Skip to content

Commit

Permalink
xds: support new fields to fetch security configuration (#4747)
Browse files Browse the repository at this point in the history
  • Loading branch information
@easwars
easwars committed Sep 10, 2021
1 parent 2608e38 commit 0a99ae2
Show file tree
Hide file tree
Showing 5 changed files with 579 additions and 20 deletions.
200 changes: 197 additions & 3 deletions xds/internal/xdsclient/cds_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -727,7 +727,44 @@ func (s) TestValidateClusterWithSecurityConfig(t *testing.T) {
wantErr: true,
},
{
name: "happy-case-with-no-identity-certs",
name: "invalid-regex-in-matching-SAN-with-new-fields",
cluster: &v3clusterpb.Cluster{
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
EdsClusterConfig: &v3clusterpb.Cluster_EdsClusterConfig{
EdsConfig: &v3corepb.ConfigSource{
ConfigSourceSpecifier: &v3corepb.ConfigSource_Ads{
Ads: &v3corepb.AggregatedConfigSource{},
},
},
ServiceName: serviceName,
},
LbPolicy: v3clusterpb.Cluster_ROUND_ROBIN,
TransportSocket: &v3corepb.TransportSocket{
ConfigType: &v3corepb.TransportSocket_TypedConfig{
TypedConfig: testutils.MarshalAny(&v3tlspb.UpstreamTlsContext{
CommonTlsContext: &v3tlspb.CommonTlsContext{
ValidationContextType: &v3tlspb.CommonTlsContext_CombinedValidationContext{
CombinedValidationContext: &v3tlspb.CommonTlsContext_CombinedCertificateValidationContext{
DefaultValidationContext: &v3tlspb.CertificateValidationContext{
MatchSubjectAltNames: []*v3matcherpb.StringMatcher{
{MatchPattern: &v3matcherpb.StringMatcher_SafeRegex{SafeRegex: &v3matcherpb.RegexMatcher{Regex: sanRegexBad}}},
},
CaCertificateProviderInstance: &v3tlspb.CertificateProviderPluginInstance{
InstanceName: rootPluginInstance,
CertificateName: rootCertName,
},
},
},
},
},
}),
},
},
},
wantErr: true,
},
{
name: "happy-case-with-no-identity-certs-using-deprecated-fields",
cluster: &v3clusterpb.Cluster{
Name: clusterName,
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
Expand Down Expand Up @@ -767,7 +804,49 @@ func (s) TestValidateClusterWithSecurityConfig(t *testing.T) {
},
},
{
name: "happy-case-with-validation-context-provider-instance",
name: "happy-case-with-no-identity-certs-using-new-fields",
cluster: &v3clusterpb.Cluster{
Name: clusterName,
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
EdsClusterConfig: &v3clusterpb.Cluster_EdsClusterConfig{
EdsConfig: &v3corepb.ConfigSource{
ConfigSourceSpecifier: &v3corepb.ConfigSource_Ads{
Ads: &v3corepb.AggregatedConfigSource{},
},
},
ServiceName: serviceName,
},
LbPolicy: v3clusterpb.Cluster_ROUND_ROBIN,
TransportSocket: &v3corepb.TransportSocket{
Name: "envoy.transport_sockets.tls",
ConfigType: &v3corepb.TransportSocket_TypedConfig{
TypedConfig: testutils.MarshalAny(&v3tlspb.UpstreamTlsContext{
CommonTlsContext: &v3tlspb.CommonTlsContext{
ValidationContextType: &v3tlspb.CommonTlsContext_ValidationContext{
ValidationContext: &v3tlspb.CertificateValidationContext{
CaCertificateProviderInstance: &v3tlspb.CertificateProviderPluginInstance{
InstanceName: rootPluginInstance,
CertificateName: rootCertName,
},
},
},
},
}),
},
},
},
wantUpdate: ClusterUpdate{
ClusterName: clusterName,
EDSServiceName: serviceName,
EnableLRS: false,
SecurityCfg: &SecurityConfig{
RootInstanceName: rootPluginInstance,
RootCertName: rootCertName,
},
},
},
{
name: "happy-case-with-validation-context-provider-instance-using-deprecated-fields",
cluster: &v3clusterpb.Cluster{
Name: clusterName,
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
Expand Down Expand Up @@ -813,7 +892,55 @@ func (s) TestValidateClusterWithSecurityConfig(t *testing.T) {
},
},
{
name: "happy-case-with-combined-validation-context",
name: "happy-case-with-validation-context-provider-instance-using-new-fields",
cluster: &v3clusterpb.Cluster{
Name: clusterName,
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
EdsClusterConfig: &v3clusterpb.Cluster_EdsClusterConfig{
EdsConfig: &v3corepb.ConfigSource{
ConfigSourceSpecifier: &v3corepb.ConfigSource_Ads{
Ads: &v3corepb.AggregatedConfigSource{},
},
},
ServiceName: serviceName,
},
LbPolicy: v3clusterpb.Cluster_ROUND_ROBIN,
TransportSocket: &v3corepb.TransportSocket{
Name: "envoy.transport_sockets.tls",
ConfigType: &v3corepb.TransportSocket_TypedConfig{
TypedConfig: testutils.MarshalAny(&v3tlspb.UpstreamTlsContext{
CommonTlsContext: &v3tlspb.CommonTlsContext{
TlsCertificateProviderInstance: &v3tlspb.CertificateProviderPluginInstance{
InstanceName: identityPluginInstance,
CertificateName: identityCertName,
},
ValidationContextType: &v3tlspb.CommonTlsContext_ValidationContext{
ValidationContext: &v3tlspb.CertificateValidationContext{
CaCertificateProviderInstance: &v3tlspb.CertificateProviderPluginInstance{
InstanceName: rootPluginInstance,
CertificateName: rootCertName,
},
},
},
},
}),
},
},
},
wantUpdate: ClusterUpdate{
ClusterName: clusterName,
EDSServiceName: serviceName,
EnableLRS: false,
SecurityCfg: &SecurityConfig{
RootInstanceName: rootPluginInstance,
RootCertName: rootCertName,
IdentityInstanceName: identityPluginInstance,
IdentityCertName: identityCertName,
},
},
},
{
name: "happy-case-with-combined-validation-context-using-deprecated-fields",
cluster: &v3clusterpb.Cluster{
Name: clusterName,
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
Expand Down Expand Up @@ -879,6 +1006,73 @@ func (s) TestValidateClusterWithSecurityConfig(t *testing.T) {
},
},
},
{
name: "happy-case-with-combined-validation-context-using-new-fields",
cluster: &v3clusterpb.Cluster{
Name: clusterName,
ClusterDiscoveryType: &v3clusterpb.Cluster_Type{Type: v3clusterpb.Cluster_EDS},
EdsClusterConfig: &v3clusterpb.Cluster_EdsClusterConfig{
EdsConfig: &v3corepb.ConfigSource{
ConfigSourceSpecifier: &v3corepb.ConfigSource_Ads{
Ads: &v3corepb.AggregatedConfigSource{},
},
},
ServiceName: serviceName,
},
LbPolicy: v3clusterpb.Cluster_ROUND_ROBIN,
TransportSocket: &v3corepb.TransportSocket{
Name: "envoy.transport_sockets.tls",
ConfigType: &v3corepb.TransportSocket_TypedConfig{
TypedConfig: testutils.MarshalAny(&v3tlspb.UpstreamTlsContext{
CommonTlsContext: &v3tlspb.CommonTlsContext{
TlsCertificateProviderInstance: &v3tlspb.CertificateProviderPluginInstance{
InstanceName: identityPluginInstance,
CertificateName: identityCertName,
},
ValidationContextType: &v3tlspb.CommonTlsContext_CombinedValidationContext{
CombinedValidationContext: &v3tlspb.CommonTlsContext_CombinedCertificateValidationContext{
DefaultValidationContext: &v3tlspb.CertificateValidationContext{
MatchSubjectAltNames: []*v3matcherpb.StringMatcher{
{
MatchPattern: &v3matcherpb.StringMatcher_Exact{Exact: sanExact},
IgnoreCase: true,
},
{MatchPattern: &v3matcherpb.StringMatcher_Prefix{Prefix: sanPrefix}},
{MatchPattern: &v3matcherpb.StringMatcher_Suffix{Suffix: sanSuffix}},
{MatchPattern: &v3matcherpb.StringMatcher_SafeRegex{SafeRegex: &v3matcherpb.RegexMatcher{Regex: sanRegexGood}}},
{MatchPattern: &v3matcherpb.StringMatcher_Contains{Contains: sanContains}},
},
CaCertificateProviderInstance: &v3tlspb.CertificateProviderPluginInstance{
InstanceName: rootPluginInstance,
CertificateName: rootCertName,
},
},
},
},
},
}),
},
},
},
wantUpdate: ClusterUpdate{
ClusterName: clusterName,
EDSServiceName: serviceName,
EnableLRS: false,
SecurityCfg: &SecurityConfig{
RootInstanceName: rootPluginInstance,
RootCertName: rootCertName,
IdentityInstanceName: identityPluginInstance,
IdentityCertName: identityCertName,
SubjectAltNameMatchers: []matcher.StringMatcher{
matcher.StringMatcherForTesting(newStringP(sanExact), nil, nil, nil, nil, true),
matcher.StringMatcherForTesting(nil, newStringP(sanPrefix), nil, nil, nil, false),
matcher.StringMatcherForTesting(nil, nil, newStringP(sanSuffix), nil, nil, false),
matcher.StringMatcherForTesting(nil, nil, nil, nil, sanRE, false),
matcher.StringMatcherForTesting(nil, nil, nil, newStringP(sanContains), nil, false),
},
},
},
},
}

for _, test := range tests {
Expand Down
32 changes: 32 additions & 0 deletions xds/internal/xdsclient/client.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,38 @@ type SecurityConfig struct {
RequireClientCert bool
}

// Equal returns true if sc is equal to other.
func (sc *SecurityConfig) Equal(other *SecurityConfig) bool {
switch {
case sc == nil && other == nil:
return true
case (sc != nil) != (other != nil):
return false
}
switch {
case sc.RootInstanceName != other.RootInstanceName:
return false
case sc.RootCertName != other.RootCertName:
return false
case sc.IdentityInstanceName != other.IdentityInstanceName:
return false
case sc.IdentityCertName != other.IdentityCertName:
return false
case sc.RequireClientCert != other.RequireClientCert:
return false
default:
if len(sc.SubjectAltNameMatchers) != len(other.SubjectAltNameMatchers) {
return false
}
for i := 0; i < len(sc.SubjectAltNameMatchers); i++ {
if !sc.SubjectAltNameMatchers[i].Equal(other.SubjectAltNameMatchers[i]) {
return false
}
}
}
return true
}

// ClusterType is the type of cluster from a received CDS response.
type ClusterType int

Expand Down
8 changes: 5 additions & 3 deletions xds/internal/xdsclient/filter_chain.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -522,12 +522,14 @@ func (fci *FilterChainManager) filterChainFromProto(fc *v3listenerpb.FilterChain
if downstreamCtx.GetCommonTlsContext() == nil {
return nil, errors.New("DownstreamTlsContext in LDS response does not contain a CommonTlsContext")
}
sc, err := securityConfigFromCommonTLSContext(downstreamCtx.GetCommonTlsContext())
sc, err := securityConfigFromCommonTLSContext(downstreamCtx.GetCommonTlsContext(), true)
if err != nil {
return nil, err
}
if sc.IdentityInstanceName == "" {
return nil, errors.New("security configuration on the server-side does not contain identity certificate provider instance name")
if sc == nil {
// sc == nil is a valid case where the control plane has not sent us any
// security configuration. xDS creds will use fallback creds.
return filterChain, nil
}
sc.RequireClientCert = downstreamCtx.GetRequireClientCertificate().GetValue()
if sc.RequireClientCert && sc.RootInstanceName == "" {
Expand Down

0 comments on commit 0a99ae2

Please sign in to comment.