buildcert.go

@@ -167,7 +167,8 @@ func (b *tCertificateBuilder) UpdatePrivileges() error {
 		if err != nil {
 			return err
 		}
-		uid, err := strconv.Atoi(usr.Uid)
+		// Uid has already been validated when reading the config file
+		uid, _ := strconv.Atoi(usr.Uid)
 		if b.changed || b.existing == nil || b.existing.owner != uint32(uid) {
 			set_uid = uid
 			log = log.WithField("uid", set_uid)
@@ -178,7 +179,8 @@ func (b *tCertificateBuilder) UpdatePrivileges() error {
 		if err != nil {
 			return err
 		}
-		gid, err := strconv.Atoi(group.Gid)
+		// Gid has already been validated when reading the config file
+		gid, _ := strconv.Atoi(group.Gid)
 		if b.changed || b.existing == nil || b.existing.group != uint32(gid) {
 			set_gid = gid
 			log = log.WithField("gid", set_gid)

ldap.go

@@ -21,9 +21,6 @@ type (
 		server  int
 		counter uint
 	}
-
-	// LDAP group members
-	ldapGroupMembers map[string][]string
 )
 
 // Try to establish a connection to one of the servers
@@ -84,9 +81,9 @@ func getLdapServerConnection(cfg tLdapConfig, server int) *tLdapConn {
 	var err error
 	var lc *ldap.Conn
 	if scfg.TLS == "yes" {
-		lc, err = ldap.DialTLS("tcp", dest, tlsConfig)
+		lc, err = ldap.DialURL("ldaps://"+dest, ldap.DialWithTLSConfig(tlsConfig))
 	} else {
-		lc, err = ldap.Dial("tcp", dest)
+		lc, err = ldap.DialURL("ldap://"+dest, ldap.DialWithTLSConfig(tlsConfig))
 	}
 	if err != nil {
 		log.WithField("error", err).Error("Failed to connect to the LDAP server")

server.go

@@ -92,12 +92,39 @@ func socketServer(cfg *tConfiguration, listener net.Listener) tCommandType {
 	}
 }
 
+func executeUpdateFromSocket(cfg *tConfiguration, conn net.Conn, command *tCommand) {
+	log.WithFields(logrus.Fields{
+		"force":    command.Force,
+		"selector": command.Selector,
+	}).Info("Update request received")
+	success := executeUpdate(cfg, command.Selector, command.Force)
+	if err := conn.SetWriteDeadline(time.Now().Add(1 * time.Second)); err != nil {
+		log.WithField("error", err).Error("Could not set the socket's write deadline")
+		return
+	}
+
+	var bval byte
+	if success {
+		bval = '1'
+	} else {
+		bval = '0'
+	}
+
+	if _, err := conn.Write([]byte{bval}); err != nil {
+		log.WithField("error", err).Error("Could not write result to socket")
+		return
+	}
+}
+
 func executeFromSocket(cfg *tConfiguration, conn net.Conn) tCommandType {
 	defer conn.Close()
 	log.Debug("Received connection")
 
 	buf := make([]byte, 512)
-	conn.SetReadDeadline(time.Now().Add(1 * time.Second))
+	if err := conn.SetReadDeadline(time.Now().Add(1 * time.Second)); err != nil {
+		log.WithField("error", err).Error("Could not set the socket's read deadline")
+		return CMD_IGNORE
+	}
 	n, err := conn.Read(buf)
 	if err != nil {
 		log.WithField("error", err).Error("Could not read from socket")
@@ -108,19 +135,7 @@ func executeFromSocket(cfg *tConfiguration, conn net.Conn) tCommandType {
 		return CMD_IGNORE
 	}
 	if command.CommandType == CMD_UPDATE {
-		log.WithFields(logrus.Fields{
+		executeUpdateFromSocket(cfg, conn, command)
-			"force":    command.Force,
-			"selector": command.Selector,
-		}).Info("Update request received")
-		success := executeUpdate(cfg, command.Selector, command.Force)
-		conn.SetWriteDeadline(time.Now().Add(1 * time.Second))
-		var bval byte
-		if success {
-			bval = '1'
-		} else {
-			bval = '0'
-		}
-		conn.Write([]byte{bval})
 		return CMD_IGNORE
 	}
 	return command.CommandType

update.go

@@ -256,7 +256,7 @@ func (b *tUpdate) runCommand(timeout int, command string, log *logrus.Entry) err
 	go func() {
 		<-ctx.Done()
 		if ctx.Err() == context.DeadlineExceeded {
-			syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
 		}
 	}()
 	output, err := cmd.CombinedOutput()