boulder
boulder copied to clipboard
gRPC: reject request if clock skew is too large
Have our gRPC server interceptor check for excessive clock skew between its own clock and gRPC client clocks. Do this by taking advantage of the client request timestamp that most clients already supply for the purpose of measuring cross-service latency. If the included timestamp is more than 10 minutes from the gRPC server's local time, immediately error out.
Add a unit test to check this behavior. Also update small bits of the integration tests to ensure that they comply with this new requirement.
Fixes https://github.com/letsencrypt/boulder/issues/7684