Chiebot-Mirror/grpc - grpc - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Luwei Ge	dd12460018	[tls] Add set min/max TLS version APIs to TLS credentials APIs. (#34861 ) Address #28382. This is a recreation of #31368 except e2e tests are not handled here (yet). Closes #34861 COPYBARA_INTEGRATE_REVIEW=https://github.com/grpc/grpc/pull/34861 from rockspore:tls_version `f9a1215ac1` PiperOrigin-RevId: 589847110	12 months ago
Matthew Stevenson	07985907f2	[tls] Fix ownership bugs in TlsCredentialsOptions and grpc_tls_credentials_options. (#34758 ) Currently it is very easy to use the `TlsCredentialsOptions` in such a way that it produces a memory leak. For example, the code block ``` { TlsCredentialsOptions options; } ``` produces a memory leak. This PR fixes up the ownership bugs in this class and its `grpc_tls_credentials_options`, the C-core analogue.	1 year ago
Gregory Cooke	9969d820b5	[TLS - Revocation] Crl Provider (#34715 ) This reverts commit `7af5efcfd3`.	1 year ago
apolcyn	7af5efcfd3	Revert "[TLS - Revocation] Crl Provider (#33786 )" (#34713 ) This reverts commit `0f0396ae92`.	1 year ago
Gregory Cooke	0f0396ae92	[TLS - Revocation] Crl Provider (#33786 ) The basic APIs for the CRL Reloading features. This adds external types to represent CRL Providers, CRLs, and CertificateInfo. Internally we will use `CrlImpl` - this layer is needed to hide OpenSSL details from the user. GRFC - https://github.com/grpc/proposal/pull/382 Things Done * Add external API for `CrlProvider`, `Crl`, `CertInfo` (`CertInfo` is used during CRL lookup rather than passing the entire certificate). * Add code paths in `ssl_transport_security` to utilize CRL providers * Add `StaticCrlProvider` * Refactor `crl_ssl_transport_security_test.cc` so it is more extensible and can be used with providers	1 year ago
Gregory Cooke	a4f345ff96	TlsCreds: Support revocation of intermediate in chain. (#32544 ) This PR is a small code change with a lot of new test data. [In OpenSSL, there are two flags that configure CRL checks. Coping relevant section:](https://www.openssl.org/docs/man1.0.2/man3/X509_VERIFY_PARAM_get_depth.html) > - X509_V_FLAG_CRL_CHECK enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found. > - X509_V_FLAG_CRL_CHECK_ALL enables CRL checking for the entire certificate chain. We currently only set `X509_V_FLAG_CRL_CHECK`, so we will only ever check if the leaf certificate is revoked. We should check the whole chain. I am open to making this a user configuration if we want to do it that way, but we certainly need to be able to check the whole chain. So, this PR contains the small code change in `ssl_transport_security.cc` to use the `X509_V_FLAG_CRL_CHECK_ALL` flag. Then the rest of the changes are in tests. I've added all the necessary files to have a chain built that looks as follows `Root CA -> Revoked Intermediate CA -> Leaf Certificate`, and added a test for this case as well. You can verify that on master this new test will fail (i.e. the handshake will succeed even though the intermediate CA is revoked) by checking out this branch, running `git checkout master -- ./src/core/tsi/ssl_transport_security.cc`, then running the test. I also slightly reorganized test/core/tsi/test_creds/ so that the CRLs are in their own directory, which is the way our API intends to accept CRLs.	2 years ago
AJ Heller	18a8f6aad9	Refactor end2end tests to exercise each EventEngine (#29202 ) * Refactor end2end tests to exercise each EventEngine * fix incorrect bazel_only exclusions * Automated change: Fix sanity tests * microbenchmark fix * sanitize, fix iOS flub * Automated change: Fix sanity tests * iOS fix * reviewer feedback * first pass at excluding EventEngine test expansion Also caught a few cases where we should not test pollers, but should test all engines. And two cases where we likely shouldn't be testing either product. * end2end fuzzers to be fuzzed differently via EventEngine. * sanitize * reviewer feedback * remove misleading comment * reviewer feedback: comments * EE test_init needs to play with our build system * fix golden file test runner Co-authored-by: drfloob <drfloob@users.noreply.github.com>	3 years ago
krestofur	1cdcd88fb1	Add experimental API for CRL checking support to gRPC C++ TlsCredentials (#28407 )	3 years ago
ZhenLian	2e14f6fa70	Support Custom Post-handshake Verification in TlsCredentials (#25631 ) * custom verification refactoring - post-handshake verification	3 years ago
Craig Tiller	ea389c00c2	Adjust include order per style guide (#27175 ) Introduce clang-format configuration to sort includes closer to our rules.	3 years ago
ZhenLian	d74e43da95	Add File Watcher Certificate Provider API	4 years ago
ZhenLian	518ed1303c	Add Credential Loading From Static Providers For TLS Credentials	4 years ago

12 Commits (00a35e24e516296158517f46eddbfa9cd5c49cc3)