Skip to content

Added support for wildcard usage in x509 SubjectAltName identification.#68236

Merged
yakov-olkhovskiy merged 9 commits intoClickHouse:masterfrom
marco-vb:marco-vb/x509-san-support-wildcard
Sep 12, 2024
Merged

Added support for wildcard usage in x509 SubjectAltName identification.#68236
yakov-olkhovskiy merged 9 commits intoClickHouse:masterfrom
marco-vb:marco-vb/x509-san-support-wildcard

Conversation

@marco-vb
Copy link
Copy Markdown
Contributor

@marco-vb marco-vb commented Aug 12, 2024

Added support for single wildcard usage in x509 SubjectAltName, supports both DNS and URI.

With this change, a user can be defined as:

<user>
    <ssl_certificates>
        <subject_alt_name>URI:spiffe://foo.com/*/bar</subject_alt_name>
    </ssl_certificates>
</user>

Changelog category (leave one):

  • Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Add wildcard support for user identification in x509 SubjectAltName extension.

Documentation entry for user-facing changes

  • Documentation is written (mandatory for new features)

Information about CI checks: https://clickhouse.com/docs/en/development/continuous-integration/

CI Settings (Only check the boxes if you know what you are doing):

  • Allow: All Required Checks
  • Allow: Stateless tests
  • Allow: Stateful tests
  • Allow: Integration Tests
  • Allow: Performance tests
  • Allow: All Builds
  • Allow: batch 1, 2 for multi-batch jobs
  • Allow: batch 3, 4, 5, 6 for multi-batch jobs
  • Exclude: Style check
  • Exclude: Fast test
  • Exclude: All with ASAN
  • Exclude: All with TSAN, MSAN, UBSAN, Coverage
  • Exclude: All with aarch64, release, debug
  • Do not test
  • Woolen Wolfdog
  • Upload binaries for special builds
  • Disable merge-commit
  • Disable CI cache

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Aug 12, 2024 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

@yakov-olkhovskiy yakov-olkhovskiy self-assigned this Aug 18, 2024
@santrancisco santrancisco self-assigned this Aug 19, 2024
@yakov-olkhovskiy
Copy link
Copy Markdown
Member

yakov-olkhovskiy commented Aug 19, 2024

This proposal requires security evaluation.
cc @santrancisco

@santrancisco
Copy link
Copy Markdown
Contributor

santrancisco commented Aug 19, 2024

Hi all - thank you for tagging me, @yakov-olkhovskiy . While this is more about implementation details, i did take a quick look through RFC anyway just in case and don't see any specific clause about how to implement it.

The implementation adds more flexibility in managing endpoints communicating with Clickhouse servers when performing the same task, making it easier to manage certificates. It does add some challenge from security that we should at least make a note about it in the documentation:

  • Difficulty in Auditing - All clients will be sharing the same user to authenticate into ClickHouse database (Query log does show source IP for queries so this can be used for auditing purposes)
  • Revoking certification can be come a challenge as it would require modifying the config and revoking every other clients instead of single client

But overall, i think it's a nice feature to have :)

@tonickkozlov
Copy link
Copy Markdown
Contributor

tonickkozlov commented Sep 2, 2024

@yakov-olkhovskiy @santrancisco any update please?

What can be done from our side (mine and @marco-vb's) to get this PR tested? Thank you

yakov-olkhovskiy
yakov-olkhovskiy reviewed Sep 2, 2024
View reviewed changes
@robot-ch-test-poll4 robot-ch-test-poll4 added the pr-improvement Pull request with some product improvements label Sep 2, 2024
@marco-vb marco-vb force-pushed the marco-vb/x509-san-support-wildcard branch from f55f063 to 5472767 Compare September 2, 2024 17:14
@yakov-olkhovskiy yakov-olkhovskiy added the can be tested Allows running workflows for external contributors label Sep 3, 2024
@robot-ch-test-poll2
Copy link
Copy Markdown
Contributor

robot-ch-test-poll2 commented Sep 3, 2024 •
edited by robot-clickhouse
Loading

This is an automated comment for commit 185d940 with description of existing statuses. It's updated for the latest CI running

❌ Click here to open a full report in a separate page

Check nameDescriptionStatus
Upgrade checkRuns stress tests on server version from last release and then tries to upgrade it to the version from the PR. It checks if the new server can successfully startup without any errors, crashes or sanitizer asserts❌ failure
Successful checks
Check nameDescriptionStatus
AST fuzzerRuns randomly generated queries to catch program errors. The build type is optionally given in parenthesis. If it fails, ask a maintainer for help✅ success
BuildsThere's no description for the check yet, please add it to tests/ci/ci_config.py:CHECK_DESCRIPTIONS✅ success
ClickBenchRuns [ClickBench](https://github.com/ClickHouse/ClickBench/) with instant-attach table✅ success
Compatibility checkChecks that clickhouse binary runs on distributions with old libc versions. If it fails, ask a maintainer for help✅ success
Docker keeper imageThe check to build and optionally push the mentioned image to docker hub✅ success
Docker server imageThe check to build and optionally push the mentioned image to docker hub✅ success
Docs checkBuilds and tests the documentation✅ success
Fast testNormally this is the first check that is ran for a PR. It builds ClickHouse and runs most of stateless functional tests, omitting some. If it fails, further checks are not started until it is fixed. Look at the report to see which tests fail, then reproduce the failure locally as described here✅ success
Flaky testsChecks if new added or modified tests are flaky by running them repeatedly, in parallel, with more randomization. Functional tests are run 100 times with address sanitizer, and additional randomization of thread scheduling. Integration tests are run up to 10 times. If at least once a new test has failed, or was too long, this check will be red. We don't allow flaky tests, read the doc✅ success
Install packagesChecks that the built packages are installable in a clear environment✅ success
Integration testsThe integration tests report. In parenthesis the package type is given, and in square brackets are the optional part/total tests✅ success
Performance ComparisonMeasure changes in query performance. The performance test report is described in detail here. In square brackets are the optional part/total tests✅ success
Stateful testsRuns stateful functional tests for ClickHouse binaries built in various configurations -- release, debug, with sanitizers, etc✅ success
Stateless testsRuns stateless functional tests for ClickHouse binaries built in various configurations -- release, debug, with sanitizers, etc✅ success
Stress testRuns stateless functional tests concurrently from several clients to detect concurrency-related errors✅ success
Style checkRuns a set of checks to keep the code style clean. If some of tests failed, see the related log from the report✅ success
Unit testsRuns the unit tests for different release types✅ success

yakov-olkhovskiy
yakov-olkhovskiy reviewed Sep 3, 2024
View reviewed changes
@marco-vb
Copy link
Copy Markdown
Contributor Author

marco-vb commented Sep 10, 2024

hey @yakov-olkhovskiy thank you for reviewing these and testing. Does this approach look good to you overall? Is it okay to merge? Not sure about the red checks, seems like some mutation tests are not passing and not sure about the performance ones, as my change should not impact query performance.

@yakov-olkhovskiy
Copy link
Copy Markdown
Member

yakov-olkhovskiy commented Sep 10, 2024

@marco-vb flaky test is failing:
https://s3.amazonaws.com/clickhouse-test-reports/68236/d6ea08e8122c2577b5c486fae4e880217908ace9/integration_tests_flaky_check__asan_/integration_run_flaky_0.log
but it seems like a general flaw in the CI setup... will investigate today and probably merge as is...

@marco-vb
Copy link
Copy Markdown
Contributor Author

marco-vb commented Sep 12, 2024

@yakov-olkhovskiy thanks again for taking a look and fixing things. Now CI complains that 'New settings are not reflected in settings changes history' even though I do not add nor change any settings in this PR... Do you know why this is happening? This was also happening before I updated with new master commits too

@yakov-olkhovskiy
Copy link
Copy Markdown
Member

yakov-olkhovskiy commented Sep 12, 2024

I don't think it's relevant. Merging.

@yakov-olkhovskiy yakov-olkhovskiy added this pull request to the merge queue Sep 12, 2024
Merged via the queue into ClickHouse:master with commit d353374 Sep 12, 2024
@robot-clickhouse robot-clickhouse added the pr-synced-to-cloud The PR is synced to the cloud repo label Sep 12, 2024
@marco-vb marco-vb deleted the marco-vb/x509-san-support-wildcard branch September 12, 2024 16:46
@arthurpassos arthurpassos mentioned this pull request Sep 13, 2024
Merged
20 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yakov-olkhovskiy yakov-olkhovskiy yakov-olkhovskiy left review comments

Assignees

@santrancisco santrancisco

@yakov-olkhovskiy yakov-olkhovskiy

Labels

can be tested Allows running workflows for external contributors pr-improvement Pull request with some product improvements pr-synced-to-cloud The PR is synced to the cloud repo

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@marco-vb @CLAassistant @yakov-olkhovskiy @santrancisco @tonickkozlov @robot-ch-test-poll2 @robot-clickhouse @robot-ch-test-poll4