Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

migrate experimental-peer-skip-client-san-verification flag to feature gate #19225

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+82 −24
Open

migrate experimental-peer-skip-client-san-verification flag to feature gate #19225

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c14e11
migrate experimental-peer-skip-client-san-verification flag to featur…
wodeyoulai Jan 17, 2025
2da0636
add owner
wodeyoulai Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 67 additions & 17 deletions server/embed/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,22 +94,24 @@ func TestConfigFileOtherFields(t *testing.T) {

func TestConfigFileFeatureGates(t *testing.T) {
testCases := []struct {
name string
serverFeatureGatesJSON string
experimentalStopGRPCServiceOnDefrag string
experimentalInitialCorruptCheck string
experimentalCompactHashCheckEnabled string
experimentalTxnModeWriteWithSharedBuffer string
expectErr bool
expectedFeatures map[featuregate.Feature]bool
name string
serverFeatureGatesJSON string
experimentalStopGRPCServiceOnDefrag string
experimentalInitialCorruptCheck string
experimentalCompactHashCheckEnabled string
experimentalTxnModeWriteWithSharedBuffer string
experimentalPeerSkipClientSanVerification string
expectErr bool
expectedFeatures map[featuregate.Feature]bool
}{
{
name: "default",
expectedFeatures: map[featuregate.Feature]bool{
features.DistributedTracing: false,
features.StopGRPCServiceOnDefrag: false,
features.InitialCorruptCheck: false,
features.TxnModeWriteWithSharedBuffer: true,
features.DistributedTracing: false,
features.StopGRPCServiceOnDefrag: false,
features.InitialCorruptCheck: false,
features.TxnModeWriteWithSharedBuffer: true,
features.PeerSkipClientSanVerification: false,
},
},
{
Expand All @@ -130,6 +132,12 @@ func TestConfigFileFeatureGates(t *testing.T) {
experimentalTxnModeWriteWithSharedBuffer: "false",
expectErr: true,
},
{
name: "cannot set both experimental flag and feature gate flag for PeerSkipClientSanVerification",
serverFeatureGatesJSON: "PeerSkipClientSanVerification=true",
experimentalPeerSkipClientSanVerification: "false",
expectErr: true,
},
{
name: "ok to set different experimental flag and feature gate flag",
serverFeatureGatesJSON: "DistributedTracing=true",
Expand Down Expand Up @@ -292,15 +300,49 @@ func TestConfigFileFeatureGates(t *testing.T) {
features.CompactHashCheck: true,
},
},
{
name: "can set feature gate PeerSkipClientSanVerification to true from experimental flag",
experimentalPeerSkipClientSanVerification: "true",
expectedFeatures: map[featuregate.Feature]bool{
features.PeerSkipClientSanVerification: true,
features.StopGRPCServiceOnDefrag: false,
features.DistributedTracing: false,
features.InitialCorruptCheck: false,
features.TxnModeWriteWithSharedBuffer: true,
},
},
{
name: "can set feature gate PeerSkipClientSanVerification to false from experimental flag",
experimentalPeerSkipClientSanVerification: "false",
expectedFeatures: map[featuregate.Feature]bool{
features.PeerSkipClientSanVerification: false,
features.StopGRPCServiceOnDefrag: false,
features.DistributedTracing: false,
features.InitialCorruptCheck: false,
features.TxnModeWriteWithSharedBuffer: true,
},
},
{
name: "can set feature gate PeerSkipClientSanVerification through feature gates JSON",
serverFeatureGatesJSON: "PeerSkipClientSanVerification=true",
expectedFeatures: map[featuregate.Feature]bool{
features.PeerSkipClientSanVerification: true,
features.StopGRPCServiceOnDefrag: false,
features.DistributedTracing: false,
features.InitialCorruptCheck: false,
features.TxnModeWriteWithSharedBuffer: true,
},
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
yc := struct {
ExperimentalStopGRPCServiceOnDefrag *bool `json:"experimental-stop-grpc-service-on-defrag,omitempty"`
ExperimentalInitialCorruptCheck *bool `json:"experimental-initial-corrupt-check,omitempty"`
ExperimentalCompactHashCheckEnabled *bool `json:"experimental-compact-hash-check-enabled,omitempty"`
ExperimentalTxnModeWriteWithSharedBuffer *bool `json:"experimental-txn-mode-write-with-shared-buffer,omitempty"`
ServerFeatureGatesJSON string `json:"feature-gates"`
ExperimentalStopGRPCServiceOnDefrag *bool `json:"experimental-stop-grpc-service-on-defrag,omitempty"`
ExperimentalInitialCorruptCheck *bool `json:"experimental-initial-corrupt-check,omitempty"`
ExperimentalCompactHashCheckEnabled *bool `json:"experimental-compact-hash-check-enabled,omitempty"`
ExperimentalTxnModeWriteWithSharedBuffer *bool `json:"experimental-txn-mode-write-with-shared-buffer,omitempty"`
ExperimentalPeerSkipClientSanVerification *bool `json:"experimental-peer-skip-client-san-verification,omitempty"`
ServerFeatureGatesJSON string `json:"feature-gates"`
}{
ServerFeatureGatesJSON: tc.serverFeatureGatesJSON,
}
Expand Down Expand Up @@ -337,6 +379,14 @@ func TestConfigFileFeatureGates(t *testing.T) {
yc.ExperimentalCompactHashCheckEnabled = &experimentalCompactHashCheckEnabled
}

if tc.experimentalPeerSkipClientSanVerification != "" {
experimentalPeerSkipClientSanVerification, err := strconv.ParseBool(tc.experimentalPeerSkipClientSanVerification)
if err != nil {
t.Fatal(err)
}
yc.ExperimentalPeerSkipClientSanVerification = &experimentalPeerSkipClientSanVerification
}

b, err := yaml.Marshal(&yc)
if err != nil {
t.Fatal(err)
Expand Down
2 changes: 1 addition & 1 deletion server/embed/etcd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,7 @@ func StartEtcd(inCfg *Config) (e *Etcd, err error) {
}

srvcfg.PeerTLSInfo.LocalAddr = srvcfg.ExperimentalLocalAddress

srvcfg.PeerTLSInfo.SkipClientSANVerify = srvcfg.ServerFeatureGate.Enabled(features.PeerSkipClientSanVerification)
print(e.cfg.logger, *cfg, srvcfg, memberInitialized)

if e.Server, err = etcdserver.NewServer(srvcfg); err != nil {
Expand Down
1 change: 1 addition & 0 deletions server/etcdmain/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ var (
"experimental-txn-mode-write-with-shared-buffer": "--experimental-txn-mode-write-with-shared-buffer is deprecated in v3.6 and will be decommissioned in v3.7. Use '--feature-gates=TxnModeWriteWithSharedBuffer=true' instead.",
"experimental-corrupt-check-time": "--experimental-corrupt-check-time is deprecated in v3.6 and will be decommissioned in v3.7. Use '--corrupt-check-time' instead.",
"experimental-compaction-batch-limit": "--experimental-compaction-batch-limit is deprecated in v3.6 and will be decommissioned in v3.7. Use '--compaction-batch-limit' instead.",
"experimental-peer-skip-client-san-verification": "--experimental-peer-skip-client-san-verification is deprecated in v3.6 and will be decommissioned in v3.7. Use '--feature-gates=PeerSkipClientSanVerification=true' instead.",
}
)

Expand Down
2 changes: 1 addition & 1 deletion server/etcdmain/help.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ Experimental feature:
--compaction-batch-limit 1000
CompactionBatchLimit sets the maximum revisions deleted in each compaction batch.
--experimental-peer-skip-client-san-verification 'false'
Skip verification of SAN field in client certificate for peer connections.
Skip verification of SAN field in client certificate for peer connections. Deprecated in v3.6 and will be decommissioned in v3.7. Use '--feature-gates=PeerSkipClientSanVerification=true' instead.
--experimental-watch-progress-notify-interval '10m'
Duration of periodical watch progress notification.
--experimental-warning-apply-duration '100ms'
Expand Down
17 changes: 12 additions & 5 deletions server/features/etcd_features.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,15 +60,21 @@ const (
// alpha: v3.6
// main PR: https://github.com/etcd-io/etcd/pull/14120
CompactHashCheck featuregate.Feature = "CompactHashCheck"
// PeerSkipClientSanVerification enables to skip the verification of Subject Alternative Name (SAN) field in client certificates during peer TLS communication
// owner: @MartinWeindel
// alpha: v3.6
// main PR: https://github.com/etcd-io/etcd/pull/10524
PeerSkipClientSanVerification featuregate.Feature = "PeerSkipClientSanVerification"
)

var (
DefaultEtcdServerFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
DistributedTracing: {Default: false, PreRelease: featuregate.Alpha},
StopGRPCServiceOnDefrag: {Default: false, PreRelease: featuregate.Alpha},
InitialCorruptCheck: {Default: false, PreRelease: featuregate.Alpha},
CompactHashCheck: {Default: false, PreRelease: featuregate.Alpha},
TxnModeWriteWithSharedBuffer: {Default: true, PreRelease: featuregate.Beta},
DistributedTracing: {Default: false, PreRelease: featuregate.Alpha},
StopGRPCServiceOnDefrag: {Default: false, PreRelease: featuregate.Alpha},
InitialCorruptCheck: {Default: false, PreRelease: featuregate.Alpha},
CompactHashCheck: {Default: false, PreRelease: featuregate.Alpha},
TxnModeWriteWithSharedBuffer: {Default: true, PreRelease: featuregate.Beta},
PeerSkipClientSanVerification: {Default: false, PreRelease: featuregate.Alpha},
}
// ExperimentalFlagToFeatureMap is the map from the cmd line flags of experimental features
// to their corresponding feature gates.
Expand All @@ -78,6 +84,7 @@ var (
"experimental-initial-corrupt-check": InitialCorruptCheck,
"experimental-compact-hash-check-enabled": CompactHashCheck,
"experimental-txn-mode-write-with-shared-buffer": TxnModeWriteWithSharedBuffer,
"experimental-peer-skip-client-san-verification": PeerSkipClientSanVerification,
}
)

Expand Down
Loading