Add validation context provider #4264

JimmyCYJ · 2018-08-27T17:23:44Z

Description:
Add certificate validation context config provider and refactor ContextConfigImpl. Make static and inline CertificateValidationContext utilize it. This is independent of PR #4256. Once #4256 is in, next step is to support fetching CertificateValidationContext via validation_context_sds_secret_config.

Risk Level: Low
Testing: unit test, integration test
Docs Changes: N/A
Release Notes: N/A

Signed-off-by: Jimmy Chen jimmychen.0102@gmail.com

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

JimmyCYJ · 2018-08-27T17:26:59Z

cc @lizan @htuch @PiotrSikora @qiwzhang

htuch

Basic refactor looks good, but this is also adding new code that doesn't have test coverage.

htuch · 2018-08-28T16:55:03Z

source/common/secret/secret_manager_impl.cc

+             .insert(std::make_pair(secret.name(), secret_provider))
+             .second) {
+      throw EnvoyException(fmt::format(
+          "Duplicate static CertificateValidationContext secret name {}", secret.name()));


Need a unit test with EXPECT_THROW_WITH_MESSAGE for this.

Tests TEST_F(SecretManagerImplTest, CertificateValidationContextSecretLoadSuccess) and TEST_F(SecretManagerImplTest, DuplicateStaticCertificateValidationContextSecret) are added into secret_manager_impl_test.cc

htuch · 2018-08-28T16:56:30Z

source/common/ssl/context_config_impl.cc

@@ -40,6 +40,29 @@ getTlsCertificateConfigProvider(const envoy::api::v2::auth::CommonTlsContext& co
  return nullptr;
 }

+Secret::CertificateValidationContextConfigProviderSharedPtr
+getCertificateValidationContextConfigProvider(const envoy::api::v2::auth::CommonTlsContext& config,


Missing coverage in this file, see https://88877-65214191-gh.circle-artifacts.com/0/build/envoy/generated/coverage/coverage.source_common_ssl_context_config_impl.cc.html.

Tests TEST(ClientContextConfigImplTest, StaticCertificateValidationContext) and TEST(ClientContextConfigImplTest, MissingStaticCertificateValidationContext) are added into context_impl_test.cc

htuch · 2018-08-28T16:59:32Z

source/common/secret/secret_manager_impl.cc

@@ -32,10 +44,24 @@ SecretManagerImpl::findStaticTlsCertificateProvider(const std::string& name) con
  return (secret != static_tls_certificate_providers_.end()) ? secret->second : nullptr;
 }

+CertificateValidationContextConfigProviderSharedPtr
+SecretManagerImpl::findStaticCertificateValidationContextProvider(const std::string& name) const {
+  auto secret = static_certificate_validation_context_providers_.find(name);


Also needs unit test.

Tests TEST_F(SecretManagerImplTest, CertificateValidationContextSecretLoadSuccess) and TEST_F(SecretManagerImplTest, DuplicateStaticCertificateValidationContextSecret) are added into secret_manager_impl_test.cc

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

htuch

LGTM modulo nits. @PiotrSikora can you take a pass?

htuch · 2018-08-28T21:34:33Z

test/common/secret/secret_manager_impl_test.cc

+
+  secret_manager->addStaticSecret(secret_config);
+
+  ASSERT_NE(secret_manager->findStaticCertificateValidationContextProvider("abc.com"), nullptr);


Nit: Can you have less vertical space between test lines? It makes it a bit hard to read.

I have removed unnecessary vertical spaces between test lines, space is only used to separate test setup and test verification. Thanks.

htuch · 2018-08-28T21:34:48Z

test/common/secret/secret_manager_impl_test.cc

+                ->caCert());
+}
+
+TEST_F(SecretManagerImplTest, DuplicateStaticCertificateValidationContextSecret) {


Can you add a one line description of what each test does above it.

Comments are added above each test. Thanks.

htuch · 2018-08-28T21:34:58Z

test/common/secret/secret_manager_impl_test.cc

+TEST_F(SecretManagerImplTest, DuplicateStaticTlsCertificateSecret) {
+  envoy::api::v2::auth::Secret secret_config;
+
+  std::string yaml =


Nit: const std::string

Add const into this file and context_impl_test.cc. Thanks.

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

JimmyCYJ · 2018-08-28T22:25:08Z

@htuch @PiotrSikora Please take a look. Thanks!

htuch

LGTM pending @PiotrSikora quick take on this.

JimmyCYJ · 2018-08-29T17:31:51Z

friendly ping?

PiotrSikora

LGTM, thanks!

Pulling the following changes from github.com/envoyproxy/envoy: f936fc6 ssl: serialize accesses to SSL socket factory contexts (envoyproxy#4345) e34dcd6 Fix crash in tcp_proxy (envoyproxy#4323) ae6a252 router: fix matching when all domains have wildcards (envoyproxy#4326) aa06142 test: Stop fake_upstream methods from accidentally succeeding (envoyproxy#4232) 5d73187 rbac: update the authenticated.user to a StringMatcher. (envoyproxy#4250) c6bfc7d time: Event::TimeSystem abstraction to make it feasible to inject time with simulated timers (envoyproxy#4257) 752483e Fixing the fix (envoyproxy#4333) 83487f6 tls: update BoringSSL to ab36a84b (3497). (envoyproxy#4338) 7bc210e test: fixing interactions between waitFor and ignore_spurious_events (envoyproxy#4309) 69474b3 admin: order stats in clusters json admin (envoyproxy#4306) 2d155f9 ppc64le build (envoyproxy#4183) 07efc6d fix static initialization fiasco problem (envoyproxy#4314) 0b7e3b5 test: Remove declared but undefined class methods (envoyproxy#4297) 1485a13 lua: make sure resetting dynamic metadata wrapper when request info is marked dead d243cd6 test: set to zero when start_time exceeds limit (envoyproxy#4328) 0a1e92a test: fix heap use-after-free in ~IntegrationTestServer. (envoyproxy#4319) cddc732 CONTRIBUTING: Document 'kick-ci' trick. (envoyproxy#4335) f13ef24 docs: remove reference to deprecated value field (envoyproxy#4322) e947a27 router: minor doc fixes in stream idle timeout (envoyproxy#4329) 0c2e998 tcp-proxy: fixing a TCP proxy bug where we attempted to readDisable a closed connection (envoyproxy#4296) 00ffe44 utility: fix strftime overflow handling. (envoyproxy#4321) af1183c Re-enable TcpProxySslIntegrationTest and make the tests pass again. (envoyproxy#4318) 3553461 fuzz: fix H2 codec fuzzer post envoyproxy#4262. (envoyproxy#4311) 42f6048 Proto string issue fix (envoyproxy#4320) 9c492a0 Support Envoy to fetch secrets using SDS service. (envoyproxy#4256) a857219 ratelimit: revert `revert rate limit failure mode config` and add tests (envoyproxy#4303) 1d34172 dns: fix exception unsafe behavior in c-ares callbacks. (envoyproxy#4307) 1212423 alts: add gRPC TSI socket (envoyproxy#4153) f0363ae fuzz: detect client-side resets in H2 codec fuzzer. (envoyproxy#4300) 01aa3f8 test: hopefully deflaking echo integration test (envoyproxy#4304) 1fc0f4b ratelimit: link legacy proto when message is being used (envoyproxy#4308) aa4481e fix rare List::remove(&target) segfault (envoyproxy#4244) 89e0f23 headers: fixing fast fail of size-validation (envoyproxy#4269) 97eba59 build: bump googletest version. (envoyproxy#4293) 0057e22 fuzz: avoid false positives in HCM fuzzer. (envoyproxy#4262) 9d094e5 Revert ac0bd74 (envoyproxy#4295) ddb28a4 Add validation context provider (envoyproxy#4264) 3b47cba added histogram latency information to Hystrix dashboard stream (envoyproxy#3986) cf87d50 docs: update SNI FAQ. (envoyproxy#4285) f952033 config: fix update empty stat for eds (envoyproxy#4276) 329e591 router: Add ability of custom headers to rely on per-request data (envoyproxy#4219) 68d20b4 thrift: refactor build files and imports (envoyproxy#4271) 5fa8192 access_log: log requested_server_name in tcp proxy (envoyproxy#4144) fa45bb4 fuzz: libc++ clocks don't like nanos. (envoyproxy#4282) 53f8944 stats: add symbol table for future stat name encoding (envoyproxy#3927) c987b42 test infra: Remove timeSource() from the ClusterManager api (envoyproxy#4247) cd171d9 websocket: tunneling websockets (and upgrades in general) over H2 (envoyproxy#4188) b9dc5d9 router: disallow :path/host rewriting in request_headers_to_add. (envoyproxy#4220) 0c91011 network: skip socket options and source address for UDS client connections (envoyproxy#4252) da1857d build: fixing a downstream compile error by noting explicit fallthrough (envoyproxy#4265) 9857cfe fuzz: cleanup per-test environment after each fuzz case. (envoyproxy#4253) 52beb06 test: Wrap proto string in std::string before comparison (envoyproxy#4238) f5e219e extensions/thrift_proxy: Add header matching to thrift router (envoyproxy#4239) c9ce5d2 fuzz: track read_disable_count bidirectionally in codec_impl_fuzz_test. (envoyproxy#4260) 35103b3 fuzz: use nanoseconds for SystemTime in RequestInfo. (envoyproxy#4255) ba6ba98 fuzz: make runtime root hermetic in server_fuzz_test. (envoyproxy#4258) b0a9014 time: Add 'format' test to ensure no one directly instantiates Prod*Time from source. (envoyproxy#4248) 8567460 access_log: support beginning of epoch in START_TIME. (envoyproxy#4254) 28d5f41 proto: unify envoy_proto_library/api_proto_library. (envoyproxy#4233) f7d3cb6 http: fix allocation bug introduced in envoyproxy#4211. (envoyproxy#4245) Fixes istio/istio#8310 (once pulled into istio/istio). Signed-off-by: Piotr Sikora <piotrsikora@google.com>

JimmyCYJ added 3 commits August 27, 2018 10:19

Add certificate validation context config provider.

fb0e921

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

Add more files.

6b61c63

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

Remove debug log.

1aba595

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

JimmyCYJ mentioned this pull request Aug 27, 2018

Add validation context provider istio/envoy#9

Closed

dnoe assigned lizan Aug 27, 2018

htuch self-requested a review August 28, 2018 16:52

htuch self-assigned this Aug 28, 2018

htuch suggested changes Aug 28, 2018

View reviewed changes

JimmyCYJ added 3 commits August 28, 2018 11:22

Add unit tests.

2c5d3d4

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

Fix compile issue.

8e25759

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

Fix test.

a353a5e

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

htuch suggested changes Aug 28, 2018

View reviewed changes

htuch assigned PiotrSikora and unassigned lizan Aug 28, 2018

htuch requested a review from PiotrSikora August 28, 2018 21:35

Add comments and reduce vertical spaces.

7a5a793

Signed-off-by: JimmyCYJ <jimmychen.0102@gmail.com>

htuch approved these changes Aug 28, 2018

View reviewed changes

JimmyCYJ mentioned this pull request Aug 28, 2018

Support Envoy to fetch secrets using SDS service. #4256

Merged

PiotrSikora approved these changes Aug 29, 2018

View reviewed changes

htuch merged commit ddb28a4 into envoyproxy:master Aug 29, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add validation context provider #4264

Add validation context provider #4264

JimmyCYJ commented Aug 27, 2018

JimmyCYJ commented Aug 27, 2018

htuch left a comment

htuch Aug 28, 2018

JimmyCYJ Aug 28, 2018

htuch Aug 28, 2018

JimmyCYJ Aug 28, 2018

htuch Aug 28, 2018

JimmyCYJ Aug 28, 2018

htuch left a comment

htuch Aug 28, 2018

JimmyCYJ Aug 28, 2018

htuch Aug 28, 2018

JimmyCYJ Aug 28, 2018

htuch Aug 28, 2018

JimmyCYJ Aug 28, 2018

JimmyCYJ commented Aug 28, 2018

htuch left a comment

JimmyCYJ commented Aug 29, 2018

PiotrSikora left a comment


		secret_manager->addStaticSecret(secret_config);

		ASSERT_NE(secret_manager->findStaticCertificateValidationContextProvider("abc.com"), nullptr);

Add validation context provider #4264

Add validation context provider #4264

Conversation

JimmyCYJ commented Aug 27, 2018

JimmyCYJ commented Aug 27, 2018

htuch left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

htuch left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JimmyCYJ commented Aug 28, 2018

htuch left a comment

Choose a reason for hiding this comment

JimmyCYJ commented Aug 29, 2018

PiotrSikora left a comment

Choose a reason for hiding this comment