kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Use exclusive root pools if a CA cert file is specified in the daemon

Browse source 
Signed-off-by: Ying Li <ying.li@docker.com>
This commit is contained in:
Ying Li 2017-05-12 11:07:51 -07:00
parent eb8abc9598
commit ddd5278b07
2 changed files with 37 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
cmd/dockerd/daemon.go
View file

@ -129,9 +129,10 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
if cli.Config.TLS {
tlsOptions := tlsconfig.Options{
CAFile: cli.Config.CommonTLSOptions.CAFile,
CertFile: cli.Config.CommonTLSOptions.CertFile,
KeyFile: cli.Config.CommonTLSOptions.KeyFile,
CAFile: cli.Config.CommonTLSOptions.CAFile,
CertFile: cli.Config.CommonTLSOptions.CertFile,
KeyFile: cli.Config.CommonTLSOptions.KeyFile,
ExclusiveRootPools: true,
}
if cli.Config.TLSVerify {

34
integration-cli/docker_cli_daemon_test.go
View file

@ -21,9 +21,14 @@ import (
"syscall"
"time"
"crypto/tls"
"crypto/x509"
"github.com/cloudflare/cfssl/helpers"
"github.com/docker/docker/integration-cli/checker"
"github.com/docker/docker/integration-cli/cli"
"github.com/docker/docker/integration-cli/daemon"
"github.com/docker/docker/opts"
"github.com/docker/docker/pkg/mount"
"github.com/docker/docker/pkg/stringid"
"github.com/docker/docker/pkg/testutil"
@ -1687,7 +1692,7 @@ func (s *DockerDaemonSuite) TestDaemonStartWithoutHost(c *check.C) {
}
// FIXME(vdemeester) Use a new daemon instance instead of the Suite one
func (s *DockerDaemonSuite) TestDaemonStartWithDefalutTLSHost(c *check.C) {
func (s *DockerDaemonSuite) TestDaemonStartWithDefaultTLSHost(c *check.C) {
s.d.UseDefaultTLSHost = true
defer func() {
s.d.UseDefaultTLSHost = false
@ -1717,6 +1722,33 @@ func (s *DockerDaemonSuite) TestDaemonStartWithDefalutTLSHost(c *check.C) {
if !strings.Contains(out, "Server") {
c.Fatalf("docker version should return information of server side")
}
// ensure when connecting to the server that only a single acceptable CA is requested
contents, err := ioutil.ReadFile("fixtures/https/ca.pem")
c.Assert(err, checker.IsNil)
rootCert, err := helpers.ParseCertificatePEM(contents)
c.Assert(err, checker.IsNil)
rootPool := x509.NewCertPool()
rootPool.AddCert(rootCert)
var certRequestInfo *tls.CertificateRequestInfo
conn, err := tls.Dial("tcp", fmt.Sprintf("%s:%d", opts.DefaultHTTPHost, opts.DefaultTLSHTTPPort), &tls.Config{
RootCAs: rootPool,
GetClientCertificate: func(cri *tls.CertificateRequestInfo) (*tls.Certificate, error) {
certRequestInfo = cri
cert, err := tls.LoadX509KeyPair("fixtures/https/client-cert.pem", "fixtures/https/client-key.pem")
if err != nil {
return nil, err
}
return &cert, nil
},
})
c.Assert(err, checker.IsNil)
conn.Close()
c.Assert(certRequestInfo, checker.NotNil)
c.Assert(certRequestInfo.AcceptableCAs, checker.HasLen, 1)
c.Assert(certRequestInfo.AcceptableCAs[0], checker.DeepEquals, rootCert.RawSubject)
}
func (s *DockerDaemonSuite) TestBridgeIPIsExcludedFromAllocatorPool(c *check.C) {