Repository: grpc/grpc-go
File: credentials/tls.go (Go)

Code before:

	"google.golang.org/grpc/grpclog"
	credinternal "google.golang.org/grpc/internal/credentials"
	"google.golang.org/grpc/internal/envconfig"
)

const alpnFailureHelpMessage = "If you upgraded from a grpc-go version earlier than 1.67, your TLS connections may have stopped working due to ALPN enforcement. For more details, see: https://github.com/grpc/grpc-go/issues/434"

var logger = grpclog.Component("credentials")

// TLSInfo contains the auth information for a TLS authenticated connection.
// It implements the AuthInfo interface.
type TLSInfo struct {
	State tls.ConnectionState
	CommonAuthInfo
	// This API is experimental.
	SPIFFEID *url.URL
}

// AuthType returns the type of TLSInfo as a string.
func (t TLSInfo) AuthType() string {
	return "tls"
}

// ValidateAuthority validates that the provided authority being used to
// override the :authority header is valid by verifying it against the peer
// certificates. It returns nil on successful validation, or a non-nil error if
// the validation fails.
func (t TLSInfo) ValidateAuthority(authority string) error {
	var errs []error
	for _, cert := range t.State.PeerCertificates {
		var err error
		if err = cert.VerifyHostname(authority); err == nil {
			return nil
		}
		errs = append(errs, err)
	}
	return fmt.Errorf("credentials: invalid authority %q: %w", authority, errors.Join(errs...))
}

// cipherSuiteLookup returns the string version of a TLS cipher suite ID.
func cipherSuiteLookup(cipherSuiteID uint16) string {
	for _, s := range tls.CipherSuites() {
		if s.ID == cipherSuiteID {
			return s.Name
		}
	}
	for _, s := range tls.InsecureCipherSuites() {
		if s.ID == cipherSuiteID {
			return s.Name
		}

Review comment (security):
```suggestion
// override the :authority header by verifying it against the peer
```

Code after:

	"google.golang.org/grpc/grpclog"
	credinternal "google.golang.org/grpc/internal/credentials"
	"google.golang.org/grpc/internal/envconfig"
)

const alpnFailureHelpMessage = "If you upgraded from a grpc-go version earlier than 1.67, your TLS connections may have stopped working due to ALPN enforcement. For more details, see: https://github.com/grpc/grpc-go/issues/434"

var logger = grpclog.Component("credentials")

// TLSInfo contains the auth information for a TLS authenticated connection.
// It implements the AuthInfo interface.
type TLSInfo struct {
	State tls.ConnectionState
	CommonAuthInfo
	// This API is experimental.
	SPIFFEID *url.URL
}

// AuthType returns the type of TLSInfo as a string.
func (t TLSInfo) AuthType() string {
	return "tls"
}

// ValidateAuthority validates the provided authority being used to override the
// :authority header by verifying it against the peer certificates. It returns a
// non-nil error if the validation fails.
func (t TLSInfo) ValidateAuthority(authority string) error {
	var errs []error
	for _, cert := range t.State.PeerCertificates {
		var err error
		if err = cert.VerifyHostname(authority); err == nil {
			return nil
		}
		errs = append(errs, err)
	}
	return fmt.Errorf("credentials: invalid authority %q: %v", authority, errors.Join(errs...))
}

// cipherSuiteLookup returns the string version of a TLS cipher suite ID.
func cipherSuiteLookup(cipherSuiteID uint16) string {
	for _, s := range tls.CipherSuites() {
		if s.ID == cipherSuiteID {
			return s.Name
		}
	}
	for _, s := range tls.InsecureCipherSuites() {
		if s.ID == cipherSuiteID {
			return s.Name
		}
	}