tls: allow cert validation by only leaf trusted CA's CRL by Shikugawa · Pull Request #18289 · envoyproxy/envoy

Shikugawa · 2021-09-28T10:59:23Z

Signed-off-by: Shikugawa rei@tetrate.io

Commit Message: Allow cert validation by only leaf trusted CAs CRL
Additional Description: Close #18268. In the previous implementation, we don't have availability to validate certs when all trusted CAs don't have their own CRLs if any trusted CAs have that. This feature allows validating even if all trusted CAs don't have CRLs.
Risk Level: Low
Testing: Unit
Docs Changes: Required
Release Notes: Required
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Deprecated:]
[Optional API Considerations:]

cc @incfly

Signed-off-by: Shikugawa <rei@tetrate.io>

repokitteh-read-only · 2021-09-28T10:59:30Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/envoy/.
envoyproxy/api-shepherds assignee is @mattklein123
CC @envoyproxy/api-watchers: FYI only for changes made to api/envoy/.

🐱

Caused by: #18289 was opened by Shikugawa.

see: more, trace.

mattklein123

Thanks flushing out some comments. cc @ggreenway to provide a quick sanity check of the feature.

/wait

api/envoy/extensions/transport_sockets/tls/v3/common.proto

docs/root/version_history/current.rst

test/extensions/transport_sockets/tls/ssl_socket_test.cc

incfly · 2021-09-28T18:23:35Z

Thanks for the quick change! @Shikugawa

test/extensions/transport_sockets/tls/ssl_socket_test.cc

Signed-off-by: Shikugawa <rei@tetrate.io>

test/extensions/transport_sockets/tls/ssl_socket_test.cc

Signed-off-by: Shikugawa <rei@tetrate.io>

mattklein123

Flushing some more API comments. I will defer to @lizan and others for the testing review to make sure we have good coverage, thanks.

/wait

api/envoy/extensions/transport_sockets/tls/v3/common.proto

docs/root/version_history/current.rst

Signed-off-by: Shikugawa <rei@tetrate.io>

Shikugawa · 2021-09-30T02:16:33Z

@lizan Could you take a look?

test/extensions/transport_sockets/tls/ssl_socket_test.cc

incfly

LGTM

mattklein123

API LGTM thanks. I will defer to @lizan for the TLS/test review. Thank you!

mattklein123 · 2021-10-06T15:44:38Z

Needs a main merge. Ping @lizan PTAL.

/wait

lizan

one more about naming, and please resolve conflicts.

api/envoy/extensions/transport_sockets/tls/v3/common.proto

Signed-off-by: Shikugawa <rei@tetrate.io>

mattklein123 · 2021-10-18T16:19:36Z

Needs a main merge.

/wait

repokitteh-read-only · 2021-10-27T06:46:26Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @lizan
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #18289 was synchronize by Shikugawa.

see: more, trace.

Signed-off-by: Shikugawa <rei@tetrate.io>

Shikugawa · 2021-10-29T11:20:17Z

/retest

repokitteh-read-only · 2021-10-29T11:20:20Z

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #18289 (comment) was created by @Shikugawa.

see: more, trace.

Shikugawa · 2021-11-02T08:42:42Z

/retest

repokitteh-read-only · 2021-11-02T08:42:47Z

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #18289 (comment) was created by @Shikugawa.

see: more, trace.

Signed-off-by: Shikugawa <rei@tetrate.io>

Shikugawa · 2021-11-02T13:21:55Z

/retest

repokitteh-read-only · 2021-11-02T13:21:58Z

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #18289 (comment) was created by @Shikugawa.

see: more, trace.

Shikugawa · 2021-11-02T14:44:17Z

/retest

repokitteh-read-only · 2021-11-02T14:44:23Z

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #18289 (comment) was created by @Shikugawa.

see: more, trace.

mattklein123

LGTM, thanks. @lizan @incfly can you quickly check the test coverage? Thank you.

incfly

This looks good to me. Thanks @Shikugawa for the change, and @mattklein123 for the headsup

tls: allow cert validation by only leaf trusted CA's CRL

5faafc3

Signed-off-by: Shikugawa <rei@tetrate.io>

Shikugawa requested review from asraa, ggreenway and lizan as code owners September 28, 2021 10:59

repokitteh-read-only bot added the api label Sep 28, 2021

repokitteh-read-only bot assigned mattklein123 Sep 28, 2021

mattklein123 requested changes Sep 28, 2021

View reviewed changes

repokitteh-read-only bot added the waiting label Sep 28, 2021

incfly reviewed Sep 28, 2021

View reviewed changes

test/extensions/transport_sockets/tls/ssl_socket_test.cc Show resolved Hide resolved

fix

3d4f9d7

Signed-off-by: Shikugawa <rei@tetrate.io>

repokitteh-read-only bot removed the waiting label Sep 29, 2021

Shikugawa added 2 commits September 29, 2021 03:20

Merge branch 'main' of https://github.com/envoyproxy/envoy into leaf-crl

24baa17

Signed-off-by: Shikugawa <rei@tetrate.io>

fix

0fd74a0

Signed-off-by: Shikugawa <rei@tetrate.io>

incfly reviewed Sep 29, 2021

View reviewed changes

test/extensions/transport_sockets/tls/ssl_socket_test.cc Outdated Show resolved Hide resolved

fix

faf39f1

Signed-off-by: Shikugawa <rei@tetrate.io>

mattklein123 requested changes Sep 29, 2021

View reviewed changes

repokitteh-read-only bot added the waiting label Sep 29, 2021

fix

dc9081c

Signed-off-by: Shikugawa <rei@tetrate.io>

repokitteh-read-only bot removed the waiting label Sep 30, 2021

Shikugawa assigned lizan Sep 30, 2021

incfly reviewed Sep 30, 2021

View reviewed changes

test/extensions/transport_sockets/tls/ssl_socket_test.cc Outdated Show resolved Hide resolved

incfly reviewed Sep 30, 2021

View reviewed changes

mattklein123 previously approved these changes Sep 30, 2021

View reviewed changes

repokitteh-read-only bot removed the api label Sep 30, 2021

repokitteh-read-only bot added the waiting label Oct 6, 2021

lizan suggested changes Oct 6, 2021

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/common.proto Outdated Show resolved Hide resolved

fix

79f987e

Signed-off-by: Shikugawa <rei@tetrate.io>

repokitteh-read-only bot added waiting and removed waiting labels Oct 18, 2021

repokitteh-read-only bot removed the waiting label Oct 27, 2021

repokitteh-read-only bot added the waiting label Oct 27, 2021

Merge branch 'main' of https://github.com/envoyproxy/envoy into leaf-crl

66fb01a

Signed-off-by: Shikugawa <rei@tetrate.io>

Shikugawa force-pushed the leaf-crl branch from b2bb812 to 66fb01a Compare October 29, 2021 09:04

repokitteh-read-only bot removed the waiting label Oct 29, 2021

Shikugawa added 2 commits October 29, 2021 18:41

fix

4a20681

Signed-off-by: Shikugawa <rei@tetrate.io>

fix

bc7e61a

Signed-off-by: Shikugawa <rei@tetrate.io>

mattklein123 added the waiting label Oct 29, 2021

Shikugawa added 2 commits November 2, 2021 17:56

Kick CI

5059098

Signed-off-by: Shikugawa <rei@tetrate.io>

Merge branch 'main' of https://github.com/envoyproxy/envoy into leaf-crl

0413ec9

Signed-off-by: Shikugawa <rei@tetrate.io>

repokitteh-read-only bot removed the waiting label Nov 2, 2021

mattklein123 approved these changes Nov 2, 2021

View reviewed changes

repokitteh-read-only bot removed the api label Nov 2, 2021

incfly reviewed Nov 2, 2021

View reviewed changes

lizan approved these changes Nov 2, 2021

View reviewed changes

lizan merged commit 56e8c45 into envoyproxy:main Nov 2, 2021

Conversation

Shikugawa commented Sep 28, 2021

Uh oh!

repokitteh-read-only bot commented Sep 28, 2021

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

incfly commented Sep 28, 2021

Uh oh!

Uh oh!

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Shikugawa commented Sep 30, 2021

Uh oh!

Uh oh!

incfly left a comment

Choose a reason for hiding this comment

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

mattklein123 commented Oct 6, 2021

Uh oh!

lizan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mattklein123 commented Oct 18, 2021

Uh oh!

repokitteh-read-only bot commented Oct 27, 2021

Uh oh!

Shikugawa commented Oct 29, 2021

Uh oh!

repokitteh-read-only bot commented Oct 29, 2021

Uh oh!

Shikugawa commented Nov 2, 2021

Uh oh!

repokitteh-read-only bot commented Nov 2, 2021

Uh oh!

Shikugawa commented Nov 2, 2021

Uh oh!

repokitteh-read-only bot commented Nov 2, 2021

Uh oh!

Shikugawa commented Nov 2, 2021

Uh oh!

repokitteh-read-only bot commented Nov 2, 2021

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

incfly left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants