Skip to content

Commit 8e06dc7

Browse files
hkdsunhkdsun
committed
Add support for certification revocation list files
Signed-off-by: Hormoz Kheradmand <[email protected]>
1 parent 6b31715 commit 8e06dc7

File tree

28 files changed

+538
-65
lines changed

28 files changed

+538
-65
lines changed

‎data/test/mysql_ldap_auth_config.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"LdapCert": "path/to/ldap-client-cert.pem",
44
"LdapKey": "path/to/ldap-client-key.pem",
55
"LdapCA": "path/to/ldap-client-ca.pem",
6+
"LdapCRL": "path/to/ldap-client-crl.pem",
67
"User": "uid=vitessROuser,ou=users,ou=people,dc=example,dc=com",
78
"Password": "sUpErSeCuRe1",
89
"GroupQuery": "ou=groups,ou=people,dc=example,dc=com",

‎go/cmd/vttlstest/vttlstest.go

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,9 @@ var cmdMap map[string]cmdFunc
4848
func init() {
4949
cmdMap = map[string]cmdFunc{
5050
"CreateCA": cmdCreateCA,
51+
"CreateCRL": cmdCreateCRL,
5152
"CreateSignedCert": cmdCreateSignedCert,
53+
"RevokeCert": cmdRevokeCert,
5254
}
5355
}
5456

@@ -65,6 +67,28 @@ func cmdCreateCA(subFlags *flag.FlagSet, args []string) {
6567
tlstest.CreateCA(*root)
6668
}
6769

70+
func cmdCreateCRL(subFlags *flag.FlagSet, args []string) {
71+
subFlags.Parse(args)
72+
if subFlags.NArg() != 1 {
73+
log.Fatalf("CreateCRL command takes a single CA name as a parameter")
74+
}
75+
76+
ca := subFlags.Arg(0)
77+
tlstest.CreateCRL(*root, ca)
78+
}
79+
80+
func cmdRevokeCert(subFlags *flag.FlagSet, args []string) {
81+
parent := subFlags.String("parent", "ca", "Parent cert name to use. Use 'ca' for the toplevel CA.")
82+
83+
subFlags.Parse(args)
84+
if subFlags.NArg() != 1 {
85+
log.Fatalf("RevokeCert command takes a single name as a parameter")
86+
}
87+
88+
name := subFlags.Arg(0)
89+
tlstest.RevokeCertAndRegenerateCRL(*root, *parent, name)
90+
}
91+
6892
func cmdCreateSignedCert(subFlags *flag.FlagSet, args []string) {
6993
parent := subFlags.String("parent", "ca", "Parent cert name to use. Use 'ca' for the toplevel CA.")
7094
serial := subFlags.String("serial", "01", "Serial number for the certificate to create. Should be different for two certificates with the same parent.")
@@ -74,11 +98,13 @@ func cmdCreateSignedCert(subFlags *flag.FlagSet, args []string) {
7498
if subFlags.NArg() != 1 {
7599
log.Fatalf("CreateSignedCert command takes a single name as a parameter")
76100
}
101+
102+
name := subFlags.Arg(0)
77103
if *commonName == "" {
78-
*commonName = subFlags.Arg(0)
104+
*commonName = name
79105
}
80106

81-
tlstest.CreateSignedCert(*root, *parent, *serial, subFlags.Arg(0), *commonName)
107+
tlstest.CreateSignedCert(*root, *parent, *serial, name, *commonName)
82108
}
83109

84110
func main() {

‎go/mysql/auth_server_clientcert_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,14 @@ func TestValidCert(t *testing.T) {
5454
tlstest.CreateCA(root)
5555
tlstest.CreateSignedCert(root, tlstest.CA, "01", "server", "server.example.com")
5656
tlstest.CreateSignedCert(root, tlstest.CA, "02", "client", clientCertUsername)
57+
tlstest.CreateCRL(root, tlstest.CA)
5758

5859
// Create the server with TLS config.
5960
serverConfig, err := vttls.ServerConfig(
6061
path.Join(root, "server-cert.pem"),
6162
path.Join(root, "server-key.pem"),
6263
path.Join(root, "ca-cert.pem"),
64+
path.Join(root, "ca-crl.pem"),
6365
"",
6466
tls.VersionTLS12)
6567
if err != nil {
@@ -136,12 +138,14 @@ func TestNoCert(t *testing.T) {
136138
defer os.RemoveAll(root)
137139
tlstest.CreateCA(root)
138140
tlstest.CreateSignedCert(root, tlstest.CA, "01", "server", "server.example.com")
141+
tlstest.CreateCRL(root, tlstest.CA)
139142

140143
// Create the server with TLS config.
141144
serverConfig, err := vttls.ServerConfig(
142145
path.Join(root, "server-cert.pem"),
143146
path.Join(root, "server-key.pem"),
144147
path.Join(root, "ca-cert.pem"),
148+
path.Join(root, "ca-crl.pem"),
145149
"",
146150
tls.VersionTLS12)
147151
if err != nil {

‎go/mysql/client.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ func (c *Conn) clientHandshake(characterSet uint8, params *ConnParams) error {
282282
}
283283

284284
// Build the TLS config.
285-
clientConfig, err := vttls.ClientConfig(params.EffectiveSslMode(), params.SslCert, params.SslKey, params.SslCa, serverName, tlsVersion)
285+
clientConfig, err := vttls.ClientConfig(params.EffectiveSslMode(), params.SslCert, params.SslKey, params.SslCa, params.SslCrl, serverName, tlsVersion)
286286
if err != nil {
287287
return NewSQLError(CRSSLConnectionError, SSUnknownSQLState, "error loading client cert and ca: %v", err)
288288
}

‎go/mysql/client_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ func TestTLSClientDisabled(t *testing.T) {
187187
path.Join(root, "server-key.pem"),
188188
"",
189189
"",
190+
"",
190191
tls.VersionTLS12)
191192
require.NoError(t, err)
192193
l.TLSConfig.Store(serverConfig)
@@ -260,6 +261,7 @@ func TestTLSClientPreferredDefault(t *testing.T) {
260261
path.Join(root, "server-key.pem"),
261262
"",
262263
"",
264+
"",
263265
tls.VersionTLS12)
264266
require.NoError(t, err)
265267
l.TLSConfig.Store(serverConfig)
@@ -381,6 +383,7 @@ func TestTLSClientVerifyCA(t *testing.T) {
381383
path.Join(root, "server-key.pem"),
382384
"",
383385
"",
386+
"",
384387
tls.VersionTLS12)
385388
require.NoError(t, err)
386389
l.TLSConfig.Store(serverConfig)
@@ -465,6 +468,7 @@ func TestTLSClientVerifyIdentity(t *testing.T) {
465468
path.Join(root, "server-key.pem"),
466469
"",
467470
"",
471+
"",
468472
tls.VersionTLS12)
469473
require.NoError(t, err)
470474
l.TLSConfig.Store(serverConfig)
@@ -511,4 +515,12 @@ func TestTLSClientVerifyIdentity(t *testing.T) {
511515
if conn != nil {
512516
conn.Close()
513517
}
518+
519+
// Now revoke the server certificate and make sure we can't connect
520+
tlstest.RevokeCertAndRegenerateCRL(root, tlstest.CA, "server")
521+
522+
params.SslCrl = path.Join(root, "ca-crl.pem")
523+
_, err = Connect(context.Background(), params)
524+
require.Error(t, err)
525+
require.Contains(t, err.Error(), "Certificate revoked: CommonName=server.example.com")
514526
}

‎go/mysql/conn_params.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ type ConnParams struct {
3939
SslCa string `json:"ssl_ca"`
4040
SslCaPath string `json:"ssl_ca_path"`
4141
SslCert string `json:"ssl_cert"`
42+
SslCrl string `json:"ssl_crl"`
4243
SslKey string `json:"ssl_key"`
4344
TLSMinVersion string `json:"tls_min_version"`
4445
ServerName string `json:"server_name"`

‎go/mysql/handshake_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ func TestSSLConnection(t *testing.T) {
126126
path.Join(root, "server-key.pem"),
127127
path.Join(root, "ca-cert.pem"),
128128
"",
129+
"",
129130
tls.VersionTLS12)
130131
if err != nil {
131132
t.Fatalf("TLSServerConfig failed: %v", err)

‎go/mysql/ldapauthserver/auth_server_ldap.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,7 @@ type ServerConfig struct {
215215
LdapCert string
216216
LdapKey string
217217
LdapCA string
218+
LdapCRL string
218219
LdapTLSMinVersion string
219220
}
220221

@@ -250,7 +251,7 @@ func (lci *ClientImpl) Connect(network string, config *ServerConfig) error {
250251
return err
251252
}
252253

253-
tlsConfig, err := vttls.ClientConfig(vttls.VerifyIdentity, config.LdapCert, config.LdapKey, config.LdapCA, serverName, tlsVersion)
254+
tlsConfig, err := vttls.ClientConfig(vttls.VerifyIdentity, config.LdapCert, config.LdapKey, config.LdapCA, config.LdapCRL, serverName, tlsVersion)
254255
if err != nil {
255256
return err
256257
}

‎go/mysql/mysql_fuzzer.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,7 @@ func FuzzTLSServer(data []byte) int {
357357
path.Join(root, "server-key.pem"),
358358
path.Join(root, "ca-cert.pem"),
359359
"",
360+
"",
360361
tls.VersionTLS12)
361362
if err != nil {
362363
return -1

‎go/mysql/server_test.go

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -833,6 +833,7 @@ func TestTLSServer(t *testing.T) {
833833
path.Join(root, "server-key.pem"),
834834
path.Join(root, "ca-cert.pem"),
835835
"",
836+
"",
836837
tls.VersionTLS12)
837838
require.NoError(t, err)
838839
l.TLSConfig.Store(serverConfig)
@@ -924,12 +925,16 @@ func TestTLSRequired(t *testing.T) {
924925
defer os.RemoveAll(root)
925926
tlstest.CreateCA(root)
926927
tlstest.CreateSignedCert(root, tlstest.CA, "01", "server", "server.example.com")
928+
tlstest.CreateSignedCert(root, tlstest.CA, "02", "client", "Client Cert")
929+
tlstest.CreateSignedCert(root, tlstest.CA, "03", "revoked-client", "Revoked Client Cert")
930+
tlstest.RevokeCertAndRegenerateCRL(root, tlstest.CA, "revoked-client")
927931

928932
// Create the server with TLS config.
929933
serverConfig, err := vttls.ServerConfig(
930934
path.Join(root, "server-cert.pem"),
931935
path.Join(root, "server-key.pem"),
932936
path.Join(root, "ca-cert.pem"),
937+
path.Join(root, "ca-crl.pem"),
933938
"",
934939
tls.VersionTLS12)
935940
require.NoError(t, err)
@@ -966,7 +971,6 @@ func TestTLSRequired(t *testing.T) {
966971
}
967972

968973
// setup conn params with TLS
969-
tlstest.CreateSignedCert(root, tlstest.CA, "02", "client", "Client Cert")
970974
params.SslMode = vttls.VerifyIdentity
971975
params.SslCa = path.Join(root, "ca-cert.pem")
972976
params.SslCert = path.Join(root, "client-cert.pem")
@@ -977,6 +981,16 @@ func TestTLSRequired(t *testing.T) {
977981
if conn != nil {
978982
conn.Close()
979983
}
984+
985+
// setup conn params with TLS, but with a revoked client certificate
986+
params.SslCert = path.Join(root, "revoked-client-cert.pem")
987+
params.SslKey = path.Join(root, "revoked-client-key.pem")
988+
conn, err = Connect(context.Background(), params)
989+
require.NotNil(t, err)
990+
require.Contains(t, err.Error(), "remote error: tls: bad certificate")
991+
if conn != nil {
992+
conn.Close()
993+
}
980994
}
981995

982996
func TestCachingSha2PasswordAuthWithTLS(t *testing.T) {
@@ -1013,6 +1027,7 @@ func TestCachingSha2PasswordAuthWithTLS(t *testing.T) {
10131027
path.Join(root, "server-key.pem"),
10141028
path.Join(root, "ca-cert.pem"),
10151029
"",
1030+
"",
10161031
tls.VersionTLS12)
10171032
if err != nil {
10181033
t.Fatalf("TLSServerConfig failed: %v", err)

‎go/test/endtoend/encryption/encryptedtransport/encrypted_transport_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -374,7 +374,7 @@ func tabletConnExtraArgs(name string) []string {
374374
}
375375

376376
func getVitessClient(addr string) (vtgateservicepb.VitessClient, error) {
377-
opt, err := grpcclient.SecureDialOption(grpcCert, grpcKey, grpcCa, grpcName)
377+
opt, err := grpcclient.SecureDialOption(grpcCert, grpcKey, grpcCa, "", grpcName)
378378
if err != nil {
379379
return nil, err
380380
}

‎go/vt/binlog/grpcbinlogplayer/player.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ var (
3636
cert = flag.String("binlog_player_grpc_cert", "", "the cert to use to connect")
3737
key = flag.String("binlog_player_grpc_key", "", "the key to use to connect")
3838
ca = flag.String("binlog_player_grpc_ca", "", "the server ca to use to validate servers when connecting")
39+
crl = flag.String("binlog_player_grpc_crl", "", "the server crl to use to validate server certificates when connecting")
3940
name = flag.String("binlog_player_grpc_server_name", "", "the server name to use to validate server certificate")
4041
)
4142

@@ -48,7 +49,7 @@ type client struct {
4849
func (client *client) Dial(tablet *topodatapb.Tablet) error {
4950
addr := netutil.JoinHostPort(tablet.Hostname, tablet.PortMap["grpc"])
5051
var err error
51-
opt, err := grpcclient.SecureDialOption(*cert, *key, *ca, *name)
52+
opt, err := grpcclient.SecureDialOption(*cert, *key, *ca, *crl, *name)
5253
if err != nil {
5354
return err
5455
}

‎go/vt/grpcclient/client.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,15 +125,15 @@ func interceptors() []grpc.DialOption {
125125
// SecureDialOption returns the gRPC dial option to use for the
126126
// given client connection. It is either using TLS, or Insecure if
127127
// nothing is set.
128-
func SecureDialOption(cert, key, ca, name string) (grpc.DialOption, error) {
128+
func SecureDialOption(cert, key, ca, crl, name string) (grpc.DialOption, error) {
129129
// No security options set, just return.
130130
if (cert == "" || key == "") && ca == "" {
131131
return grpc.WithInsecure(), nil
132132
}
133133

134134
// Load the config. At this point we know
135135
// we want a strict config with verify identity.
136-
config, err := vttls.ClientConfig(vttls.VerifyIdentity, cert, key, ca, name, tls.VersionTLS12)
136+
config, err := vttls.ClientConfig(vttls.VerifyIdentity, cert, key, ca, crl, name, tls.VersionTLS12)
137137
if err != nil {
138138
return nil, err
139139
}

‎go/vt/servenv/grpc_server.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ var (
6767
// GRPCCA is the CA to use if TLS is enabled
6868
GRPCCA = flag.String("grpc_ca", "", "server CA to use for gRPC connections, requires TLS, and enforces client certificate check")
6969

70+
// GRPCCRL is the CRL (Certificate Revocation List) to use if TLS is enabled
71+
GRPCCRL = flag.String("grpc_crl", "", "path to a certificate revocation list in PEM format, client certificates will be further verified against this file during TLS handshake")
72+
7073
GRPCEnableOptionalTLS = flag.Bool("grpc_enable_optional_tls", false, "enable optional TLS mode when a server accepts both TLS and plain-text connections on the same port")
7174

7275
// GRPCServerCA if specified will combine server cert and server CA
@@ -133,7 +136,7 @@ func createGRPCServer() {
133136

134137
var opts []grpc.ServerOption
135138
if GRPCPort != nil && *GRPCCert != "" && *GRPCKey != "" {
136-
config, err := vttls.ServerConfig(*GRPCCert, *GRPCKey, *GRPCCA, *GRPCServerCA, tls.VersionTLS12)
139+
config, err := vttls.ServerConfig(*GRPCCert, *GRPCKey, *GRPCCA, *GRPCCRL, *GRPCServerCA, tls.VersionTLS12)
137140
if err != nil {
138141
log.Exitf("Failed to log gRPC cert/key/ca: %v", err)
139142
}

‎go/vt/throttler/grpcthrottlerclient/grpcthrottlerclient.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ var (
3636
cert = flag.String("throttler_client_grpc_cert", "", "the cert to use to connect")
3737
key = flag.String("throttler_client_grpc_key", "", "the key to use to connect")
3838
ca = flag.String("throttler_client_grpc_ca", "", "the server ca to use to validate servers when connecting")
39+
crl = flag.String("throttler_client_grpc_crl", "", "the server crl to use to validate server certificates when connecting")
3940
name = flag.String("throttler_client_grpc_server_name", "", "the server name to use to validate server certificate")
4041
)
4142

@@ -45,7 +46,7 @@ type client struct {
4546
}
4647

4748
func factory(addr string) (throttlerclient.Client, error) {
48-
opt, err := grpcclient.SecureDialOption(*cert, *key, *ca, *name)
49+
opt, err := grpcclient.SecureDialOption(*cert, *key, *ca, *crl, *name)
4950
if err != nil {
5051
return nil, err
5152
}

0 commit comments

Comments
 (0)