m/n/core/curator: check that pubkey is given when expecting self-signed certificate
PeerInfo.Unauthenticated does not imply Unauthenticated.SelfSigned,
which might be nil if a client connects without a certificate at all.
This makes sure we don't crash when that happens.
Change-Id: I52ceefe13f1eab9efe549e900a1ae715086b499e
Reviewed-on: https://review.monogon.dev/c/monogon/+/1414
Reviewed-by: Leopold Schabel <leo@monogon.tech>
Tested-by: Jenkins CI
diff --git a/metropolis/node/core/curator/impl_leader_curator.go b/metropolis/node/core/curator/impl_leader_curator.go
index e5b6f57..f25b95b 100644
--- a/metropolis/node/core/curator/impl_leader_curator.go
+++ b/metropolis/node/core/curator/impl_leader_curator.go
@@ -294,7 +294,7 @@
// ephemeral certificate. That certificate's pubkey will become the node's
// pubkey.
pi := rpc.GetPeerInfo(ctx)
- if pi == nil || pi.Unauthenticated == nil {
+ if pi == nil || pi.Unauthenticated == nil || pi.Unauthenticated.SelfSignedPublicKey == nil {
return nil, status.Error(codes.Unauthenticated, "connection must be established with a self-signed ephemeral certificate")
}
pubkey := pi.Unauthenticated.SelfSignedPublicKey
@@ -362,7 +362,7 @@
// ephemeral certificate. That certificate's pubkey will become the node's
// pubkey.
pi := rpc.GetPeerInfo(ctx)
- if pi == nil || pi.Unauthenticated == nil {
+ if pi == nil || pi.Unauthenticated == nil || pi.Unauthenticated.SelfSignedPublicKey == nil {
return nil, status.Error(codes.Unauthenticated, "connection must be established with a self-signed ephemeral certificate")
}
pubkey := pi.Unauthenticated.SelfSignedPublicKey
@@ -460,7 +460,7 @@
func (l *leaderCurator) JoinNode(ctx context.Context, req *ipb.JoinNodeRequest) (*ipb.JoinNodeResponse, error) {
// Gather peer information.
pi := rpc.GetPeerInfo(ctx)
- if pi == nil || pi.Unauthenticated == nil {
+ if pi == nil || pi.Unauthenticated == nil || pi.Unauthenticated.SelfSignedPublicKey == nil {
return nil, status.Error(codes.PermissionDenied, "connection must be established with a self-signed ephemeral certificate")
}
// The node will attempt to connect using its Join Key. jkey will contain