Add a new keyless protocol error type for remote configuration issues

client/keys.go

@@ -8,6 +8,7 @@ import (
 	"crypto/subtle"
 	"errors"
 	"fmt"
+	"github.com/cloudflare/gokeyless/server"
 	"io"
 	"net"
 
@@ -117,7 +118,7 @@ func (key *PrivateKey) execute(ctx context.Context, op protocol.Op, msg []byte)
 
 		conn, err := r.Dial(key.client)
 		if err != nil {
-			return nil, err
+			return nil, server.RemoteConfigurationErr{Err: err}
 		}
 
 		// We explicitly do NOT want to fill in JaegerSpan here, since the remote keyless server

protocol/protocol.go

@@ -161,6 +161,8 @@ const (
 	ErrCertNotFound
 	// ErrExpired indicates that the sealed blob is no longer unsealable.
 	ErrExpired
+	// ErrRemoteConfiguration indicates that a remote keyserver was not configured correctly.
+	ErrRemoteConfiguration
 )
 
 func (e Error) Error() string {

server/errors.go

@@ -0,0 +1,9 @@
+package server
+
+type RemoteConfigurationErr struct {
+	Err error
+}
+
+func (rce RemoteConfigurationErr) Error() string {
+	return rce.Error()
+}

server/server.go

@@ -377,7 +377,15 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response {
 		sig, err := key.Sign(rand.Reader, pkt.Operation.Payload, crypto.Hash(0))
 		if err != nil {
 			log.Errorf("Connection: %s: Signing error: %v", connName, protocol.ErrCrypto, err)
-			return makeErrResponse(pkt, protocol.ErrCrypto)
+			// This indicates that a remote keyserver is being used
+			var remoteConfigurationErr RemoteConfigurationErr
+			if errors.As(err, &remoteConfigurationErr) {
+				log.Errorf("Connection %v: %s: Signing error: %v\n", connName, protocol.ErrRemoteConfiguration, err)
+				return makeErrResponse(pkt, protocol.ErrRemoteConfiguration)
+			} else {
+				log.Errorf("Connection %v: %s: Signing error: %v\n", connName, protocol.ErrCrypto, err)
+				return makeErrResponse(pkt, protocol.ErrCrypto)
+			}
 		}
 		return makeRespondResponse(pkt, sig)
 
@@ -486,8 +494,15 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response {
 				continue
 			} else {
 				tracing.LogError(span, err)
-				log.Errorf("Connection %v: %s: Signing error: %v\n", connName, protocol.ErrCrypto, err)
-				return makeErrResponse(pkt, protocol.ErrCrypto)
+				// This indicates that a remote keyserver is being used
+				var remoteConfigurationErr RemoteConfigurationErr
+				if errors.As(err, &remoteConfigurationErr) {
+					log.Errorf("Connection %v: %s: Signing error: %v\n", connName, protocol.ErrRemoteConfiguration, err)
+					return makeErrResponse(pkt, protocol.ErrRemoteConfiguration)
+				} else {
+					log.Errorf("Connection %v: %s: Signing error: %v\n", connName, protocol.ErrCrypto, err)
+					return makeErrResponse(pkt, protocol.ErrCrypto)
+				}
 			}
 		}
 		break