etcd-io / etcd

Distributed reliable key-value store for the most critical data of a distributed system
https://etcd.io
Apache License 2.0
47.92k stars 9.78k forks source link

[3.5] add tls min/max version to grpc proxy #18829

Closed tjungblu closed 1 week ago

tjungblu commented 3 weeks ago

This adds the min and max TLS version support from #13506 and #15156 to the grpc proxy.

Fixes #13506 Backport of #18816

Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.

tjungblu commented 1 week ago

note to myself, I need to update the CHANGELOG

tjungblu commented 1 week ago

@ahrtr I have rebased, but I don't think this workflow failure is related to this PR nor main.

ahrtr commented 1 week ago

new CVE? @ivanvc @jmhbnz @ArkaSaha30

Vulnerability #1: GO-2024-3250
    Improper error handling in ParseWithClaims and bad documentation may cause
    dangerous situations in github.com/golang-jwt/jwt
  More info: https://pkg.go.dev/vuln/GO-2024-3250
  Module: github.com/golang-jwt/jwt/v4
    Found in: github.com/golang-jwt/jwt/v4@v4.4.2
    Fixed in: github.com/golang-jwt/jwt/v4@v4.5.1
    Example traces found:
Error:       #1: auth/jwt.go:48:26: auth.tokenJWT.info calls jwt.Parse
ahrtr commented 1 week ago

Raised https://github.com/etcd-io/etcd/issues/18898

k8s-ci-robot commented 1 week ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahrtr, jmhbnz, tjungblu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/etcd-io/etcd/blob/release-3.5/OWNERS)~~ [ahrtr,jmhbnz] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
ivanvc commented 1 week ago

/retest

Edit: ah, we need a rebase to have green tests

ahrtr commented 1 week ago

@tjungblu would you mind rebasing this PR before we merge it? thx

tjungblu commented 1 week ago

done

ahrtr commented 1 week ago

/retest