Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

advancedtls: populate verified chains when using custom buildVerifyFunc #7181

Merged
merged 8 commits into from
May 22, 2024
Merged

advancedtls: populate verified chains when using custom buildVerifyFunc #7181

Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
54a29d7
populate verified chains when using custom buildVerifyFunc
mudhireddy May 2, 2024
188bbcc
add comments
mudhireddy May 6, 2024
6653a37
address code review comment
mudhireddy May 8, 2024
ce997a6
add unit testing and documentation
mudhireddy May 14, 2024
f512e23
replace nil with context.TODO()
mudhireddy May 14, 2024
39011ab
address review comments
mudhireddy May 15, 2024
8147924
review comments
mudhireddy May 20, 2024
01160d4
update typename to CertificateChains
mudhireddy May 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 7 additions & 7 deletions security/advancedtls/advancedtls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ import (
credinternal "google.golang.org/grpc/internal/credentials"
)

type CertChains [][]*x509.Certificate
mudhireddy marked this conversation as resolved.
Show resolved Hide resolved

// HandshakeVerificationInfo contains information about a handshake needed for
// verification for use when implementing the `PostHandshakeVerificationFunc`
// The fields in this struct are read-only.
Expand All @@ -47,7 +49,7 @@ type HandshakeVerificationInfo struct {
RawCerts [][]byte
// The verification chain obtained by checking peer RawCerts against the
// trust certificate bundle(s), if applicable.
VerifiedChains [][]*x509.Certificate
VerifiedChains CertChains
// The leaf certificate sent from peer, if choosing to verify the peer
// certificate(s) and that verification passed. This field would be nil if
// either user chose not to verify or the verification failed.
Expand Down Expand Up @@ -484,7 +486,7 @@ func (c *advancedTLSCreds) ClientHandshake(ctx context.Context, authority string
if cfg.ServerName == "" {
cfg.ServerName = authority
}
peerVerifiedChains := [][]*x509.Certificate{}
peerVerifiedChains := CertChains{}
cfg.VerifyPeerCertificate = buildVerifyFunc(c, cfg.ServerName, rawConn, &peerVerifiedChains)
conn := tls.Client(rawConn, cfg)
errChannel := make(chan error, 1)
Expand All @@ -509,14 +511,13 @@ func (c *advancedTLSCreds) ClientHandshake(ctx context.Context, authority string
},
}
info.SPIFFEID = credinternal.SPIFFEIDFromState(conn.ConnectionState())
// set the VerifiedChains
info.State.VerifiedChains = peerVerifiedChains
return credinternal.WrapSyscallConn(rawConn, conn), info, nil
}

func (c *advancedTLSCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
cfg := credinternal.CloneTLSConfig(c.config)
peerVerifiedChains := [][]*x509.Certificate{}
peerVerifiedChains := CertChains{}
cfg.VerifyPeerCertificate = buildVerifyFunc(c, "", rawConn, &peerVerifiedChains)
conn := tls.Server(rawConn, cfg)
if err := conn.Handshake(); err != nil {
Expand All @@ -530,7 +531,6 @@ func (c *advancedTLSCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credenti
},
}
info.SPIFFEID = credinternal.SPIFFEIDFromState(conn.ConnectionState())
// set the VerifiedChains
info.State.VerifiedChains = peerVerifiedChains
return credinternal.WrapSyscallConn(rawConn, conn), info, nil
}
Expand Down Expand Up @@ -564,7 +564,7 @@ func (c *advancedTLSCreds) OverrideServerName(serverNameOverride string) error {
func buildVerifyFunc(c *advancedTLSCreds,
mudhireddy marked this conversation as resolved.
Show resolved Hide resolved
serverName string,
rawConn net.Conn,
peerVerifiedChains *[][]*x509.Certificate) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
peerVerifiedChains *CertChains) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
chains := verifiedChains
var leafCert *x509.Certificate
Expand Down Expand Up @@ -628,7 +628,7 @@ func buildVerifyFunc(c *advancedTLSCreds,
if c.revocationOptions != nil {
verifiedChains := chains
if verifiedChains == nil {
verifiedChains = [][]*x509.Certificate{rawCertList}
verifiedChains = CertChains{rawCertList}
}
if err := checkChainRevocation(verifiedChains, *c.revocationOptions); err != nil {
return err
Expand Down