Repository navigation
fix(security): refuse auth reloads the running TLS cannot enforce - #269
Merged
Merged
Conversation
`mtls` and certificate authentication in `both` are checked only by the TLS handshake. Each listener builds its handshake once at startup. A reload could switch auth to either mode. Listeners started plaintext or with `tls.client_auth: none` then accepted every request unauthenticated until restart. `create_auth_state` takes the listener's running handshake and refuses `mtls` or `both` if it admits clients without certificate verification. The reload watcher keeps the current auth if replacement auth fails to build. A refused reload logs an error and leaves auth unchanged. Every listener that reloads auth passes its handshake: HTTP, Splunk HEC, Prometheus remote write, OTLP on both ports and gRPC. The gRPC and OTLP gRPC interceptor demanded a bearer token for every request. `mtls` builds no token provider, so an `mtls` port refused every RPC. Under `mtls`, the interceptor skips token checks, matching the HTTP middleware. Startup validation and the reload check both reject handshakes that do not verify the certificate.
Document gRPC support for `auth.mode: mtls` with `tls.client_auth: required`. The hardening and sidecar pages no longer send certificate users to `mode: none`. The internals page says a reload into `mtls` or `both` is refused when the running handshake accepts any client. The current auth stays.
catinspace-au
force-pushed
the
fix/mtls-reload
branch
from
November 15, 2026 08:51
4d8429d to
9c058bd
Compare
|
Released in v1.15.69 -- https://github.com/hyperi-io/dfe-receiver/releases/tag/v1.15.69 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A reload replaced the whole auth section, including the mode. The client-certificate policy is built once at start. Reloading from
bearerintomtlson a plaintext listener accepted unauthenticated ingest until a restart.create_auth_statetakes the listener's runningHandshake. It refusesmtlsorbothwhen the handshake admits clients without a certificate. The watcher keeps the current auth and logs an error.The gRPC and OTLP gRPC interceptor demanded a bearer token on every request, so
mtlsrefused every RPC. The interceptor now skips bearer-token checks undermtls, as the HTTP middleware does. OTLP HTTP sharesotlp.authwith OTLP gRPC, so validation affects both.tls.client_authhot reload is outside this change.The first three tests fail on main:
a_reload_into_mtls_over_plaintext_keeps_the_current_authreloads every listener intomtls. For 1s the token must still work and a bare request must still be refused.the_grpc_interceptor_checks_what_the_mode_namescovers the interceptor undermtlsandbearer.client_certificates_are_required_on_every_mtls_listenerruns both gRPC ports undermtlsand sends an RPC with the client certificate.a_certificate_mode_needs_a_handshake_that_requires_onetests the build cases forcreate_auth_state.Done when CI Quality and Test are green.