Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test: Update negative test case for TLS SNI #37386

Merged
merged 1 commit into from
Feb 1, 2025
Merged

test: Update negative test case for TLS SNI #37386

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cilium-cli/connectivity/builder/builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,9 @@ var (
//go:embed manifests/client-egress-tls-sni.yaml
clientEgressTLSSNIPolicyYAML string

//go:embed manifests/client-egress-tls-sni-other.yaml
clientEgressTLSSNIOtherPolicyYAML string

//go:embed manifests/client-egress-l7-tls-sni.yaml
clientEgressL7TLSSNIPolicyYAML string

Expand Down Expand Up @@ -311,6 +314,7 @@ func renderTemplates(clusterName string, param check.Parameters) (map[string]str
"clientEgressL7HTTPNamedPortPolicyYAML": clientEgressL7HTTPNamedPortPolicyYAML,
"clientEgressToFQDNsPolicyYAML": clientEgressToFQDNsPolicyYAML,
"clientEgressTLSSNIPolicyYAML": clientEgressTLSSNIPolicyYAML,
"clientEgressTLSSNIOtherPolicyYAML": clientEgressTLSSNIOtherPolicyYAML,
"clientEgressL7TLSSNIPolicyYAML": clientEgressL7TLSSNIPolicyYAML,
"clientEgressL7TLSPolicyYAML": clientEgressL7TLSPolicyYAML,
"clientEgressL7TLSPolicyPortRangeYAML": clientEgressL7TLSPolicyPortRangeYAML,
Expand Down
3 changes: 2 additions & 1 deletion cilium-cli/connectivity/builder/client_egress_tls_sni.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,13 @@ func clientEgressTlsSniTest(ct *check.ConnectivityTest, templates map[string]str
return check.ResultDefaultDenyEgressDrop, check.ResultNone
})

yamlFile = templates["clientEgressTLSSNIOtherPolicyYAML"]
newTest(fmt.Sprintf("%s-denied", testName), ct).
WithCiliumVersion("!1.14.15 !1.14.16 !1.15.9 !1.15.10 !1.16.2 !1.16.3").
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
WithCiliumPolicy(yamlFile). // L7 allow policy TLS SNI enforcement for external target
WithCiliumPolicy(templates["clientEgressOnlyDNSPolicyYAML"]). // DNS resolution only
WithScenarios(tests.PodToWorld2()). // Another External Target is not allowed
WithScenarios(tests.PodToWorld()). // External Target is not allowed
WithExpectations(func(a *check.Action) (egress, ingress check.Result) {
if a.Destination().Port() == 443 {
// SSL error as another external target (e.g. cilium.io) SNI is not allowed
Expand Down
17 changes: 17 additions & 0 deletions cilium-cli/connectivity/builder/manifests/client-egress-tls-sni-other.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Same as client-egress-tls-sni.yaml but with external other target server name
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: "client-egress-tls-sni-other"
specs:
- description: "TLS SNI policy with ExternalOtherTarget"
endpointSelector:
matchLabels:
kind: client
egress:
- toPorts:
- ports:
- port: "443"
protocol: "TCP"
serverNames:
- "{{trimSuffix .ExternalOtherTarget "."}}"
2 changes: 1 addition & 1 deletion cilium-cli/connectivity/tests/errors.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,5 +329,5 @@ var (
// Cf. https://github.com/cilium/cilium/issues/35803
endpointMapDeleteFailed = regexMatcher{regexp.MustCompile(`Ignoring error while deleting endpoint.*from map cilium_\w+: delete: key does not exist`)}
// envoyTLSWarning is the legitimate warning log for negative TLS SNI test case
envoyTLSWarning = regexMatcher{regexp.MustCompile("cilium.tls_wrapper: Could not get server TLS context for pod.*on destination IP.*port 443 sni.*cilium.io.*and raw socket is not allowed")}
envoyTLSWarning = regexMatcher{regexp.MustCompile("cilium.tls_wrapper: Could not get server TLS context for pod.*on destination IP.*port 443 sni.*one.one.one.one.*and raw socket is not allowed")}
)
Loading