Skip to content

tls: remove compatibility shim for X509_V_FLAG_NO_CHECK_TIME#43770

Merged
ggreenway merged 1 commit intoenvoyproxy:mainfrom
ggreenway:delete-cruft
Mar 5, 2026
Merged

tls: remove compatibility shim for X509_V_FLAG_NO_CHECK_TIME#43770
ggreenway merged 1 commit intoenvoyproxy:mainfrom
ggreenway:delete-cruft

Conversation

@ggreenway
Copy link
Copy Markdown
Member

@ggreenway ggreenway commented Mar 4, 2026

Additional Description: This deletes code that wasn't needed anymore
Risk Level: Low
Testing: Existing tests
Docs Changes: none
Release Notes: none

@ggreenway
tls: remove compatibility shim for X509_V_FLAG_NO_CHECK_TIME
b7d1498 
Signed-off-by: Greg Greenway <ggreenway@apple.com>
@gemini-code-assist
Copy link
Copy Markdown
Contributor

gemini-code-assist bot commented Mar 4, 2026

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request streamlines the TLS certificate validation logic by removing a compatibility shim that was no longer necessary. The CertValidatorUtil class, which provided a conditional mechanism to ignore certificate expiration based on BoringSSL version, has been entirely removed. This change allows for direct use of the X509_V_FLAG_NO_CHECK_TIME flag, simplifying the codebase and leveraging updated OpenSSL/BoringSSL capabilities.

Highlights

  • Compatibility Shim Removal: The CertValidatorUtil compatibility shim, which conditionally handled X509_V_FLAG_NO_CHECK_TIME for ignoring certificate expiration, has been entirely removed.
  • Direct Flag Usage: The code now directly utilizes the X509_V_FLAG_NO_CHECK_TIME flag in OpenSSL/BoringSSL for ignoring certificate expiration, simplifying the TLS validation logic.
  • Codebase Cleanup: Obsolete utility files (utility.cc and utility.h) and their references in build configurations and source files have been deleted, leading to a cleaner codebase.
Changelog
  • source/common/tls/cert_validator/BUILD
    • Removed references to utility.cc and utility.h from the build rules.
  • source/common/tls/cert_validator/default_validator.cc
    • Removed the include for source/common/tls/cert_validator/utility.h.
    • Replaced the call to CertValidatorUtil::setIgnoreCertificateExpiration with a direct call to X509_STORE_set_flags using X509_V_FLAG_NO_CHECK_TIME.
  • source/common/tls/cert_validator/utility.cc
    • Deleted the entire file, removing the implementation of the CertValidatorUtil class.
  • source/common/tls/cert_validator/utility.h
    • Deleted the entire header file, removing the declaration of the CertValidatorUtil class.
  • source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc
    • Removed the include for source/common/tls/cert_validator/utility.h.
    • Replaced the call to CertValidatorUtil::setIgnoreCertificateExpiration with a direct call to X509_STORE_CTX_set_flags using X509_V_FLAG_NO_CHECK_TIME.
Activity
  • No human activity (comments, reviews, etc.) has been recorded on this pull request yet.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist bot reviewed Mar 4, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request removes a compatibility shim for X509_V_FLAG_NO_CHECK_TIME, which is a good cleanup. However, the new implementation using X509_STORE_set_flags and X509_STORE_CTX_set_flags reveals a pre-existing critical issue where certificate verification flags are overwritten instead of being accumulated. This could lead to security features like CRL checking being silently disabled. I've added comments in the relevant files with suggestions to fix this by correctly combining the flags.

RyanTheOptimist
RyanTheOptimist approved these changes Mar 5, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@RyanTheOptimist RyanTheOptimist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the cleanup!

@ggreenway
Copy link
Copy Markdown
Member Author

ggreenway commented Mar 5, 2026

/retest

@ggreenway ggreenway enabled auto-merge (squash) March 5, 2026 17:35
@ggreenway ggreenway merged commit 3bf195f into envoyproxy:main Mar 5, 2026
29 checks passed
bmjask pushed a commit to bmjask/envoy that referenced this pull request Mar 14, 2026
@ggreenway @bmjask
tls: remove compatibility shim for X509_V_FLAG_NO_CHECK_TIME (envoypr…
c7d3d2a 
…oxy#43770)

This deletes code that wasn't needed anymore

Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: bjmask <11672696+bjmask@users.noreply.github.com>
bvandewalle pushed a commit to bvandewalle/envoy that referenced this pull request Mar 17, 2026
@ggreenway @bvandewalle
tls: remove compatibility shim for X509_V_FLAG_NO_CHECK_TIME (envoypr…
8c7e418 
…oxy#43770)

This deletes code that wasn't needed anymore

Signed-off-by: Greg Greenway <ggreenway@apple.com>
fishcakez pushed a commit to fishcakez/envoy that referenced this pull request Mar 25, 2026
@ggreenway @fishcakez
tls: remove compatibility shim for X509_V_FLAG_NO_CHECK_TIME (envoypr…
d488023 
…oxy#43770)

This deletes code that wasn't needed anymore

Signed-off-by: Greg Greenway <ggreenway@apple.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RyanTheOptimist RyanTheOptimist RyanTheOptimist approved these changes

@mathetake mathetake Awaiting requested review from mathetake mathetake is a code owner

@botengyao botengyao Awaiting requested review from botengyao botengyao is a code owner

@tyxia tyxia Awaiting requested review from tyxia tyxia is a code owner

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@RyanTheOptimist RyanTheOptimist

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ggreenway @RyanTheOptimist