forked from moby/swarmkit
-
Notifications
You must be signed in to change notification settings - Fork 0
/
forward.go
67 lines (59 loc) · 1.71 KB
/
forward.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
package ca
import (
"golang.org/x/net/context"
"google.golang.org/grpc/metadata"
)
const (
certForwardedKey = "forwarded_cert"
certCNKey = "forwarded_cert_cn"
certOUKey = "forwarded_cert_ou"
certOrgKey = "forwarded_cert_org"
)
// forwardedTLSInfoFromContext obtains forwarded TLS CN/OU from the grpc.MD
// object in ctx.
func forwardedTLSInfoFromContext(ctx context.Context) (string, string, []string) {
var cn, org string
md, _ := metadata.FromContext(ctx)
if len(md[certCNKey]) != 0 {
cn = md[certCNKey][0]
}
if len(md[certOrgKey]) != 0 {
org = md[certOrgKey][0]
}
return cn, org, md[certOUKey]
}
func isForwardedRequest(ctx context.Context) bool {
md, _ := metadata.FromContext(ctx)
if len(md[certForwardedKey]) != 1 {
return false
}
return md[certForwardedKey][0] == "true"
}
// WithMetadataForwardTLSInfo reads certificate from context and returns context where
// ForwardCert is set based on original certificate.
func WithMetadataForwardTLSInfo(ctx context.Context) (context.Context, error) {
md, ok := metadata.FromContext(ctx)
if !ok {
md = metadata.MD{}
}
ous := []string{}
org := ""
cn := ""
certSubj, err := certSubjectFromContext(ctx)
if err == nil {
cn = certSubj.CommonName
ous = certSubj.OrganizationalUnit
if len(certSubj.Organization) > 0 {
org = certSubj.Organization[0]
}
}
// If there's no TLS cert, forward with blank TLS metadata.
// Note that the presence of this blank metadata is extremely
// important. Without it, it would look like manager is making
// the request directly.
md[certForwardedKey] = []string{"true"}
md[certCNKey] = []string{cn}
md[certOrgKey] = []string{org}
md[certOUKey] = ous
return metadata.NewContext(ctx, md), nil
}