44 lines
1.5 KiB
Go
44 lines
1.5 KiB
Go
package proxmox
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"errors"
|
|
"strings"
|
|
)
|
|
|
|
// The causes a call to Proxmox can fail on TRUST (R-1380, felhom.eu `03` §12a). A symptom alarm („the agent channel is
|
|
// down") exists; these name the cause.
|
|
const (
|
|
TrustPinnedCertChanged = "pinned_cert_changed" // the pinned certificate is not the one Proxmox serves any more
|
|
TrustCAMismatch = "ca_mismatch" // the CA file did not sign the served certificate
|
|
TrustCertExpired = "cert_expired" // the served certificate (or the CA) has ended
|
|
TrustCAFileUnreadable = "ca_file_unreadable" // the CA file is missing or holds no certificate
|
|
TrustNameMismatch = "name_mismatch" // the certificate does not name the address the agent calls
|
|
)
|
|
|
|
// TrustProblem names why err is a TRUST failure, or "" when it is none (a refused connection, a 401, a timeout).
|
|
func TrustProblem(err error) string {
|
|
if err == nil {
|
|
return ""
|
|
}
|
|
var ua x509.UnknownAuthorityError
|
|
var inv x509.CertificateInvalidError
|
|
var hn x509.HostnameError
|
|
switch {
|
|
case strings.Contains(err.Error(), "TLS pin mismatch"):
|
|
return TrustPinnedCertChanged
|
|
case errors.As(err, &ua):
|
|
return TrustCAMismatch
|
|
case errors.As(err, &inv):
|
|
if inv.Reason == x509.Expired {
|
|
return TrustCertExpired
|
|
}
|
|
return TrustCAMismatch
|
|
case errors.As(err, &hn):
|
|
return TrustNameMismatch
|
|
case strings.Contains(err.Error(), "reading TLS CA file"), strings.Contains(err.Error(), "contained no usable certificates"):
|
|
return TrustCAFileUnreadable
|
|
}
|
|
return ""
|
|
}
|