grpc/client at 8f012ae13bb680a6bf15cfd91973f60cffe51903 - grpc

The C based gRPC (C++, Python, Ruby, Objective-C, PHP, C#) https://grpc.io/

Tag: Branch: Tree: 8f012ae13b

Gregory Cooke a4f345ff96 TlsCreds: Support revocation of intermediate in chain. (#32544 ) This PR is a small code change with a lot of new test data. [In OpenSSL, there are two flags that configure CRL checks. Coping relevant section:](https://www.openssl.org/docs/man1.0.2/man3/X509_VERIFY_PARAM_get_depth.html) > - X509_V_FLAG_CRL_CHECK enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found. > - X509_V_FLAG_CRL_CHECK_ALL enables CRL checking for the entire certificate chain. We currently only set `X509_V_FLAG_CRL_CHECK`, so we will only ever check if the leaf certificate is revoked. We should check the whole chain. I am open to making this a user configuration if we want to do it that way, but we certainly need to be able to check the whole chain. So, this PR contains the small code change in `ssl_transport_security.cc` to use the `X509_V_FLAG_CRL_CHECK_ALL` flag. Then the rest of the changes are in tests. I've added all the necessary files to have a chain built that looks as follows `Root CA -> Revoked Intermediate CA -> Leaf Certificate`, and added a test for this case as well. You can verify that on master this new test will fail (i.e. the handshake will succeed even though the intermediate CA is revoked) by checking out this branch, running `git checkout master -- ./src/core/tsi/ssl_transport_security.cc`, then running the test. I also slightly reorganized test/core/tsi/test_creds/ so that the CRLs are in their own directory, which is the way our API intends to accept CRLs.		2 years ago
..
BUILD	Clean up the TODO item in build target `grpc_base` part `channel_args` (#31642 )	2 years ago
client_channel_stress_test.cc	[cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757 )	2 years ago
credentials_test.cc	TlsCreds: Support revocation of intermediate in chain. (#32544 )	2 years ago
destroy_grpclb_channel_with_active_connect_stress_test.cc	[cleanup] Eliminate usage of GRPC_ASSERT(false...); (#31757 )	2 years ago