Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

etcdmain, pkg: Support peer and client TLS auth based on SAN fields. #10614

Merged
merged 5 commits into from
Jul 19, 2019
Merged

etcdmain, pkg: Support peer and client TLS auth based on SAN fields. #10614

merged 5 commits into from
Jul 19, 2019

Commits on Jul 10, 2019

  1. etcdmain, pkg: Support peer and client TLS auth based on SAN fields. 

    Etcd currently supports validating peers based on their TLS certificate's
CN field. The current best practice for creation and validation of TLS
certs is to use the Subject Alternative Name (SAN) fields instead, so that
a certificate might be issued with a unique CN and its logical
identities in the SANs.

This commit extends the peer validation logic to use Go's
`(*"crypto/x509".Certificate).ValidateHostname` function for name
validation, which allows SANs to be used for peer access control.

In addition, it allows name validation to be enabled on clients as well.
This is used when running Etcd behind an authenticating proxy, or as
an internal component in a larger system (like a Kubernetes master).
    @jmillikin-stripe
    jmillikin-stripe committed Jul 10, 2019
    Configuration menu
    Copy the full SHA
    9a53601 View commit details
    Browse the repository at this point in the history

  2. etcdman, pkg: Rename new flags to 'hostname'

    @jmillikin-stripe
    jmillikin-stripe committed Jul 10, 2019
    Configuration menu
    Copy the full SHA
    5824421 View commit details
    Browse the repository at this point in the history

  3. pkg: Remove stray printfs

    @jmillikin-stripe
    jmillikin-stripe committed Jul 10, 2019
    Configuration menu
    Copy the full SHA
    9147279 View commit details
    Browse the repository at this point in the history

  4. tests: Use 'localhost' to match SAN of integration/fixtures/server.crt

    @jmillikin-stripe
    jmillikin-stripe committed Jul 10, 2019
    Configuration menu
    Copy the full SHA
    c668673 View commit details
    Browse the repository at this point in the history

  5. tests: Use more deterministic error message in TestEtcdPeerNameAuth

    @jmillikin-stripe
    jmillikin-stripe committed Jul 10, 2019
    Configuration menu
    Copy the full SHA
    95f3138 View commit details
    Browse the repository at this point in the history