kazusa
/
skywalking-java
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Include SAN to set mTLS property (#5908) 

* Include SAN to set mTLS property
* Fix codes as SAN is a list.
* Update the changelog.
Signed-off-by: Gao Hongtao <hanahmily@gmail.com>
Co-authored-by: Wu Sheng <wu.sheng@foxmail.com>
This commit is contained in:
Gao Hongtao 2020-11-27 12:39:09 +08:00 committed by GitHub
parent 9a61835cb7
commit 2150904f01
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.md
View File

@ -57,6 +57,7 @@ Release Notes.
* Add otel rules to ui template to observe Istio control plane.
* Remove istio mixer
* Support close influxdb batch write model.
* Check SAN in the ALS (m)TLS process.
#### UI
* Fix incorrect label in radial chart in topology.

29
oap-server/server-receiver-plugin/envoy-metrics-receiver-plugin/src/main/java/org/apache/skywalking/oap/server/receiver/envoy/als/LogEntry2MetricsAdapter.java
View File

@ -28,6 +28,7 @@ import io.envoyproxy.envoy.data.accesslog.v2.HTTPResponseProperties;
import io.envoyproxy.envoy.data.accesslog.v2.ResponseFlags;
import io.envoyproxy.envoy.data.accesslog.v2.TLSProperties;
import java.time.Instant;
import java.util.List;
import java.util.Optional;
import lombok.RequiredArgsConstructor;
import org.apache.skywalking.apm.network.common.v3.DetectPoint;
@ -156,14 +157,16 @@ public class LogEntry2MetricsAdapter {
if (properties == null) {
return NON_TLS;
}
if (isNullOrEmpty(Optional.ofNullable(properties.getLocalCertificateProperties())
.orElse(TLSProperties.CertificateProperties.newBuilder().build())
.getSubject())) {
TLSProperties.CertificateProperties lp = Optional
.ofNullable(properties.getLocalCertificateProperties())
.orElse(TLSProperties.CertificateProperties.newBuilder().build());
if (isNullOrEmpty(lp.getSubject()) && !hasSAN(lp.getSubjectAltNameList())) {
return NON_TLS;
}
if (isNullOrEmpty(Optional.ofNullable(properties.getPeerCertificateProperties())
.orElse(TLSProperties.CertificateProperties.newBuilder().build())
.getSubject())) {
TLSProperties.CertificateProperties pp = Optional
.ofNullable(properties.getPeerCertificateProperties())
.orElse(TLSProperties.CertificateProperties.newBuilder().build());
if (isNullOrEmpty(pp.getSubject()) && !hasSAN(pp.getSubjectAltNameList())) {
return TLS;
}
return M_TLS;
@ -217,4 +220,18 @@ public class LogEntry2MetricsAdapter {
}
return "";
}
/**
* @param subjectAltNameList from ALS LocalCertificateProperties and PeerCertificateProperties
* @return true is there is at least one SAN, based on URI check.
*/
private static boolean hasSAN(List<TLSProperties.CertificateProperties.SubjectAltName> subjectAltNameList) {
for (final TLSProperties.CertificateProperties.SubjectAltName san : subjectAltNameList) {
// Don't check DNS for now, as it is tagged not-implemented in ALS v2
if (!isNullOrEmpty(san.getUri())) {
return true;
}
}
return false;
}
}