Merge pull request #22021 from ahrtr/20260701_crl_3.5

[release-3.5] Reject the client request if the client certificate has been revoked

Author: ahrtr

client/pkg/transport/listener_tls.go

@@ -166,6 +166,29 @@ func (l *tlsListener) acceptLoop() {
 	}
 }
 
+// ConfigureCRLVerification appends a VerifyConnection hook to cfg that
+// rejects any peer certificate whose serial number appears in the CRL file
+// configured on info. It is a no-op when CRLFile is empty. Any existing
+// VerifyConnection hook is called first and its error short-circuits.
+func (info TLSInfo) ConfigureCRLVerification(cfg *tls.Config) {
+	if len(info.CRLFile) == 0 {
+		return
+	}
+	crlFile := info.CRLFile
+	prev := cfg.VerifyConnection
+	cfg.VerifyConnection = func(cs tls.ConnectionState) error {
+		if prev != nil {
+			if err := prev(cs); err != nil {
+				return err
+			}
+		}
+		if len(cs.PeerCertificates) == 0 {
+			return nil
+		}
+		return checkCRL(crlFile, cs.PeerCertificates)
+	}
+}
+
 func checkCRL(crlPath string, cert []*x509.Certificate) error {
 	// TODO: cache
 	crlBytes, err := ioutil.ReadFile(crlPath)

server/embed/serve.go

@@ -223,6 +223,14 @@ func (sctx *serveCtx) serve(
 			return tlsErr
 		}
 
+		// In gRPC-only mode the gRPC stack owns the TLS handshake (via grpc.Creds).
+		// Wrapping sctx.l with a second TLS listener would cause a double-TLS failure,
+		// so inject CRL checking into the TLS config before the gRPC server is created
+		// (gRPC clones the config at creation time).
+		if onlyGRPC {
+			tlsinfo.ConfigureCRLVerification(tlscfg)
+		}
+
 		if grpcEnabled {
 			gs = v3rpc.Server(s, tlscfg, nil, gopts...)
 			v3electionpb.RegisterElectionServer(gs, servElection)

tests/e2e/ctl_v3_kv_test.go

@@ -69,6 +69,23 @@ func TestCtlV3GetRevokedCRL(t *testing.T) {
 	testCtl(t, testGetRevokedCRL, withCfg(cfg))
 }
 
+// TestCtlV3GetRevokedCRLGRPCOnly is the same as TestCtlV3GetRevokedCRL but uses
+// --listen-client-http-urls to split HTTP and gRPC onto separate ports. In that
+// mode the gRPC server owns the TLS handshake directly (onlyGRPC=true in
+// serve.go) and CRL checking must be injected via ConfigureCRLVerification
+// rather than through the wrapping TLS listener used in the combined path.
+func TestCtlV3GetRevokedCRLGRPCOnly(t *testing.T) {
+	cfg := e2e.EtcdProcessClusterConfig{
+		ClusterSize:           1,
+		InitialToken:          "new",
+		ClientTLS:             e2e.ClientTLS,
+		IsClientCRL:           true,
+		ClientCertAuthEnabled: true,
+		ClientHttpSeparate:    true,
+	}
+	testCtl(t, testGetRevokedCRL, withCfg(cfg))
+}
+
 func testGetRevokedCRL(cx ctlCtx) {
 	// test reject
 	if err := ctlV3Put(cx, "k", "v", ""); err == nil || !strings.Contains(err.Error(), "Error:") {