search

tapis-project / pods_service

Network Accessible Pods API.
https://tapis.readthedocs.io/en/latest/technical/pods.html
BSD 3-Clause "New" or "Revised" License
1 stars 1 forks source link

KG T1 - Possible to get around requiring TLS for TCP connections. #11

Closed NotChristianGarcia closed 1 year ago

NotChristianGarcia commented 2 years ago

Currently TLS is required so we can "ssl_preread" at the nginx level and route according to subdomain. With the bolt driver, user has to have TLS outgoing and incoming if "encrypted" attr is True. Meaning, we need to return TLS, meaning certs.

It might be possible for a user to send us non-TLS TCP, we convert that to TLS compliant TCP, THEN we preread subdomain information? This assumes that ssl_preread just works at this point. Might be possible. Nginx has the certs. We can then go back to sending non-TLS TCP to the pod. Bolt is happy in this case, because non-TLS out and non-TLS back.

NotChristianGarcia commented 1 year ago

There's no way to read SNI information. This is a flop for now.