add fallback verifier and make verifiers context aware (#85)

certverify/fallback.go

@@ -0,0 +1,41 @@
+package certverify
+
+import (
+	"context"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// CertVerifier is a simple interface for verifying a certificate.
+type CertVerifier interface {
+	Verify(context.Context, *x509.Certificate) error
+}
+
+// FallbackVerifier verfies certificate validity using multiple verifiers.
+type FallbackVerifier struct {
+	verifiers []CertVerifier
+}
+
+// NewFallbackVerifier creates a new verifier using other verifiers.
+func NewFallbackVerifier(verifiers ...CertVerifier) *FallbackVerifier {
+	return &FallbackVerifier{verifiers: verifiers}
+}
+
+// Verify performs certificate verification.
+// Any verifier returning nil ("passes") will pass (return nil) and not
+// check any other verifier.
+// If all verifiers return non-nil ("fail") then an error for all
+// verifiers will be returned.
+func (v *FallbackVerifier) Verify(ctx context.Context, cert *x509.Certificate) error {
+	var errs []string
+	for i, verifier := range v.verifiers {
+		err := verifier.Verify(ctx, cert)
+		if err == nil {
+			return nil
+		}
+		errs = append(errs, fmt.Sprintf("fallback error (%d): %v", i, err))
+	}
+	return errors.New(strings.Join(errs, "; "))
+}

certverify/fallback_test.go

@@ -0,0 +1,50 @@
+package certverify
+
+import (
+	"context"
+	"crypto/x509"
+	"errors"
+	"testing"
+)
+
+type errVerifier struct{ err error }
+
+func (v *errVerifier) Verify(_ context.Context, _ *x509.Certificate) error {
+	return v.err
+}
+
+var nilErroringVerifier = &errVerifier{}
+var errErroringVerifier = &errVerifier{err: errors.New("verifier error")}
+
+func TestFallbackVerifier(t *testing.T) {
+	v := NewFallbackVerifier(nilErroringVerifier)
+	err := v.Verify(nil, nil)
+	if err != nil {
+		t.Errorf("should not have errored: %v", err)
+	}
+
+	v = NewFallbackVerifier(nilErroringVerifier, nilErroringVerifier)
+	if err = v.Verify(nil, nil); err != nil {
+		t.Errorf("should not have errored: %v", err)
+	}
+
+	v = NewFallbackVerifier(errErroringVerifier)
+	if err = v.Verify(nil, nil); err == nil {
+		t.Error("should have errored")
+	}
+
+	v = NewFallbackVerifier(errErroringVerifier, nilErroringVerifier)
+	if err = v.Verify(nil, nil); err != nil {
+		t.Errorf("should not have errored: %v", err)
+	}
+
+	v = NewFallbackVerifier(nilErroringVerifier, errErroringVerifier)
+	if err = v.Verify(nil, nil); err != nil {
+		t.Errorf("should not have errored: %v", err)
+	}
+
+	v = NewFallbackVerifier(errErroringVerifier, errErroringVerifier)
+	if err = v.Verify(nil, nil); err == nil {
+		t.Error("should have errored")
+	}
+}

certverify/pool.go

@@ -1,6 +1,7 @@
 package certverify
 
 import (
+	"context"
 	"crypto/x509"
 	"errors"
 )
@@ -31,7 +32,7 @@ func NewPoolVerifier(rootsPEM []byte, intsPEM []byte, keyUsages ...x509.ExtKeyUs
 }
 
 // Verify performs certificate verification
-func (v *PoolVerifier) Verify(cert *x509.Certificate) error {
+func (v *PoolVerifier) Verify(_ context.Context, cert *x509.Certificate) error {
 	if cert == nil {
 		return errors.New("missing MDM certificate")
 	}

certverify/signature.go

@@ -1,6 +1,7 @@
 package certverify
 
 import (
+	"context"
 	"crypto/x509"
 	"errors"
 
@@ -25,7 +26,7 @@ func NewSignatureVerifier(rootPEM []byte) (*SignatureVerifier, error) {
 }
 
 // Verify checks only the signature of the certificate against the CA
-func (v *SignatureVerifier) Verify(cert *x509.Certificate) error {
+func (v *SignatureVerifier) Verify(_ context.Context, cert *x509.Certificate) error {
 	if cert == nil {
 		return errors.New("missing MDM certificate")
 	}

http/mdm/mdm_cert.go

@@ -110,7 +110,7 @@ func GetCert(ctx context.Context) *x509.Certificate {
 
 // CertVerifier is a simple interface for verifying a certificate.
 type CertVerifier interface {
-	Verify(*x509.Certificate) error
+	Verify(context.Context, *x509.Certificate) error
 }
 
 // CertVerifyMiddleware checks the MDM certificate against verifier and
@@ -120,7 +120,7 @@ type CertVerifier interface {
 // MDM unenrollments in the case of bugs or something going wrong.
 func CertVerifyMiddleware(next http.Handler, verifier CertVerifier, logger log.Logger) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if err := verifier.Verify(GetCert(r.Context())); err != nil {
+		if err := verifier.Verify(r.Context(), GetCert(r.Context())); err != nil {
 			ctxlog.Logger(r.Context(), logger).Info(
 				"msg", "error verifying MDM certificate",
 				"err", err,