summaryrefslogtreecommitdiffstats
path: root/vespalib/src/tests/net
Commit message (Collapse)AuthorAgeFilesLines
* Unify to_string for PeerCredentials to match other typesTor Brede Vekterli2022-08-291-2/+2
|
* Add capabilities and RPC filters for sentinel and internal Proton APIsTor Brede Vekterli2022-08-251-12/+16
|
* Refactor Capability(Set) and add more testingTor Brede Vekterli2022-06-301-19/+63
| | | | | | | Hide all nitty-gritty details of how capabilities map to internal bit set positions by making more of Capability private and only allowing CapabilitySet to see how the sausages are made. Move all bit set functionality to CapabilitySet, where it really belongs.
* Support mTLS connection-level capabilities and RPC access filtering in C++Tor Brede Vekterli2022-06-295-69/+293
| | | | | | | | | | | | | | | | | | | | | | | | Adds the following: * Named capabilities and capability sets that represent (respectively) a single Vespa access API (such as Document API, search API etc) or a concrete subset of individual capabilities that make up a particular Vespa service (such as a content node). * A new `capabilities` array field to the mTLS authorization policies that allows for constraining what requests sent over a particular connection are allowed to actually do. Capabilities are referenced by name and may include any combination of capability sets and individual capabilities. If multiple capabilities/sets are configured, the resulting set of capabilities is the union set of all of them. * An FRT RPC-level access filter that can be set up as part of RPC method definitions. If set, filters are invoked prior to RPC methods. * A new `PERMISSION_DENIED` error code to FRT RPC that is invoked if an access filter denies a request. This also GCs the unused `AssumedRoles` concept which is now deprecated in favor of capabilities. Note: this is **not yet** a public or stable API, and capability names/semantics may change at any time.
* Rename AuthorizationResult to VerificationResultTor Brede Vekterli2022-04-282-15/+15
|
* Add more unit testsTor Brede Vekterli2022-04-261-0/+58
|
* Initial foundations for C++ mTLS peer authz role constraintsTor Brede Vekterli2022-04-262-15/+83
| | | | | | | | | | | | Exposes the following information via the OpenSSL-backed CryptoCodec: * Credentials retrieved from authenticated peer certificate. * Union set of assumed roles from all peer authorization rules that matched the peer certificate. Note that this does not add parsing of any mTLS config file role fields, nor any FNET/FRT wiring required for RPC requests to be associated with a particular peer authz context. Syntax and semantics etc still pending.
* Remove inlining warnings (vespalib).Tor Egge2022-02-261-0/+3
|
* Support glob-style credential matching of SAN_URI certificate fieldsTor Brede Vekterli2021-12-091-31/+93
| | | | | | | This is much like the DNS_SAN matching, but with two major differences: * Implicit delimiting around `/` characters instead of `.` characters. * Only wildcard `*` globbing is supported. `?` may be present in a valid URI and is matched as a literal character instead of _any_ single char.
* expose fallback host if you ask nicelyHåvard Pettersen2021-10-211-6/+8
|
* Update 2018 copyright notices.gjoranv2021-10-0716-16/+16
|
* Update 2017 copyright notices.gjoranv2021-10-0712-12/+12
|
* use size literals in vespalibArne Juul2021-02-152-6/+8
|
* Use vespalib::duration for timeoutsHenning Baldersheim2021-01-317-4/+8
|
* Only handle wakeup if necessary.Henning Baldersheim2020-12-051-1/+6
|
* Add basic exact matching support for X509 URI SANsTor Brede Vekterli2020-11-103-15/+53
| | | | | | | | | | Adds extraction of X509 URI peer credentials during the handshake process as well as a new SAN_URI field to the transport security options peer policy section. This implementation is NOT conformant with RFC 2459 since we don't currently support case insensitive matching of scheme, host etc., but it's good enough for our purposes for now.
* - GC the last usages of vespalib::Lock.Henning Baldersheim2020-10-081-1/+0
| | | | - Now it is only vespalib::Monitor left
* Add noexcept as indicated by -WnoeexceptHenning Baldersheim2020-10-071-2/+2
|
* Use Google RE2 as underlying regex engineTor Brede Vekterli2020-03-041-3/+0
| | | | | | | | | | | | This introduces guaranteed upper bounds for memory usage and CPU time during regex evaluation. Most importantly, it removes the danger of catastrophic backtracking that is currrently present in GCC's std::regex implementation. With this commit, RE2 will be used instead of std::regex for: * Document selection regex/glob operators * Attribute regex search * Evaluation of mTLS authorization rules
* Move crypto utility code out into vespalib and use for test credentialsTor Brede Vekterli2020-02-205-478/+4
| | | | | | | | | | | Currently offers only the following functionality: * Generate P-256 EC private keys and export to PEM * Generate X509 certificates and export to PEM Instead of using hardcoded private key/certs for unit tests, use crypto utility code to generate new credentials once per test process. Since these certs now use a SAN of `localhost` it also means we no longer need to disable hostname validation for networked unit tests.
* Implement TLS client SNI and hostname validation in OpenSSL codecTor Brede Vekterli2020-02-172-32/+163
| | | | | | | | | | Also adds `disable-hostname-validation` config entry to TLS JSON config file parsing in C++. For the time being, hostname validation is implicitly disabled unless explicitly specified in the config file. This will be gradually changed over to be implicitly enabled by default. SNI is always sent when a valid connection spec is provided.
* extend crypto engine apiHåvard Pettersen2020-02-133-8/+18
| | | | | send spec for client connections to enable SNI as well as server name verification
* Disable linux specific socket tests on non-linux platform.Tor Egge2020-02-121-8/+10
|
* avoid blocking accept callsHåvard Pettersen2019-09-301-0/+9
| | | | | | | | this is to increase portability to platforms not implementing the close-convention for (server) sockets. also set all accepted sockets to blocking mode to avoid issues related to maybe inheriting this setting from the server socket.
* Propagate peer address for TLS codec/context and print on errorTor Brede Vekterli2019-07-161-1/+1
| | | | | Buffer emitted log messages on the peer's IP address to avoid log flooding in the case of a misbehaving client that keeps sending bogus requests.
* Use utility function to create nonblocking socketpair.Tor Egge2019-03-202-2/+4
|
* Perform basic epoll emulation on Darwin.Tor Egge2019-03-151-2/+2
|
* async tls handshake workHåvard Pettersen2019-02-211-0/+2
|
* Enable deferred handshake work in OpenSSL codec implementationTor Brede Vekterli2019-02-201-4/+30
| | | | | | Separates handshaking into lightweight `handshake()` and potentially CPU-heavy `do_handshake_work()` functions. Intended to enable asynchronous processing of handshake work in separate threads further down the line.
* Eliminate clang warning in vespalibTor Egge2019-02-061-2/+2
|
* Add support for default cipher suite and `accepted-ciphers` config in C++Tor Brede Vekterli2019-01-241-0/+18
| | | | | | | | | Since the TLS config file uses IANA cipher names but OpenSSL uses its own cipher spec format internally, we explicitly remap the provided names. We only support a modern subset of ciphers. The default cipher suite contains ciphers that work across both TLSv1.2 and TLSv1.3.
* Allow a client connection to be considered established in testTor Brede Vekterli2019-01-211-1/+2
| | | | | TLSv1.3 completes in fewer roundtrips and may therefore seemingly not observe that a server has rejected it as part of the handshake itself.
* Add TLS statistics to vespalib and expose as metrics via storageserverTor Brede Vekterli2018-12-182-8/+46
| | | | Now without unused expiry time extraction.
* Revert "Add TLS statistics to vespalib and expose as metrics via storageserver"Harald Musum2018-12-182-46/+8
|
* Add TLS statistics to vespalib and expose as metrics via storageserverTor Brede Vekterli2018-12-172-8/+46
| | | | | Also add functionality for extracting "notAfter" expiration time from current certificate, which may later be added as an expiry metric.
* Add support for authorization mode environment variable in C++Tor Brede Vekterli2018-12-102-7/+58
|
* Introduce extra mutex to avoid need for unlock guardTor Brede Vekterli2018-12-101-0/+42
| | | | Also add instructions on how to regenerate keys/certs for tests.
* Support auto-reloading of TLS config in C++ implementationTor Brede Vekterli2018-12-036-0/+129
| | | | | | | | | By default reloads every 60 minutes. This also reloads all peer authorization rules. Files referenced by the TLS config are reloaded transitively. If reloading fails a warning will be logged and the existing config will continue to be in effect until the next reload time.
* Rename `allowed-peers` to `authorized-peers`Tor Brede Vekterli2018-11-203-74/+74
|
* Correct test nameTor Brede Vekterli2018-11-131-1/+1
|
* Add support for basic certificate verification policies in C++Tor Brede Vekterli2018-11-084-4/+339
| | | | | | | | Extends TLS config JSON file with an `allowed-peers` object, which if non-empty specifies a set of policies that a peer may match. If at least one policy exists a peer must match all requirements in any single policy to be allowed to connect. I.e. it's sufficient to match 1 policy out of many.
* half_close for sync crypto socketsHåvard Pettersen2018-10-191-0/+27
|
* half_close for crypto socketsHåvard Pettersen2018-10-191-1/+54
|
* Add support for half-close to `CryptoCodec` and OpenSSL implementationTor Brede Vekterli2018-10-181-7/+64
|
* Add support for custom certificate verification callbacksTor Brede Vekterli2018-10-154-7/+642
| | | | | | | Specified as part of `TransportSecurityOptions` and will default to a callback accepting all pre-verified certificates if not given. Callback is provided with certificate subject Common Name and DNS Subject Alternate Name entries.
* added sync crypto socket with testHåvard Pettersen2018-10-092-0/+118
|
* added simple test for various crypto socketsHåvard Pettersen2018-10-092-0/+198
|
* added SingleFdSelector utilityHåvard Pettersen2018-10-091-0/+49
|
* Improve OpenSSL codec tests and error detection for X509 PEM parsingTor Brede Vekterli2018-09-271-63/+245
| | | | | Also support creating non-authenticated clients in case the codec will be used for non-RPC purposes at some point.
* Address code review feedbackTor Brede Vekterli2018-09-251-3/+18
|