Handle EC parameters before TLS private keys

Author: jvlxz

internal/gatewayapi/tls.go

@@ -105,7 +105,7 @@ func parseCertsFromTLSSecretsData(secrets []*corev1.Secret) ([]*corev1.Secret, [
 
 		keyData := secret.Data[corev1.TLSPrivateKeyKey]
 
-		keyBlock, _ := pem.Decode(keyData)
+		keyBlock := firstSupportedPrivateKeyBlock(keyData)
 		if keyBlock == nil {
 			errs = append(errs, fmt.Errorf("%s/%s must contain valid %s and %s, unable to decode pem data in %s",
 				secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey))
@@ -203,6 +203,25 @@ func parseCertsFromTLSSecretsData(secrets []*corev1.Secret) ([]*corev1.Secret, [
 //
 // Return a status.ListenerError with InvalidCertificateRef Condition if no valid certificates are found in the provided data,
 // Return a status.ListenerError with PartiallyInvalidCertificateRef Condition if some certificates are invalid but also valid certificates exist.
+func firstSupportedPrivateKeyBlock(data []byte) *pem.Block {
+	var firstBlock *pem.Block
+	for len(data) > 0 {
+		block, rest := pem.Decode(data)
+		if block == nil {
+			return firstBlock
+		}
+		if firstBlock == nil {
+			firstBlock = block
+		}
+		switch block.Type {
+		case "PRIVATE KEY", "RSA PRIVATE KEY", "EC PRIVATE KEY":
+			return block
+		}
+		data = rest
+	}
+	return firstBlock
+}
+
 func filterValidCertificates(data []byte) ([]byte, status.ListenerError) {
 	if len(data) == 0 {
 		return nil, status.NewListenerStatusError(

internal/gatewayapi/tls_test.go

@@ -306,6 +306,37 @@ func TestValidateTLSSecretsData(t *testing.T) {
 	}
 }
 
+func TestValidateTLSSecretsDataWithECParameters(t *testing.T) {
+	const ecParametersPEM = "-----BEGIN EC PARAMETERS-----\nBggqhkjOPQMBBw==\n-----END EC PARAMETERS-----\n"
+
+	t.Run("ec-parameters-before-private-key", func(t *testing.T) {
+		secrets := createTestSecrets(t, []string{"ecdsa-p256-cert.pem"}, []string{"ecdsa-p256.key"})
+		keyData := append([]byte(nil), secrets[0].Data[corev1.TLSPrivateKeyKey]...)
+		secrets[0].Data[corev1.TLSPrivateKeyKey] = append([]byte(ecParametersPEM), keyData...)
+
+		validSecrets, certs, err := parseCertsFromTLSSecretsData(secrets)
+		require.NoError(t, err)
+		require.Len(t, validSecrets, 1)
+		require.Len(t, certs, 1)
+
+		keyBlock, _ := pem.Decode(keyData)
+		require.NotNil(t, keyBlock)
+		require.Equal(t, pem.EncodeToMemory(keyBlock), validSecrets[0].Data[corev1.TLSPrivateKeyKey])
+	})
+
+	t.Run("ec-parameters-without-private-key", func(t *testing.T) {
+		secrets := createTestSecrets(t, []string{"ecdsa-p256-cert.pem"}, []string{"ecdsa-p256.key"})
+		secrets[0].Data[corev1.TLSPrivateKeyKey] = []byte(ecParametersPEM)
+
+		validSecrets, certs, err := parseCertsFromTLSSecretsData(secrets)
+		require.Error(t, err)
+		require.Equal(t, "test/secret must contain valid tls.crt and tls.key, EC PARAMETERS key format found in tls.key, supported formats are PKCS1, PKCS8 or EC", err.Error())
+		require.Equal(t, gwapiv1.ListenerReasonInvalidCertificateRef, err.Reason())
+		require.Empty(t, validSecrets)
+		require.Empty(t, certs)
+	})
+}
+
 func TestFilterValidCertificates(t *testing.T) {
 	type testCase struct {
 		Name              string