[management] optimize posture cache (#8366)

shared/management/certposture/certposture_test.go

@@ -175,6 +175,24 @@ func TestChainMatchesCAs(t *testing.T) {
 	assert.False(t, ChainMatchesCAs("not a pem", []string{ca.PEM}, now))
 }
 
+func TestAnyChainMatchesCAs(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	otherCA := certtest.NewCA(t, "other-root")
+	chainPEM := EncodeChainPEM([]*x509.Certificate{ca.Issue(t, certtest.ECDSAKey(t), "device")})
+	otherPEM := EncodeChainPEM([]*x509.Certificate{otherCA.Issue(t, certtest.ECDSAKey(t), "device")})
+
+	assert.True(t, AnyChainMatchesCAs([]string{otherPEM, chainPEM}, []string{ca.PEM}, now))
+	assert.False(t, AnyChainMatchesCAs([]string{otherPEM}, []string{ca.PEM}, now))
+	assert.False(t, AnyChainMatchesCAs(nil, []string{ca.PEM}, now))
+	assert.False(t, AnyChainMatchesCAs([]string{chainPEM}, []string{"not a pem"}, now))
+
+	roots, err := ParseCAs([]string{ca.PEM})
+	require.NoError(t, err)
+	assert.True(t, AnyChainMatchesPool([]string{otherPEM, chainPEM}, roots, now))
+	assert.False(t, AnyChainMatchesPool([]string{otherPEM}, roots, now))
+	assert.False(t, AnyChainMatchesPool(nil, roots, now))
+}
+
 func TestChainPEM_RoundTrip(t *testing.T) {
 	ca := certtest.NewCA(t, "root")
 	leaf := ca.Issue(t, certtest.ECDSAKey(t), "device")

shared/management/certposture/chain.go

@@ -68,10 +68,19 @@ func ChainMatchesCAs(chainPEM string, caPEMs []string, now time.Time) bool {
 // AnyChainMatchesCAs reports whether at least one of the peer's verified chains
 // is anchored in one of the configured CAs.
 func AnyChainMatchesCAs(chainPEMs, caPEMs []string, now time.Time) bool {
+	if len(chainPEMs) == 0 {
+		return false
+	}
 	roots, err := ParseCAs(caPEMs)
 	if err != nil {
 		return false
 	}
+	return AnyChainMatchesPool(chainPEMs, roots, now)
+}
+
+// AnyChainMatchesPool is AnyChainMatchesCAs over an already parsed root pool, for
+// callers that verify many peers against the same CAs.
+func AnyChainMatchesPool(chainPEMs []string, roots *x509.CertPool, now time.Time) bool {
 	for _, chainPEM := range chainPEMs {
 		if chainMatchesPool(chainPEM, roots, now) {
 			return true