Skip to content

Commit c76f686

Browse files
gtcooke94gtcooke94
authored
advancedTLS: Rename get root certs related pieces (#7207)
1 parent f591e3b commit c76f686

3 files changed

Lines changed: 152 additions & 100 deletions

File tree

‎security/advancedtls/advancedtls.go‎

Lines changed: 72 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -87,31 +87,52 @@ type PostHandshakeVerificationFunc func(params *HandshakeVerificationInfo) (*Pos
8787
// Deprecated: use PostHandshakeVerificationFunc instead.
8888
type CustomVerificationFunc = PostHandshakeVerificationFunc
8989

90-
// GetRootCAsParams contains the parameters available to users when
91-
// implementing GetRootCAs.
92-
type GetRootCAsParams struct {
93-
RawConn net.Conn
90+
// ConnectionInfo contains the parameters available to users when
91+
// implementing GetRootCertificates.
92+
type ConnectionInfo struct {
93+
// RawConn is the raw net.Conn representing a connection.
94+
RawConn net.Conn
95+
// RawCerts is the byte representation of the presented peer cert chain.
9496
RawCerts [][]byte
9597
}
9698

97-
// GetRootCAsResults contains the results of GetRootCAs.
99+
// GetRootCAsParams contains the parameters available to users when
100+
// implementing GetRootCAs.
101+
//
102+
// Deprecated: use ConnectionInfo instead.
103+
type GetRootCAsParams = ConnectionInfo
104+
105+
// RootCertificates is the result of GetRootCertificates.
98106
// If users want to reload the root trust certificate, it is required to return
99107
// the proper TrustCerts in GetRootCAs.
100-
type GetRootCAsResults struct {
108+
type RootCertificates struct {
109+
// TrustCerts is the pool of trusted certificates.
101110
TrustCerts *x509.CertPool
102111
}
103112

113+
// GetRootCAsResults contains the results of GetRootCAs.
114+
// If users want to reload the root trust certificate, it is required to return
115+
// the proper TrustCerts in GetRootCAs.
116+
//
117+
// Deprecated: use RootCertificates instead.
118+
type GetRootCAsResults = RootCertificates
119+
104120
// RootCertificateOptions contains options to obtain root trust certificates
105121
// for both the client and the server.
106122
// At most one option could be set. If none of them are set, we
107123
// use the system default trust certificates.
108124
type RootCertificateOptions struct {
125+
// If RootCertificates is set, it will be used every time when verifying
126+
// the peer certificates, without performing root certificate reloading.
127+
RootCertificates *x509.CertPool
109128
// If RootCACerts is set, it will be used every time when verifying
110129
// the peer certificates, without performing root certificate reloading.
130+
//
131+
// Deprecated: use RootCertificates instead.
111132
RootCACerts *x509.CertPool
112133
// If GetRootCertificates is set, it will be invoked to obtain root certs for
113134
// every new connection.
114-
GetRootCertificates func(params *GetRootCAsParams) (*GetRootCAsResults, error)
135+
GetRootCertificates func(params *ConnectionInfo) (*RootCertificates, error)
115136
// If RootProvider is set, we will use the root certs from the Provider's
116137
// KeyMaterial() call in the new connections. The Provider must have initial
117138
// credentials if specified. Otherwise, KeyMaterial() will block forever.
@@ -277,6 +298,12 @@ func (o *Options) clientConfig() (*tls.Config, error) {
277298
if o.MaxTLSVersion == 0 {
278299
o.MaxTLSVersion = o.MaxVersion
279300
}
301+
// TODO(gtcooke94) RootCACerts is deprecated, eventually remove this block.
302+
// This will ensure that users still explicitly setting RootCACerts will get
303+
// the setting int the right place.
304+
if o.RootOptions.RootCACerts != nil {
305+
o.RootOptions.RootCertificates = o.RootOptions.RootCACerts
306+
}
280307
if o.VerificationType == SkipVerification && o.AdditionalPeerVerification == nil {
281308
return nil, fmt.Errorf("client needs to provide custom verification mechanism if choose to skip default verification")
282309
}
@@ -312,19 +339,19 @@ func (o *Options) clientConfig() (*tls.Config, error) {
312339
}
313340
// Propagate root-certificate-related fields in tls.Config.
314341
switch {
315-
case o.RootOptions.RootCACerts != nil:
316-
config.RootCAs = o.RootOptions.RootCACerts
342+
case o.RootOptions.RootCertificates != nil:
343+
config.RootCAs = o.RootOptions.RootCertificates
317344
case o.RootOptions.GetRootCertificates != nil:
318345
// In cases when users provide GetRootCertificates callback, since this
319346
// callback is not contained in tls.Config, we have nothing to set here.
320347
// We will invoke the callback in ClientHandshake.
321348
case o.RootOptions.RootProvider != nil:
322-
o.RootOptions.GetRootCertificates = func(*GetRootCAsParams) (*GetRootCAsResults, error) {
349+
o.RootOptions.GetRootCertificates = func(*ConnectionInfo) (*RootCertificates, error) {
323350
km, err := o.RootOptions.RootProvider.KeyMaterial(context.Background())
324351
if err != nil {
325352
return nil, err
326353
}
327-
return &GetRootCAsResults{TrustCerts: km.Roots}, nil
354+
return &RootCertificates{TrustCerts: km.Roots}, nil
328355
}
329356
default:
330357
// No root certificate options specified by user. Use the certificates
@@ -381,6 +408,12 @@ func (o *Options) serverConfig() (*tls.Config, error) {
381408
if o.MaxTLSVersion == 0 {
382409
o.MaxTLSVersion = o.MaxVersion
383410
}
411+
// TODO(gtcooke94) RootCACerts is deprecated, eventually remove this block.
412+
// This will ensure that users still explicitly setting RootCACerts will get
413+
// the setting int the right place.
414+
if o.RootOptions.RootCACerts != nil {
415+
o.RootOptions.RootCertificates = o.RootOptions.RootCACerts
416+
}
384417
if o.RequireClientCert && o.VerificationType == SkipVerification && o.AdditionalPeerVerification == nil {
385418
return nil, fmt.Errorf("server needs to provide custom verification mechanism if choose to skip default verification, but require client certificate(s)")
386419
}
@@ -420,19 +453,19 @@ func (o *Options) serverConfig() (*tls.Config, error) {
420453
}
421454
// Propagate root-certificate-related fields in tls.Config.
422455
switch {
423-
case o.RootOptions.RootCACerts != nil:
424-
config.ClientCAs = o.RootOptions.RootCACerts
456+
case o.RootOptions.RootCertificates != nil:
457+
config.ClientCAs = o.RootOptions.RootCertificates
425458
case o.RootOptions.GetRootCertificates != nil:
426459
// In cases when users provide GetRootCertificates callback, since this
427460
// callback is not contained in tls.Config, we have nothing to set here.
428461
// We will invoke the callback in ServerHandshake.
429462
case o.RootOptions.RootProvider != nil:
430-
o.RootOptions.GetRootCertificates = func(*GetRootCAsParams) (*GetRootCAsResults, error) {
463+
o.RootOptions.GetRootCertificates = func(*ConnectionInfo) (*RootCertificates, error) {
431464
km, err := o.RootOptions.RootProvider.KeyMaterial(context.Background())
432465
if err != nil {
433466
return nil, err
434467
}
435-
return &GetRootCAsResults{TrustCerts: km.Roots}, nil
468+
return &RootCertificates{TrustCerts: km.Roots}, nil
436469
}
437470
default:
438471
// No root certificate options specified by user. Use the certificates
@@ -477,12 +510,12 @@ func (o *Options) serverConfig() (*tls.Config, error) {
477510
// advancedTLSCreds is the credentials required for authenticating a connection
478511
// using TLS.
479512
type advancedTLSCreds struct {
480-
config *tls.Config
481-
verifyFunc PostHandshakeVerificationFunc
482-
getRootCAs func(params *GetRootCAsParams) (*GetRootCAsResults, error)
483-
isClient bool
484-
revocationOptions *RevocationOptions
485-
verificationType VerificationType
513+
config *tls.Config
514+
verifyFunc PostHandshakeVerificationFunc
515+
getRootCertificates func(params *ConnectionInfo) (*RootCertificates, error)
516+
isClient bool
517+
revocationOptions *RevocationOptions
518+
verificationType VerificationType
486519
}
487520

488521
func (c advancedTLSCreds) Info() credentials.ProtocolInfo {
@@ -548,10 +581,10 @@ func (c *advancedTLSCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credenti
548581

549582
func (c *advancedTLSCreds) Clone() credentials.TransportCredentials {
550583
return &advancedTLSCreds{
551-
config: credinternal.CloneTLSConfig(c.config),
552-
verifyFunc: c.verifyFunc,
553-
getRootCAs: c.getRootCAs,
554-
isClient: c.isClient,
584+
config: credinternal.CloneTLSConfig(c.config),
585+
verifyFunc: c.verifyFunc,
586+
getRootCertificates: c.getRootCertificates,
587+
isClient: c.isClient,
555588
}
556589
}
557590

@@ -588,8 +621,8 @@ func buildVerifyFunc(c *advancedTLSCreds,
588621
rootCAs = c.config.ClientCAs
589622
}
590623
// Reload root CA certs.
591-
if rootCAs == nil && c.getRootCAs != nil {
592-
results, err := c.getRootCAs(&GetRootCAsParams{
624+
if rootCAs == nil && c.getRootCertificates != nil {
625+
results, err := c.getRootCertificates(&ConnectionInfo{
593626
RawConn: rawConn,
594627
RawCerts: rawCerts,
595628
})
@@ -661,12 +694,12 @@ func NewClientCreds(o *Options) (credentials.TransportCredentials, error) {
661694
return nil, err
662695
}
663696
tc := &advancedTLSCreds{
664-
config: conf,
665-
isClient: true,
666-
getRootCAs: o.RootOptions.GetRootCertificates,
667-
verifyFunc: o.AdditionalPeerVerification,
668-
revocationOptions: o.RevocationOptions,
669-
verificationType: o.VerificationType,
697+
config: conf,
698+
isClient: true,
699+
getRootCertificates: o.RootOptions.GetRootCertificates,
700+
verifyFunc: o.AdditionalPeerVerification,
701+
revocationOptions: o.RevocationOptions,
702+
verificationType: o.VerificationType,
670703
}
671704
tc.config.NextProtos = credinternal.AppendH2ToNextProtos(tc.config.NextProtos)
672705
return tc, nil
@@ -680,12 +713,12 @@ func NewServerCreds(o *Options) (credentials.TransportCredentials, error) {
680713
return nil, err
681714
}
682715
tc := &advancedTLSCreds{
683-
config: conf,
684-
isClient: false,
685-
getRootCAs: o.RootOptions.GetRootCertificates,
686-
verifyFunc: o.AdditionalPeerVerification,
687-
revocationOptions: o.RevocationOptions,
688-
verificationType: o.VerificationType,
716+
config: conf,
717+
isClient: false,
718+
getRootCertificates: o.RootOptions.GetRootCertificates,
719+
verifyFunc: o.AdditionalPeerVerification,
720+
revocationOptions: o.RevocationOptions,
721+
verificationType: o.VerificationType,
689722
}
690723
tc.config.NextProtos = credinternal.AppendH2ToNextProtos(tc.config.NextProtos)
691724
return tc, nil

‎security/advancedtls/advancedtls_integration_test.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -142,13 +142,13 @@ func (s) TestEnd2End(t *testing.T) {
142142
clientCert []tls.Certificate
143143
clientGetCert func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
144144
clientRoot *x509.CertPool
145-
clientGetRoot func(params *GetRootCAsParams) (*GetRootCAsResults, error)
145+
clientGetRoot func(params *ConnectionInfo) (*RootCertificates, error)
146146
clientVerifyFunc PostHandshakeVerificationFunc
147147
clientVerificationType VerificationType
148148
serverCert []tls.Certificate
149149
serverGetCert func(*tls.ClientHelloInfo) ([]*tls.Certificate, error)
150150
serverRoot *x509.CertPool
151-
serverGetRoot func(params *GetRootCAsParams) (*GetRootCAsResults, error)
151+
serverGetRoot func(params *ConnectionInfo) (*RootCertificates, error)
152152
serverVerifyFunc PostHandshakeVerificationFunc
153153
serverVerificationType VerificationType
154154
}{
@@ -180,12 +180,12 @@ func (s) TestEnd2End(t *testing.T) {
180180
},
181181
clientVerificationType: CertVerification,
182182
serverCert: []tls.Certificate{cs.ServerCert1},
183-
serverGetRoot: func(params *GetRootCAsParams) (*GetRootCAsResults, error) {
183+
serverGetRoot: func(params *ConnectionInfo) (*RootCertificates, error) {
184184
switch stage.read() {
185185
case 0, 1:
186-
return &GetRootCAsResults{TrustCerts: cs.ServerTrust1}, nil
186+
return &RootCertificates{TrustCerts: cs.ServerTrust1}, nil
187187
default:
188-
return &GetRootCAsResults{TrustCerts: cs.ServerTrust2}, nil
188+
return &RootCertificates{TrustCerts: cs.ServerTrust2}, nil
189189
}
190190
},
191191
serverVerifyFunc: func(params *HandshakeVerificationInfo) (*PostHandshakeVerificationResults, error) {
@@ -208,12 +208,12 @@ func (s) TestEnd2End(t *testing.T) {
208208
{
209209
desc: "test the reloading feature for server identity callback and client trust callback",
210210
clientCert: []tls.Certificate{cs.ClientCert1},
211-
clientGetRoot: func(params *GetRootCAsParams) (*GetRootCAsResults, error) {
211+
clientGetRoot: func(params *ConnectionInfo) (*RootCertificates, error) {
212212
switch stage.read() {
213213
case 0, 1:
214-
return &GetRootCAsResults{TrustCerts: cs.ClientTrust1}, nil
214+
return &RootCertificates{TrustCerts: cs.ClientTrust1}, nil
215215
default:
216-
return &GetRootCAsResults{TrustCerts: cs.ClientTrust2}, nil
216+
return &RootCertificates{TrustCerts: cs.ClientTrust2}, nil
217217
}
218218
},
219219
clientVerifyFunc: func(params *HandshakeVerificationInfo) (*PostHandshakeVerificationResults, error) {
@@ -250,12 +250,12 @@ func (s) TestEnd2End(t *testing.T) {
250250
{
251251
desc: "test client custom verification",
252252
clientCert: []tls.Certificate{cs.ClientCert1},
253-
clientGetRoot: func(params *GetRootCAsParams) (*GetRootCAsResults, error) {
253+
clientGetRoot: func(params *ConnectionInfo) (*RootCertificates, error) {
254254
switch stage.read() {
255255
case 0:
256-
return &GetRootCAsResults{TrustCerts: cs.ClientTrust1}, nil
256+
return &RootCertificates{TrustCerts: cs.ClientTrust1}, nil
257257
default:
258-
return &GetRootCAsResults{TrustCerts: cs.ClientTrust2}, nil
258+
return &RootCertificates{TrustCerts: cs.ClientTrust2}, nil
259259
}
260260
},
261261
clientVerifyFunc: func(params *HandshakeVerificationInfo) (*PostHandshakeVerificationResults, error) {
@@ -342,7 +342,7 @@ func (s) TestEnd2End(t *testing.T) {
342342
GetIdentityCertificatesForServer: test.serverGetCert,
343343
},
344344
RootOptions: RootCertificateOptions{
345-
RootCACerts: test.serverRoot,
345+
RootCertificates: test.serverRoot,
346346
GetRootCertificates: test.serverGetRoot,
347347
},
348348
RequireClientCert: true,
@@ -370,7 +370,7 @@ func (s) TestEnd2End(t *testing.T) {
370370
},
371371
AdditionalPeerVerification: test.clientVerifyFunc,
372372
RootOptions: RootCertificateOptions{
373-
RootCACerts: test.clientRoot,
373+
RootCertificates: test.clientRoot,
374374
GetRootCertificates: test.clientGetRoot,
375375
},
376376
VerificationType: test.clientVerificationType,
@@ -787,7 +787,7 @@ func (s) TestDefaultHostNameCheck(t *testing.T) {
787787
go s.Serve(lis)
788788
clientOptions := &Options{
789789
RootOptions: RootCertificateOptions{
790-
RootCACerts: test.clientRoot,
790+
RootCertificates: test.clientRoot,
791791
},
792792
VerificationType: test.clientVerificationType,
793793
}
@@ -927,7 +927,7 @@ func (s) TestTLSVersions(t *testing.T) {
927927
go s.Serve(lis)
928928
clientOptions := &Options{
929929
RootOptions: RootCertificateOptions{
930-
RootCACerts: cs.ClientTrust1,
930+
RootCertificates: cs.ClientTrust1,
931931
},
932932
VerificationType: CertAndHostVerification,
933933
MinTLSVersion: test.clientMinVersion,

0 commit comments

Comments
 (0)