Repository navigation
feat: add opt-in AIA certificate chain fetching (tlsAIAFetch) #6137
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,4 @@ | ||
| //go:build !linux | ||
|
|
||
| package common | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,197 @@ | ||
| package grpc | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "encoding/pem" | ||
| "net" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "strings" | ||
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/sirupsen/logrus" | ||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "go.k6.io/k6/v2/internal/lib/testutils/tlstest" | ||
| "go.k6.io/k6/v2/lib/netext" | ||
| ) | ||
|
|
||
| // AIA verification must honour per-connect cacerts, not the VU config's RootCAs. | ||
| func TestBuildTLSConfig_AIAWithCustomCACerts(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| chain := tlstest.NewChain(t) | ||
|
|
||
| aiaSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { | ||
| w.Header().Set("Content-Type", "application/pkix-cert") | ||
| _, _ = w.Write(chain.IntermediateDER) | ||
| })) | ||
| t.Cleanup(aiaSrv.Close) | ||
| chain.SetAIAURL(aiaSrv.URL) | ||
|
|
||
| tlsListener := newLeafOnlyTLSListener(t, chain) | ||
| t.Cleanup(func() { _ = tlsListener.Close() }) | ||
|
|
||
| // VU config has no RootCAs — the user relies on per-connect cacerts. | ||
| vuCfg := &tls.Config{MinVersion: tls.VersionTLS12} | ||
| wrappedVU := netext.NewAIAFetcher(nil).Wrap(vuCfg, nullLogger()) | ||
|
|
||
| rootPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: chain.RootDER}) | ||
| tlsCfg, err := buildTLSConfig(wrappedVU, nil, nil, [][]byte{rootPEM}, netext.NewAIAFetcher(nil), false, nullLogger()) | ||
| require.NoError(t, err) | ||
|
|
||
| tlsCfg.ServerName = "localhost" | ||
|
|
||
| ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
| defer cancel() | ||
| dialer := &tls.Dialer{Config: tlsCfg} | ||
| conn, err := dialer.DialContext(ctx, "tcp", tlsListener.Addr().String()) | ||
| require.NoError(t, err) | ||
| _ = conn.Close() | ||
| } | ||
|
|
||
| func TestBuildTLSConfig_InsecureSkipVerifyIsHonoured(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| chain := tlstest.NewChain(t) | ||
| chain.SetAIAURL("http://127.0.0.1:1") // never reached; skip short-circuits | ||
|
|
||
| tlsListener := newLeafOnlyTLSListener(t, chain) | ||
| t.Cleanup(func() { _ = tlsListener.Close() }) | ||
|
|
||
| // Unrelated CA — verification would fail if it ran. | ||
| otherChain := tlstest.NewChain(t) | ||
| otherRootPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: otherChain.RootDER}) | ||
|
|
||
| for _, aiaEnabled := range []bool{false, true} { | ||
| name := "aia_off" | ||
| if aiaEnabled { | ||
| name = "aia_on" | ||
| } | ||
| t.Run(name, func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| vuCfg := &tls.Config{ | ||
| MinVersion: tls.VersionTLS12, | ||
| InsecureSkipVerify: true, | ||
| } | ||
| parent := vuCfg | ||
| if aiaEnabled { | ||
| parent = netext.NewAIAFetcher(nil).Wrap(vuCfg, nullLogger()) | ||
| } | ||
|
|
||
| var aiaFetcher *netext.AIAFetcher | ||
| if aiaEnabled { | ||
| aiaFetcher = netext.NewAIAFetcher(nil) | ||
| } | ||
| tlsCfg, err := buildTLSConfig(parent, nil, nil, [][]byte{otherRootPEM}, aiaFetcher, true, nullLogger()) | ||
| require.NoError(t, err) | ||
| require.True(t, tlsCfg.InsecureSkipVerify, "user asked to skip verification; must be honoured") | ||
| tlsCfg.ServerName = "localhost" | ||
|
|
||
| ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
| defer cancel() | ||
| dialer := &tls.Dialer{Config: tlsCfg} | ||
| conn, err := dialer.DialContext(ctx, "tcp", tlsListener.Addr().String()) | ||
| require.NoError(t, err, "handshake must succeed with insecureSkipTLSVerify even against a mismatched CA") | ||
| _ = conn.Close() | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| // Guard against silent insecurity: with AIA enabled and mismatched cacerts, the dial | ||
| // must fail — even though the AIA wrapper flips InsecureSkipVerify internally. | ||
| func TestBuildTLSConfig_AIARejectsMismatchedCACert(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| chain := tlstest.NewChain(t) | ||
|
|
||
| aiaSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { | ||
| w.Header().Set("Content-Type", "application/pkix-cert") | ||
| _, _ = w.Write(chain.IntermediateDER) | ||
| })) | ||
| t.Cleanup(aiaSrv.Close) | ||
| chain.SetAIAURL(aiaSrv.URL) | ||
|
|
||
| tlsListener := newLeafOnlyTLSListener(t, chain) | ||
| t.Cleanup(func() { _ = tlsListener.Close() }) | ||
|
|
||
| // Unrelated root — the caller supplies this as cacerts; the server presents a chain | ||
| // rooted in a different CA, so verification must fail. | ||
| otherChain := tlstest.NewChain(t) | ||
| otherRootPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: otherChain.RootDER}) | ||
|
|
||
| vuCfg := &tls.Config{MinVersion: tls.VersionTLS12} | ||
| wrappedVU := netext.NewAIAFetcher(nil).Wrap(vuCfg, nullLogger()) | ||
|
|
||
| tlsCfg, err := buildTLSConfig(wrappedVU, nil, nil, [][]byte{otherRootPEM}, netext.NewAIAFetcher(nil), false, nullLogger()) | ||
| require.NoError(t, err) | ||
| tlsCfg.ServerName = "localhost" | ||
|
|
||
| ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
| defer cancel() | ||
| dialer := &tls.Dialer{Config: tlsCfg} | ||
| conn, err := dialer.DialContext(ctx, "tcp", tlsListener.Addr().String()) | ||
| if conn != nil { | ||
| _ = conn.Close() | ||
| } | ||
| require.Error(t, err, "AIA-enabled gRPC dial must fail when cacerts do not cover the server chain") | ||
| require.True(t, | ||
| strings.Contains(err.Error(), "unknown authority") || | ||
| strings.Contains(err.Error(), "signed by"), | ||
| "unexpected error: %v", err, | ||
| ) | ||
| } | ||
|
|
||
| // newLeafOnlyTLSListener starts a raw tls.Listener serving only the leaf certificate. | ||
| func newLeafOnlyTLSListener(t testing.TB, c *tlstest.Chain) net.Listener { | ||
| t.Helper() | ||
|
|
||
| leafCert, err := tls.X509KeyPair( | ||
| pemEncodeCert(c.LeafTLSCertificate(t).Certificate[0]), | ||
| pemEncodeKey(t, c), | ||
| ) | ||
| require.NoError(t, err) | ||
|
|
||
| listener, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{ | ||
| Certificates: []tls.Certificate{leafCert}, | ||
| MinVersion: tls.VersionTLS12, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| go func() { | ||
| for { | ||
| conn, acceptErr := listener.Accept() | ||
| if acceptErr != nil { | ||
| return | ||
| } | ||
| if tlsConn, ok := conn.(*tls.Conn); ok { | ||
| hctx, hcancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
| _ = tlsConn.HandshakeContext(hctx) | ||
| hcancel() | ||
| } | ||
| _ = conn.Close() | ||
| } | ||
| }() | ||
| return listener | ||
| } | ||
|
|
||
| func pemEncodeCert(der []byte) []byte { | ||
| return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}) | ||
| } | ||
|
|
||
| func pemEncodeKey(t testing.TB, c *tlstest.Chain) []byte { | ||
| t.Helper() | ||
| keyDER, err := x509.MarshalECPrivateKey(c.LeafKey) | ||
| require.NoError(t, err) | ||
| return pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}) | ||
| } | ||
|
|
||
| func nullLogger() logrus.FieldLogger { | ||
| l := logrus.New() | ||
| l.SetLevel(logrus.PanicLevel) | ||
| return l | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This here does create an AIA fetcher per grpc Connect. Given it likely won't be used with ti tall that much maybe we can have it just as a TODO / issue for the future/