Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix handling of trusted certs in CA mode #221

Merged
merged 2 commits into from
Nov 5, 2023
Merged

Fix handling of trusted certs in CA mode #221

merged 2 commits into from
Nov 5, 2023

Conversation

stgraber
Copy link
Member

@stgraber stgraber commented Nov 5, 2023

This fixes a regression introduced by LXD when refactoring the auth code ahead of OpenFGA.
The regression was further hidden by an incorrect PKI test.

Closes lxc#218

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
The test as it was written was quite incorrect.

core.trust_ca_certificates causes valid certificates to be implictly
trusted and not get a certificate store entry.

But as the test was run immediately after a configuration where
core.trust_ca_certificates was not set, there was a leftover entry in
the trust store which the test was then checking.

This corrects the test by clearing the trust store after the initial
test and by further making sure that when using
core.trust_ca_certificates, no trust store entries get created.

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
@tych0 tych0 merged commit 56caa66 into lxc:main Nov 5, 2023
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants