eece0c034a
[tls] Backport of #34861 to v1.56.x. ( #35795 )
...
Co-authored-by: Luwei Ge <lwge@google.com>
2024-02-05 11:04:00 -08:00
a4f345ff96
TlsCreds: Support revocation of intermediate in chain. ( #32544 )
...
This PR is a small code change with a lot of new test data.
[In OpenSSL, there are two flags that configure CRL checks. Coping
relevant
section:](https://www.openssl.org/docs/man1.0.2/man3/X509_VERIFY_PARAM_get_depth.html )
> - X509_V_FLAG_CRL_CHECK enables CRL checking for the certificate chain
leaf certificate. An error occurs if a suitable CRL cannot be found.
> - X509_V_FLAG_CRL_CHECK_ALL enables CRL checking for the entire
certificate chain.
We currently only set `X509_V_FLAG_CRL_CHECK`, so we will only ever
check if the leaf certificate is revoked. We should check the whole
chain. I am open to making this a user configuration if we want to do it
that way, but we certainly need to be able to check the whole chain.
So, this PR contains the small code change in
`ssl_transport_security.cc` to use the `X509_V_FLAG_CRL_CHECK_ALL` flag.
Then the rest of the changes are in tests. I've added all the necessary
files to have a chain built that looks as follows
`Root CA -> Revoked Intermediate CA -> Leaf Certificate`, and added a
test for this case as well.
You can verify that on master this new test will fail (i.e. the
handshake will succeed even though the intermediate CA is revoked) by
checking out this branch, running `git checkout master --
./src/core/tsi/ssl_transport_security.cc`, then running the test.
I also slightly reorganized test/core/tsi/test_creds/ so that the CRLs
are in their own directory, which is the way our API intends to accept
CRLs.
2023-03-23 11:34:59 -04:00
f99b8b5bc4
Convert c-style comments to C++-style comments ( #31923 )
...
* baseline
* fix clang-tidy
* manually revert these files
* manually fixup at eof
* revert 2 more files
* change check_deprecated_grpc++.py
* change end2end_defs.include template
* fix check_include_guards.py
* untrack tools/distrib/python/convert_cstyle_comments_to_cpp.py
not yet ready to be submitted
* fix
yapf check_include_guards.py
remove a space...
* fix version.cc.template
* fix version_info.h.template
2022-12-22 23:01:53 -08:00
d934aabb09
Added url validation for aws metadata endpoints in aws external account ( #31626 )
...
* Added url validation for aws metadata endpoints in aws external account
* addressing review comments
* fix error message back
* Fix broken test
2022-11-12 11:56:33 -08:00
c2ab8c99bb
Revert "Revert "[c++] Move environment functions to C++ ( #30937 )" ( #30986 )" ( #30988 )
...
This reverts commit 96264e07b8
2022-09-14 14:19:36 -07:00
96264e07b8
Revert "[c++] Move environment functions to C++ ( #30937 )" ( #30986 )
...
This reverts commit 74c0d6fe3f
2022-09-14 11:53:55 -07:00
74c0d6fe3f
[c++] Move environment functions to C++ ( #30937 )
...
* [gprpp] Move env to C++
* move headers/impl
* Automated change: Fix sanity tests
* fix
* fix
* Automated change: Fix sanity tests
* Update http_proxy.cc
* fix
* fix
* rename
* fix merge
* fix
Co-authored-by: ctiller <ctiller@users.noreply.github.com>
2022-09-14 10:17:15 -07:00
1cdcd88fb1
Add experimental API for CRL checking support to gRPC C++ TlsCredentials ( #28407 )
2022-01-26 20:23:48 -08:00
2e14f6fa70
Support Custom Post-handshake Verification in TlsCredentials ( #25631 )
...
* custom verification refactoring - post-handshake verification
2021-11-10 13:45:52 -08:00
ea389c00c2
Adjust include order per style guide ( #27175 )
...
Introduce clang-format configuration to sort includes closer to our rules.
2021-09-08 12:14:44 -07:00
33b80f16ec
Applies clang_format_code.sh to address sanity check tests.
2021-02-08 15:42:40 -08:00
a8e061bf88
Removes experimental namespace from ExternalAccountCredentials tests.
2021-02-08 14:22:04 -08:00
e745f8cb55
Merge pull request #25018 from ZhenLian/zhen_dynamic_file_reloading_9
...
Support Default Root Certs in Tls Credentials
2021-01-07 09:40:31 -08:00
c48e39d5c2
Support Default Root Certs in Tls Credentials
2021-01-06 23:02:52 -08:00
06cc42eb85
Add support of implicit and explicit flows for external account creds
2021-01-05 13:20:42 -08:00
d74e43da95
Add File Watcher Certificate Provider API
2020-11-19 13:36:13 -08:00
518ed1303c
Add Credential Loading From Static Providers For TLS Credentials
2020-10-22 13:55:31 -07:00
1de0bfd9e2
Revert "Revert "Move create_channel and credentials from ::grpc_impl to ::grpc""
2020-07-24 12:47:33 -07:00
f1bc43edf6
Revert "Move create_channel and credentials from ::grpc_impl to ::grpc"
2020-07-24 11:08:54 -07:00
44f721eeb0
Merge branch 'master' into create-channel
2020-06-30 15:52:24 -07:00
165ee5007a
Replaced grpc::string with std::string
2020-06-29 17:56:36 -07:00
59b41d50fa
Formatting fixes
2020-06-29 14:37:52 -07:00
bf551af394
Fix credentials test.
2020-06-29 13:02:01 -07:00
12a6435557
TlsCredentialsOption API optimization
2020-05-11 22:46:11 -07:00
a37d5f14b0
Remove flaky test introduced in PR 21932.
2020-05-07 07:22:29 -07:00
09b42371e7
Remove grpc_core::InlinedVector<> and grpc_core::Optional<>.
2020-04-23 11:24:41 -07:00
738272f3a8
[ImproveTLS] add a wrapper to error_detail in C core args
2020-03-18 09:35:39 -07:00
cbc977204b
[ImproveTLS] fix memory leak issue from users' perspective
2020-03-04 17:04:06 -08:00
864e232edf
Update TlsServerCredentials to initialize C-core.
2020-02-28 13:23:51 -08:00
77377fa931
Removed server builder and ssl creds stuff.
2020-02-19 14:35:59 -08:00
b344c90fe1
ssl creds
2020-02-13 15:35:58 -08:00
924aace7dc
Version 4.
2020-02-06 08:51:41 -08:00
ceae5835e6
Merge remote-tracking branch 'upstream/master' into tls-credentials-1
2020-02-06 08:42:26 -08:00
d869bed623
Added in server builder.
2020-02-05 15:56:16 -08:00
ee7ae056e5
Revert "Updates to TLS credentials, version 3"
2020-02-05 13:52:46 -08:00
f557437b51
Add back changes.
2020-01-30 15:26:51 -08:00
3818f81fb8
Update from master.
2020-01-30 08:43:16 -08:00
840b0f9cb9
Merge branch 'master' of https://github.com/grpc/grpc into tls-credentials-1
2020-01-30 08:42:22 -08:00
47c755520c
Remove TestEnvironment.
2020-01-30 08:13:32 -08:00
1f13c17a28
Adding back in grpc_init.
2020-01-30 06:42:31 -08:00
0b51d535f3
Remove grpc_init.
2020-01-29 18:42:29 -08:00
e392d0ac7d
experiment test
2020-01-29 15:36:44 -08:00
9e0b87f523
Revert "Updates to TLS credentials, version 2"
2020-01-29 12:24:21 -08:00
e18defc303
Fix attempt #2 .
2020-01-27 12:47:32 -08:00
4d61655409
Merge remote-tracking branch 'upstream/master' into tls-credentials-1
2020-01-23 14:31:17 -08:00
b2f1510dd7
Fix load TLS server credentials 1.
2020-01-23 13:44:18 -08:00
26d50f726a
Revert "Collect TLS-specific changes from PR 20568."
2020-01-23 12:34:43 -08:00
5cfff04ce9
Collect TLS-specific changes from PR 2-568.
2020-01-22 13:06:22 -08:00
db11b94f25
FullChainExperimental-01-200103
2020-01-03 22:37:18 -08:00
a6dbc7adb5
rename spiffe to tls
2019-12-05 16:03:37 -08:00
Matthew Stevenson