Verify TLS certificate on endpoints that are used between agents only #11956
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lgfa29
commented
Jan 27, 2022
lgfa29
commented
Jan 27, 2022
lgfa29
commented
Jan 27, 2022
shoenig
reviewed
Jan 28, 2022
shoenig
reviewed
Jan 28, 2022
shoenig
approved these changes
Jan 28, 2022
schmichael
approved these changes
Jan 31, 2022
Ember Asset Size actionAs of dd59dc5 Files that stayed the same size 🤷:
|
Ember Test Audit comparison
|
schmichael
reviewed
Feb 1, 2022
…> server or client -> server communication
|
My merge to fix conflicts with |
lgfa29
force-pushed
the
f-verify-rpc-cert-origin
branch
from
dd59dc5
to
5d540a4
Compare
lgfa29
added a commit
that referenced
this pull request
Feb 3, 2022
PR #11956 implemented a new mTLS RPC check to validate the role of the certificate used in the request, but further testing revealed two flaws: 1. client-only endpoints did not accept server certificates so the request would fail when forwarded from one server to another. 2. the certificate was being checked after the request was forwarded, so the check would happen over the server certificate, not the actual source. This commit checks for the desired mTLS level, where the client level accepts both, a server or a client certificate. It also validates the cercertificate before the request is forwarded.
lgfa29
added a commit
that referenced
this pull request
Feb 5, 2022
PR #11956 implemented a new mTLS RPC check to validate the role of the certificate used in the request, but further testing revealed two flaws: 1. client-only endpoints did not accept server certificates so the request would fail when forwarded from one server to another. 2. the certificate was being checked after the request was forwarded, so the check would happen over the server certificate, not the actual source. This commit checks for the desired mTLS level, where the client level accepts both, a server or a client certificate. It also validates the cercertificate before the request is forwarded.
This was referenced Apr 19, 2022
lgfa29
added a commit
that referenced
this pull request
Apr 19, 2022
lgfa29
added a commit
that referenced
this pull request
Apr 19, 2022
lgfa29
added a commit
that referenced
this pull request
Apr 19, 2022
lgfa29
added a commit
that referenced
this pull request
Apr 19, 2022
lgfa29
added
backport/1.1.x
This was referenced Apr 19, 2022
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are different types of endpoints in Nomad, and different types use different mechanism to validate and authenticate requests.
The most common endpoints are called by end-users via the HTTP API and get translated to an RPC request. They are authenticated using ACL tokens.
Another type of endpoint is used by Raft and are called between servers. This process doesn't have ACL tokens involved, so requests are validated by checking the mTLS certificates, when available.
Finally, there are endpoints that are called by agents directly via RPC, either
client -> serverorserver -> server. These also don't use ACL tokens, so there was no explicit validation.This PRs adds a check to these agent to agent endpoints similar to Raft's, using the mTLS certificate, if available.