v0.23.0 color, presets, certificates made at startup, cli.go, sink flush

internal/authz/authz.go

@@ -129,8 +129,9 @@ func New(o *config.AuthOptions, tlsCfg *tls.Config, role Role, transport Transpo
 	if tlsCfg == nil && (o.Type != MethodSCRAM || len(o.TrustedProxies) == 0) {
 		return nil, fmt.Errorf("auth: type %q requires tls.enabled", o.Type)
 	}
-	if role == RoleDialer && tlsCfg != nil && tlsCfg.InsecureSkipVerify {
-		// An unverified server makes identities claims and exposes credentials
+	if role == RoleDialer && tlsCfg != nil && tlsCfg.InsecureSkipVerify && tlsCfg.VerifyPeerCertificate == nil {
+		// An unverified server makes identities claims and exposes credentials;
+		// tls.pin_sha256 verifies it in VerifyPeerCertificate instead
 		return nil, fmt.Errorf("auth: type %q cannot be used with tls.insecure_skip_verify", o.Type)
 	}
 

internal/authz/authz_test.go

@@ -167,10 +167,13 @@ func TestNewValidation(t *testing.T) {
 	}
 
 	// The rows' bases are valid: a dialer needs TLS but not client_auth, as it
-	// pins the server's identity
+	// pins the server's identity; tls.pin_sha256 verifies in place of the chain
+	pinned := &tls.Config{InsecureSkipVerify: true, VerifyPeerCertificate: func([][]byte, [][]*x509.Certificate) error { return nil }}
 	for _, o := range []*config.AuthOptions{{Type: MethodMTLS}, dialer(config.AuthOptions{})} {
-		if _, err := New(o, &tls.Config{}, RoleDialer, TCP); err != nil {
-			t.Fatalf("dialer policy %s rejected: %v", o.Type, err)
+		for _, c := range []*tls.Config{{}, pinned} {
+			if _, err := New(o, c, RoleDialer, TCP); err != nil {
+				t.Fatalf("dialer policy %s rejected: %v", o.Type, err)
+			}
 		}
 	}
 	if _, err := New(listener(config.AuthOptions{TokenLifetimeMS: 60000}), f.serverTLS, RoleListener, HTTP); err != nil {