[ca]: Add a 5-second timeout to an external CA signing request

ca/external.go

@@ -11,6 +11,7 @@ import (
 	"io/ioutil"
 	"net/http"
 	"sync"
+	"time"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/cloudflare/cfssl/api"
@@ -29,6 +30,8 @@ var ErrNoExternalCAURLs = errors.New("no external CA URLs")
 // ExternalCA is able to make certificate signing requests to one of a list
 // remote CFSSL API endpoints.
 type ExternalCA struct {
+	ExternalRequestTimeout time.Duration
+
 	mu     sync.Mutex
 	rootCA *RootCA
 	urls   []string
@@ -39,8 +42,9 @@ type ExternalCA struct {
 // authenticate to any of the given URLS of CFSSL API endpoints.
 func NewExternalCA(rootCA *RootCA, tlsConfig *tls.Config, urls ...string) *ExternalCA {
 	return &ExternalCA{
-		rootCA: rootCA,
-		urls:   urls,
+		ExternalRequestTimeout: 5 * time.Second,
+		rootCA:                 rootCA,
+		urls:                   urls,
 		client: &http.Client{
 			Transport: &http.Transport{
 				TLSClientConfig: tlsConfig,
@@ -93,7 +97,9 @@ func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert [
 	// Try each configured proxy URL. Return after the first success. If
 	// all fail then the last error will be returned.
 	for _, url := range urls {
-		cert, err = makeExternalSignRequest(ctx, client, url, csrJSON)
+		requestCtx, cancel := context.WithTimeout(ctx, eca.ExternalRequestTimeout)
+		cert, err = makeExternalSignRequest(requestCtx, client, url, csrJSON)
+		cancel()
 		if err == nil {
 			return append(cert, eca.rootCA.Intermediates...), err
 		}

ca/external_test.go

@@ -3,7 +3,10 @@ package ca_test
 import (
 	"context"
 	"crypto/x509"
+	"net/http"
+	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/cloudflare/cfssl/helpers"
 	"github.com/docker/swarmkit/ca"
@@ -77,3 +80,49 @@ func TestExternalCACrossSign(t *testing.T) {
 	_, err = leafCert.Verify(x509.VerifyOptions{Roots: rootCA2.Pool, Intermediates: intermediatePool})
 	require.NoError(t, err)
 }
+
+func TestExternalCASignRequestTimesOut(t *testing.T) {
+	t.Parallel()
+
+	if testutils.External {
+		return // this does not require the external CA in any way
+	}
+
+	rootCA, err := ca.CreateRootCA("rootCN")
+	require.NoError(t, err)
+
+	signDone, allDone := make(chan error), make(chan struct{})
+	defer close(signDone)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", func(http.ResponseWriter, *http.Request) {
+		// hang forever
+		select {
+		case <-allDone:
+		}
+	})
+
+	server := httptest.NewServer(mux)
+	defer server.Close()
+	defer server.CloseClientConnections()
+	defer close(allDone)
+
+	csr, _, err := ca.GenerateNewCSR()
+	require.NoError(t, err)
+
+	externalCA := ca.NewExternalCA(&rootCA, nil, server.URL)
+	externalCA.ExternalRequestTimeout = time.Second
+	go func() {
+		_, err := externalCA.Sign(context.Background(), ca.PrepareCSR(csr, "cn", "ou", "org"))
+		select {
+		case <-allDone:
+		case signDone <- err:
+		}
+	}()
+
+	select {
+	case err = <-signDone:
+		require.Contains(t, err.Error(), context.DeadlineExceeded.Error())
+	case <-time.After(3 * time.Second):
+		require.FailNow(t, "call to external CA signing should have timed out after 1 second - it's been 3")
+	}
+}