mTLS client prototype#4031
Draft
End-rey wants to merge 3 commits into
Draft
Conversation
Storage nodes authenticate to each other with mutual TLS over their existing public gRPC port. A node dials with a sentinel SNI and is served the identity certificate, verified against the network map; clients keep getting the plain or server-TLS endpoint unchanged. Peers are pinned by their network-map key. Signed-off-by: Andrey Butusov <andrey@nspcc.io>
On the inter-node mTLS listener the peer is an authenticated network-map node, so verifying the per-request signature and signing the response are redundant for 1:1 (TTL<=1) hops and are skipped. Requests arriving on the plain public listener carry no TLS peer certificate and are always verified and signed, so clients remain unaffected. Signed-off-by: Andrey Butusov <andrey@nspcc.io>
Signed-off-by: Andrey Butusov <andrey@nspcc.io>
Contributor
Author
|
Benchmark tests were run for the client mTLS variant against the inter-node mTLS. Throughput in ops/s. Small-object GET still benefits in some cases, but overall client-side mTLS looks neutral-to-slightly-negative, while large-object GET generally a bit slower. REP3
EC6+2
The main gain vs base still comes from the inter-node changes; adding client-side mTLS does not show a general throughput improvement. The only clear positive signal here is small-object GET at low-to-medium concurrency, while large-object GET is somewhat worse |
End-rey
force-pushed
the
mtls
branch
2 times, most recently
from
055eceb to
810ccfe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continue #4003.