Repository: istio/istio
File: security/pkg/pki/util/crypto.go (Go)

Code before:
		cb            *pem.Block
		rootCertBytes []byte
	)
	certBytes = bytes.TrimSpace(certBytes)
	for {
		rootCertBytes = certBytes
		cb, certBytes = pem.Decode(certBytes)
		if cb == nil {
			return nil, nil, fmt.Errorf("invalid PEM encoded certificate")
		}
		cert, err := x509.ParseCertificate(cb.Bytes)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to parse X.509 certificate")
		}
		certs = append(certs, cert)
		if len(certBytes) == 0 {
			break
		}
	}
	if len(certs) == 0 {
		return nil, nil, fmt.Errorf("no PEM encoded X.509 certificates parsed")
	}
	return certs, rootCertBytes, nil
}

// ParsePemEncodedCSR constructs a `x509.CertificateRequest` object using the
// given PEM-encoded certificate signing request.
func ParsePemEncodedCSR(csrBytes []byte) (*x509.CertificateRequest, error) {
	block, _ := pem.Decode(csrBytes)
	if block == nil {
		return nil, fmt.Errorf("certificate signing request is not properly encoded")
	}
	csr, err := x509.ParseCertificateRequest(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed to parse X.509 certificate signing request")
	}
	return csr, nil
}

// ParsePemEncodedKey takes a PEM-encoded key and parsed the bytes into a `crypto.PrivateKey`.
func ParsePemEncodedKey(keyBytes []byte) (crypto.PrivateKey, error) {
	kb, _ := pem.Decode(keyBytes)
	if kb == nil {
		return nil, fmt.Errorf("invalid PEM-encoded key")
	}

	switch kb.Type {
	case blockTypeECPrivateKey:
		key, err := x509.ParseECPrivateKey(kb.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse the ECDSA private key: %v", err)

Review comment (suggestion):
nit
```suggestion
// ParseRootCerts filters out certs that are invalid for whatever reason (e.g. negative serial number).
```

Code after:
		cb            *pem.Block
		rootCertBytes []byte
	)
	certBytes = bytes.TrimSpace(certBytes)
	for {
		rootCertBytes = certBytes
		cb, certBytes = pem.Decode(certBytes)
		if cb == nil {
			return nil, nil, fmt.Errorf("invalid PEM encoded certificate")
		}
		cert, err := x509.ParseCertificate(cb.Bytes)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to parse X.509 certificate")
		}
		certs = append(certs, cert)
		if len(certBytes) == 0 {
			break
		}
	}
	if len(certs) == 0 {
		return nil, nil, fmt.Errorf("no PEM encoded X.509 certificates parsed")
	}
	return certs, rootCertBytes, nil
}

// ParseRootCerts We want to filter out certs that are invalid for whatever reason (e.g. negative serial number).
// First return is the bytes of valid certs,
// and the second return is a slice of errors from parsing the certs.
func ParseRootCerts(certBytes []byte) ([]byte, []error) {
	var (
		cb                 *pem.Block
		validRootCertBytes []byte
		errs               []error
	)
	certBytes = bytes.TrimSpace(certBytes)
	validRootCertBytes = make([]byte, 0, len(certBytes))

	for {
		if len(certBytes) == 0 {
			break
		}
		cb, certBytes = pem.Decode(certBytes)
		if cb == nil {
			// give up if we have an encoding error
			errs = append(errs, fmt.Errorf("invalid PEM encoded certificate"))
			return validRootCertBytes, errs
		}
		_, err := x509.ParseCertificate(cb.Bytes)
		if err != nil {
			errs = append(errs, err)
			continue