{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/29057157","id":29057157,"diff_hunk":"@@ -102,9 +108,126 @@ func validateTLS(tls *routeapi.TLSConfig) fielderrors.ValidationErrorList {\n \t\tif len(tls.DestinationCACertificate) > 0 {\n \t\t\tresult = append(result, fielderrors.NewFieldInvalid(\"destinationCACertificate\", tls.DestinationCACertificate, \"edge termination does not support destination certificates\"))\n \t\t}\n+\n+\t\tresult = append(result, validateTLSCertificates(tls)...)\n+\n \tdefault:\n \t\tmsg := fmt.Sprintf(\"invalid value for termination, acceptable values are %s, %s, %s, or emtpy (no tls specified)\", routeapi.TLSTerminationEdge, routeapi.TLSTerminationPassthrough, routeapi.TLSTerminationReencrypt)\n \t\tresult = append(result, fielderrors.NewFieldInvalid(\"termination\", tls.Termination, msg))\n \t}\n \treturn result\n }\n+\n+// validateTLSCertificates checks that the certificates passed are able to be parsed.  This includes ensuring that\n+// the cert/key pair are matching and, if a ca cert is provided it will check the first ca cert against the leaf\n+// to ensure that the leaf was signed by the ca\n+func validateTLSCertificates(tls *routeapi.TLSConfig) fielderrors.ValidationErrorList {\n+\tif tls == nil {\n+\t\treturn nil\n+\t}\n+\t//edge and reencrypt (the use cases that call this require all 3 (at least) so we can ignore anything\n+\t//that doesn't have all 3 set.  It will already fail validation elsewhere\n+\tif len(tls.Certificate) == 0 || len(tls.Key) == 0 || len(tls.CACertificate) == 0 {","path":"pkg/route/api/validation/validation.go","position":51,"original_position":51,"commit_id":"1c90733ce8a37dcbc6f222040aa569ac39e8aefc","original_commit_id":"1c90733ce8a37dcbc6f222040aa569ac39e8aefc","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"body":"Yes it is valid, we can relax this requirement.  The destination ca should still be required.  HAProxy does a verify check with a specific file to the pod so we need to write it and know the location.","created_at":"2015-04-24T15:16:25Z","updated_at":"2015-04-24T15:16:25Z","html_url":"https://github.com/openshift/origin/pull/1824#discussion_r29057157","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/1824","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/29057157"},"html":{"href":"https://github.com/openshift/origin/pull/1824#discussion_r29057157"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/1824"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/1824","id":33709323,"html_url":"https://github.com/openshift/origin/pull/1824","diff_url":"https://github.com/openshift/origin/pull/1824.diff","patch_url":"https://github.com/openshift/origin/pull/1824.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/1824","number":1824,"state":"open","locked":false,"title":"WIP: in depth tls certificate validations for routes","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"body":"Part 2 of strengthening the router validations.  This PR includes validation for\r\n\r\n1.  is the cert/key a valid pair\r\n2.  can the ca cert blocks be parsed, including if it is a concatenated cert chain\r\n3.  can the dest cert blocks be parsed, including if it is a concatenated cert chain\r\n4.  did the first ca cert parsed actually sign the cert/key pair\r\n\r\n@smarterclayton @liggitt PTAL","created_at":"2015-04-20T21:42:36Z","updated_at":"2015-04-24T15:16:25Z","closed_at":null,"merged_at":null,"merge_commit_sha":"153c92f8c0bd508f51b7fdf47ce0a7bfc61d5bd8","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/1824/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/1824/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/1824/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/1c90733ce8a37dcbc6f222040aa569ac39e8aefc","head":{"label":"pweil-:tls-validation","ref":"tls-validation","sha":"1c90733ce8a37dcbc6f222040aa569ac39e8aefc","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"repo":{"id":24119315,"name":"origin","full_name":"pweil-/origin","owner":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pweil-/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/pweil-/origin","forks_url":"https://api.github.com/repos/pweil-/origin/forks","keys_url":"https://api.github.com/repos/pweil-/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pweil-/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pweil-/origin/teams","hooks_url":"https://api.github.com/repos/pweil-/origin/hooks","issue_events_url":"https://api.github.com/repos/pweil-/origin/issues/events{/number}","events_url":"https://api.github.com/repos/pweil-/origin/events","assignees_url":"https://api.github.com/repos/pweil-/origin/assignees{/user}","branches_url":"https://api.github.com/repos/pweil-/origin/branches{/branch}","tags_url":"https://api.github.com/repos/pweil-/origin/tags","blobs_url":"https://api.github.com/repos/pweil-/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pweil-/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pweil-/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/pweil-/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pweil-/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/pweil-/origin/languages","stargazers_url":"https://api.github.com/repos/pweil-/origin/stargazers","contributors_url":"https://api.github.com/repos/pweil-/origin/contributors","subscribers_url":"https://api.github.com/repos/pweil-/origin/subscribers","subscription_url":"https://api.github.com/repos/pweil-/origin/subscription","commits_url":"https://api.github.com/repos/pweil-/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/pweil-/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/pweil-/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/pweil-/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/pweil-/origin/contents/{+path}","compare_url":"https://api.github.com/repos/pweil-/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pweil-/origin/merges","archive_url":"https://api.github.com/repos/pweil-/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pweil-/origin/downloads","issues_url":"https://api.github.com/repos/pweil-/origin/issues{/number}","pulls_url":"https://api.github.com/repos/pweil-/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/pweil-/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/pweil-/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pweil-/origin/labels{/name}","releases_url":"https://api.github.com/repos/pweil-/origin/releases{/id}","created_at":"2014-09-16T21:53:06Z","updated_at":"2015-04-24T13:42:31Z","pushed_at":"2015-04-24T13:42:31Z","git_url":"git://github.com/pweil-/origin.git","ssh_url":"git@github.com:pweil-/origin.git","clone_url":"https://github.com/pweil-/origin.git","svn_url":"https://github.com/pweil-/origin","homepage":"https://openshift.github.io","size":83428,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"96eda976bbd5ac12e9479cb066a9bd6e806428fb","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-04-24T14:51:28Z","pushed_at":"2015-04-24T15:06:32Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":137093,"stargazers_count":383,"watchers_count":383,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":192,"mirror_url":null,"open_issues_count":228,"forks":192,"open_issues":228,"watchers":383,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/1824"},"html":{"href":"https://github.com/openshift/origin/pull/1824"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/1824"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/1824/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/1824/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/1824/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/1c90733ce8a37dcbc6f222040aa569ac39e8aefc"}}}}