natas_hw
/
grpc
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
grpc/test/core/security
History
Matthew Stevenson 278978d6f0
[tls] Remove use of SSL_CTX_set_client_CA_list for TLS server credentials. (#33558) 
This PR does the following: for the TLS server credentials, stops
calling `SSL_CTX_set_client_CA_list` by default in
`ssl_transport_security.cc`, and gives users a knob to re-enable calling
this API.

## What does the `SSL_CTX_set_client_CA_list` API do?

When this API is called, a gRPC TLS server sends the following data in
the ServerHello: for each certificate in the server's trust bundle, the
CA name in the certificate.

This API does not change the set of certificates trusted by the server
in any way. Rather, it is just providing a hint to the client about what
client certificate should be sent to the server.

## Why are we removing the use of `SSL_CTX_set_client_CA_list` by
default for the TLS server credentials?

Removing the use of this API by default has 2 benefits:
1. Calling this API makes gRPC TLS unusable for servers with a
sufficiently large trust bundle. Indeed, if the server trust bundle is
too large, then the server will always fail to build the ServerHello.
2. Calling this API is introducing a huge amount of overhead (1000s of
bytes) to each ServerHello, so removing this feature will improve
connection establishment latency for all users of the TLS server
credentials.
 		2023-06-29 09:48:15 -07:00
..
authorization/test_policies Revert "Revert "Revert "Revert "File watcher authorization policy provider implementation"" (#27605)" (#27644)" (#27645) 2021-10-08 15:52:13 -07:00
corpus Add ALTS fuzzer 2018-05-08 10:15:03 -07:00
etc Add a test for a (now-illegal) build file construct (#27602) 2021-10-06 07:43:59 -07:00
BUILD [Audit Logging] End2end test for audit logging in authorization policy (#33196) 2023-05-24 14:09:32 -07:00
alts_credentials_fuzzer.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
alts_security_connector_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
auth_context_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
authorization_matchers_test.cc [c++14] absl::make_unique --> std::make_unique (#31159) 2022-09-29 06:45:17 -07:00
aws_request_signer_test.cc Removed GRPC_ERROR_[INT|STR] macros (#31195) 2022-10-03 11:33:56 -07:00
cel_authorization_engine_test.cc RBAC engine matchers implementation. (#25997) 2021-04-19 13:05:27 -07:00
certificate_provider_registry_test.cc [xDS] second attempt: clean up cert provider factory and registry APIs (#33249) 2023-05-25 12:59:21 -07:00
channel_creds_registry_test.cc [xDS] support "tls" channel creds in bootstrap file (#33234) 2023-06-16 08:07:58 -07:00
check_gcp_environment_linux_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
check_gcp_environment_windows_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
create_jwt.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
credentials_test.cc [JSON] Replace ctors with factory methods (#32834) 2023-05-02 09:22:42 -07:00
evaluate_args_test.cc Revert "Revert "Fix grpc_sockaddr_to_uri to return URI encoded string. Also see #29323 which has a similar fix for unix abstract addresses."" (#29798) 2022-06-02 13:51:04 -07:00
fetch_oauth2.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
grpc_alts_credentials_options_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
grpc_audit_logging_test.cc [Audit Logging] Second attempt: rbac service config parsing with audit logging (#33183) 2023-05-18 14:27:26 -07:00
grpc_authorization_engine_test.cc [Audit Logging] End2end test for audit logging in authorization policy (#33196) 2023-05-24 14:09:32 -07:00
grpc_authorization_policy_provider_test.cc Detect unknown fields in SDK to RBAC translator (#27669) 2022-12-05 20:04:10 -08:00
grpc_tls_certificate_distributor_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
grpc_tls_certificate_provider_test.cc Minimum time file watcher (#32365) 2023-02-22 11:12:22 -08:00
grpc_tls_certificate_verifier_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
grpc_tls_credentials_options_comparator_test.cc [tls] Remove use of SSL_CTX_set_client_CA_list for TLS server credentials. (#33558) 2023-06-29 09:48:15 -07:00
grpc_tls_credentials_options_test.cc Reland global config changes (#32661) 2023-03-27 18:55:24 -07:00
insecure_security_connector_test.cc [iwyu] rest of the owl: src/core/lib - excluding iomgr, gpr (#29735) 2022-06-10 13:04:47 -07:00
json_token_test.cc [JSON] move Parse() and Dump() methods out of JSON object (#32742) 2023-03-30 13:30:54 -07:00
jwt_verifier_test.cc [JSON] move Parse() and Dump() methods out of JSON object (#32742) 2023-03-30 13:30:54 -07:00
oauth2_utils.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
oauth2_utils.h Convert c-style comments to C++-style comments (#31923) 2022-12-22 23:01:53 -08:00
print_google_default_creds_token.cc Add enforcement for cpp-style comment license in check_copyright.py (#32273) 2023-02-02 13:00:20 -08:00
rbac_translator_test.cc [Audit Logging] Authz policy support for audit logging (#32944) 2023-05-02 15:51:46 -07:00
secure_endpoint_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
security_connector_test.cc Reland global config changes (#32661) 2023-03-27 18:55:24 -07:00
ssl_credentials_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
ssl_server_fuzzer.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
system_roots_test.cc [cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757) 2023-01-11 08:50:32 -08:00
tls_security_connector_test.cc Reland global config changes (#32661) 2023-03-27 18:55:24 -07:00
verify_jwt.cc [JSON] make API public but experimental (#32987) 2023-05-09 08:05:24 -07:00
xds_credentials_test.cc Refactor end2end tests to exercise each EventEngine (#29202) 2022-03-30 15:43:05 -07:00