Skip to content

[TLS Credentials]: Private Key Offload Implementation#41606

Closed
anniefrchz wants to merge 96 commits intogrpc:masterfrom
anniefrchz:private_key_signer
Closed

[TLS Credentials]: Private Key Offload Implementation#41606
anniefrchz wants to merge 96 commits intogrpc:masterfrom
anniefrchz:private_key_signer

Conversation

@anniefrchz
Copy link
Copy Markdown
Contributor

No description provided.

anniefrchz and others added 30 commits February 10, 2026 19:12
yaml-cpp@0.9.0 is released at
bazelbuild/bazel-central-registry#7443

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->
PiperOrigin-RevId: 868250332
The `grpc_bazel_c_cpp_{opt,dbg}` tests are failing with timeout (most failures are under `//test/core/end2end` ). The exact cause isn't clear (might be bzlmod causing slower compilation). Try increasing the timeout to see if the error goes away.
 https://fusion2.corp.google.com/ci;ids=1930537984/kokoro/prod:grpc%2Fcore%2Fmaster%2Fmacos%2Fgrpc_bazel_c_cpp_dbg/activity/0d32a035-4712-49af-9f20-e90d065e3ae0/summary

Closes grpc#41596

COPYBARA_INTEGRATE_REVIEW=grpc#41596 from yuanweiz:fix-macos-ci bf8754f
PiperOrigin-RevId: 868346260
Changes in parser:
- add support for max recursion depth limit
- add support for keep_matching
- check if field is unset
- eliminate unnecessary `ParseStringMatcher()` function

Changes in matcher:
- fix edge case in `XdsMatcherPrefixMap`
- add `ForEachAction()` method, which will be needed by composite filter
- split matcher and matcher context into separate build targets

b/431645556
b/431645620

Closes grpc#41500

COPYBARA_INTEGRATE_REVIEW=grpc#41500 from markdroth:xds_matcher_polish f41a36e
PiperOrigin-RevId: 868440217
PiperOrigin-RevId: 868492036
…ficates independently (grpc#41484)

<!--

If you know who should review your pull request, please assign it to that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the appropriate
lang label.

-->

Closes grpc#41484

COPYBARA_INTEGRATE_REVIEW=grpc#41484 from anniefrchz:in_memory_provider d5c64b9
PiperOrigin-RevId: 868750621
…rpc#41597)

These tests don't work with the `Chttp2SocketPair` or `Chttp2SocketPair1ByteAtATime` fixtures, since they use direct channels.

Closes grpc#41597

COPYBARA_INTEGRATE_REVIEW=grpc#41597 from markdroth:connection_scaling_test_fix 6a5c84f
PiperOrigin-RevId: 868763207
Copy link
Copy Markdown
Contributor Author

@anniefrchz anniefrchz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I pushed the changes from your last revision minus the tests that were deleted. I was defeated by github UI in finding the comments in the file view to respond to them but all other commets should be addressed.
Thanks!

@anniefrchz anniefrchz requested a review from markdroth February 26, 2026 02:14
Copy link
Copy Markdown
Contributor Author

@anniefrchz anniefrchz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This patch is ready for another review

Copy link
Copy Markdown
Member

@markdroth markdroth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks really good!

Just a few minor cosmetic comments remaining; feel free to merge after addressing.

Copy link
Copy Markdown
Contributor

@gtcooke94 gtcooke94 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This LGTM once you finish roth@'s other comments!

justsmth added a commit to aws/aws-lc that referenced this pull request Mar 4, 2026
### Description of changes:
gRPC recently landed a TLS Private Key Offload feature (grpc/grpc#41606)
that gates BoringSSL-specific code paths behind `#ifdef
OPENSSL_IS_BORINGSSL`. AWS-LC defines `OPENSSL_IS_AWSLC` instead, so
gRPC doesn't recognize it as BoringSSL-compatible. This causes all 11
`TlsPrivateKeyOffloadTest` tests to fail at setup time because
`grpc_tls_identity_pairs_add_pair_with_signer` returns
`UnimplementedError`.

Since AWS-LC is a BoringSSL fork and supports all the relevant APIs
(e.g. `SSL_PRIVATE_KEY_METHOD`), we pass `-DOPENSSL_IS_BORINGSSL=1` via
`CMAKE_C_FLAGS`/`CMAKE_CXX_FLAGS` when building gRPC. This enables the
BoringSSL code paths that are correct for AWS-LC, including private key
offload, optimized session caching, and type macros.

### Call-outs:
All `OPENSSL_IS_BORINGSSL` checks in gRPC are preprocessor-level guards
inside source files — there's no CMake-level source file selection based
on BoringSSL detection, so the CFLAGS approach is safe.

### Testing:
The gRPC integration test itself validates the fix — the 11
`TlsPrivateKeyOffloadTest` tests that were failing should now pass.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
WillChilds-Klein pushed a commit to WillChilds-Klein/aws-lc that referenced this pull request Mar 11, 2026
### Description of changes:
gRPC recently landed a TLS Private Key Offload feature (grpc/grpc#41606)
that gates BoringSSL-specific code paths behind `#ifdef
OPENSSL_IS_BORINGSSL`. AWS-LC defines `OPENSSL_IS_AWSLC` instead, so
gRPC doesn't recognize it as BoringSSL-compatible. This causes all 11
`TlsPrivateKeyOffloadTest` tests to fail at setup time because
`grpc_tls_identity_pairs_add_pair_with_signer` returns
`UnimplementedError`.

Since AWS-LC is a BoringSSL fork and supports all the relevant APIs
(e.g. `SSL_PRIVATE_KEY_METHOD`), we pass `-DOPENSSL_IS_BORINGSSL=1` via
`CMAKE_C_FLAGS`/`CMAKE_CXX_FLAGS` when building gRPC. This enables the
BoringSSL code paths that are correct for AWS-LC, including private key
offload, optimized session caching, and type macros.

### Call-outs:
All `OPENSSL_IS_BORINGSSL` checks in gRPC are preprocessor-level guards
inside source files — there's no CMake-level source file selection based
on BoringSSL detection, so the CFLAGS approach is safe.

### Testing:
The gRPC integration test itself validates the fix — the 11
`TlsPrivateKeyOffloadTest` tests that were failing should now pass.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
@markdroth markdroth added release notes: yes Indicates if PR needs to be in release notes and removed release notes: no Indicates if PR should not be in release notes labels Mar 16, 2026
Zgoda91 pushed a commit to Zgoda91/grpc that referenced this pull request Mar 22, 2026
Closes grpc#41606

COPYBARA_INTEGRATE_REVIEW=grpc#41606 from anniefrchz:private_key_signer 881d900
PiperOrigin-RevId: 876385877
nebeid pushed a commit to nebeid/aws-lc that referenced this pull request Mar 23, 2026
### Description of changes:
gRPC recently landed a TLS Private Key Offload feature (grpc/grpc#41606)
that gates BoringSSL-specific code paths behind `#ifdef
OPENSSL_IS_BORINGSSL`. AWS-LC defines `OPENSSL_IS_AWSLC` instead, so
gRPC doesn't recognize it as BoringSSL-compatible. This causes all 11
`TlsPrivateKeyOffloadTest` tests to fail at setup time because
`grpc_tls_identity_pairs_add_pair_with_signer` returns
`UnimplementedError`.

Since AWS-LC is a BoringSSL fork and supports all the relevant APIs
(e.g. `SSL_PRIVATE_KEY_METHOD`), we pass `-DOPENSSL_IS_BORINGSSL=1` via
`CMAKE_C_FLAGS`/`CMAKE_CXX_FLAGS` when building gRPC. This enables the
BoringSSL code paths that are correct for AWS-LC, including private key
offload, optimized session caching, and type macros.

### Call-outs:
All `OPENSSL_IS_BORINGSSL` checks in gRPC are preprocessor-level guards
inside source files — there's no CMake-level source file selection based
on BoringSSL detection, so the CFLAGS approach is safe.

### Testing:
The gRPC integration test itself validates the fix — the 11
`TlsPrivateKeyOffloadTest` tests that were failing should now pass.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
asheshvidyut pushed a commit to asheshvidyut/grpc that referenced this pull request Mar 26, 2026
Closes grpc#41606

COPYBARA_INTEGRATE_REVIEW=grpc#41606 from anniefrchz:private_key_signer 881d900
PiperOrigin-RevId: 876385877
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants