fix: also validate DNS/SAN names when DNS resolution is bypassed

closes issue #247

Signed-off-by: Clément Nussbaumer <[email protected]>

internal/controller/csr_controller_test.go

@@ -90,8 +90,8 @@ func TestNonMatchingCommonNameUsername(t *testing.T) {
 func TestRegexCheckActiveWithBypass(t *testing.T) {
 	csrParams := CsrParams{
 		csrName:  "csr-mismatch-SAN-hostname-with-bypass",
-		nodeName: testNodeName,
-		dnsName:  "hostname-000.test.ch,auth.evil.io",
+		nodeName: "a",
+		dnsName:  "a" + ".test.ch,auth.evil.io",
 	}
 
 	csrController.BypassDNSResolution = true
@@ -104,7 +104,7 @@ func TestRegexCheckActiveWithBypass(t *testing.T) {
 	require.Nil(t, err, "Could not create the CSR.")
 
 	approved, denied, reason, err := waitCsrApprovalStatus(csr.Name)
-	t.Log("CSR rejected with the following reason:" + reason)
+	t.Log(reason)
 	require.Nil(t, err, "Could not retrieve the CSR to check its approval status")
 	assert.False(t, approved)
 	assert.True(t, denied)

internal/controller/regex_ip_checks.go

@@ -29,12 +29,6 @@ func (r *CertificateSigningRequestReconciler) DNSCheck(ctx context.Context, csr
 		return valid, reason, nil
 	}
 
-	// bypassing DNS reslution - DNS check is approved
-	if r.BypassDNSResolution {
-		valid = true
-		return valid, reason, nil
-	}
-
 	dnsCtx, dnsCtxCancel := context.WithDeadline(ctx, time.Now().Add(time.Second)) // 1 second timeout for the dns request
 	defer dnsCtxCancel()
 
@@ -53,13 +47,15 @@ func (r *CertificateSigningRequestReconciler) DNSCheck(ctx context.Context, csr
 			return valid, reason, err
 		}
 
-		resolvedAddrs, err := r.DNSResolver.LookupHost(dnsCtx, sanDNSName)
+		if !r.BypassDNSResolution {
+			resolvedAddrs, err := r.DNSResolver.LookupHost(dnsCtx, sanDNSName)
 
-		if err != nil || len(resolvedAddrs) == 0 {
-			return false, "The SAN DNS Name could not be resolved, denying the CSR", nil
-		}
+			if err != nil || len(resolvedAddrs) == 0 {
+				return false, "The SAN DNS Name could not be resolved, denying the CSR", nil
+			}
 
-		allResolvedAddrs = append(allResolvedAddrs, resolvedAddrs...)
+			allResolvedAddrs = append(allResolvedAddrs, resolvedAddrs...)
+		}
 	}
 
 	var setBuilder netipx.IPSetBuilder