Cherry pick "[nydusd] Support custom TLS CA" (#31)

* Add TLS and mTLS support for nydusd

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

* Fix format

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

* Handle only TLS trusted CA configuration

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

* Also inject ca_cert_files for HttpProxyConfig

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

* Also add the configuration for the proxy

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

* Add some unit tests for ca_cert_files parameter

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

---------

Signed-off-by: Etienne Carriere <etienne.carriere@datadoghq.com>

Author: ecdatadog

api/src/config.rs

@@ -504,6 +504,9 @@ pub struct OssConfig {
     /// Skip SSL certificate validation for HTTPS scheme.
     #[serde(default)]
     pub skip_verify: bool,
+    /// Paths to PEM-encoded CA certificate files to trust in addition to the system CA store.
+    #[serde(default)]
+    pub ca_cert_files: Vec<String>,
     /// Drop the read request once http request timeout, in seconds.
     #[serde(default = "default_http_timeout")]
     pub timeout: u32,
@@ -548,6 +551,9 @@ pub struct S3Config {
     /// Skip SSL certificate validation for HTTPS scheme.
     #[serde(default)]
     pub skip_verify: bool,
+    /// Paths to PEM-encoded CA certificate files to trust in addition to the system CA store.
+    #[serde(default)]
+    pub ca_cert_files: Vec<String>,
     /// Drop the read request once http request timeout, in seconds.
     #[serde(default = "default_http_timeout")]
     pub timeout: u32,
@@ -577,6 +583,9 @@ pub struct HttpProxyConfig {
     /// Skip SSL certificate validation for HTTPS scheme.
     #[serde(default)]
     pub skip_verify: bool,
+    /// Paths to PEM-encoded CA certificate files to trust in addition to the system CA store.
+    #[serde(default)]
+    pub ca_cert_files: Vec<String>,
     /// Drop the read request once http request timeout, in seconds.
     #[serde(default = "default_http_timeout")]
     pub timeout: u32,
@@ -611,6 +620,9 @@ pub struct RegistryConfig {
     /// When true, also allows automatic HTTPS-to-HTTP fallback on TLS errors.
     #[serde(default)]
     pub skip_verify: bool,
+    /// Paths to PEM-encoded CA certificate files to trust in addition to the system CA store.
+    #[serde(default)]
+    pub ca_cert_files: Vec<String>,
     /// Drop the read request once http request timeout, in seconds.
     #[serde(default = "default_http_timeout")]
     pub timeout: u32,
@@ -1745,6 +1757,7 @@ mod tests {
         let config: OssConfig = serde_json::from_str(content).unwrap();
         assert_eq!(config.scheme, "https");
         assert!(!config.skip_verify);
+        assert!(config.ca_cert_files.is_empty());
         assert_eq!(config.timeout, 5);
         assert_eq!(config.connect_timeout, 5);
     }
@@ -1762,6 +1775,7 @@ mod tests {
         let config: OssConfig = serde_json::from_str(content).unwrap();
         assert_eq!(config.scheme, "https");
         assert!(!config.skip_verify);
+        assert!(config.ca_cert_files.is_empty());
         assert_eq!(config.timeout, 5);
         assert_eq!(config.connect_timeout, 5);
     }
@@ -1775,11 +1789,15 @@ mod tests {
 	    "repo": "test/repo",
 	    "auth": "base64_encoded_auth",
 	    "registry_token": "bearer_token",
-	    "blob_redirected_host": "blob_redirected_host"
+	    "blob_redirected_host": "blob_redirected_host",
+        "ca_cert_files": ["/etc/ssl/certs/my-ca.pem","/etc/ssl/certs/my-ca2.pem"]
         }"#;
         let config: RegistryConfig = serde_json::from_str(content).unwrap();
         assert_eq!(config.scheme, "http");
         assert!(config.skip_verify);
+        assert_eq!(config.ca_cert_files.len(), 2);
+        assert_eq!(config.ca_cert_files[0], "/etc/ssl/certs/my-ca.pem");
+        assert_eq!(config.ca_cert_files[1], "/etc/ssl/certs/my-ca2.pem");
     }
 
     #[test]

docs/nydusd.md

@@ -260,6 +260,9 @@ Document located at: https://github.com/adamqqqplay/nydus-localdisk/blob/master/
         // Skip SSL certificate validation for HTTPS scheme.
         // When true, also allows automatic HTTPS-to-HTTP fallback on TLS errors.
         "skip_verify": false,
+        // Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+        // Useful when the registry uses a private or self-signed CA.
+        "ca_cert_files": ["/etc/ssl/certs/my-ca.pem"],
         // Use format `$namespace/$repo` (no image tag)
         "repo": "test/repo",
         // Username and password for auth

misc/configs/nydusd-blob-cache-entry-configuration-v2.toml

@@ -31,6 +31,9 @@ access_key_id = "my_access_key_id"
 access_key_secret = "my_access_key_secret"
 # Skip SSL certificate validation for HTTPS scheme.
 skip_verify = true
+# Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+# Useful when the endpoint uses a private or self-signed CA.
+# ca_cert_files = ["/etc/ssl/certs/my-ca.pem"]
 # Drop the read request once http request timeout, in seconds.
 timeout = 10
 # Drop the read request once http connection timeout, in seconds.
@@ -74,6 +77,9 @@ auth = "base64_encoded"
 # Skip SSL certificate validation for HTTPS scheme.
 # When true, also allows automatic HTTPS-to-HTTP fallback on TLS errors.
 skip_verify = true
+# Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+# Useful when the registry uses a private or self-signed CA.
+# ca_cert_files = ["/etc/ssl/certs/my-ca.pem"]
 # Drop the read request once http request timeout, in seconds.
 timeout = 10
 # Drop the read request once http connection timeout, in seconds.

misc/configs/nydusd-blob-cache-entry.toml

@@ -36,6 +36,9 @@ access_key_id = "my_access_key_id"
 access_key_secret = "my_access_key_secret"
 # Skip SSL certificate validation for HTTPS scheme.
 skip_verify = true
+# Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+# Useful when the endpoint uses a private or self-signed CA.
+# ca_cert_files = ["/etc/ssl/certs/my-ca.pem"]
 # Drop the read request once http request timeout, in seconds.
 timeout = 10
 # Drop the read request once http connection timeout, in seconds.
@@ -79,6 +82,9 @@ auth = "base64_encoded"
 # Skip SSL certificate validation for HTTPS scheme.
 # When true, also allows automatic HTTPS-to-HTTP fallback on TLS errors.
 skip_verify = true
+# Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+# Useful when the registry uses a private or self-signed CA.
+# ca_cert_files = ["/etc/ssl/certs/my-ca.pem"]
 # Drop the read request once http request timeout, in seconds.
 timeout = 10
 # Drop the read request once http connection timeout, in seconds.

misc/configs/nydusd-config-v2.toml

@@ -29,6 +29,9 @@ access_key_id = "my_access_key_id"
 access_key_secret = "my_access_key_secret"
 # Skip SSL certificate validation for HTTPS scheme.
 skip_verify = true
+# Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+# Useful when the endpoint uses a private or self-signed CA.
+# ca_cert_files = ["/etc/ssl/certs/my-ca.pem"]
 # Drop the read request once http request timeout, in seconds.
 timeout = 10
 # Drop the read request once http connection timeout, in seconds.
@@ -72,6 +75,9 @@ auth = "base64_encoded"
 # Skip SSL certificate validation for HTTPS scheme.
 # When true, also allows automatic HTTPS-to-HTTP fallback on TLS errors.
 skip_verify = true
+# Paths to PEM-encoded CA certificate files to trust in addition to the system CA store, optional.
+# Useful when the registry uses a private or self-signed CA.
+# ca_cert_files = ["/etc/ssl/certs/my-ca.pem"]
 # Drop the read request once http request timeout, in seconds.
 timeout = 10
 # Drop the read request once http connection timeout, in seconds.

misc/configs/nydusd-config.json

@@ -5,7 +5,9 @@
       "config": {
         "timeout": 5,
         "connect_timeout": 5,
-        "retry_limit": 2
+        "retry_limit": 2,
+        "skip_verify": false,
+        "ca_cert_files": ["/etc/ssl/certs/my-ca.pem"]
       }
     },
     "cache": {

storage/src/backend/connection.rs

@@ -74,6 +74,8 @@ pub(crate) struct ConnectionConfig {
     pub timeout: u32,
     pub connect_timeout: u32,
     pub retry_limit: u8,
+    /// Paths to PEM-encoded CA certificate files to trust in addition to the system CA store.
+    pub ca_cert_files: Vec<String>,
 }
 
 impl Default for ConnectionConfig {
@@ -85,6 +87,7 @@ impl Default for ConnectionConfig {
             timeout: 5,
             connect_timeout: 5,
             retry_limit: 0,
+            ca_cert_files: Vec::new(),
         }
     }
 }
@@ -98,6 +101,7 @@ impl From<OssConfig> for ConnectionConfig {
             timeout: c.timeout,
             connect_timeout: c.connect_timeout,
             retry_limit: c.retry_limit,
+            ca_cert_files: c.ca_cert_files,
         }
     }
 }
@@ -111,6 +115,7 @@ impl From<S3Config> for ConnectionConfig {
             timeout: c.timeout,
             connect_timeout: c.connect_timeout,
             retry_limit: c.retry_limit,
+            ca_cert_files: c.ca_cert_files,
         }
     }
 }
@@ -124,6 +129,7 @@ impl From<RegistryConfig> for ConnectionConfig {
             timeout: c.timeout,
             connect_timeout: c.connect_timeout,
             retry_limit: c.retry_limit,
+            ca_cert_files: c.ca_cert_files,
         }
     }
 }
@@ -137,6 +143,7 @@ impl From<HttpProxyConfig> for ConnectionConfig {
             timeout: c.timeout,
             connect_timeout: c.connect_timeout,
             retry_limit: c.retry_limit,
+            ca_cert_files: c.ca_cert_files,
         }
     }
 }
@@ -660,6 +667,12 @@ impl Connection {
             cb = cb.danger_accept_invalid_certs(true);
         }
 
+        for ca_cert_file in &config.ca_cert_files {
+            let pem = std::fs::read(ca_cert_file).map_err(|e| einval!(e))?;
+            let cert = reqwest::Certificate::from_pem(&pem).map_err(|e| einval!(e))?;
+            cb = cb.add_root_certificate(cert);
+        }
+
         if !proxy.is_empty() {
             cb = cb.proxy(reqwest::Proxy::all(proxy).map_err(|e| einval!(e))?)
         }
@@ -789,5 +802,6 @@ mod tests {
         assert_eq!(config.proxy.ping_url, "");
         assert_eq!(config.proxy.url, "");
         assert!(config.mirrors.is_empty());
+        assert!(config.ca_cert_files.is_empty());
     }
 }