Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

google_grpc: add a runtime flag to disable TLSv1.3 #32315

Merged
merged 8 commits into from
Feb 21, 2024
Merged

google_grpc: add a runtime flag to disable TLSv1.3 #32315

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f5a1a3e
google_grpc: add a runtime flag to disable TLSv1.3
kyessenov Feb 10, 2024
9a03786
Merge remote-tracking branch 'upstream/main' into set_max_grpc_tls_ve…
kyessenov Feb 14, 2024
ce82ed3
add test
kyessenov Feb 15, 2024
e83a118
merge fix
kyessenov Feb 16, 2024
f0067d1
deflake
kyessenov Feb 16, 2024
0b5b535
minimize
kyessenov Feb 16, 2024
9bd21ab
fix import
kyessenov Feb 16, 2024
9d5366f
Merge remote-tracking branch 'upstream/main' into set_max_grpc_tls_ve…
kyessenov Feb 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions source/common/grpc/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,7 @@ envoy_cc_library(
"//envoy/grpc:google_grpc_creds_interface",
"//envoy/registry",
"//source/common/config:datasource_lib",
"//source/common/runtime:runtime_lib",
"@envoy_api//envoy/config/core/v3:pkg_cc_proto",
],
alwayslink = LEGACY_ALWAYSLINK,
Expand Down
38 changes: 31 additions & 7 deletions source/common/grpc/google_grpc_creds_impl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@
#include "envoy/grpc/google_grpc_creds.h"

#include "source/common/config/datasource.h"
#include "source/common/runtime/runtime_features.h"

#include "grpcpp/security/tls_certificate_provider.h"

namespace Envoy {
namespace Grpc {
Expand All @@ -15,12 +18,29 @@ std::shared_ptr<grpc::ChannelCredentials> CredsUtility::getChannelCredentials(
case envoy::config::core::v3::GrpcService::GoogleGrpc::ChannelCredentials::
CredentialSpecifierCase::kSslCredentials: {
const auto& ssl_credentials = google_grpc.channel_credentials().ssl_credentials();
const grpc::SslCredentialsOptions ssl_credentials_options = {
Config::DataSource::read(ssl_credentials.root_certs(), true, api),
Config::DataSource::read(ssl_credentials.private_key(), true, api),
Config::DataSource::read(ssl_credentials.cert_chain(), true, api),
};
return grpc::SslCredentials(ssl_credentials_options);
const auto root_certs = Config::DataSource::read(ssl_credentials.root_certs(), true, api);
const auto private_key = Config::DataSource::read(ssl_credentials.private_key(), true, api);
const auto cert_chain = Config::DataSource::read(ssl_credentials.cert_chain(), true, api);
grpc::experimental::TlsChannelCredentialsOptions options;
if (!private_key.empty() || !cert_chain.empty()) {
options.set_certificate_provider(
std::make_shared<grpc::experimental::StaticDataCertificateProvider>(
root_certs,
std::vector<grpc::experimental::IdentityKeyCertPair>{{private_key, cert_chain}}));
} else if (!root_certs.empty()) {
options.set_certificate_provider(
std::make_shared<grpc::experimental::StaticDataCertificateProvider>(root_certs));
}
if (!root_certs.empty()) {
options.watch_root_certs();
}
if (!private_key.empty() || !cert_chain.empty()) {
options.watch_identity_key_cert_pairs();
}
if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.google_grpc_disable_tls_13")) {
options.set_max_tls_version(grpc_tls_version::TLS1_2);
}
return grpc::experimental::TlsCredentials(options);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code all looks reasonable, but I notice that we are now returning experimental::TlsCredentials instead of SslCredentials. Is there any behavior change associated with this new class? (I'm guessing not, but thought I should confirm.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked @matthewstevenson88 from gRPC team to confirm the API usage - and they did per #32315 (review). We only need to set a root cert, a private key, and a cert chain in Envoy, and the API seems to be compatible with that and offer more knobs.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Sounds good.

}
case envoy::config::core::v3::GrpcService::GoogleGrpc::ChannelCredentials::
CredentialSpecifierCase::kLocalCredentials: {
Expand All @@ -43,7 +63,11 @@ std::shared_ptr<grpc::ChannelCredentials> CredsUtility::defaultSslChannelCredent
if (creds != nullptr) {
return creds;
}
return grpc::SslCredentials({});
grpc::experimental::TlsChannelCredentialsOptions options;
if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.google_grpc_disable_tls_13")) {
options.set_max_tls_version(grpc_tls_version::TLS1_2);
}
return grpc::experimental::TlsCredentials(options);
}

std::vector<std::shared_ptr<grpc::CallCredentials>>
Expand Down
4 changes: 4 additions & 0 deletions source/common/runtime/runtime_features.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,10 @@ FALSE_RUNTIME_GUARD(envoy_restart_features_use_fast_protobuf_hash);
// TODO(panting): flip this to true after some test time.
FALSE_RUNTIME_GUARD(envoy_reloadable_features_use_config_in_happy_eyeballs);

// A flag to set the maximum TLS version for google_grpc client to TLS1.2, when needed for
// compliance restrictions.
FALSE_RUNTIME_GUARD(envoy_reloadable_features_google_grpc_disable_tls_13);

// Block of non-boolean flags. Use of int flags is deprecated. Do not add more.
ABSL_FLAG(uint64_t, re2_max_program_size_error_level, 100, ""); // NOLINT
ABSL_FLAG(uint64_t, re2_max_program_size_warn_level, // NOLINT
Expand Down
Loading