config: reject TLS cert/key/CA file paths that don't exist during validation - #23828
Open
mittalpk wants to merge 2 commits into
Open
config: reject TLS cert/key/CA file paths that don't exist during validation#23828mittalpk wants to merge 2 commits into
mittalpk wants to merge 2 commits into
Conversation
…idation consul validate builds and checks the runtime config but never touches the TLS cert/key/CA file paths on disk. A typo'd path in tls.internal_rpc.cert_file (or https/grpc, or ca_file/ca_path) passes validation cleanly and only surfaces once the agent tries to start and load TLS, with no useful error at that point. Adds a check to validate() that stats each configured cert/key/ca file (and confirms ca_path is a directory) for the internal RPC, HTTPS, and gRPC protocols, failing validation early with a clear tls.<protocol>.<field> "<path>" does not exist error instead. Fixes hashicorp#23820
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
`consul validate` builds and checks the runtime config but never touches the TLS cert/key/CA file paths on disk. A typo'd path in `tls.internal_rpc.cert_file` (or `https`/`grpc`, or `ca_file`/`ca_path`) passes validation cleanly and only surfaces once the agent actually tries to start and load TLS, with no useful error at that point.
This adds a check to `validate()` that stats each configured cert/key/ca file (and confirms `ca_path` is a directory) for the internal RPC, HTTPS, and gRPC protocols, failing validation early with a clear `tls.. "" does not exist` error instead.
Fixes #23820
Testing & Reproduction steps
Confirmed live: built both an unpatched `main` binary and this branch's binary, ran `consul validate` against a config with a typo'd `tls.internal_rpc.cert_file`. Unpatched: "Configuration is valid!". Fixed: "Config validation failed: tls.internal_rpc.cert_file ... does not exist".
Added `TestBuilder_validateTLSFiles` (direct unit coverage of missing/wrong-type cert, key, ca_file, ca_path across all three protocols) and `TestLoad_TLSCertFileMustExist` (end-to-end `Load()` reproduction of the reported issue, both the failing and passing case).
Several existing tests used placeholder paths that never pointed at real files on disk, since nothing previously checked them. Updated those to use real temp files/dirs so they still test what they originally tested: `TestBuilder_WarnGRPCTLS`, `TestLoad_DeprecatedConfig`, the "TLS defaults and overrides" and "auto config authorizer ok" cases in `TestLoad_IntegrationWithFlags`, and the `TestLoad_FullConfig` golden fixture.
Full `agent/config` package test suite passes.
PR Checklist