k8s.io/apiserver@v0.31.1/pkg/server/dynamiccertificates/named_certificates.go (about) 1 /* 2 Copyright 2019 The Kubernetes Authors. 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15 */ 16 17 package dynamiccertificates 18 19 import ( 20 "crypto/tls" 21 "crypto/x509" 22 "fmt" 23 "strings" 24 25 corev1 "k8s.io/api/core/v1" 26 "k8s.io/apimachinery/pkg/util/validation" 27 "k8s.io/klog/v2" 28 netutils "k8s.io/utils/net" 29 ) 30 31 // BuildNamedCertificates returns a map of *tls.Certificate by name. It's 32 // suitable for use in tls.Config#NamedCertificates. Returns an error if any of the certs 33 // is invalid. Returns nil if len(certs) == 0 34 func (c *DynamicServingCertificateController) BuildNamedCertificates(sniCerts []sniCertKeyContent) (map[string]*tls.Certificate, error) { 35 nameToCertificate := map[string]*tls.Certificate{} 36 byNameExplicit := map[string]*tls.Certificate{} 37 38 // Iterate backwards so that earlier certs take precedence in the names map 39 for i := len(sniCerts) - 1; i >= 0; i-- { 40 cert, err := tls.X509KeyPair(sniCerts[i].cert, sniCerts[i].key) 41 if err != nil { 42 return nil, fmt.Errorf("invalid SNI cert keypair [%d/%q]: %v", i, c.sniCerts[i].Name(), err) 43 } 44 45 // error is not possible given above call to X509KeyPair 46 x509Cert, _ := x509.ParseCertificate(cert.Certificate[0]) 47 48 names := sniCerts[i].sniNames 49 for _, name := range names { 50 byNameExplicit[name] = &cert 51 } 52 53 klog.V(2).InfoS("Loaded SNI cert", "index", i, "certName", c.sniCerts[i].Name(), "certDetail", GetHumanCertDetail(x509Cert)) 54 if c.eventRecorder != nil { 55 c.eventRecorder.Eventf(&corev1.ObjectReference{Name: c.sniCerts[i].Name()}, nil, corev1.EventTypeWarning, "TLSConfigChanged", "SNICertificateReload", "loaded SNI cert [%d/%q]: %s with explicit names %v", i, c.sniCerts[i].Name(), GetHumanCertDetail(x509Cert), names) 56 } 57 58 if len(names) == 0 { 59 names = getCertificateNames(x509Cert) 60 for _, name := range names { 61 nameToCertificate[name] = &cert 62 } 63 } 64 } 65 66 // Explicitly set names must override 67 for k, v := range byNameExplicit { 68 nameToCertificate[k] = v 69 } 70 71 return nameToCertificate, nil 72 } 73 74 // getCertificateNames returns names for an x509.Certificate. The names are 75 // suitable for use in tls.Config#NamedCertificates. 76 func getCertificateNames(cert *x509.Certificate) []string { 77 var names []string 78 79 cn := cert.Subject.CommonName 80 cnIsIP := netutils.ParseIPSloppy(cn) != nil 81 cnIsValidDomain := cn == "*" || len(validation.IsDNS1123Subdomain(strings.TrimPrefix(cn, "*."))) == 0 82 // don't use the CN if it is a valid IP because our IP serving detection may unexpectedly use it to terminate the connection. 83 if !cnIsIP && cnIsValidDomain { 84 names = append(names, cn) 85 } 86 names = append(names, cert.DNSNames...) 87 // intentionally all IPs in the cert are ignored as SNI forbids passing IPs 88 // to select a cert. Before go 1.6 the tls happily passed IPs as SNI values. 89 90 return names 91 }