Add initial version of the handshake command#1402
Conversation
This commit adds the command `step certificate handshake`. This command performs a handshake and displays details about it.
github-actions
bot
added
the
needs triage
command/certificate/handshake.go
Outdated
| return tlsDialWithFallback(addr, tlsConfig) | ||
| } | ||
| defer conn.Close() | ||
| conn.Handshake() |
There was a problem hiding this comment.
Can use HandshakeContext, and it would be good to check and return the error.
In a follow up we could implement some additional error handling logic for more informative errors based on some internal code we have. I think it could be nice to put that in tlsutil.
| // Print only the list of verified chains | ||
| if printChains { | ||
| for _, chain := range cs.VerifiedChains { | ||
| for _, crt := range chain { | ||
| fmt.Print(string(pem.EncodeToMemory(&pem.Block{ | ||
| Type: "CERTIFICATE", | ||
| Bytes: crt.Raw, | ||
| }))) | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // Print only the peer certificates | ||
| if printPeer { | ||
| for _, crt := range cs.PeerCertificates { | ||
| fmt.Print(string(pem.EncodeToMemory(&pem.Block{ | ||
| Type: "CERTIFICATE", Bytes: crt.Raw, | ||
| }))) | ||
| } | ||
| return nil | ||
| } |
There was a problem hiding this comment.
Maybe needs an option to continue down, so that the connection details are shown in addition to these too? Or make that the default, instead of returning early?
There was a problem hiding this comment.
I'm not sure about this. I make them independent commands because a certificate, especially if you include all the intermediates, is quite noisy. I also wanted to pipe those certificates to another command.
There was a problem hiding this comment.
That's fair, but in practice providing one of the printPeer or printChains options is doing the same as step certificate inspect https://example.com and step certificate inspect https://example.com --bundle, respectively, so if intend to return early to pipe the certs, those commands can be used, incl. JSON format.
If instead execution would continue after printing the details, it would be a bit more like curl -v (with more certificate details, of course). That would be like enabling these options results in a more verbose output, which I think is fair, considering the default is to print just TLS handshake details.
Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
| import ( | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/pkg/errors" | ||
| "github.com/stretchr/testify/assert" |
There was a problem hiding this comment.
| import ( | |
| "strings" | |
| "testing" | |
| "github.com/pkg/errors" | |
| "github.com/stretchr/testify/assert" | |
| import ( | |
| "errors" | |
| "strings" | |
| "testing" | |
| "github.com/stretchr/testify/assert" |
| "github.com/smallstep/cli-utils/command" | ||
| ) | ||
|
|
||
| // Command returns the cli.Command for jwt and related subcommands. |
There was a problem hiding this comment.
| // Command returns the cli.Command for jwt and related subcommands. | |
| // Command returns the cli.Command for tls and related subcommands. |
| "github.com/smallstep/cli-utils/errs" | ||
| "github.com/smallstep/cli/flags" | ||
| "github.com/smallstep/cli/internal/cryptoutil" | ||
| "github.com/smallstep/cli/utils" | ||
| "github.com/urfave/cli" | ||
| "go.step.sm/crypto/pemutil" | ||
| "go.step.sm/crypto/x509util" |
There was a problem hiding this comment.
| "github.com/smallstep/cli-utils/errs" | |
| "github.com/smallstep/cli/flags" | |
| "github.com/smallstep/cli/internal/cryptoutil" | |
| "github.com/smallstep/cli/utils" | |
| "github.com/urfave/cli" | |
| "go.step.sm/crypto/pemutil" | |
| "go.step.sm/crypto/x509util" | |
| "github.com/urfave/cli" | |
| "github.com/smallstep/cli-utils/errs" | |
| "go.step.sm/crypto/pemutil" | |
| "go.step.sm/crypto/x509util" | |
| "github.com/smallstep/cli/flags" | |
| "github.com/smallstep/cli/internal/cryptoutil" | |
| "github.com/smallstep/cli/utils" |
2 participants
Description
This commit adds the command
step certificate handshake. This command performs a handshake and displays details about it.For example: