHPOP_AuthorizeSSHRenew(t *testing.T) {
337337
p: p,
338338
token: tok,
339339
code: http.StatusBadRequest,
340-
err: errors.New("sshpop.AuthorizeSSHRenew; sshpop certificate must be a host ssh certificate"),
340+
err: errors.New("The request could not be completed: sshpop certificate must be a host ssh certificate."),
341341
}
342342
},
343343
"ok": func(t *testing.T) test {
@@ -419,7 +419,7 @@ func TestSSHPOP_AuthorizeSSHRekey(t *testing.T) {
419419
p: p,
420420
token: tok,
421421
code: http.StatusBadRequest,
422-
err: errors.New("sshpop.AuthorizeSSHRekey; sshpop certificate must be a host ssh certificate"),
422+
err: errors.New("The request could not be completed: sshpop certificate must be a host ssh certificate."),
423423
}
424424
},
425425
"ok": func(t *testing.T) test {

‎authority/ssh.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func (a *Authority) GetSSHConfig(ctx context.Context, typ string, data map[strin
6969
ts = a.templates.SSH.Host
7070
}
7171
default:
72-
return nil, errs.BadRequest("getSSHConfig: type %s is not valid", typ)
72+
return nil, errs.BadRequest("invalid certificate type '%s'", typ)
7373
}
7474

7575
// Merge user and default data
@@ -258,7 +258,7 @@ func (a *Authority) SignSSH(ctx context.Context, key ssh.PublicKey, opts provisi
258258
// RenewSSH creates a signed SSH certificate using the old SSH certificate as a template.
259259
func (a *Authority) RenewSSH(ctx context.Context, oldCert *ssh.Certificate) (*ssh.Certificate, error) {
260260
if oldCert.ValidAfter == 0 || oldCert.ValidBefore == 0 {
261-
return nil, errs.BadRequest("renewSSH: cannot renew certificate without validity period")
261+
return nil, errs.BadRequest("cannot renew a certificate without validity period")
262262
}
263263

264264
if err := a.authorizeSSHCertificate(ctx, oldCert); err != nil {
@@ -329,7 +329,7 @@ func (a *Authority) RekeySSH(ctx context.Context, oldCert *ssh.Certificate, pub
329329
}
330330

331331
if oldCert.ValidAfter == 0 || oldCert.ValidBefore == 0 {
332-
return nil, errs.BadRequest("rekeySSH; cannot rekey certificate without validity period")
332+
return nil, errs.BadRequest("cannot rekey a certificate without validity period")
333333
}
334334

335335
if err := a.authorizeSSHCertificate(ctx, oldCert); err != nil {
@@ -369,7 +369,7 @@ func (a *Authority) RekeySSH(ctx context.Context, oldCert *ssh.Certificate, pub
369369
}
370370
signer = a.sshCAHostCertSignKey
371371
default:
372-
return nil, errs.BadRequest("rekeySSH; unexpected ssh certificate type: %d", cert.CertType)
372+
return nil, errs.BadRequest("unexpected certificate type '%d'", cert.CertType)
373373
}
374374

375375
var err error

‎authority/ssh_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -912,7 +912,7 @@ func TestAuthority_RekeySSH(t *testing.T) {
912912
cert: &ssh.Certificate{},
913913
key: pub,
914914
signOpts: []provisioner.SignOption{},
915-
err: errors.New("rekeySSH; cannot rekey certificate without validity period"),
915+
err: errors.New("The request could not be completed: cannot rekey a certificate without validity period."),
916916
code: http.StatusBadRequest,
917917
}
918918
},
@@ -923,7 +923,7 @@ func TestAuthority_RekeySSH(t *testing.T) {
923923
cert: &ssh.Certificate{ValidAfter: uint64(now.Unix())},
924924
key: pub,
925925
signOpts: []provisioner.SignOption{},
926-
err: errors.New("rekeySSH; cannot rekey certificate without validity period"),
926+
err: errors.New("The request could not be completed: cannot rekey a certificate without validity period."),
927927
code: http.StatusBadRequest,
928928
}
929929
},
@@ -956,7 +956,7 @@ func TestAuthority_RekeySSH(t *testing.T) {
956956
cert: &ssh.Certificate{ValidAfter: uint64(now.Unix()), ValidBefore: uint64(now.Add(10 * time.Minute).Unix()), CertType: 0},
957957
key: pub,
958958
signOpts: []provisioner.SignOption{},
959-
err: errors.New("rekeySSH; unexpected ssh certificate type: 0"),
959+
err: errors.New("The request could not be completed: unexpected certificate type '0'."),
960960
code: http.StatusBadRequest,
961961
}
962962
},

‎authority/tls.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -433,8 +433,10 @@ func (a *Authority) Revoke(ctx context.Context, revokeOpts *RevokeOptions) error
433433
case db.ErrNotImplemented:
434434
return errs.NotImplemented("authority.Revoke; no persistence layer configured", opts...)
435435
case db.ErrAlreadyExists:
436-
return errs.BadRequest("authority.Revoke; certificate with serial "+
437-
"number %s has already been revoked", append([]interface{}{rci.Serial}, opts...)...)
436+
return errs.ApplyOptions(
437+
errs.BadRequest("certificate with serial number '%s' is already revoked", rci.Serial),
438+
opts...,
439+
)
438440
default:
439441
return errs.Wrap(http.StatusInternalServerError, err, "authority.Revoke", opts...)
440442
}

‎authority/tls_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -1187,7 +1187,7 @@ func TestAuthority_Revoke(t *testing.T) {
11871187
Reason: reason,
11881188
OTT: raw,
11891189
},
1190-
err: errors.New("authority.Revoke; certificate with serial number sn has already been revoked"),
1190+
err: errors.New("The request could not be completed: certificate with serial number 'sn' is already revoked"),
11911191
code: http.StatusBadRequest,
11921192
checkErrDetails: func(err *errs.Error) {
11931193
assert.Equals(t, err.Details["token"], raw)

‎ca/ca_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -588,15 +588,15 @@ func TestCARenew(t *testing.T) {
588588
ca: ca,
589589
tlsConnState: nil,
590590
status: http.StatusBadRequest,
591-
errMsg: errs.BadRequestDefaultMsg,
591+
errMsg: errs.BadRequestPrefix,
592592
}
593593
},
594594
"request-missing-peer-certificate": func(t *testing.T) *renewTest {
595595
return &renewTest{
596596
ca: ca,
597597
tlsConnState: &tls.ConnectionState{PeerCertificates: []*x509.Certificate{}},
598598
status: http.StatusBadRequest,
599-
errMsg: errs.BadRequestDefaultMsg,
599+
errMsg: errs.BadRequestPrefix,
600600
}
601601
},
602602
"success": func(t *testing.T) *renewTest {

‎ca/client.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -662,7 +662,7 @@ retry:
662662
// verify the sha256
663663
sum := sha256.Sum256(root.RootPEM.Raw)
664664
if !strings.EqualFold(sha256Sum, strings.ToLower(hex.EncodeToString(sum[:]))) {
665-
return nil, errs.BadRequest("client.Root; root certificate SHA256 fingerprint do not match")
665+
return nil, errs.BadRequest("root certificate fingerprint does not match")
666666
}
667667
return &root, nil
668668
}

‎ca/client_test.go

+14-14
Original file line numberDiff line numberDiff line change
@@ -337,8 +337,8 @@ func TestClient_Sign(t *testing.T) {
337337
}{
338338
{"ok", request, ok, 200, false, nil},
339339
{"unauthorized", request, errs.Unauthorized("force"), 401, true, errors.New(errs.UnauthorizedDefaultMsg)},
340-
{"empty request", &api.SignRequest{}, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
341-
{"nil request", nil, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
340+
{"empty request", &api.SignRequest{}, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix + "force.")},
341+
{"nil request", nil, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix + "force.")},
342342
}
343343

344344
srv := httptest.NewServer(nil)
@@ -410,7 +410,7 @@ func TestClient_Revoke(t *testing.T) {
410410
}{
411411
{"ok", request, ok, 200, false, nil},
412412
{"unauthorized", request, errs.Unauthorized("force"), 401, true, errors.New(errs.UnauthorizedDefaultMsg)},
413-
{"nil request", nil, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
413+
{"nil request", nil, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
414414
}
415415

416416
srv := httptest.NewServer(nil)
@@ -455,7 +455,7 @@ func TestClient_Revoke(t *testing.T) {
455455
if got != nil {
456456
t.Errorf("Client.Revoke() = %v, want nil", got)
457457
}
458-
assert.HasPrefix(t, tt.expectedErr.Error(), err.Error())
458+
assert.HasPrefix(t, err.Error(), tt.expectedErr.Error())
459459
default:
460460
if !reflect.DeepEqual(got, tt.response) {
461461
t.Errorf("Client.Revoke() = %v, want %v", got, tt.response)
@@ -484,8 +484,8 @@ func TestClient_Renew(t *testing.T) {
484484
}{
485485
{"ok", ok, 200, false, nil},
486486
{"unauthorized", errs.Unauthorized("force"), 401, true, errors.New(errs.UnauthorizedDefaultMsg)},
487-
{"empty request", errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
488-
{"nil request", errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
487+
{"empty request", errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
488+
{"nil request", errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
489489
}
490490

491491
srv := httptest.NewServer(nil)
@@ -519,7 +519,7 @@ func TestClient_Renew(t *testing.T) {
519519
sc, ok := err.(errs.StatusCoder)
520520
assert.Fatal(t, ok, "error does not implement StatusCoder interface")
521521
assert.Equals(t, sc.StatusCode(), tt.responseCode)
522-
assert.HasPrefix(t, tt.err.Error(), err.Error())
522+
assert.HasPrefix(t, err.Error(), tt.err.Error())
523523
default:
524524
if !reflect.DeepEqual(got, tt.response) {
525525
t.Errorf("Client.Renew() = %v, want %v", got, tt.response)
@@ -553,8 +553,8 @@ func TestClient_Rekey(t *testing.T) {
553553
}{
554554
{"ok", request, ok, 200, false, nil},
555555
{"unauthorized", request, errs.Unauthorized("force"), 401, true, errors.New(errs.UnauthorizedDefaultMsg)},
556-
{"empty request", &api.RekeyRequest{}, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
557-
{"nil request", nil, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
556+
{"empty request", &api.RekeyRequest{}, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
557+
{"nil request", nil, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
558558
}
559559

560560
srv := httptest.NewServer(nil)
@@ -588,7 +588,7 @@ func TestClient_Rekey(t *testing.T) {
588588
sc, ok := err.(errs.StatusCoder)
589589
assert.Fatal(t, ok, "error does not implement StatusCoder interface")
590590
assert.Equals(t, sc.StatusCode(), tt.responseCode)
591-
assert.HasPrefix(t, tt.err.Error(), err.Error())
591+
assert.HasPrefix(t, err.Error(), tt.err.Error())
592592
default:
593593
if !reflect.DeepEqual(got, tt.response) {
594594
t.Errorf("Client.Renew() = %v, want %v", got, tt.response)
@@ -735,7 +735,7 @@ func TestClient_Roots(t *testing.T) {
735735
}{
736736
{"ok", ok, 200, false, nil},
737737
{"unauthorized", errs.Unauthorized("force"), 401, true, errors.New(errs.UnauthorizedDefaultMsg)},
738-
{"bad-request", errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
738+
{"bad-request", errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
739739
}
740740

741741
srv := httptest.NewServer(nil)
@@ -768,7 +768,7 @@ func TestClient_Roots(t *testing.T) {
768768
sc, ok := err.(errs.StatusCoder)
769769
assert.Fatal(t, ok, "error does not implement StatusCoder interface")
770770
assert.Equals(t, sc.StatusCode(), tt.responseCode)
771-
assert.HasPrefix(t, tt.err.Error(), err.Error())
771+
assert.HasPrefix(t, err.Error(), tt.err.Error())
772772
default:
773773
if !reflect.DeepEqual(got, tt.response) {
774774
t.Errorf("Client.Roots() = %v, want %v", got, tt.response)
@@ -1016,7 +1016,7 @@ func TestClient_SSHBastion(t *testing.T) {
10161016
}{
10171017
{"ok", &api.SSHBastionRequest{Hostname: "host.local"}, ok, 200, false, nil},
10181018
{"bad-response", &api.SSHBastionRequest{Hostname: "host.local"}, "bad json", 200, true, nil},
1019-
{"bad-request", &api.SSHBastionRequest{}, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestDefaultMsg)},
1019+
{"bad-request", &api.SSHBastionRequest{}, errs.BadRequest("force"), 400, true, errors.New(errs.BadRequestPrefix)},
10201020
}
10211021

10221022
srv := httptest.NewServer(nil)
@@ -1050,7 +1050,7 @@ func TestClient_SSHBastion(t *testing.T) {
10501050
sc, ok := err.(errs.StatusCoder)
10511051
assert.Fatal(t, ok, "error does not implement StatusCoder interface")
10521052
assert.Equals(t, sc.StatusCode(), tt.responseCode)
1053-
assert.HasPrefix(t, tt.err.Error(), err.Error())
1053+
assert.HasPrefix(t, err.Error(), tt.err.Error())
10541054
}
10551055
default:
10561056
if !reflect.DeepEqual(got, tt.response) {

0 commit comments

Comments
 (0)