From e4fcf2d2733bf98cb38006d8059685cdc211056f Mon Sep 17 00:00:00 2001 From: Rob Best Date: Wed, 19 Aug 2020 20:36:49 +0100 Subject: [PATCH] prober/tls: fix probe_ssl_last_chain_expiry_timestamp_seconds This metric should report the earliest expiry of the chain that expires the latest out of all the verified chains. Presently, it reports the earliest expiry of the chain that expires first. The current test for this metric was using an expired root certificate which is omitted from the verified chain, so the test was passing despite this bug. I've changed it to use a root that is still valid but expires before a root held by the client. --- prober/tcp_test.go | 16 ++++++++-------- prober/tls.go | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/prober/tcp_test.go b/prober/tcp_test.go index fd219f946..9111682c8 100644 --- a/prober/tcp_test.go +++ b/prober/tcp_test.go @@ -224,26 +224,26 @@ func TestTCPConnectionWithTLSAndVerifiedCertificateChain(t *testing.T) { panic(fmt.Sprintf("Error creating rsa key: %s", err)) } - rootCertExpiry := time.Now().AddDate(0, 0, 2) + rootCertExpiry := time.Now().AddDate(0, 0, 3) rootCertTmpl := generateCertificateTemplate(rootCertExpiry, false) rootCertTmpl.IsCA = true _, rootCertPem := generateSelfSignedCertificateWithPrivateKey(rootCertTmpl, rootPrivatekey) - oldRootCertExpiry := time.Now().AddDate(0, 0, -1) - expiredRootCertTmpl := generateCertificateTemplate(oldRootCertExpiry, false) - expiredRootCertTmpl.IsCA = true - expiredRootCert, expiredRootCertPem := generateSelfSignedCertificateWithPrivateKey(expiredRootCertTmpl, rootPrivatekey) + oldRootCertExpiry := time.Now().AddDate(0, 0, 1) + olderRootCertTmpl := generateCertificateTemplate(oldRootCertExpiry, false) + olderRootCertTmpl.IsCA = true + olderRootCert, olderRootCertPem := generateSelfSignedCertificateWithPrivateKey(olderRootCertTmpl, rootPrivatekey) - serverCertExpiry := time.Now().AddDate(0, 0, 1) + serverCertExpiry := time.Now().AddDate(0, 0, 2) serverCertTmpl := generateCertificateTemplate(serverCertExpiry, false) - _, serverCertPem, serverKey := generateSignedCertificate(serverCertTmpl, expiredRootCert, rootPrivatekey) + _, serverCertPem, serverKey := generateSignedCertificate(serverCertTmpl, olderRootCert, rootPrivatekey) // CAFile must be passed via filesystem, use a tempfile. tmpCaFile, err := ioutil.TempFile("", "cafile.pem") if err != nil { t.Fatalf(fmt.Sprintf("Error creating CA tempfile: %s", err)) } - if _, err := tmpCaFile.Write(bytes.Join([][]byte{rootCertPem, expiredRootCertPem}, []byte("\n"))); err != nil { + if _, err := tmpCaFile.Write(bytes.Join([][]byte{rootCertPem, olderRootCertPem}, []byte("\n"))); err != nil { t.Fatalf(fmt.Sprintf("Error writing CA tempfile: %s", err)) } if err := tmpCaFile.Close(); err != nil { diff --git a/prober/tls.go b/prober/tls.go index 87107974b..38d553361 100644 --- a/prober/tls.go +++ b/prober/tls.go @@ -45,7 +45,7 @@ func getLastChainExpiry(state *tls.ConnectionState) time.Time { earliestCertExpiry = cert.NotAfter } } - if lastChainExpiry.IsZero() || lastChainExpiry.After(earliestCertExpiry) { + if lastChainExpiry.IsZero() || lastChainExpiry.Before(earliestCertExpiry) { lastChainExpiry = earliestCertExpiry }