mirror/opencloud
1
0
Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-01-05 11:51:16 -06:00
Code Issues Packages Projects Releases Wiki Activity

Improve LDAP CA cert check

Browse Source 
The check was still racy as it could return early if the cert file
exists but was not fully written yet.
This commit is contained in:
Ralf Haferkamp
2022-06-23 13:17:57 +02:00
parent 889acbfbf0
commit ca5952fe34
1 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
ocis-pkg/ldap/ldap.go
View File

@@ -1,24 +1,39 @@
package ldap
import (
"crypto/x509"
"errors"
"io/ioutil"
"os"
"time"
"github.com/owncloud/ocis/v2/ocis-pkg/log"
)
const _caTimeout = 5
const (
caCheckRetries = 3
caCheckSleep = 2
)
func WaitForCA(log log.Logger, insecure bool, caCert string) error {
if !insecure && caCert != "" {
if _, err := os.Stat(caCert); errors.Is(err, os.ErrNotExist) {
log.Warn().Str("LDAP CACert", caCert).Msgf("File does not exist. Waiting %d seconds for it to appear.", _caTimeout)
time.Sleep(_caTimeout * time.Second)
if _, err := os.Stat(caCert); errors.Is(err, os.ErrNotExist) {
log.Warn().Str("LDAP CACert", caCert).Msgf("File still does not exist after Timeout")
for i := 0; i < caCheckRetries; i++ {
if _, err := os.Stat(caCert); err != nil && !errors.Is(err, os.ErrNotExist) {
return err
}
// Check if this actually is a CA cert. We need to retry here as well
// as the file might exist already, but have no contents yet.
certs := x509.NewCertPool()
pemData, err := ioutil.ReadFile(caCert)
if err != nil {
log.Debug().Err(err).Str("LDAP CACert", caCert).Msg("Error reading CA")
} else if !certs.AppendCertsFromPEM(pemData) {
log.Debug().Str("LDAP CAcert", caCert).Msg("Failed to append CA to pool")
} else {
return nil
}
time.Sleep(caCheckSleep * time.Second)
log.Warn().Str("LDAP CACert", caCert).Msgf("CA cert file is not ready yet. Waiting %d seconds for it to appear.", caCheckSleep)
}
}
return nil