maskit opened a new pull request, #14006:
URL: https://github.com/apache/trafficserver/pull/14006
## Summary
The way trusted raw public keys (RFC 7250) are configured today is different
from the way X.509 trust is configured:
- **Inbound:** trusted client keys can only be set per ssl_multicert.yaml
entry, while trusted client CAs are set globally in records.yaml and per host
in sni.yaml.
- **Outbound:** trusted next-hop keys can only be set per next hop in
sni.yaml; there is no global setting like
`proxy.config.ssl.client.CA.cert.filename`.
Besides being harder to configure, the difference has a consequence:
`host_sni_policy` covers per-host client trust in sni.yaml, but not trust set
in ssl_multicert.yaml.
This PR removes the difference by configuring raw public key trust the same
way as X.509 trust, in both directions:
| Direction | Scope | X.509 | Raw public keys today | Raw public keys with
this PR |
|---|---|---|---|---|
| Inbound | global | `proxy.config.ssl.CA.cert.filename` | — |
`proxy.config.ssl.CA.rpk.filename` |
| Inbound | per host | sni.yaml `verify_client_ca_certs` |
ssl_multicert.yaml `ssl_client_rpk_ca_name` | sni.yaml `verify_client_rpk_ca` |
| Outbound | global | `proxy.config.ssl.client.CA.cert.filename` | — |
`proxy.config.ssl.client.CA.rpk.filename` |
| Outbound | per host | per-transaction override of the record above |
sni.yaml `server_rpk_ca` | sni.yaml `verify_server_rpk_ca` (renamed) |
The current names came with PR 13548 and are in no release, so
`ssl_client_rpk_ca_name` is removed and `server_rpk_ca` is renamed without a
deprecation period.
## Behavior
- **Inbound per host:** `verify_client_rpk_ca` belongs to the
`verify_client` action, so `host_sni_policy` covers it as it covers
`verify_client_ca_certs`. Setting it without `verify_client` is a configuration
error, since nothing would apply it. Setting it on a build without RFC 7250
support is also an error, since ignoring it would leave the host trusting the
global client CA.
- **One override replaces both global settings:** a host that sets either
`verify_client_ca_certs` or `verify_client_rpk_ca` accepts only the credentials
it names. With only `verify_client_ca_certs`, no raw public key is accepted
there. With only `verify_client_rpk_ca`, no X.509 client certificate is
accepted.
- **The trusted set is chosen once per connection,** when the ClientHello is
processed and after the SNI actions run. The client certificate type
negotiation (on both OpenSSL and BoringSSL), the two verify callbacks and the
session ID context all read that same set, even across a reload during the
handshake.
- **Outbound global:** `proxy.config.ssl.client.CA.rpk.filename` applies to
every next hop that has no `verify_server_rpk_ca` of its own in sni.yaml. The
handshake and the origin session reuse check select the set the same way. A raw
public key carries no name, so the docs note that any key in the global set
authenticates every such origin.
- **Reloads:** a global key file that cannot be loaded fails the reload, and
no raw public key is trusted through it.
- **HTTP/3:** not changed here. A `verify_client` action does not reach
HTTP/3 connections, so the global settings apply there; the docs say so.
## Testing
- `tests/uranium_tests/tls/test_tls_rpk_client_trust.py` (new) covers:
- a host whose own set refuses the client's key, including a request for
that host on another host's connection, which `host_sni_policy` now refuses;
- the global inbound set, matching and mismatching;
- a host's set replacing the global one;
- a `verify_client` entry without a set of its own falling back to the
global one;
- a host that names only a CA refusing raw public keys, and a host that
names only raw public keys refusing X.509 certificates.
- `tests/uranium_tests/tls/test_tls_rpk_hop.py`:
- outbound global set cases: matching, mismatching, a per-host set
overriding it, an sni.yaml entry without a set of its own, and a key file that
fails to load on reload, which fails the reload and trusts nothing until the
file is restored;
- the reload and pooled-connection tests run with the set in sni.yaml and
in records.yaml;
- the inbound mTLS cases use `proxy.config.ssl.CA.rpk.filename` in place
of `ssl_client_rpk_ca_name`.
- Unit tests for the new sni.yaml key and its configuration error.
- All 50 tests in both files pass with BoringSSL and with OpenSSL 3.6.
Reverting any one of the following code changes on its own makes its tests fail
on both libraries:
- the X.509 refusal on a host that names only raw public keys;
- the raw public key refusal on a host that names only a CA;
- the global outbound set in the reuse check;
- the reload failure when the global key file cannot be loaded.
- On a build without RFC 7250 support (quictls 1.1.1), the unit tests and
the existing client verification and resumption scope tests pass.
- Not covered by a test, because the test clients cannot produce them: the
session ID context marker for a host that trusts only raw public keys (it needs
a session cached under one configuration and offered under another), choosing
trust again on an OpenSSL TLS 1.2 renegotiation that names another host, and
OpenSSL offering only raw public keys to a client that lists X.509 first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
