Merge pull request #265 from xmidt-org/feature/report-verify-errors

Feature/report verify errors

token/claimBuilder.go

@@ -14,6 +14,8 @@ import (
 	"github.com/xmidt-org/themis/random"
 	"github.com/xmidt-org/themis/xhttp/xhttpclient"
 	"github.com/xmidt-org/themis/xhttp/xhttpserver"
+	"github.com/xmidt-org/themis/xzap"
+	"go.uber.org/zap"
 
 	"github.com/go-kit/kit/endpoint"
 	kithttp "github.com/go-kit/kit/transport/http"
@@ -238,6 +240,13 @@ func (cb *clientCertificateClaimBuilder) AddClaims(_ context.Context, r *Request
 		}
 
 		_, verifyErr := pc.Verify(vo)
+		if verifyErr != nil {
+			r.Logger.Warn(
+				"certificate verification failed",
+				zap.Error(verifyErr),
+				xzap.Certificate("cert", pc),
+			)
+		}
 
 		switch {
 		case expired && verifyErr != nil:

xhttp/xhttpserver/server.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/xmidt-org/sallust"
 	"github.com/xmidt-org/sallust/sallusthttp"
+	"github.com/xmidt-org/themis/xzap"
 	"go.uber.org/zap"
 
 	"github.com/justinas/alice"
@@ -59,7 +60,7 @@ func NewServerChain(o Options, l *zap.Logger, fbs ...sallusthttp.FieldBuilder) a
 		return l.With(zap.String("userAgent", r.UserAgent()))
 	})
 	bs.Add(func(r *http.Request, l *zap.Logger) *zap.Logger {
-		return l.With(connectionStateField("state", r.TLS))
+		return l.With(xzap.ConnectionState("state", r.TLS))
 	})
 
 	chain := alice.New(

xzap/doc.go

@@ -0,0 +1,7 @@
+// SPDX-FileCopyrightText: 2019 Comcast Cable Communications Management, LLC
+// SPDX-License-Identifier: Apache-2.0
+
+/*
+Package xzap provides some zap logging integrations.
+*/
+package xzap

xhttp/xhttpserver/zap.go → xzap/zap.go

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2017 Comcast Cable Communications Management, LLC
 // SPDX-License-Identifier: Apache-2.0
-package xhttpserver
+package xzap
 
 import (
 	"crypto/tls"
@@ -53,6 +53,14 @@ func (c certificate) MarshalLogObject(enc zapcore.ObjectEncoder) error {
 	return nil
 }
 
+func Certificate(field string, cert *x509.Certificate) zap.Field {
+	if cert != nil {
+		return zap.Object(field, certificate(*cert))
+	} else {
+		return zap.Skip()
+	}
+}
+
 type certificates []*x509.Certificate
 
 func (cs certificates) MarshalLogArray(enc zapcore.ArrayEncoder) error {
@@ -96,7 +104,9 @@ func (cstate connectionState) MarshalLogObject(enc zapcore.ObjectEncoder) error
 	return nil
 }
 
-func connectionStateField(field string, v *tls.ConnectionState) zap.Field {
+// ConnectionState produces a zap logging Field that produces an object representation
+// of a TLS connection state.
+func ConnectionState(field string, v *tls.ConnectionState) zap.Field {
 	if v != nil {
 		return zap.Object(field, connectionState(*v))
 	} else {