test: Add negative test case for TLS SNI #37122
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/test |
cb81b4e to
000d799
Compare
000d799 to
c285d1d
Compare
|
/test |
jrajahalme
reviewed
Jan 21, 2025
c285d1d to
bba9788
Compare
christarazi
approved these changes
Jan 22, 2025
|
/test |
|
Rebased to pick up the fix for ci-eks #37184 |
We don't really need to toFQDNs rule for as the feature under test is TLS SNI. Signed-off-by: Tam Mach <tam.mach@cilium.io>
This commit is to add the negative test case for TLS SNI feature with another external target (e.g. cilium.io). There should be no policy dropped but SSL error from curl command. ``` $ kex -n cilium-test-1 client-645b68dcf7-n4xx7 -- curl -v https://cilium.io * Host cilium.io:443 was resolved. * IPv6: (none) * IPv4: 104.198.14.52 * Trying 104.198.14.52:443... * Connected to cilium.io (104.198.14.52) port 443 * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * Recv failure: Connection reset by peer * OpenSSL SSL_connect: Connection reset by peer in connection to cilium.io:443 * Closing connection curl: (35) Recv failure: Connection reset by peer command terminated with exit code 35 ``` Signed-off-by: Tam Mach <tam.mach@cilium.io>
bba9788 to
05cdc50
Compare
|
/test |
sayboras
added a commit
to sayboras/cilium
that referenced
this pull request
Jan 31, 2025
The current SNI denied test sends request to cilium.io with serverNames as one.one.one.one, and expects TLS error. However, cilium.io might not be as reliable compared to one.one.one.one, hence causes timeout issue (e.g. 28) instead of expected SSL error code (e.g. 35) as observed in cilium#37381. This commit is to reverse the test to use one.one.one.one as external target, however, new CNP client-egress-tls-sni-other will only allow serverNames with ExternalOtherTarget (defaults to cilium.io). Relates: cilium#37122, cilium#37381 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
to sayboras/cilium
that referenced
this pull request
Jan 31, 2025
The current SNI denied test sends request to cilium.io with serverNames as one.one.one.one, and expects TLS error. However, cilium.io might not be as reliable compared to one.one.one.one, hence causes timeout issue (e.g. 28) instead of expected SSL error code (e.g. 35) as observed in the issue cilium#37381. This commit is to reverse the test to use one.one.one.one as external target, however, new CNP client-egress-tls-sni-other will only allow serverNames with ExternalOtherTarget (defaults to cilium.io). Relates: cilium#37122, cilium#37381 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
to sayboras/cilium
that referenced
this pull request
Jan 31, 2025
The current SNI denied test sends request to cilium.io with serverNames as one.one.one.one, and expects TLS error. However, cilium.io might not be as reliable compared to one.one.one.one, hence causes timeout issue (e.g. 28) instead of expected SSL error code (e.g. 35) as observed in the issue cilium#37381. This commit is to reverse the test to use one.one.one.one as external target, however, new CNP client-egress-tls-sni-other will only allow serverNames with ExternalOtherTarget (defaults to cilium.io). Relates: cilium#37122, cilium#37381 Signed-off-by: Tam Mach <tam.mach@cilium.io>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Feb 1, 2025
The current SNI denied test sends request to cilium.io with serverNames as one.one.one.one, and expects TLS error. However, cilium.io might not be as reliable compared to one.one.one.one, hence causes timeout issue (e.g. 28) instead of expected SSL error code (e.g. 35) as observed in the issue #37381. This commit is to reverse the test to use one.one.one.one as external target, however, new CNP client-egress-tls-sni-other will only allow serverNames with ExternalOtherTarget (defaults to cilium.io). Relates: #37122, #37381 Signed-off-by: Tam Mach <tam.mach@cilium.io>
jongj
pushed a commit
to jongj/cilium
that referenced
this pull request
Feb 11, 2025
The current SNI denied test sends request to cilium.io with serverNames as one.one.one.one, and expects TLS error. However, cilium.io might not be as reliable compared to one.one.one.one, hence causes timeout issue (e.g. 28) instead of expected SSL error code (e.g. 35) as observed in the issue cilium#37381. This commit is to reverse the test to use one.one.one.one as external target, however, new CNP client-egress-tls-sni-other will only allow serverNames with ExternalOtherTarget (defaults to cilium.io). Relates: cilium#37122, cilium#37381 Signed-off-by: Tam Mach <tam.mach@cilium.io>
karina-ranadive
pushed a commit
to karina-ranadive/cilium
that referenced
this pull request
Jun 24, 2025
The current SNI denied test sends request to cilium.io with serverNames as one.one.one.one, and expects TLS error. However, cilium.io might not be as reliable compared to one.one.one.one, hence causes timeout issue (e.g. 28) instead of expected SSL error code (e.g. 35) as observed in the issue cilium#37381. This commit is to reverse the test to use one.one.one.one as external target, however, new CNP client-egress-tls-sni-other will only allow serverNames with ExternalOtherTarget (defaults to cilium.io). Relates: cilium#37122, cilium#37381 Signed-off-by: Tam Mach <tam.mach@cilium.io>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please refer to individual commit for more details. The first commit is to simplify the current policy, and pave the way for the second one.