Merge pull request #964 from tristanmorgan/report_all_certs

Report all certificate errors instead of stopping at the first. (#941)

bgp/bgp_nonwindows.go

@@ -19,8 +19,6 @@ import (
 	"google.golang.org/protobuf/proto"
 	apb "google.golang.org/protobuf/types/known/anypb"
 
-	"github.com/hashicorp/go-multierror"
-
 	api "github.com/osrg/gobgp/v3/api"
 	bgpconfig "github.com/osrg/gobgp/v3/pkg/config"
 	"github.com/osrg/gobgp/v3/pkg/server"
@@ -229,7 +227,7 @@ func (bgph *BGPHandler) setPolicies() error {
 }
 
 func (bgph *BGPHandler) addNeighbors(ctx context.Context, peers []config.BGPPeer) error {
-	var result error
+	var errs []error
 	peerCount := 0
 	for _, peer := range peers {
 		var hop *api.EbgpMultihop
@@ -263,27 +261,27 @@ func (bgph *BGPHandler) addNeighbors(ctx context.Context, peers []config.BGPPeer
 			},
 		})
 		if err != nil {
-			result = multierror.Append(result, err)
+			errs = append(errs, err)
 			continue
 		}
 		peerCount++
 	}
 	if peerCount == 0 {
-		result = multierror.Append(result, ErrNoPeersAdded)
+		errs = append(errs, ErrNoPeersAdded)
 	}
-	return result
+	return errors.Join(errs...)
 }
 
 func (bgph *BGPHandler) AddRoutes(ctx context.Context, routes []string) error {
-	var result error
+	var errs []error
 	// Add our Anycast routes
 
 	routesAdded := 0
 
 	for _, addr := range routes {
 		_, ipnet, err := net.ParseCIDR(addr)
 		if err != nil {
-			result = multierror.Append(result, err)
+			errs = append(errs, err)
 			continue
 		}
 		prefixLen, _ := ipnet.Mask.Size()
@@ -307,25 +305,25 @@ func (bgph *BGPHandler) AddRoutes(ctx context.Context, routes []string) error {
 		})
 		if err != nil {
 			log.Printf("[ERROR] bgp error adding path for %s: %s", addr, err)
-			result = multierror.Append(result, fmt.Errorf("error adding %s: %w", addr, err))
+			errs = append(errs, fmt.Errorf("error adding %s: %w", addr, err))
 		} else {
 			log.Printf("[INFO] bgp successfully added path for %s", addr)
 			routesAdded++
 		}
 	}
 	if routesAdded == 0 {
-		result = multierror.Append(result, ErrNoRoutesAdded)
+		errs = append(errs, ErrNoRoutesAdded)
 	}
-	return result
+	return errors.Join(errs...)
 }
 
 func (bgph *BGPHandler) DeleteRoutes(ctx context.Context, routes []string) error {
-	var result error
+	var errs []error
 	delCount := 0
 	for _, addr := range routes {
 		_, ipnet, err := net.ParseCIDR(addr)
 		if err != nil {
-			result = multierror.Append(result, err)
+			errs = append(errs, err)
 			continue
 		}
 		prefixLen, _ := ipnet.Mask.Size()
@@ -349,15 +347,15 @@ func (bgph *BGPHandler) DeleteRoutes(ctx context.Context, routes []string) error
 			},
 		})
 		if err != nil {
-			result = multierror.Append(result, err)
+			errs = append(errs, err)
 			continue
 		}
 		delCount++
 	}
 	if delCount == 0 {
-		result = multierror.Append(result, ErrNoRoutesDeleted)
+		errs = append(errs, ErrNoRoutesDeleted)
 	}
-	return result
+	return errors.Join(errs...)
 }
 
 func ValidateConfig(config *config.BGP) error {

bgp/bgp_nonwindows_test.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package bgp

cert/load.go

@@ -4,6 +4,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -16,6 +17,7 @@ import (
 	"strings"
 )
 
+// MaxSize is the limit for individual certificate sizes.
 const MaxSize = 1 << 20 // 1MB
 
 func loadURL(listURL string) (pemBlocks map[string][]byte, err error) {
@@ -105,6 +107,7 @@ func loadPath(root string) (pemBlocks map[string][]byte, err error) {
 }
 
 func loadCertificates(pemBlocks map[string][]byte) ([]tls.Certificate, error) {
+	var errs []error
 	var n []string
 	x := map[string]tls.Certificate{}
 
@@ -127,12 +130,14 @@ func loadCertificates(pemBlocks map[string][]byte) ([]tls.Certificate, error) {
 
 		cert, key := pemBlocks[certFile], pemBlocks[keyFile]
 		if cert == nil || key == nil {
-			return nil, fmt.Errorf("cert: cannot load certificate %s", name)
+			errs = append(errs, fmt.Errorf("cert: cannot load certificate %s", name))
+			continue
 		}
 
 		c, err := tls.X509KeyPair(cert, key)
 		if err != nil {
-			return nil, fmt.Errorf("cert: invalid certificate %s. %s", name, err)
+			errs = append(errs, fmt.Errorf("cert: invalid certificate %s. %s", name, err))
+			continue
 		}
 
 		x[certFile] = c
@@ -148,7 +153,7 @@ func loadCertificates(pemBlocks map[string][]byte) ([]tls.Certificate, error) {
 		certs = append(certs, x[certFile])
 	}
 
-	return certs, nil
+	return certs, errors.Join(errs...)
 }
 
 // base returns the rawurl with the last element of the path

cert/load_test.go

@@ -42,7 +42,7 @@ func TestReplaceSuffix(t *testing.T) {
 func TestUpgradeCACertificate(t *testing.T) {
 	// generated at
 	// https://eu-west-1.console.aws.amazon.com/apigateway/home?region=eu-west-1#/client-certificates
-	const awsApiGWCert = `
+	const awsAPIGWCert = `
 -----BEGIN CERTIFICATE-----
 MIIC6DCCAdCgAwIBAgIIZAgycYqDRqQwDQYJKoZIhvcNAQELBQAwNDELMAkGA1UE
 BhMCVVMxEDAOBgNVBAcTB1NlYXR0bGUxEzARBgNVBAMTCkFwaUdhdGV3YXkwHhcN
@@ -62,7 +62,7 @@ kqBgtRrHux3BRxPRqS4jM4akdplFhejHExVatOxfS+DEXzFefi+aMb7qApB1YjV/
 n/iFVG4Y6zyXQY2RzTt+ZB2VPR72X4wqS9fBeQ==
 -----END CERTIFICATE-----`
 
-	p, rest := pem.Decode([]byte(awsApiGWCert))
+	p, rest := pem.Decode([]byte(awsAPIGWCert))
 	if len(rest) > 0 {
 		t.Fatal("want only one cert")
 	}

go.mod

@@ -9,7 +9,6 @@ require (
 	github.com/go-kit/log v0.2.1
 	github.com/gobwas/glob v0.2.3
 	github.com/hashicorp/consul/api v1.29.4
-	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-sockaddr v1.0.7
 	github.com/hashicorp/vault/api v1.15.0
 	github.com/hashicorp/vault/sdk v0.14.0
@@ -61,6 +60,7 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect