Split cryptographic dependencies into a dedicated crate #1307

olix0r · 2021-10-14T17:09:39Z

The ring/rustls/webpki crates provide the cryptographic primitives
that we use for the proxy's mTLS functionality. But there's a desire to
support other cryptographic implementations (i.e. openssl/boringssl),
especially for FIPS 140-2.

This change introduces a new crate, linkerd-tls-rustls, into which all
types that depend on ring/rustls/webpki are moved. Specifically,
Key, Crt, and CrtKey are moved from linkerd-identity into
rustls. The linkerd-tls crate becomes generic over its TLS
implementation by using a NewService to build client connectors and a
Service to terminate server-side TLS connections.

The proxy-identity crate currently depends on the linkerd-tls-rustls
crate, as do the various app crates. In followup changes, these crates
will be further decoupled from the rustls types.

:; cargo tree -i ring -e normal
ring v0.16.20
├── linkerd-tls-rustls v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/tls/rustls)
│   ├── linkerd-app-core v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/core)
│   │   ├── linkerd-app v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app)
│   │   │   ├── linkerd-app-integration v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/integration)
│   │   │   └── linkerd2-proxy v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd2-proxy)
│   │   ├── linkerd-app-admin v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/admin)
│   │   │   └── linkerd-app v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app) (*)
│   │   ├── linkerd-app-gateway v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/gateway)
│   │   │   └── linkerd-app v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app) (*)
│   │   ├── linkerd-app-inbound v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/inbound)
│   │   │   ├── linkerd-app v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app) (*)
│   │   │   ├── linkerd-app-admin v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/admin) (*)
│   │   │   └── linkerd-app-gateway v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/gateway) (*)
│   │   ├── linkerd-app-integration v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/integration)
│   │   ├── linkerd-app-outbound v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/outbound)
│   │   │   ├── linkerd-app v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app) (*)
│   │   │   └── linkerd-app-gateway v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/gateway) (*)
│   │   └── linkerd-app-test v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/test)
│   │       └── linkerd-app-integration v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/integration)
│   ├── linkerd-proxy-identity v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/proxy/identity)
│   │   └── linkerd-app-core v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/core) (*)
│   └── linkerd-proxy-tap v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/proxy/tap)
│       └── linkerd-app-core v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/core) (*)
├── rustls v0.19.1
│   └── tokio-rustls v0.22.0
│       ├── linkerd-app-integration v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/integration)
│       └── linkerd-tls-rustls v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/tls/rustls) (*)
├── sct v0.6.1
│   └── rustls v0.19.1 (*)
└── webpki v0.21.4 (https://github.com/linkerd/webpki?branch=cert-dns-names-0.21#a4acca51)
    ├── linkerd-app-integration v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/app/integration)
    ├── linkerd-tls-rustls v0.1.0 (/home/ver/b/linkerd2-proxy/linkerd/tls/rustls) (*)
    ├── rustls v0.19.1 (*)
    └── tokio-rustls v0.22.0 (*)

Copy webpki's DNS name types into our dns-name crate so that webpki and ring aren't needed for basic name types.

The `ring`/`rustls`/`webpki` crates provide the cryptographic primitives that we use for the proxy's mTLS functionality. But there's a desire to support other cryptographic implementations (i.e. openssl/boringssl), especially for FIPS 140-2. This change introduces a new crate, `linkerd-tls-rustls`, into which all types that depend on `ring`/`rustls`/`webpki` are moved. Specifically, `Key`, `Crt`, and `CrtKey` are moved from `linkerd-identity` into `rustls`. The `linkerd-tls` crate becomes generic over its TLS implementation by using a `NewService` to build client connectors and a `Service` to terminate server-side TLS connections.

This reverts commit dd198fe.

hawkw

this looks good to me!

hawkw · 2021-10-18T21:56:52Z

linkerd/proxy/tap/src/accept.rs

-type Connection<T, I> = ((tls::ConditionalServerTls, T), tls::server::Io<I>);
+type Connection<T, I> = (
+    (tls::ConditionalServerTls, T),
+    io::EitherIo<linkerd_tls_rustls::ServerIo<tls::server::DetectIo<I>>, tls::server::DetectIo<I>>,


hawkw · 2021-10-18T22:04:07Z

linkerd/app/core/src/lib.rs

 pub use linkerd_service_profiles as profiles;
 pub use linkerd_stack_metrics as stack_metrics;
 pub use linkerd_stack_tracing as stack_tracing;
 pub use linkerd_tls as tls;
+pub use linkerd_tls_rustls as rustls;


take it or leave it, but i'm kind of on the fence about reexporting this as rustls? it seems like it's kind of unclear in downstream code whether imports from this module are library APIs or our code, which could be confusing to future readers?

not a b locker either way though.

I expect this to change in a followup

hawkw · 2021-10-18T22:05:59Z

linkerd/app/inbound/src/direct.rs

+                                    let permit =
+                                        allow.check_authorized(client.client_addr, &tls)?;
+                                    Ok(svc::Either::A(Local {
+                                        addr: Remote(ServerAddr(addr)),
+                                        permit,
+                                        client_id: client.client_id,
+                                    }))


it took me a min to realize that this (and some of the other code in this file) was not actually changed, and rustfmt just changed its mind about which line to wrap at or something. :/

I'm not sure why but rustfmt was just ignoring this whole stack before and something changed and now it wants to format it all

hawkw · 2021-10-18T22:12:17Z

linkerd/tls/rustls/src/client.rs

+        let server_id = webpki::DNSNameRef::try_from_ascii(client_tls.server_id.as_bytes())
+            .expect("identity must be a valid DNS name")
+            .to_owned();


kind of a bummer we have to do the conversion by-ref and then convert it into a new owned DNSName, rather than just moving the String from the dns::Name if it's valid. but, idk if this is worth trying to change it upstream...

yeah. we're on a fork of webpki so we could perhaps patch our fork to avoid it... but this will be a small allocation once per connection, so I'm not particularly worried

hawkw · 2021-10-18T22:14:48Z

linkerd/tls/rustls/src/tests.rs

+}
+
+#[test]
+#[ignore] // XXX this doesn't fail because we don't actually check the key against the cert...


should there be an issue for this?

this is just moved from the TLS crate, so it's been a long standing issue. practically, I don't think it's an issue we're likely to hit; and I don't know that we have a path forward to fixing it given the state of things.

This release fixes a bug where the outbound proxy could loop infinitely while handling errors on meshed HTTP/1 connections. This would typically cause proxies to be fail health checks and be restarted. Furthermore, the proxy now requires identity. Proxies will log an error and fail to start if identity is disabled. --- * dns: Avoid allocating in `Name::is_localhost` (linkerd/linkerd2-proxy#1303) * metrics: Implement FmtMetrics for Option (linkerd/linkerd2-proxy#1302) * tracing: simplify subscriber construction with `Box`ed layers (linkerd/linkerd2-proxy#1304) * Require identity configuration (linkerd/linkerd2-proxy#1305) * build(deps): bump thiserror from 1.0.29 to 1.0.30 (linkerd/linkerd2-proxy#1306) * build(deps): bump tower from 0.4.8 to 0.4.9 (linkerd/linkerd2-proxy#1308) * build(deps): bump trust-dns-resolver (linkerd/linkerd2-proxy#1311) * build(deps): bump actions/checkout from 2.3.4 to 2.3.5 (linkerd/linkerd2-proxy#1313) * dns-name: Remove `webpki` dependency (linkerd/linkerd2-proxy#1316) * build(deps): bump libc from 0.2.103 to 0.2.104 (linkerd/linkerd2-proxy#1315) * inbound: Add a box layer to reduce compile times (linkerd/linkerd2-proxy#1317) * Split cryptographic dependencies into a dedicated crate (linkerd/linkerd2-proxy#1307) * Fix an infinite loop when downgrading HTTP/2 errors (linkerd/linkerd2-proxy#1318)

olix0r added 23 commits October 8, 2021 18:20

wip

bc679c1

Merge branch 'main' into ver/tls-connect-generic

97f4f21

Decouple TLS client from rustls

9baee40

wip:server

075ce6d

factor out server TLS as well

e6b36c0

Split rustls into its own module

77345e5

fix client ALPN

3ae896e

-needless checks

7926c08

Drop rustls dependency from io

ae94c6a

Implement deref for ID types

54d40d7

semicolon

960ad0d

move credential types to rustls crate

3ef9c5c

Move identity::TokenSource to proxy::identity

003bf42

Remove webpki/ring from dns::Name

f53671a

Copy webpki's DNS name types into our dns-name crate so that webpki and ring aren't needed for basic name types.

Remove webpki from linkerd-tls

117dced

Merge branch 'main' into ver/tls-rustls-split

a333817

back out unnecessary change

058cda3

fixup type alias

aea2d5c

drop unused patch

f5e8c64

restore comments

05c2be8

needless change

4c1f719

Move Csr to proxy-identity

c28a124

olix0r changed the title ~~Ver/tls rustls split~~ Split cryptographic dependencies into a dedicated crate Oct 17, 2021

olix0r marked this pull request as ready for review October 17, 2021 20:44

olix0r requested a review from a team October 17, 2021 20:44

olix0r added 4 commits October 17, 2021 20:46

unused code

dd198fe

Revert "unused code"

94dd975

This reverts commit dd198fe.

fix feature flagging on TrustAnchors::empty

9efd9c8

fixups for nightly

491e0ba

olix0r added 7 commits October 17, 2021 22:09

fix feature flagging for inbound fuzzer

efa8420

Merge branch 'main' into ver/tls-rustls-split

e18578b

drop unneeded deps

b5cf662

drop unneeded deps

8d7d70b

tidy imports

ffb8c09

publish = false

4335c43

inline

bb3d11d

hawkw approved these changes Oct 18, 2021

View reviewed changes

olix0r merged commit 384aa21 into main Oct 18, 2021

olix0r deleted the ver/tls-rustls-split branch October 18, 2021 22:22

olix0r mentioned this pull request Oct 19, 2021

proxy: v2.163.0 linkerd/linkerd2#7120

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Split cryptographic dependencies into a dedicated crate #1307

Split cryptographic dependencies into a dedicated crate #1307

olix0r commented Oct 14, 2021 •

edited

Loading

hawkw left a comment

hawkw Oct 18, 2021

hawkw Oct 18, 2021

olix0r Oct 18, 2021

hawkw Oct 18, 2021

olix0r Oct 18, 2021

hawkw Oct 18, 2021

hawkw Oct 18, 2021

olix0r Oct 18, 2021

hawkw Oct 18, 2021

olix0r Oct 18, 2021

Split cryptographic dependencies into a dedicated crate #1307

Split cryptographic dependencies into a dedicated crate #1307

Conversation

olix0r commented Oct 14, 2021 • edited Loading

hawkw left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

olix0r commented Oct 14, 2021 •

edited

Loading