zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-07-24 19:48:32 +02:00
Code Issues Projects Releases Packages Wiki Activity

Don't check cert validation if we're not changing the certs in the console (#2178)

Browse source 
If the cert(s) are invalid or expired that's a problem, but that
shouldn't necessarily prevent us from changing other things. If we're
not changing the certs, leave them alone.
This commit is contained in:
gbrodman 2023-10-16 13:37:57 -04:00 • committed by GitHub
parent a63916b08e
commit da04caeea2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

1
core/src/main/java/google/registry/request/RequestHandler.java
View file

@ -166,6 +166,7 @@ public class RequestHandler<C> {
} catch (Exception e) { } catch (Exception e) {
rsp.setStatus(SC_INTERNAL_SERVER_ERROR); rsp.setStatus(SC_INTERNAL_SERVER_ERROR);
rsp.getWriter().write("Internal server error, please try again later"); rsp.getWriter().write("Internal server error, please try again later");
logger.atSevere().withCause(e).log("Encountered internal server error");
} finally { } finally {
requestMetrics.record( requestMetrics.record(
new Duration(startTime, clock.nowUtc()), new Duration(startTime, clock.nowUtc()),

54
core/src/main/java/google/registry/ui/server/console/settings/SecurityAction.java
View file

@ -17,7 +17,6 @@ package google.registry.ui.server.console.settings;
import static google.registry.persistence.transaction.TransactionManagerFactory.tm; import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
import static google.registry.request.Action.Method.POST; import static google.registry.request.Action.Method.POST;
import avro.shaded.com.google.common.collect.ImmutableList;
import com.google.api.client.http.HttpStatusCodes; import com.google.api.client.http.HttpStatusCodes;
import com.google.gson.Gson; import com.google.gson.Gson;
import google.registry.flows.certs.CertificateChecker; import google.registry.flows.certs.CertificateChecker;
@ -103,42 +102,31 @@ public class SecurityAction implements JsonGetAction {
.asBuilder() .asBuilder()
.setIpAddressAllowList(registrarParameter.getIpAddressAllowList()); .setIpAddressAllowList(registrarParameter.getIpAddressAllowList());
boolean hasInvalidCerts = try {
ImmutableList.of( if (!savedRegistrar
registrarParameter.getClientCertificate(), .getClientCertificate()
registrarParameter.getFailoverClientCertificate()) .equals(registrarParameter.getClientCertificate())) {
.stream() if (registrarParameter.getClientCertificate().isPresent()) {
.filter(Optional::isPresent) String newClientCert = registrarParameter.getClientCertificate().get();
.map(Optional::get) certificateChecker.validateCertificate(newClientCert);
.anyMatch( updatedRegistrar.setClientCertificate(newClientCert, tm().getTransactionTime());
cert -> { }
try { }
certificateChecker.validateCertificate(cert); if (!savedRegistrar
return false; .getFailoverClientCertificate()
} catch (InsecureCertificateException e) { .equals(registrarParameter.getFailoverClientCertificate())) {
return true; if (registrarParameter.getFailoverClientCertificate().isPresent()) {
} String newFailoverCert = registrarParameter.getFailoverClientCertificate().get();
}); certificateChecker.validateCertificate(newFailoverCert);
updatedRegistrar.setFailoverClientCertificate(newFailoverCert, tm().getTransactionTime());
if (hasInvalidCerts) { }
}
} catch (InsecureCertificateException e) {
response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST); response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
response.setPayload("Insecure Certificate in parameter"); response.setPayload("Invalid certificate in parameter");
return; return;
} }
registrarParameter
.getClientCertificate()
.ifPresent(
newClientCert ->
updatedRegistrar.setClientCertificate(newClientCert, tm().getTransactionTime()));
registrarParameter
.getFailoverClientCertificate()
.ifPresent(
failoverCert ->
updatedRegistrar.setFailoverClientCertificate(
failoverCert, tm().getTransactionTime()));
tm().put(updatedRegistrar.build()); tm().put(updatedRegistrar.build());
response.setStatus(HttpStatusCodes.STATUS_CODE_OK); response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
} }