1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
package ca
import (
"context"
"google.golang.org/grpc/metadata"
"google.golang.org/grpc/peer"
)
const (
certForwardedKey = "forwarded_cert"
certCNKey = "forwarded_cert_cn"
certOUKey = "forwarded_cert_ou"
certOrgKey = "forwarded_cert_org"
remoteAddrKey = "remote_addr"
)
// forwardedTLSInfoFromContext obtains forwarded TLS CN/OU from the grpc.MD
// object in ctx.
func forwardedTLSInfoFromContext(ctx context.Context) (remoteAddr string, cn string, org string, ous []string) {
md, _ := metadata.FromIncomingContext(ctx)
if len(md[remoteAddrKey]) != 0 {
remoteAddr = md[remoteAddrKey][0]
}
if len(md[certCNKey]) != 0 {
cn = md[certCNKey][0]
}
if len(md[certOrgKey]) != 0 {
org = md[certOrgKey][0]
}
ous = md[certOUKey]
return
}
func isForwardedRequest(ctx context.Context) bool {
md, _ := metadata.FromIncomingContext(ctx)
if len(md[certForwardedKey]) != 1 {
return false
}
return md[certForwardedKey][0] == "true"
}
// WithMetadataForwardTLSInfo reads certificate from context and returns context where
// ForwardCert is set based on original certificate.
func WithMetadataForwardTLSInfo(ctx context.Context) (context.Context, error) {
md, ok := metadata.FromIncomingContext(ctx)
if !ok {
md = metadata.MD{}
}
ous := []string{}
org := ""
cn := ""
certSubj, err := certSubjectFromContext(ctx)
if err == nil {
cn = certSubj.CommonName
ous = certSubj.OrganizationalUnit
if len(certSubj.Organization) > 0 {
org = certSubj.Organization[0]
}
}
// If there's no TLS cert, forward with blank TLS metadata.
// Note that the presence of this blank metadata is extremely
// important. Without it, it would look like manager is making
// the request directly.
md[certForwardedKey] = []string{"true"}
md[certCNKey] = []string{cn}
md[certOrgKey] = []string{org}
md[certOUKey] = ous
peer, ok := peer.FromContext(ctx)
if ok {
md[remoteAddrKey] = []string{peer.Addr.String()}
}
return metadata.NewOutgoingContext(ctx, md), nil
}
|
