Commit Graph

30 Commits

Author SHA1 Message Date
Gregory Cooke 4879d51a59
advancedTLS: Swap to DenyUndetermined from AllowUndetermined in revocation settings (#7179)
* swap to `DenyUndetermined` from `AllowUndetermined`
2024-05-06 13:40:28 -04:00
Gregory Cooke befc29de93
advancedTLS: Rename {Min/Max}Version to {Min/Max}TLSVersion (#7173)
* rename `MinVersion` and `MaxVersion` to `MinTLSVersion` and `MaxTLSVersion`
2024-05-06 12:59:03 -04:00
Gregory Cooke b433b9467d
advancedtls: Rename RevocationConfig (#7151) 2024-04-30 11:00:35 -07:00
Gregory Cooke d75b5e2f5e
advancedtls: Rename custom verification function APIs (#7140)
* Rename custom verification function APIs
2024-04-23 14:20:28 -04:00
Gregory Cooke 5fe2e74bf4
advancedtls: Rename VType (#7149)
* renamed VType to VerificationType and add deprecation note
2024-04-19 14:02:42 -04:00
Gregory Cooke fc8da03081
advancedtls: unexport parts of API not meant to be public (#7118) 2024-04-17 08:32:56 -07:00
erm-g 408139acc3
security/advancedtls: CRL checks improvement (#6968) 2024-02-14 15:33:38 -08:00
Roland Bracewell Shoemaker 686fdd8da1
security/advancedtls: fix test that relies on min TLS version (#6824)
Bump the version in tls.ClientHelloInfo.SupportedVersions to
tls.VersionTLS12 (security/advancedtls/advancedtls_test.go)
2023-12-12 17:42:22 -05:00
erm-g b82468a346
crl provider: Static and FileWatcher provider implementations (#6670)
* rename certificateListExt to CRL

* CRLProvider file

* Add CRLProvider to RevocationConfig

* Beginning refactor of CRL handling

* Shell of StaticCRLProvider

* basic static crl provider test

* use loadCRL helper

* refactor of CRL loading

* Table tests

* Table tests

* Add tests with Static CRL provider

* New certs to be used for CRL tests. Added test for passing and failing connections based on CRL check outcomes

* Main functionality of File Watcher (Directory) CRL provider

* Refactor async go routine, validate() func, add unit tests

* Custom error callback, related unit tests

* Error callback test improvement

* Comments for StaticCRLProvider

* Comments for public API

* go mod tidy

* Comments for tests

* Fix vet errors

* Change Static provider behavior to match C Core, address other PR comments

* Data race fix

* Test helper fn change

* Address PR comments

* Address PR comments (part 2)

* Migration from context to channel for controlling crl reloading goroutine

* Align in-memory CRL updates during directory scan to C++ behavior

* Improve comments for ScanCRLDirectory

* Base test case for Scan CRL Directory file manipulations

* full set of cases for CRL directory content manipulation

* Add comment for table test structure

* Fix for go.mod and go.sum

* Empty directoru workaround

* Delete deprecated crl functionality

* Restoring deprecated crl files

* Fit to grpctest.Tester pattern

* Update readme for crl provider tests

* Address PR comments

* Revert "Restoring deprecated crl files"

This reverts commit 56437603a4.

* Revert "Resolve conflicts with upstream - deletion of deprecated crl"

This reverts commit e0130640c46efd9a43649bf409c6e762ae66e225, reversing
changes made to 21f430135c.

Revert deletion

* Update link for gRFC proposal

* Address PR comments

* Address PR comments part 1

* Address PR comments part 2

* Address PR comments part 3

* Fix for go.mod and go.sum

* Fix comment typo

* Fix for gRFC tag

* Add more details to CRL api  godoc comments.

* Address PR comments

* Address PR comments

* Delete crl_deprecated.go and crl_deprecated_test.go

* Delete testdate/crl/provider/filewatcher directory and .gitignore under it

* Race test fix

* Address PR comments

* Address PR comments

* Refactor directory reloader test from checking size of crl map to querying individual entries approach

* Add extra case for RefreshDuration config test

* Update cpmment for table test structure

* Unexport scan scanCRLDirectory, drop related mutex, update the comments

* Update API comments, clear tmp dir after the tests

---------

Co-authored-by: Gregory Cooke <gregorycooke@google.com>
2023-10-30 20:41:22 -04:00
Joel Jeske 81b30924fc
security/advancedtls: add TlsVersionOption to select desired min/max TLS versions (#6007)
Co-authored-by: ZhenLian <zhenlian.cs@gmail.com>
2023-04-10 12:27:04 -07:00
ZhenLian 710419d32b
advancedtls: add revocation support to client/server options (#4781) 2021-09-27 16:42:32 -07:00
Easwar Swaminathan 712e8d4f57
Remove support for Go 1.13 and older (cont) (#4706) 2021-08-25 14:51:41 -07:00
Doug Fawley 74fe6eaa41
github: testing action workflow improvements and update to test Go1.16 (#4358) 2021-04-22 14:59:51 -07:00
ZhenLian 666aea1fb3
advancedtls: add IPv6 address to certificate SAN names (#4101)
* advancedtls: add IPv6 address to certificate SAN names
2020-12-18 11:05:59 -08:00
ZhenLian 2efef8fd12
advancedtls: fix default host name check issue (#4069)
* advancedtls: fix default hostname check issue
2020-12-03 09:52:30 -08:00
ZhenLian 8238a33b57
advancedtls: make sni test check common name only (#4055)
* advancedtls: make sni test check common name only
2020-11-24 09:13:08 -08:00
Easwar Swaminathan 2af65e80c6
advancedtls: Make test happy on Go1.15 (#4053) 2020-11-19 11:57:06 -08:00
ZhenLian 3c400e7fcc
advancedtls: clean up test files and shared code (#3897)
* advancedtls: clean up test files and shared code
2020-10-10 13:47:49 -07:00
ZhenLian 0f7e218c2c
advancedtls: add fields for root and identity providers in API (#3863)
* add provider in advancedtls API for pem file reloading
2020-09-17 12:08:03 -07:00
cindyxue b830b5f361
advancedtls: fixed SNI testing and put SNI functions back in advancedtls.go (#3774)
* Fixed sni unit test
2020-08-06 11:10:47 -07:00
cindyxue b72d07f816
advancedtls: migrate testing to grpctest (#3773)
advancedtls: migrate tests to use grpctest
2020-07-30 13:48:30 -07:00
cindyxue dfc0c05b2d
advancedtls: Add SNI logic to ServerOptions.GetCertificate (#3697)
* Add SNI support in the user-provided GetCertificate callback
2020-07-27 23:50:43 -07:00
cindyxue 68098483a7
advancedtls: Add system default CAs to config function (#3663)
* Add system default CAs to config function
2020-06-27 16:05:33 -07:00
ZhenLian eedec2c1c3
advancedtls: add leaf cert in verify params (#3571) 2020-04-29 11:00:02 -07:00
ZhenLian d70354e6e2
advancedtls: add field names for unit tests (#3570)
* advancedtls: add field names for unit tests
2020-04-28 16:00:26 -07:00
ZhenLian f313ade84c
advancedtls: add fine-grained verification levels in XXXOptions (#3454) 2020-04-22 13:44:18 -07:00
ZhenLian f97821dd2f
advancedtls: add end to end tests (#3318) 2020-01-28 14:24:27 -08:00
ZhenLian d670c2dcc8 advancedtls: fix internal tests (#3322)
fix an internal error in advanced_tls.test. Previous check is to check against the prefix of the ServerName, which might be different in various environments. We'd better not rely on checking that.
2020-01-15 14:03:38 -08:00
Menghan Li 20bce9a0c6
advancedtls: add package for testdata (#3306) 2020-01-10 14:33:38 -08:00
ZhenLian 4a4d179f28 advancedtls: add new module for advanced TLS handshaker (#3187) 2020-01-07 15:47:01 -08:00