Chiebot-Mirror/grpc - grpc - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Gregory Cooke	a4f345ff96	TlsCreds: Support revocation of intermediate in chain. (#32544 ) This PR is a small code change with a lot of new test data. [In OpenSSL, there are two flags that configure CRL checks. Coping relevant section:](https://www.openssl.org/docs/man1.0.2/man3/X509_VERIFY_PARAM_get_depth.html) > - X509_V_FLAG_CRL_CHECK enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found. > - X509_V_FLAG_CRL_CHECK_ALL enables CRL checking for the entire certificate chain. We currently only set `X509_V_FLAG_CRL_CHECK`, so we will only ever check if the leaf certificate is revoked. We should check the whole chain. I am open to making this a user configuration if we want to do it that way, but we certainly need to be able to check the whole chain. So, this PR contains the small code change in `ssl_transport_security.cc` to use the `X509_V_FLAG_CRL_CHECK_ALL` flag. Then the rest of the changes are in tests. I've added all the necessary files to have a chain built that looks as follows `Root CA -> Revoked Intermediate CA -> Leaf Certificate`, and added a test for this case as well. You can verify that on master this new test will fail (i.e. the handshake will succeed even though the intermediate CA is revoked) by checking out this branch, running `git checkout master -- ./src/core/tsi/ssl_transport_security.cc`, then running the test. I also slightly reorganized test/core/tsi/test_creds/ so that the CRLs are in their own directory, which is the way our API intends to accept CRLs.	2 years ago
Gregory Cooke	1d8fac36b3	Add info about ca cert used to verify chain. (#32215 ) * Add info about ca cert used to verify chain. The tsi_peer object will now contain the subject of the root/ca cert that was used to verify the peer's chain during a handshake. * temp investigation * Fix issues relating to overlapping CRL callback * formatting on ssl_transport_security.cc * Swap ca_cert naming * Use preverify_ok instead of numbers * Continue some renaming, addressing pr comments * Removed early return if peer property setting fails * Continue renaming * clang-tidy * Fix clang problem * clang fixes * Add null check in tests * More PR changes. Behavior change to include root cert extract when TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY * Add intermediate ca, leaf cert, and test with them * clang-tidy * Basic formatting * Add new keys to build for export * Add new cert files to test BUILD * build file style fix * changes for chain test * clang-format * build clean * Add $ to lines of code in README * Add directive about X509_STORE_CTX_get0_chain * formatting	2 years ago
Zhan Jiang	ec6d6025e5	security: Refactor some utility functions in TSI for better internal use (#31736 ) security: Refactor some utility functions in TSI for better internal use	2 years ago
Yijie Ma	b6f2af4682	Revert "security: Refactor some utility functions in TSI for better internal use (#29728 )" (#31687 ) This reverts commit `8984a264b8`.	2 years ago
Zhan Jiang	8984a264b8	security: Refactor some utility functions in TSI for better internal use (#29728 )	2 years ago
Esun Kim	70a311b736	gtestify test/core/tsi (#30211 ) * Fix * test/core/tsi/alts/frame_protector * Fix * Fix	2 years ago
yihuaz	b458db9246	Eliminate gRPC insecure build (#25586 ) * force submit * fix test error * remove is_client from local tsi and its callsites * fix too_many_pings_test * add missing dep	3 years ago
krestofur	7759632a2d	Add CRL checking to gRPC Core (#28418 )	3 years ago
Vignesh Babu	24778bf8ea	Revert "Enable CRL checking in gRPC core (#26287 )" (#28416 ) This reverts commit `7d8c9ae890`.	3 years ago
krestofur	7d8c9ae890	Enable CRL checking in gRPC core (#26287 ) * enable crl checking in gRPC C core	3 years ago
Richard Belleville	468768865b	Make Buildifier Sanity Test Strict (#27807 ) * Fix all lint errors in repo. * Use strict buildifier by default * Whoops. That file does not exist * Attempt fix to buildifier invocation * Add missing copyright	3 years ago
Craig Tiller	d1e01ac139	Add a test for a (now-illegal) build file construct (#27602 ) * Add a test for a (now-illegal) build file construct * add to test suite! * fix * fix * fix syntax	3 years ago
Lidi Zheng	c34bef4ca4	Format all Bazel files with buildifier	5 years ago
Jan Tattermusch	3ce50ae754	disable some test on windows based on build.yaml	5 years ago
Yihua Zhang	c414fe06f8	add cred data to BUILD files	5 years ago
yang-g	67742ef63f	Fix BUILD files. Manually edit bzl files	6 years ago
Ruslan Nigmatullin	7ae3733cab	[grpc] Add SSL session client cache support	7 years ago
Yihua Zhang	04fb58efbd	Add ALTS code to grpc/core	7 years ago
Sree Kuchibhotla	ae277dd000	Revert "Add ALTS C stack to gRPC core"	7 years ago
Yihua Zhang	eaf6486677	Add ALTS code to grpc/core	7 years ago
Yash Tibrewal	77532036b6	BUILD changes. test languauge to C++	7 years ago
Yash Tibrewal	e586324627	BUILD files changes for bazel	7 years ago
Nicolas "Pixel" Noble	2bc5e3ac40	Moving visibility and package creation to the build system.	7 years ago
Yihua Zhang	7fab9bf3bb	Add TSI test library and SSL and fake TSI tests	7 years ago
Jan Tattermusch	4d5c3102a1	fix remaining license notices	8 years ago
Jan Tattermusch	7897ae9308	auto-fix most of licenses	8 years ago
Nicolas "Pixel" Noble	af6c83f9e1	Adding dummy layering check option.	8 years ago
Nicolas "Pixel" Noble	15cd5ce2ed	Rewriting core tests BUILD files to use the build system.	8 years ago
Nicolas "Pixel" Noble	7c26eed838	Buildifier and wrapping test/cpp/* rules with our build system.	8 years ago
Craig Tiller	911a5dc5b1	Add test/core/tsi/BUILD	8 years ago
yang-g	43dc9ed3b7	Add licenses to all BUILD files and missing copyright	8 years ago
Craig Tiller	674c66cd37	Bad ssl tests converted	8 years ago
Masood Malekghassemi	1ff429da2a	Organize Python tests to use grpcio-tools directly Moves all tests into a separate package. This does not change existing supported means of running tests (e.g. through run_tests.py).	9 years ago
Jan Tattermusch	072ebaa153	make python test suites run in parallel	9 years ago
Masood Malekghassemi	fe8dc883d0	Reorganize Python packages This is in preparation of moving all tests into a separate package to enable ease of coverage checking and testing.	10 years ago
Craig Tiller	94640a3df9	Rework python, expand tool to make this easier	10 years ago
Nathaniel Manista	1d1f952731	The Python interoperability testing server.	10 years ago
Nathaniel Manista	b8b0adfbf9	Refactoring of the Python build. The source code is moved from src/python to src/python/src. A setup.py is added at src/python. The build_python.sh and run_python.sh scripts are updated to build and run the Python tests by building a package and installing it in the developer's Python 2.7 virtual environment.	10 years ago
Nathaniel Manista	59d095a7df	The logging_pool module.	10 years ago

32 Commits (35754ac603693e20f84967652abe102132491734)