cmd/litewitness,cmd/witnessctl: remove -bastion flag, add set-bastions command

Fixes #64

Author: FiloSottile

NEWS.md

@@ -1,3 +1,16 @@
+## Unreleased
+
+### litewitness
+
+- The `-bastion` flag was removed. Configure per-log bastions instead, for
+  example with the new `set-bastions` witnessctl command.
+
+### witnessctl
+
+- Added `set-bastions` command, which adds the given bastion(s) to every log
+  that has none configured (for example after `pull-logs`), or replaces the
+  bastions of every log with `-all`.
+
 ## v0.9.0
 
 ### torchwood

cmd/litewitness/README.md

@@ -52,21 +52,17 @@ ssh-agent -a litewitness.sock
 SSH_AUTH_SOCK=litewitness.sock ssh-add litewitness.pem
 ```
 
-    -bastion string
-            address of the bastion(s) to reverse proxy through, comma separated, the first online one is selected
     -listen string
             address to listen for HTTP requests (default "localhost:7380")
     -no-listen
             do not open any listening socket, rely exclusively on bastions
 
-Only one of `-bastion` or `-listen` must be specified, or `-no-listen` can be
-used to rely exclusively on per-log bastions configured in the database. The
-`-bastion` flag will cause litewitness to serve requests through a bastion
-reverse proxy (see below). The `-listen` flag will listen for HTTP requests on
-the specified port. (HTTPS needs to be terminated outside of litewitness.) The
-bastion flag is an optionally comma-separated list of bastions to try in order
-until one connects successfully. If the connection drops after establishing,
-litewitness exits.
+The `-listen` flag will listen for HTTP requests on the specified port. (HTTPS
+needs to be terminated outside of litewitness.) Alternatively, `-no-listen` can
+be used to rely exclusively on per-log bastions, which are configured in the
+database with the `add-bastion`, `del-bastion`, and `set-bastions` witnessctl
+commands (see below) and cause litewitness to serve requests through a bastion
+reverse proxy.
 
     -obscurity
             enable obscurity mode (disable / and /logz and /metrics endpoints)
@@ -111,6 +107,15 @@ for a log. Multiple bastions can be configured for a log and will be used
 simultaneously. Bastion configuration is reloaded when litewitness receives a
 SIGHUP signal.
 
+    witnessctl set-bastions -db <path> -bastion <address:port>[,<address:port>] [-all]
+
+The `set-bastions` command adds the given bastion(s) to every log that has none
+configured, for example after `pull-logs` adds new logs. With `-all`, it
+replaces the bastions of every log instead.
+
+Use this if the witness is exposed to the internet only through a global
+bastion, for logs that don't have a per-log bastion endpoint.
+
     witnessctl add-sigsum-log -db <path> -key <hex-encoded key>
 
 The `add-sigsum-log` command is a helper that adds a new Sigsum log, computing

cmd/litewitness/litewitness.go

@@ -22,7 +22,6 @@ import (
 	"os"
 	"os/signal"
 	"slices"
-	"strings"
 	"syscall"
 	"time"
 
@@ -45,7 +44,6 @@ var sshAgentFlag = flag.String("ssh-agent", "litewitness.sock", "path to ssh-age
 var listenFlag = flag.String("listen", "localhost:7380", "address to listen for HTTP requests")
 var noListenFlag = flag.Bool("no-listen", false, "do not open any listening socket, rely exclusively on bastions")
 var keyFlag = flag.String("key", "", "SSH fingerprint (with SHA256: prefix) of the witness key")
-var bastionFlag = flag.String("bastion", "", "address of the bastion(s) to reverse proxy through, comma separated, the first online one is selected")
 var testCertFlag = flag.Bool("testcert", false, "use rootCA.pem for connections to the bastion")
 var obscurityFlag = flag.Bool("obscurity", false, "enable obscurity mode (disable / and /logz endpoints)")
 var listenMetricsFlag = flag.String("listen-metrics", "", "address to listen for metrics requests, instead of exposing them on the main listener")
@@ -204,7 +202,7 @@ func main() {
 		retry := 0
 		for {
 			startTime := time.Now()
-			err := connectToBastion(ctx, addr, bastionCert, srv, true)
+			err := connectToBastion(ctx, addr, bastionCert, srv)
 			duration := time.Since(startTime)
 			slog.Warn("bastion connection failed", "bastion", addr, "duration", duration, "err", err)
 
@@ -256,20 +254,7 @@ func main() {
 		bastionSet.Configure(ctx, logBastions)
 	})
 
-	if *bastionFlag != "" {
-		go func() {
-			for _, bastion := range strings.Split(*bastionFlag, ",") {
-				err := connectToBastion(ctx, bastion, bastionCert, srv, false)
-				if err == errBastionDisconnected {
-					// Connection succeeded and then was interrupted. Restart to
-					// let the scheduler apply any backoff, and then retry all bastions.
-					e <- err
-					return
-				}
-			}
-			e <- errors.New("couldn't connect to any bastion")
-		}()
-	} else if !*noListenFlag {
+	if !*noListenFlag {
 		go func() {
 			slog.Info("listening", "addr", *listenFlag)
 			e <- srv.ListenAndServe()
@@ -418,7 +403,7 @@ func indexHandler(w *witness.Witness) http.HandlerFunc {
 
 var errBastionDisconnected = errors.New("connection to bastion interrupted")
 
-func connectToBastion(ctx context.Context, bastion string, cert tls.Certificate, srv *http.Server, logSpecific bool) error {
+func connectToBastion(ctx context.Context, bastion string, cert tls.Certificate, srv *http.Server) error {
 	slog.Info("connecting to bastion", "bastion", bastion)
 	dialCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
@@ -454,9 +439,7 @@ func connectToBastion(ctx context.Context, bastion string, cert tls.Certificate,
 	}(ctx)
 
 	slog.Info("connected to bastion", "bastion", bastion)
-	if logSpecific {
-		ctx = witness.ContextWithBastion(ctx, bastion)
-	}
+	ctx = witness.ContextWithBastion(ctx, bastion)
 	// TODO: find a way to surface the fatal error, especially since with
 	// TLS 1.3 it might be that the bastion rejected the client certificate.
 	(&http2.Server{

cmd/litewitness/testdata/bastion.txt

@@ -3,6 +3,11 @@
 # set up log
 exec witnessctl add-sigsum-log -key=ffdc2d4d98e4124d3feaf788c0c2f9abfd796083d1f0495437f302ec79cf100f
 
+# set the bastions of all logs
+exec witnessctl set-bastions -bastion=0.0.0.0:443,localhost:8443
+stderr 'Added bastion "0.0.0.0:443" for log "sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562"'
+stderr 'Added bastion "localhost:8443" for log "sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562"'
+
 # start bastion
 exec litebastion -tls-cert localhost.pem -tls-key localhost-key.pem -backends=backends.txt &litebastion&
 waitfor localhost:8443
@@ -14,15 +19,12 @@ waitfor $SSH_AUTH_SOCK
 chmod 600 witness_key.pem
 exec ssh-add witness_key.pem
 
-# fail to start litewitness
-! exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -bastion=0.0.0.0:443,localhost:8443 -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a
+# start litewitness, which can't connect until the backends are reloaded
+exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -no-listen -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a &litewitness&
 
 # reload backends
 mv correct_backends.txt backends.txt
 killall -SIGHUP litebastion
-
-# start litewitness
-exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -bastion=0.0.0.0:443,localhost:8443 -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a &litewitness&
 waitfor https://localhost:8443/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/
 
 # add-checkpoint

cmd/litewitness/testdata/bastionlocal.txt

@@ -3,6 +3,9 @@
 # set up log
 exec witnessctl add-sigsum-log -key=ffdc2d4d98e4124d3feaf788c0c2f9abfd796083d1f0495437f302ec79cf100f
 
+# set the bastions of all logs
+exec witnessctl set-bastions -bastion=0.0.0.0:443,localhost:8444
+
 # start bastion
 exec litebastion -tls-cert localhost.pem -tls-key localhost-key.pem -backends=backends.txt -listen localhost:8444 -listen-http 8080 &litebastion&
 waitfor localhost:8444
@@ -14,15 +17,12 @@ waitfor $SSH_AUTH_SOCK
 chmod 600 witness_key.pem
 exec ssh-add witness_key.pem
 
-# fail to start litewitness
-! exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -bastion=0.0.0.0:443,localhost:8444 -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a
+# start litewitness, which can't connect until the backends are reloaded
+exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -no-listen -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a &litewitness&
 
 # reload backends
 mv correct_backends.txt backends.txt
 killall -SIGHUP litebastion
-
-# start litewitness
-exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -bastion=0.0.0.0:443,localhost:8444 -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a &litewitness&
 waitfor http://localhost:8080/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/
 
 # add-checkpoint to bastion interface

cmd/litewitness/testdata/bastionlocalhost.txt

@@ -3,6 +3,9 @@
 # set up log
 exec witnessctl add-sigsum-log -key=ffdc2d4d98e4124d3feaf788c0c2f9abfd796083d1f0495437f302ec79cf100f
 
+# set the bastions of all logs
+exec witnessctl set-bastions -bastion=0.0.0.0:443,localhost:8445
+
 # start bastion with host:port -listen-http
 exec litebastion -tls-cert localhost.pem -tls-key localhost-key.pem -backends=backends.txt -listen localhost:8445 -listen-http localhost:8081 &litebastion&
 waitfor localhost:8445
@@ -14,15 +17,12 @@ waitfor $SSH_AUTH_SOCK
 chmod 600 witness_key.pem
 exec ssh-add witness_key.pem
 
-# fail to start litewitness
-! exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -bastion=0.0.0.0:443,localhost:8445 -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a
+# start litewitness, which can't connect until the backends are reloaded
+exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -no-listen -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a &litewitness&
 
 # reload backends
 mv correct_backends.txt backends.txt
 killall -SIGHUP litebastion
-
-# start litewitness
-exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -bastion=0.0.0.0:443,localhost:8445 -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a &litewitness&
 waitfor http://localhost:8081/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/
 
 # add-checkpoint to bastion interface

cmd/litewitness/testdata/loglist.txt

@@ -25,6 +25,23 @@ exec witnessctl list-logs
 cmp stdout list-logs.2.jsonl
 ! stderr .
 
+# set the bastion of logs that don't have one
+exec witnessctl set-bastions -bastion bastion-3.example.org:666
+stderr 'Added bastion "bastion-3.example.org:666" for log "example.com/foo"'
+exec witnessctl list-logs
+cmp stdout list-logs.3.jsonl
+! stderr .
+
+# running it again is a no-op
+exec witnessctl set-bastions -bastion bastion-3.example.org:666
+! stderr .
+
+# override the bastions of all logs
+exec witnessctl set-bastions -all -bastion bastion-4.example.org:666
+exec witnessctl list-logs
+cmp stdout list-logs.4.jsonl
+! stderr .
+
 -- log_list.0 --
 #
 # List:      10qps-100klogs
@@ -82,3 +99,11 @@ origin sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4
 {"origin":"example.com/foo","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/2ef59132082631d13e353b5ae49b22bc51a9bd59f41a2d570960a9658c1ed151+e2137795+ATp+37IPHc3SbPGzFMyZmPTOUlClk6PYPH+Ce5JiCb/h"],"bastions":[]}
 {"origin":"sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4cd2e9b8702","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4cd2e9b8702+9bc54c7f+AVv6q3xDaHxI2aTemqEb7W6ZcbO7QbTqTr20thOqfqsw"],"bastions":[]}
 {"origin":"sigsum.org/v1/tree/fae7fd8f084f9e7a1482162da8a3e52b08e6c1bac74ab831d00eb5c983b84120","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/fae7fd8f084f9e7a1482162da8a3e52b08e6c1bac74ab831d00eb5c983b84120+7f693d84+AUlxeri80AO7/4j/+OGo+5M2Sud0ktFg34uZl2fZnjJT"],"bastions":["bastion-1.example.org:666","bastion-2.example.org:666"]}
+-- list-logs.3.jsonl --
+{"origin":"example.com/foo","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/2ef59132082631d13e353b5ae49b22bc51a9bd59f41a2d570960a9658c1ed151+e2137795+ATp+37IPHc3SbPGzFMyZmPTOUlClk6PYPH+Ce5JiCb/h"],"bastions":["bastion-3.example.org:666"]}
+{"origin":"sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4cd2e9b8702","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4cd2e9b8702+9bc54c7f+AVv6q3xDaHxI2aTemqEb7W6ZcbO7QbTqTr20thOqfqsw"],"bastions":["bastion-3.example.org:666"]}
+{"origin":"sigsum.org/v1/tree/fae7fd8f084f9e7a1482162da8a3e52b08e6c1bac74ab831d00eb5c983b84120","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/fae7fd8f084f9e7a1482162da8a3e52b08e6c1bac74ab831d00eb5c983b84120+7f693d84+AUlxeri80AO7/4j/+OGo+5M2Sud0ktFg34uZl2fZnjJT"],"bastions":["bastion-1.example.org:666","bastion-2.example.org:666"]}
+-- list-logs.4.jsonl --
+{"origin":"example.com/foo","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/2ef59132082631d13e353b5ae49b22bc51a9bd59f41a2d570960a9658c1ed151+e2137795+ATp+37IPHc3SbPGzFMyZmPTOUlClk6PYPH+Ce5JiCb/h"],"bastions":["bastion-4.example.org:666"]}
+{"origin":"sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4cd2e9b8702","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/f48d4a1d0c6370ec189dc537f648ef3bb347b012fbd3c899a630a4cd2e9b8702+9bc54c7f+AVv6q3xDaHxI2aTemqEb7W6ZcbO7QbTqTr20thOqfqsw"],"bastions":["bastion-4.example.org:666"]}
+{"origin":"sigsum.org/v1/tree/fae7fd8f084f9e7a1482162da8a3e52b08e6c1bac74ab831d00eb5c983b84120","size":0,"root_hash":"47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","keys":["sigsum.org/v1/tree/fae7fd8f084f9e7a1482162da8a3e52b08e6c1bac74ab831d00eb5c983b84120+7f693d84+AUlxeri80AO7/4j/+OGo+5M2Sud0ktFg34uZl2fZnjJT"],"bastions":["bastion-4.example.org:666"]}

cmd/witnessctl/witnessctl.go

@@ -29,6 +29,7 @@ func usage() {
 	fmt.Println("    del-key -db <path> -origin <origin> -key <verifier key>")
 	fmt.Println("    add-bastion -db <path> -origin <origin> -bastion <address:port>")
 	fmt.Println("    del-bastion -db <path> -origin <origin> -bastion <address:port>")
+	fmt.Println("    set-bastions -db <path> -bastion <address:port>[,<address:port>] [-all]")
 	fmt.Println("    add-sigsum-log -db <path> -key <hex-encoded key>")
 	fmt.Println("    pull-logs -db <path> -source <witness url> [-verbose]")
 	fmt.Println("    list-logs -db <path>")
@@ -83,6 +84,17 @@ func main() {
 		delBastion(db, *originFlag, *bastionFlag)
 		log.Printf("Deleted bastion %q for log %q.", *bastionFlag, *originFlag)
 
+	case "set-bastions":
+		bastionFlag := fs.String("bastion", "", "comma-separated address:port list")
+		allFlag := fs.Bool("all", false, "replace the bastions of all logs, not just those without any")
+		fs.Parse(os.Args[2:])
+		bastions := strings.Split(*bastionFlag, ",")
+		for _, bastion := range bastions {
+			checkBastion(bastion)
+		}
+		db := openDB(*dbFlag)
+		setBastions(db, bastions, *allFlag)
+
 	case "add-sigsum-log":
 		keyFlag := fs.String("key", "", "hex-encoded key")
 		fs.Parse(os.Args[2:])
@@ -183,6 +195,32 @@ func delBastion(db *sqlite.Conn, origin string, bastion string) {
 	}
 }
 
+func setBastions(db *sqlite.Conn, bastions []string, all bool) {
+	query := `SELECT origin FROM log WHERE NOT EXISTS
+		(SELECT 1 FROM bastion WHERE bastion.origin = log.origin)`
+	if all {
+		query = "SELECT origin FROM log"
+	}
+	var origins []string
+	if err := sqlitexExec(db, query, func(stmt *sqlite.Stmt) error {
+		origins = append(origins, stmt.ColumnText(0))
+		return nil
+	}); err != nil {
+		log.Fatalf("Error listing logs: %v", err)
+	}
+	if all {
+		if err := sqlitexExec(db, "DELETE FROM bastion", nil); err != nil {
+			log.Fatalf("Error deleting bastions: %v", err)
+		}
+	}
+	for _, origin := range origins {
+		for _, bastion := range bastions {
+			addBastion(db, origin, bastion)
+			log.Printf("Added bastion %q for log %q.", bastion, origin)
+		}
+	}
+}
+
 func addSigsumLog(db *sqlite.Conn, keyFlag string) {
 	if len(keyFlag) != sigsum.PublicKeySize*2 {
 		log.Fatal("Key must be 32 hex-encoded bytes.")