Chiebot-Mirror/grpc - grpc - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Gregory Cooke	a4f345ff96	TlsCreds: Support revocation of intermediate in chain. (#32544 ) This PR is a small code change with a lot of new test data. [In OpenSSL, there are two flags that configure CRL checks. Coping relevant section:](https://www.openssl.org/docs/man1.0.2/man3/X509_VERIFY_PARAM_get_depth.html) > - X509_V_FLAG_CRL_CHECK enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found. > - X509_V_FLAG_CRL_CHECK_ALL enables CRL checking for the entire certificate chain. We currently only set `X509_V_FLAG_CRL_CHECK`, so we will only ever check if the leaf certificate is revoked. We should check the whole chain. I am open to making this a user configuration if we want to do it that way, but we certainly need to be able to check the whole chain. So, this PR contains the small code change in `ssl_transport_security.cc` to use the `X509_V_FLAG_CRL_CHECK_ALL` flag. Then the rest of the changes are in tests. I've added all the necessary files to have a chain built that looks as follows `Root CA -> Revoked Intermediate CA -> Leaf Certificate`, and added a test for this case as well. You can verify that on master this new test will fail (i.e. the handshake will succeed even though the intermediate CA is revoked) by checking out this branch, running `git checkout master -- ./src/core/tsi/ssl_transport_security.cc`, then running the test. I also slightly reorganized test/core/tsi/test_creds/ so that the CRLs are in their own directory, which is the way our API intends to accept CRLs.	2 years ago
krestofur	b8d3a09092	Update CRL test credentials (#28794 ) * remove old files * update credentials * fix README	3 years ago
krestofur	7759632a2d	Add CRL checking to gRPC Core (#28418 )	3 years ago
Vignesh Babu	24778bf8ea	Revert "Enable CRL checking in gRPC core (#26287 )" (#28416 ) This reverts commit `7d8c9ae890`.	3 years ago
krestofur	7d8c9ae890	Enable CRL checking in gRPC core (#26287 ) * enable crl checking in gRPC C core	3 years ago
krestofur	7e5f257925	Update test creds to have 10 year expiry (#28291 )	3 years ago
Mark D. Roth	1ff1feaa83	Revert "update (#28275 )" (#28288 ) This reverts commit `55b12e2679`.	3 years ago
krestofur	55b12e2679	update (#28275 ) - Update test creds to have 10 year expiry	3 years ago
krestofur	8610a34016	Add CRL Enabled Credentials to test folder (#27678 )	3 years ago
Vignesh Babu	34e4bd93e1	Revert "Add CRL Enabled Credentials to test folder (#27436 )" (#27535 ) This reverts commit `e611d0c489`.	3 years ago
krestofur	e611d0c489	Add CRL Enabled Credentials to test folder (#27436 )	3 years ago

11 Commits (e4b63015ea09636cb1a435596ac5b2e13530a419)