Repository: envoyproxy/envoy
File: source/common/tls/cert_validator/default_validator.cc (C++)

Code before:
  if (detailed_status == Envoy::Ssl::ClientValidationStatus::NotValidated ||
      validated != Envoy::Ssl::ClientValidationStatus::NotValidated) {
    detailed_status = validated;
  }

  // If `trusted_ca` exists, it is already verified in the code above. Thus, we just need to make
  // sure the verification for other validation context configurations doesn't fail (i.e. either
  // `NotValidated` or `Validated`). If `trusted_ca` doesn't exist, we will need to make sure
  // other configurations are verified and the verification succeed.
  const bool success = verify_trusted_ca_
                           ? validated != Envoy::Ssl::ClientValidationStatus::Failed
                           : validated == Envoy::Ssl::ClientValidationStatus::Validated;

  return (allow_untrusted_certificate_ || success);
}

Envoy::Ssl::ClientValidationStatus
DefaultCertValidator::verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list,
                                        const std::vector<SanMatcherPtr>& subject_alt_name_matchers,
                                        OptRef<const StreamInfo::StreamInfo> stream_info,
                                        std::string* error_details, uint8_t* out_alert) {
  Envoy::Ssl::ClientValidationStatus validated = Envoy::Ssl::ClientValidationStatus::NotValidated;
  if (!verify_san_list.empty()) {
    if (!verifySubjectAltName(cert, verify_san_list)) {
      const std::string error_msg =
          fmt::format("verify cert failed: verify SAN list, SAN List is [{}]",
                      fmt::join(verify_san_list, ", "));

      if (error_details != nullptr) {
        *error_details = error_msg;
      }
      ENVOY_LOG(debug, error_msg);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;
  }

  if (!subject_alt_name_matchers.empty()) {
    if (!matchSubjectAltName(cert, stream_info, subject_alt_name_matchers)) {
      const std::string error_msg =
          fmt::format("verify cert failed: SAN matcher, certificate SANs are [{}]",
                      fmt::join(CertValidatorUtil::getCertificateSans(cert), ", "));
      if (error_details != nullptr) {
        *error_details = error_msg;
      }
      ENVOY_LOG(debug, error_msg);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;

Review comment (suggestion):
I missed this earlier, but this is logging the configured san validators. Wouldn't it be more useful to log the certificate SANs? In that case, this would end up doing the same operation as below calling `getCertificateSans`.

Code after:
  if (detailed_status == Envoy::Ssl::ClientValidationStatus::NotValidated ||
      validated != Envoy::Ssl::ClientValidationStatus::NotValidated) {
    detailed_status = validated;
  }

  // If `trusted_ca` exists, it is already verified in the code above. Thus, we just need to make
  // sure the verification for other validation context configurations doesn't fail (i.e. either
  // `NotValidated` or `Validated`). If `trusted_ca` doesn't exist, we will need to make sure
  // other configurations are verified and the verification succeed.
  const bool success = verify_trusted_ca_
                           ? validated != Envoy::Ssl::ClientValidationStatus::Failed
                           : validated == Envoy::Ssl::ClientValidationStatus::Validated;

  return (allow_untrusted_certificate_ || success);
}

Envoy::Ssl::ClientValidationStatus
DefaultCertValidator::verifyCertificate(X509* cert, const std::vector<std::string>& verify_san_list,
                                        const std::vector<SanMatcherPtr>& subject_alt_name_matchers,
                                        OptRef<const StreamInfo::StreamInfo> stream_info,
                                        std::string* error_details, uint8_t* out_alert) {
  Envoy::Ssl::ClientValidationStatus validated = Envoy::Ssl::ClientValidationStatus::NotValidated;
  if (!verify_san_list.empty()) {
    if (!verifySubjectAltName(cert, verify_san_list)) {
      const std::string error_msg = fmt::format(
          "verify cert failed: verify SAN list, expected SANs: [{}], certificate SANs: [{}]",
          fmt::join(verify_san_list, ", "),
          fmt::join(Utility::getCertificateSansForLogging(cert), ", "));

      if (error_details != nullptr) {
        *error_details = error_msg;
      }
      ENVOY_LOG(debug, error_msg);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }
    validated = Envoy::Ssl::ClientValidationStatus::Validated;
  }

  if (!subject_alt_name_matchers.empty()) {
    if (!matchSubjectAltName(cert, stream_info, subject_alt_name_matchers)) {
      const std::string error_msg =
          fmt::format("verify cert failed: SAN matcher, certificate SANs are [{}]",
                      fmt::join(Utility::getCertificateSansForLogging(cert), ", "));
      if (error_details != nullptr) {
        *error_details = error_msg;
      }
      ENVOY_LOG(debug, error_msg);
      stats_.fail_verify_san_.inc();
      return Envoy::Ssl::ClientValidationStatus::Failed;
    }