open-nomad/nomad
Luiz Aoqui 0e09b120e4
fix mTLS certificate check on agent to agent RPCs (#11998)
PR #11956 implemented a new mTLS RPC check to validate the role of the
certificate used in the request, but further testing revealed two flaws:

  1. client-only endpoints did not accept server certificates so the
     request would fail when forwarded from one server to another.
  2. the certificate was being checked after the request was forwarded,
     so the check would happen over the server certificate, not the
     actual source.

This commit checks for the desired mTLS level, where the client level
accepts both, a server or a client certificate. It also validates the
cercertificate before the request is forwarded.
2022-02-04 20:35:20 -05:00
..
deploymentwatcher rename test variable names to something a easier to identify 2022-01-31 14:59:52 -08:00
drainer cleanup: prevent leaks from time.After 2022-02-02 14:32:26 -06:00
mock Fix health checking for ephemeral poststart tasks (#11945) 2022-02-02 16:29:49 -05:00
state CSI: move terminal alloc handling into denormalization (#11931) 2022-01-27 10:39:08 -05:00
stream events: fix wildcard namespace handling (#10935) 2021-09-02 09:36:55 -07:00
structs improve error message on service length (#12012) 2022-02-04 19:39:34 -05:00
volumewatcher CSI: move terminal alloc handling into denormalization (#11931) 2022-01-27 10:39:08 -05:00
acl.go
acl_endpoint.go
acl_endpoint_test.go
acl_test.go
alloc_endpoint.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
alloc_endpoint_test.go
autopilot.go
autopilot_test.go test: fix flaky TestAutopilot_CleanupDeadServer 2021-09-28 16:38:56 -07:00
blocked_evals.go cleanup: prevent leaks from time.After 2022-02-02 14:32:26 -06:00
blocked_evals_stats.go
blocked_evals_stats_test.go
blocked_evals_system.go
blocked_evals_test.go
client_agent_endpoint.go
client_agent_endpoint_test.go debug: Improve namespace and region support (#11269) 2021-10-12 16:58:41 -04:00
client_alloc_endpoint.go
client_alloc_endpoint_test.go
client_csi_endpoint.go
client_csi_endpoint_test.go
client_fs_endpoint.go
client_fs_endpoint_test.go
client_rpc.go
client_rpc_test.go
client_stats_endpoint.go
client_stats_endpoint_test.go
config.go
consul.go
consul_oss_test.go gofmt all the files 2021-10-01 10:14:28 -04:00
consul_policy.go
consul_policy_oss_test.go gofmt all the files 2021-10-01 10:14:28 -04:00
consul_policy_test.go gofmt all the files 2021-10-01 10:14:28 -04:00
consul_test.go
core_sched.go core: log CSI GC cutoff index only on non-forced GC (#11997) 2022-02-03 15:03:39 -05:00
core_sched_test.go CSI: resolve invalid claim states (#11890) 2022-01-27 09:30:03 -05:00
csi_endpoint.go CSI: move terminal alloc handling into denormalization (#11931) 2022-01-27 10:39:08 -05:00
csi_endpoint_test.go api: support namespace wildcard in CSI volume list (#11724) 2021-12-21 17:19:45 -05:00
deployment_endpoint.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
deployment_endpoint_test.go api: paginate deployment list and accept wildcard namespace (#11743) 2022-01-03 08:36:02 -05:00
deployment_watcher_shims.go
drainer_int_test.go
drainer_shims.go
endpoints_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
eval_broker.go cleanup: prevent leaks from time.After 2022-02-02 14:32:26 -06:00
eval_broker_test.go test: fix fake by increasing time window 2021-09-28 12:22:59 -07:00
eval_endpoint.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
eval_endpoint_test.go api: respect wildcard in evaluations list API (#11710) 2021-12-20 12:23:50 -05:00
event_endpoint.go
event_endpoint_test.go
fsm.go scheduler: detect and log unexpected scheduling collisions (#11793) 2022-01-14 20:09:14 -05:00
fsm_oss.go chore: ensure consistent file naming for non-enterprise files. 2022-01-13 11:32:16 +01:00
fsm_registry_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
fsm_test.go events: fix wildcard namespace handling (#10935) 2021-09-02 09:36:55 -07:00
heartbeat.go
heartbeat_test.go
job_endpoint.go Verify TLS certificate on endpoints that are used between agents only (#11956) 2022-02-02 15:03:18 -05:00
job_endpoint_hook_connect.go fix panic when Connect mesh gateway doesn't have a proxy block (#11257) 2021-10-04 15:52:07 -04:00
job_endpoint_hook_connect_test.go fix panic when Connect mesh gateway doesn't have a proxy block (#11257) 2021-10-04 15:52:07 -04:00
job_endpoint_hook_expose_check.go
job_endpoint_hook_expose_check_test.go
job_endpoint_hooks.go
job_endpoint_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
job_endpoint_oss_test.go gofmt all the files 2021-10-01 10:14:28 -04:00
job_endpoint_test.go replace 'a alloc' with 'an alloc' where appropriate (#11792) 2022-01-10 11:59:46 -05:00
leader.go csi: update leader's ACL in volumewatcher (#11891) 2022-01-24 11:49:50 -05:00
leader_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
leader_test.go Make number of scheduler workers reloadable (#11593) 2022-01-06 11:56:13 -05:00
merge.go
namespace_endpoint.go
namespace_endpoint_test.go
node_endpoint.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
node_endpoint_test.go do not initialize copy's slice if nil in original 2021-12-23 16:40:35 -08:00
operator_endpoint.go
operator_endpoint_test.go
periodic.go
periodic_endpoint.go
periodic_endpoint_test.go
periodic_test.go
plan_apply.go scheduler: detect and log unexpected scheduling collisions (#11793) 2022-01-14 20:09:14 -05:00
plan_apply_oss.go chore: ensure consistent file naming for non-enterprise files. 2022-01-13 11:32:16 +01:00
plan_apply_pool.go
plan_apply_pool_test.go
plan_apply_test.go
plan_endpoint.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
plan_endpoint_test.go core: prevent malformed plans from crashing leader 2022-01-31 12:15:15 -08:00
plan_normalization_test.go allow configuration of Docker hostnames in bridge mode (#11173) 2021-09-16 08:13:09 +02:00
plan_queue.go cleanup: prevent leaks from time.After 2022-02-02 14:32:26 -06:00
plan_queue_test.go
raft_rpc.go
regions_endpoint.go
regions_endpoint_test.go
rpc.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
rpc_test.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
scaling_endpoint.go chore: fixup inconsistent method receiver names. (#11704) 2021-12-20 11:44:21 +01:00
scaling_endpoint_test.go rpc: fix scaling policy get index response when policy is found. 2021-11-26 10:40:27 +01:00
search_endpoint.go
search_endpoint_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
search_endpoint_test.go
serf.go
serf_test.go
server.go cleanup: prevent leaks from time.After 2022-02-02 14:32:26 -06:00
server_setup_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
server_test.go Make number of scheduler workers reloadable (#11593) 2022-01-06 11:56:13 -05:00
stats_fetcher.go
stats_fetcher_test.go
status_endpoint.go chore: fix incorrect docstring formatting. 2021-08-30 11:08:12 +02:00
status_endpoint_test.go
system_endpoint.go chore: fix incorrect docstring formatting. 2021-08-30 11:08:12 +02:00
system_endpoint_test.go
testing.go Make number of scheduler workers reloadable (#11593) 2022-01-06 11:56:13 -05:00
testing_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
timetable.go
timetable_test.go
util.go fix mTLS certificate check on agent to agent RPCs (#11998) 2022-02-04 20:35:20 -05:00
util_test.go
vault.go cleanup: prevent leaks from time.After 2022-02-02 14:32:26 -06:00
vault_test.go
vault_testing.go chore: fix incorrect docstring formatting. 2021-08-30 11:08:12 +02:00
worker.go scheduler: detect and log unexpected scheduling collisions (#11793) 2022-01-14 20:09:14 -05:00
worker_string_schedulerworkerstatus.go Make number of scheduler workers reloadable (#11593) 2022-01-06 11:56:13 -05:00
worker_string_workerstatus.go Make number of scheduler workers reloadable (#11593) 2022-01-06 11:56:13 -05:00
worker_test.go scheduler: detect and log unexpected scheduling collisions (#11793) 2022-01-14 20:09:14 -05:00