node: send certificates for inter-node TLS connections - #4097
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #4097 +/- ##
==========================================
+ Coverage 27.20% 27.24% +0.04%
==========================================
Files 676 678 +2
Lines 46227 46282 +55
==========================================
+ Hits 12576 12611 +35
- Misses 32437 32453 +16
- Partials 1214 1218 +4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
294c5f3 to
d15b80b
Compare
d15b80b to
1d9c14f
Compare
| GetMetaHeader() *protosession.RequestMetaHeader | ||
| GetVerifyHeader() *protosession.RequestVerificationHeader | ||
| }, tokens common.RequestTokens) (user.ID, []byte, error) { | ||
| if req.GetVerifyHeader() == nil && req.GetMetaHeader().GetTtl() == 1 { |
There was a problem hiding this comment.
what is so special about TTL? what if req.GetVerifyHeader() == nil and TTL == 2? isnt such a request still a possible Node-Node? can you point me, please, to a place where non-container node sends a node-to-node request with TTL=2?
There was a problem hiding this comment.
can you point me, please, to a place where non-container node sends a node-to-node request with TTL=2? (i guess)
There is no such path in the current object service. A request with TTL=2 may arrive from a client at a non-container node, but when this node forwards it to a container node, it creates a new request with TTL=1. Thus, all node-to-node requests produced by the forwarding paths use TTL=1. TLS authentication replaces request signatures only for this final local hop; unsigned requests with TTL>1 are not trusted as forwarded requests.
There was a problem hiding this comment.
unsigned requests with TTL>1 are not trusted as forwarded requests.
The key. We can't forward unsigned requests.
There was a problem hiding this comment.
if it is strictly prohibited, i suggest returning a clear error message. currently, an empty verify header with TTL=2 just skips this branch, and it will fail later casually, like a request with no verification header (even if a client tried to use TLS correctly and just used TTL=2 for some reason)
1d9c14f to
2113b4b
Compare
Request client certificates on TLS endpoints and use their keys to authenticate unsigned one-hop object requests. Closes #4088. Signed-off-by: Andrey Butusov <andrey@nspcc.io>
3 participants
Closes #4088.