search

olix0r / kubert

Rust Kubernetes runtime helpers. Based on kube-rs.
Apache License 2.0
148 stars 13 forks source link

server: Fix private key parsing with BoringSSL #188

Closed hawkw closed 1 year ago

hawkw commented 1 year ago

Currently, the tls_boring module incorrectly passes a PEM-encoded private key file to boring::PKey::private_key_from_pkcs8, which expects a single DER-encoded PKCS#8 private key. This fails, because the PEM file's contents is PEM-encoded, rather than DER-encoded. The test added in 9187fb89e201062e80083f9ebd6532b39491f940 reproduces this failure.

This PR changes the tls_boring module to use PKey::private_key_from_pem instead of PKey::private_key_from_pkcs8, which correctly parses the PEM-encoded private key file contents.

We may wish to consider making this code smarter and determining the input file format based on the filename extension, so that we can handle private key files with different encodings. But, the rustls implementation currently assumes that the private key file is always PEM-encoded, so that's probably better saved for future work.

hawkw commented 1 year ago

CI failure suggests dockerhub is having availability issues again: https://github.com/olix0r/kubert/actions/runs/6385014482/job/17328855919?pr=188