Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

advancedtls: populate verified chains when using custom buildVerifyFunc #7181

Merged
merged 8 commits into from
May 22, 2024
Merged

advancedtls: populate verified chains when using custom buildVerifyFunc #7181

Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
54a29d7
populate verified chains when using custom buildVerifyFunc
mudhireddy May 2, 2024
188bbcc
add comments
mudhireddy May 6, 2024
6653a37
address code review comment
mudhireddy May 8, 2024
ce997a6
add unit testing and documentation
mudhireddy May 14, 2024
f512e23
replace nil with context.TODO()
mudhireddy May 14, 2024
39011ab
address review comments
mudhireddy May 15, 2024
8147924
review comments
mudhireddy May 20, 2024
01160d4
update typename to CertificateChains
mudhireddy May 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions security/advancedtls/advancedtls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -484,7 +484,8 @@ func (c *advancedTLSCreds) ClientHandshake(ctx context.Context, authority string
if cfg.ServerName == "" {
cfg.ServerName = authority
}
cfg.VerifyPeerCertificate = buildVerifyFunc(c, cfg.ServerName, rawConn)
peerVerifiedChains := [][]*x509.Certificate{}
cfg.VerifyPeerCertificate = buildVerifyFunc(c, cfg.ServerName, rawConn, &peerVerifiedChains)
conn := tls.Client(rawConn, cfg)
errChannel := make(chan error, 1)
go func() {
Expand All @@ -508,12 +509,15 @@ func (c *advancedTLSCreds) ClientHandshake(ctx context.Context, authority string
},
}
info.SPIFFEID = credinternal.SPIFFEIDFromState(conn.ConnectionState())
// set the VerifiedChains
mudhireddy marked this conversation as resolved.
Show resolved Hide resolved
info.State.VerifiedChains = peerVerifiedChains
return credinternal.WrapSyscallConn(rawConn, conn), info, nil
}

func (c *advancedTLSCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
cfg := credinternal.CloneTLSConfig(c.config)
cfg.VerifyPeerCertificate = buildVerifyFunc(c, "", rawConn)
peerVerifiedChains := [][]*x509.Certificate{}
cfg.VerifyPeerCertificate = buildVerifyFunc(c, "", rawConn, &peerVerifiedChains)
conn := tls.Server(rawConn, cfg)
if err := conn.Handshake(); err != nil {
conn.Close()
Expand All @@ -526,6 +530,8 @@ func (c *advancedTLSCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credenti
},
}
info.SPIFFEID = credinternal.SPIFFEIDFromState(conn.ConnectionState())
// set the VerifiedChains
mudhireddy marked this conversation as resolved.
Show resolved Hide resolved
info.State.VerifiedChains = peerVerifiedChains
return credinternal.WrapSyscallConn(rawConn, conn), info, nil
}

Expand All @@ -552,7 +558,8 @@ func (c *advancedTLSCreds) OverrideServerName(serverNameOverride string) error {
// to true.
func buildVerifyFunc(c *advancedTLSCreds,
mudhireddy marked this conversation as resolved.
Show resolved Hide resolved
serverName string,
rawConn net.Conn) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
rawConn net.Conn,
peerVerifiedChains *[][]*x509.Certificate) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
mudhireddy marked this conversation as resolved.
Show resolved Hide resolved
return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
chains := verifiedChains
var leafCert *x509.Certificate
Expand Down Expand Up @@ -611,6 +618,7 @@ func buildVerifyFunc(c *advancedTLSCreds,
return err
}
leafCert = rawCertList[0]
*peerVerifiedChains = chains
gtcooke94 marked this conversation as resolved.
Show resolved Hide resolved
}
// Perform certificate revocation check if specified.
if c.revocationOptions != nil {
Expand Down
Loading