Reject the client request if the client certificate has been revoked by ahrtr · Pull Request #22007 · etcd-io/etcd

ahrtr · 2026-06-29T15:36:56Z

Fix the issue that gRPC client listener does not enforce --client-crl-file certificate revocation.

Refer to GHSA-3wh4-j44w-pg92 for more details

codecov · 2026-06-29T16:09:36Z

Codecov Report

❌ Patch coverage is 0% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.65%. Comparing base (1cc3438) to head (2308ce1).

Files with missing lines	Patch %	Lines
client/pkg/transport/listener_tls.go	0.00%	16 Missing ⚠️
server/embed/serve.go	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
server/embed/serve.go	`58.98% <0.00%> (-0.41%)`	⬇️
client/pkg/transport/listener_tls.go	`61.90% <0.00%> (-6.52%)`	⬇️

... and 23 files with indirect coverage changes

@@            Coverage Diff             @@
##             main   #22007      +/-   ##
==========================================
- Coverage   69.76%   69.65%   -0.12%     
==========================================
  Files         449      449              
  Lines       38163    38181      +18     
==========================================
- Hits        26626    26596      -30     
- Misses      10112    10150      +38     
- Partials     1425     1435      +10

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1cc3438...2308ce1. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ahrtr · 2026-06-29T17:36:01Z

/retest

e2e fails

ahrtr · 2026-06-29T19:50:16Z

/test pull-etcd-e2e-amd64

ahrtr · 2026-06-29T20:22:18Z

@fuweid PTAL

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

ahrtr · 2026-06-30T09:41:35Z

Just added an e2e test case, confirmed the test case passes with the patch; and fails without the patch, see error below,

$ go test -run TestCtlV3GetRevokedCRLGRPCOnly -v
=== RUN   TestCtlV3GetRevokedCRLGRPCOnly
    testing.go:25: Changing working directory to: /var/folders/mf/_v3jxtyd0qgccvmc1z0_5klm0000gq/T/TestCtlV3GetRevokedCRLGRPCOnly2171455799/001
    logger.go:146: 2026-06-30T10:37:41.530+0100	INFO	starting server...	{"name": "TestCtlV3GetRevokedCRLGRPCOnly-test-0"}
    logger.go:146: 2026-06-30T10:37:41.531+0100	INFO	spawning process	{"args": ["/Users/wachao/go/src/github.com/ahrtr/etcd/bin/etcd", "--name=TestCtlV3GetRevokedCRLGRPCOnly-test-0", "--listen-client-urls=https://localhost:20000", "--advertise-client-urls=https://localhost:20000", "--listen-peer-urls=http://localhost:20001", "--initial-advertise-peer-urls=http://localhost:20001", "--initial-cluster-token=new", "--data-dir=/var/folders/mf/_v3jxtyd0qgccvmc1z0_5klm0000gq/T/TestCtlV3GetRevokedCRLGRPCOnly2171455799/002", "--snapshot-count=10000", "--listen-client-http-urls=https://localhost:20004", "--cert-file", "/Users/wachao/go/src/github.com/ahrtr/etcd/tests/fixtures/server.crt", "--key-file", "/Users/wachao/go/src/github.com/ahrtr/etcd/tests/fixtures/server.key.insecure", "--trusted-ca-file", "/Users/wachao/go/src/github.com/ahrtr/etcd/tests/fixtures/ca.crt", "--client-cert-auth", "--client-crl-file", "/Users/wachao/go/src/github.com/ahrtr/etcd/tests/fixtures/revoke.crl", "--client-cert-auth", "--feature-gates=InitialCorruptCheck=true", "--initial-cluster-token=new", "--initial-cluster=TestCtlV3GetRevokedCRLGRPCOnly-test-0=http://localhost:20001", "--initial-cluster-state=new"], "working-dir": "/var/folders/mf/_v3jxtyd0qgccvmc1z0_5klm0000gq/T/TestCtlV3GetRevokedCRLGRPCOnly2171455799/001", "name": "TestCtlV3GetRevokedCRLGRPCOnly-test-0", "environment-variables": ["PATH=/Users/wachao/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.4.darwin-arm64/bin:/Users/wachao/software/google-cloud-sdk/bin:/Users/wachao/.local/bin:/Users/wachao/software/kcp:/Users/wachao/software/prometheus:/Users/wachao/software/marker:/opt/homebrew/bin:/Users/wachao/software/java/jdk/Contents/Home/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Library/TeX/texbin:/opt/homebrew/bin:/Users/wachao/go/bin:/Users/wachao/software/etcd:/Users/wachao/software/golangci:/Users/wachao/software/umlet/umlet14:/Users/wachao/software/umlet/umlet15:/Users/wachao/software/protoc/bin:/Users/wachao/software/k8s_tools:/Users/wachao/software/jmeter/bin:/Users/wachao/software/grpcurl:/Users/wachao/software/pdfcpu:/Users/wachao/software/kubebuilder:/Users/wachao/software/go/bin:/Users/wachao/software/kind:/Users/wachao/software/gh/bin:/Users/wachao/software/shellcheck:/Users/wachao/software/etcd:/Users/wachao/software", "ETCD_UNSUPPORTED_ARCH=arm64", "ETCD_VERIFY=all"]}
    logger.go:146: 2026-06-30T10:37:41.953+0100	INFO	started server.	{"name": "TestCtlV3GetRevokedCRLGRPCOnly-test-0", "pid": 18549}
    ctl_v3_kv_test.go:76: 
        	Error Trace:	/Users/wachao/go/src/github.com/ahrtr/etcd/tests/e2e/ctl_v3_kv_test.go:76
        	            				/Users/wachao/go/src/github.com/ahrtr/etcd/tests/e2e/ctl_v3_test.go:262
        	            				/Users/wachao/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.4.darwin-arm64/src/runtime/asm_arm64.s:1447
        	Error:      	An error is expected but got nil.
        	Test:       	TestCtlV3GetRevokedCRLGRPCOnly
    ctl_v3_test.go:274: closing test cluster...
    logger.go:146: 2026-06-30T10:37:42.550+0100	INFO	stopping server...	{"name": "TestCtlV3GetRevokedCRLGRPCOnly-test-0"}
    logger.go:146: 2026-06-30T10:37:42.591+0100	INFO	stopped server.	{"name": "TestCtlV3GetRevokedCRLGRPCOnly-test-0"}
    logger.go:146: 2026-06-30T10:37:42.591+0100	INFO	closing test cluster...
    logger.go:146: 2026-06-30T10:37:42.591+0100	INFO	closing server...	{"name": "TestCtlV3GetRevokedCRLGRPCOnly-test-0"}
    logger.go:146: 2026-06-30T10:37:42.591+0100	INFO	removing directory	{"data-dir": "/var/folders/mf/_v3jxtyd0qgccvmc1z0_5klm0000gq/T/TestCtlV3GetRevokedCRLGRPCOnly2171455799/002"}
    logger.go:146: 2026-06-30T10:37:42.594+0100	INFO	closed test cluster.
    ctl_v3_test.go:278: closed test cluster...
--- FAIL: TestCtlV3GetRevokedCRLGRPCOnly (1.74s)
FAIL
exit status 1
FAIL	go.etcd.io/etcd/tests/v3/e2e	2.324s

ping @fuweid @ivanvc @serathius

ahrtr · 2026-06-30T10:01:54Z

/test pull-etcd-robustness-amd64

ahrtr · 2026-06-30T10:21:18Z

/test pull-etcd-e2e-amd64

ahrtr · 2026-07-01T09:07:50Z

ping @fuweid @ivanvc @serathius

kubernetes-prow · 2026-07-01T09:37:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahrtr, serathius

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ahrtr,serathius]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ahrtr · 2026-07-01T09:59:52Z

This should be a safe change, It's verified by an e2e test, also by manually steps. So merging for now.. to unblock the patch releases.

ahrtr · 2026-07-01T10:00:15Z

/cherry-pick release-3.7

ahrtr · 2026-07-01T10:00:21Z

/cherry-pick release-3.6

ahrtr · 2026-07-01T10:00:26Z

/cherry-pick release-3.5

k8s-infra-cherrypick-robot · 2026-07-01T10:01:18Z

@ahrtr: new pull request created: #22018

Details

In response to this:

/cherry-pick release-3.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-infra-cherrypick-robot · 2026-07-01T10:01:18Z

@ahrtr: new pull request created: #22019

Details

In response to this:

/cherry-pick release-3.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-infra-cherrypick-robot · 2026-07-01T10:01:19Z

@ahrtr: new pull request created: #22020

Details

In response to this:

/cherry-pick release-3.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kubernetes-prow Bot added size/XS approved labels Jun 29, 2026

serathius force-pushed the main branch from 8f85876 to 5f6496a Compare June 29, 2026 16:21

ahrtr force-pushed the 20260626_crl branch from 0b47507 to 1f690ab Compare June 29, 2026 16:34

ahrtr changed the title ~~Reject the client reqeust if the client certificate has been revoked~~ Reject the client request if the client certificate has been revoked Jun 29, 2026

fuweid previously approved these changes Jun 29, 2026

View reviewed changes

ahrtr force-pushed the 20260626_crl branch from 1f690ab to 5559ee4 Compare June 29, 2026 19:14

kubernetes-prow Bot added size/M and removed size/XS labels Jun 29, 2026

Reject the client reqeust if the client certificate has been revoked

2308ce1

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

ahrtr force-pushed the 20260626_crl branch from 5559ee4 to 2308ce1 Compare June 30, 2026 09:38

kubernetes-prow Bot added the area/testing label Jun 30, 2026

serathius approved these changes Jul 1, 2026

View reviewed changes

ahrtr merged commit 503a88f into etcd-io:main Jul 1, 2026
34 checks passed

This was referenced Jul 1, 2026

[release-3.7] Reject the client request if the client certificate has been revoked #22018

Closed

[release-3.6] Reject the client request if the client certificate has been revoked #22019

Closed

k8s-infra-cherrypick-robot mentioned this pull request Jul 1, 2026

[release-3.5] Reject the client request if the client certificate has been revoked #22020

Closed

nixpkgs-security-tracker Bot mentioned this pull request Jul 9, 2026

etcd: gRPC client listener does not enforce --client-crl-file certificate revocation NixOS/nixpkgs#539902

Open

Uh oh!

Conversation

ahrtr commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ahrtr commented Jun 29, 2026

Uh oh!

ahrtr commented Jun 29, 2026

Uh oh!

ahrtr commented Jun 29, 2026

Uh oh!

ahrtr commented Jun 30, 2026

Uh oh!

ahrtr commented Jun 30, 2026

Uh oh!

ahrtr commented Jun 30, 2026

Uh oh!

ahrtr commented Jul 1, 2026

Uh oh!

kubernetes-prow Bot commented Jul 1, 2026

Uh oh!

ahrtr commented Jul 1, 2026

Uh oh!

Uh oh!

ahrtr commented Jul 1, 2026

Uh oh!

ahrtr commented Jul 1, 2026

Uh oh!

ahrtr commented Jul 1, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 1, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 1, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

ahrtr commented Jun 29, 2026 •

edited

Loading

codecov Bot commented Jun 29, 2026 •

edited

Loading