Skip to content

Commit 59e94f3

Browse files
jastBytesjastBytes
authored
Reload certificates automatically (#38)
* Add auto reloader for tls conf Signed-off-by: Jan Steffen <[email protected]> * Add getclient cert Signed-off-by: Jan Steffen <[email protected]> * Start watch Signed-off-by: Jan Steffen <[email protected]> * Add root Signed-off-by: Jan Steffen <[email protected]> * Fix tls conf Signed-off-by: Jan Steffen <[email protected]> * Fix logging Signed-off-by: Jan Steffen <[email protected]> * fix level Signed-off-by: Jan Steffen <[email protected]> * Add test Signed-off-by: Jan Steffen <[email protected]> * Rename file Signed-off-by: Jan Steffen <[email protected]>
1 parent 39e32cd commit 59e94f3

File tree

9 files changed

+533
-55
lines changed

9 files changed

+533
-55
lines changed

‎go.mod‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,9 @@ require (
5454
github.com/elimity-com/scim v0.0.0-20211119105057-007f1a2691f0
5555
github.com/envoyproxy/protoc-gen-validate v0.6.2
5656
github.com/heptiolabs/healthcheck v0.0.0-20180807145615-6ff867650f40
57+
github.com/pkg/errors v0.9.1
5758
github.com/scim2/filter-parser/v2 v2.2.0
59+
gopkg.in/fsnotify.v1 v1.4.7
5860
)
5961

6062
require (
@@ -99,7 +101,6 @@ require (
99101
github.com/opencontainers/go-digest v1.0.0 // indirect
100102
github.com/opencontainers/image-spec v1.0.2 // indirect
101103
github.com/opencontainers/runc v1.0.3 // indirect
102-
github.com/pkg/errors v0.9.1 // indirect
103104
github.com/prometheus/client_model v0.2.0 // indirect
104105
github.com/prometheus/procfs v0.7.3 // indirect
105106
github.com/sirupsen/logrus v1.8.1 // indirect

‎go.sum‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1182,6 +1182,7 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8X
11821182
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
11831183
gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
11841184
gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
1185+
gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
11851186
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
11861187
gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
11871188
gopkg.in/go-playground/validator.v9 v9.29.1/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=

‎pkg/eventsourcing/messaging/bus_rabbitmq_config.go‎

Lines changed: 7 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,7 @@
1515
package messaging
1616

1717
import (
18-
"crypto/tls"
19-
"crypto/x509"
20-
"io/ioutil"
18+
m8tls "github.com/finleap-connect/monoskope/pkg/tls"
2119

2220
"github.com/finleap-connect/monoskope/pkg/eventsourcing/errors"
2321
amqp "github.com/rabbitmq/amqp091-go"
@@ -68,33 +66,22 @@ func NewRabbitEventBusConfig(name, url, routingKeyPrefix string) (*RabbitEventBu
6866

6967
// ConfigureTLS adds the configuration for TLS secured connection/auth
7068
func (conf *RabbitEventBusConfig) configureTLS() error {
71-
var err error
72-
caCertPool := x509.NewCertPool()
73-
ca, err := ioutil.ReadFile(CACertPath)
69+
loader, err := m8tls.NewTLSConfigLoader(CACertPath, TLSCertPath, TLSKeyPath)
7470
if err != nil {
7571
return err
7672
}
77-
caCertPool.AppendCertsFromPEM(ca)
7873

79-
conf.amqpConfig.TLSClientConfig = &tls.Config{
80-
RootCAs: caCertPool,
81-
GetClientCertificate: getClientCertificate,
74+
err = loader.Watch()
75+
if err != nil {
76+
return err
8277
}
78+
79+
conf.amqpConfig.TLSClientConfig = loader.GetTLSConfig()
8380
conf.amqpConfig.SASL = []amqp.Authentication{&CertAuth{}}
8481

8582
return nil
8683
}
8784

88-
// getClientCertificate returns the loaded certificate for use by
89-
// the TLSConfig fields getClientCertificate.
90-
func getClientCertificate(hello *tls.CertificateRequestInfo) (*tls.Certificate, error) {
91-
cert, err := tls.LoadX509KeyPair(TLSCertPath, TLSKeyPath)
92-
if err != nil {
93-
return nil, err
94-
}
95-
return &cert, nil
96-
}
97-
9885
// Validate validates the configuration
9986
func (conf *RabbitEventBusConfig) Validate() error {
10087
if conf.name == "" {

pkg/eventsourcing/storage/store_posgres_config.go renamed to pkg/eventsourcing/storage/store_postgres_config.go

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,12 @@
1515
package storage
1616

1717
import (
18-
"crypto/tls"
19-
"crypto/x509"
2018
"errors"
21-
"io/ioutil"
2219
"strings"
2320
"time"
2421

22+
m8tls "github.com/finleap-connect/monoskope/pkg/tls"
23+
2524
"github.com/go-pg/pg/v10"
2625
)
2726

@@ -30,6 +29,9 @@ const (
3029
DefaultReInitDelay = 5 * time.Second // When setting up db schema
3130
DefaultResendDelay = 3 * time.Second // When retrying to read/write
3231
DefaultMaxRetries = 10 // How many times retrying read/write
32+
CACertPath = "/etc/eventstore/certs/db/ca.crt"
33+
TLSCertPath = "/etc/eventstore/certs/db/tls.crt"
34+
TLSKeyPath = "/etc/eventstore/certs/db/tls.key"
3335
)
3436

3537
type postgresStoreConfig struct {
@@ -64,23 +66,19 @@ func NewPostgresStoreConfig(url string) (*postgresStoreConfig, error) {
6466

6567
// ConfigureTLS adds the configuration for TLS secured connection/auth
6668
func (conf *postgresStoreConfig) ConfigureTLS() error {
67-
cfg := &tls.Config{
68-
RootCAs: x509.NewCertPool(),
69-
ServerName: strings.Split(conf.pgOptions.Addr, ":")[0],
70-
}
71-
if ca, err := ioutil.ReadFile("/etc/eventstore/certs/db/ca.crt"); err != nil {
69+
loader, err := m8tls.NewTLSConfigLoader(CACertPath, TLSCertPath, TLSKeyPath)
70+
if err != nil {
7271
return err
73-
} else {
74-
cfg.RootCAs.AppendCertsFromPEM(ca)
7572
}
7673

77-
if cert, err := tls.LoadX509KeyPair("/etc/eventstore/certs/db/tls.crt", "/etc/eventstore/certs/db/tls.key"); err != nil {
74+
err = loader.Watch()
75+
if err != nil {
7876
return err
79-
} else {
80-
cfg.Certificates = append(cfg.Certificates, cert)
8177
}
8278

83-
conf.pgOptions.TLSConfig = cfg
79+
conf.pgOptions.TLSConfig = loader.GetTLSConfig()
80+
conf.pgOptions.TLSConfig.ServerName = strings.Split(conf.pgOptions.Addr, ":")[0]
81+
8482
return nil
8583
}
8684

‎pkg/grpc/connection.go‎

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,10 @@ package grpc
1616

1717
import (
1818
"context"
19-
"crypto/tls"
20-
"crypto/x509"
21-
"fmt"
22-
"io/ioutil"
2319
"time"
2420

21+
m8tls "github.com/finleap-connect/monoskope/pkg/tls"
22+
2523
grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/retry"
2624
"google.golang.org/grpc"
2725
"google.golang.org/grpc/credentials"
@@ -140,28 +138,15 @@ func (factory grpcConnectionFactory) ConnectWithTimeout(ctx context.Context, tim
140138

141139
// loadTLSCredentials actually loads the configured certs
142140
func (factory *grpcConnectionFactory) loadTLSCredentials() (credentials.TransportCredentials, error) {
143-
// Load certificate of the CA who signed server's certificate
144-
pemServerCA, err := ioutil.ReadFile(factory.tlsConf.pemServerCAFile)
141+
loader, err := m8tls.NewTLSConfigLoader(factory.tlsConf.pemServerCAFile, factory.tlsConf.certFile, factory.tlsConf.keyFile)
145142
if err != nil {
146143
return nil, err
147144
}
148145

149-
certPool := x509.NewCertPool()
150-
if !certPool.AppendCertsFromPEM(pemServerCA) {
151-
return nil, fmt.Errorf("failed to add server CA's certificate")
152-
}
153-
154-
// Load client's certificate and private key
155-
clientCert, err := tls.LoadX509KeyPair(factory.tlsConf.certFile, factory.tlsConf.keyFile)
146+
err = loader.Watch()
156147
if err != nil {
157148
return nil, err
158149
}
159150

160-
// Create the credentials and return it
161-
config := &tls.Config{
162-
Certificates: []tls.Certificate{clientCert},
163-
RootCAs: certPool,
164-
}
165-
166-
return credentials.NewTLS(config), nil
151+
return credentials.NewTLS(loader.GetTLSConfig()), nil
167152
}

‎pkg/tls/suite_test.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2022 Monoskope Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package tls
16+
17+
import (
18+
"testing"
19+
20+
"github.com/finleap-connect/monoskope/internal/test"
21+
22+
. "github.com/onsi/ginkgo"
23+
. "github.com/onsi/gomega"
24+
)
25+
26+
var testEnv *TestEnv
27+
28+
func TestTLS(t *testing.T) {
29+
RegisterFailHandler(Fail)
30+
RunSpecs(t, "tls")
31+
}
32+
33+
var _ = BeforeSuite(func() {
34+
done := make(chan interface{})
35+
36+
go func() {
37+
By("bootstrapping test env")
38+
39+
var err error
40+
baseTestEnv := test.NewTestEnv("TestTLS")
41+
testEnv, err = NewTestEnv(baseTestEnv)
42+
Expect(err).To(Not(HaveOccurred()))
43+
close(done)
44+
}()
45+
46+
Eventually(done, 60).Should(BeClosed())
47+
})
48+
49+
var _ = AfterSuite(func() {
50+
By("tearing down the test environment")
51+
})

0 commit comments

Comments
 (0)