Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Separate tls::ServerName and identity::Id types #2506

Merged
merged 7 commits into from
Nov 8, 2023
Merged

Separate tls::ServerName and identity::Id types #2506

merged 7 commits into from
Nov 8, 2023

Commits on Nov 7, 2023

  1. Remove the Credentials::dns_name API 

    The Credentials trait needlessly exposes a dns::Name value. We plan to
decouple certificates from DNS names (though DNS names will remain in
use for SNI negotiation).

This change narrows the trait interface so we can begin to make those
changes.
    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    833de52 View commit details
    Browse the repository at this point in the history

  2. Separate tls::ServerName and identity::Id types 

    To prepare for the introduction of SPIFFE identities into Linkerd's
identity system, this change we need to begin to separate the
representation of an endpoint's SNI value and its "identity" for the
purposes of authentication.

This change distinguishes:

* Authenticated `Id` values (i.e. as described by a certificate)
* Server Name Indication (SNI) values used for TLS negotation

The `tls::ServerName` type to represent the SNI use case. The
`tls::ClientTls` type now has distinct `ServerName` and `ServerId`
configurations to support distinct behavior for sending an SNI value to
the server server

The `id::Name` type is genralized as `id::Id`. In the future, this type
will be used to encompass both DNS-like and SPIFFE identities. This type
is specifically used for peer authentication (and not for SNI
negotiation).

The `id::LocalId` type is removed. It was only being used as a means for
the local server name configuration.

Co-authored-by: <[email protected]>
    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    8c35fe7 View commit details
    Browse the repository at this point in the history

  3. Update mTLS providers to have both a Name and an Id

    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    897d53a View commit details
    Browse the repository at this point in the history

  4. Clarify use of server_id to server_name in rustls client

    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    127bb94 View commit details
    Browse the repository at this point in the history

  5. fixup boring test

    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    eb0c17f View commit details
    Browse the repository at this point in the history

  6. Appease no-tls compilation tests

    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    c943b18 View commit details
    Browse the repository at this point in the history

  7. fixup comment

    @olix0r
    olix0r committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    02cbae7 View commit details
    Browse the repository at this point in the history