resource/remote: support TLS coordinator sessions for RemotePlace

Signed-off-by: Asher Pemberton <asher.pemberton@arm.com>
Reviewed-by: Asher Pemberton <asher.pemberton@arm.com> # gatekeeper

Author: asher-pem-arm

doc/getting_started.rst

@@ -449,6 +449,9 @@ When you are connecting with ``labgrid-client`` or ``labgrid-exporter`` to a
 the ``--tls`` (and ``--cert`` if the certificate is not trusted by the host
 machine) option.
 Refer to the ``labgrid-client`` and ``labgrid-exporter`` man pages for details.
+For ``RemotePlace`` connections from an environment config, set the
+``coordinator_tls`` option or ``LG_COORDINATOR_TLS``. If the certificate
+is not trusted by the host machine, set ``coordinator_cert`` in the config.
 
 Using a Strategy
 ----------------

doc/man/device-config.rst

@@ -43,6 +43,15 @@ OPTIONS KEYS
   takes as parameter the coordinator ``HOST[:PORT]`` to connect to.
   Defaults to ``127.0.0.1:20408``.
 
+``coordinator_tls``
+  enables a TLS gRPC channel for ``RemotePlace`` connections.
+  Defaults to whether ``LG_COORDINATOR_TLS`` is set.
+
+``coordinator_cert``
+  path to the coordinator TLS certificate in PEM format for ``RemotePlace``
+  connections. If unset, the host CA certificates are used. Relative paths are
+  resolved relative to the configuration file.
+
 .. _labgrid-device-config-images:
 
 IMAGES

labgrid/resource/remote.py

@@ -1,3 +1,4 @@
+from argparse import Namespace
 import copy
 import os
 import attr
@@ -16,13 +17,47 @@ def __attrs_post_init__(self):
         self.ready = None
         self.unmanaged_resources = []
 
+    @staticmethod
+    def _is_tls_option_enabled(value):
+        if isinstance(value, str):
+            return value.strip().lower() == "true"
+
+        return value is True
+
+    def _get_credentials(self):
+        from ..remote.common import get_client_credentials
+
+        tls = os.environ.get("LG_COORDINATOR_TLS") is not None
+        cert = None
+
+        if self.env:
+            config = self.env.config
+            tls = config.get_option("coordinator_tls", tls)
+
+            cert = config.get_option("coordinator_cert", "")
+            if cert:
+                cert = config.resolve_path(str(cert))
+            else:
+                cert = None
+
+        args = Namespace(
+            tls=self._is_tls_option_enabled(tls),
+            cert=cert,
+        )
+
+        return get_client_credentials(args)
+
     def _start(self):
         if self.session:
             return
 
         from ..remote.client import start_session
         try:
-            self.session = start_session(self.url, extra={'env': self.env})
+            self.session = start_session(
+                self.url,
+                extra={'env': self.env},
+                credentials=self._get_credentials(),
+            )
         except ConnectionRefusedError as e:
             raise ConnectionRefusedError(f"Could not connect to coordinator {self.url}") \
                 from e

man/labgrid-device-config.5

@@ -60,6 +60,15 @@ The \fBoptions:\fP top key configures various options such as the coordinator_ad
 .B \fBcoordinator_address\fP
 takes as parameter the coordinator \fBHOST[:PORT]\fP to connect to.
 Defaults to \fB127.0.0.1:20408\fP\&.
+.TP
+.B \fBcoordinator_tls\fP
+enables a TLS gRPC channel for \fBRemotePlace\fP connections.
+Defaults to whether \fBLG_COORDINATOR_TLS\fP is set.
+.TP
+.B \fBcoordinator_cert\fP
+path to the coordinator TLS certificate in PEM format for \fBRemotePlace\fP
+connections. If unset, the host CA certificates are used. Relative paths are
+resolved relative to the configuration file.
 .UNINDENT
 .SS IMAGES
 .sp

tests/test_remote.py

@@ -1,8 +1,12 @@
 import argparse
 import pexpect
 import pytest
+from labgrid import Environment, Target
 from labgrid.remote.coordinator import get_server_credentials
 from labgrid.remote.common import get_client_credentials
+from labgrid.resource import RemotePlace
+from labgrid.resource.common import ResourceManager
+from labgrid.util.yaml import dump
 
 
 def test_client_help():
@@ -287,3 +291,81 @@ def test_get_client_credentials_valid(tmpdir):
     creds = get_client_credentials(ns)
 
     assert creds is not None
+
+
+def _make_remote_place_config(tmpdir, options=None):
+    config = tmpdir.join("config.yaml")
+    data = {"targets": {}}
+    if options:
+        data["options"] = options
+
+    config.write(dump(data))
+
+    return config
+
+
+def _capture_remote_place_credentials(monkeypatch, tmpdir, *, options=None, tls_env=False):
+    monkeypatch.setattr(ResourceManager, "instances", {})
+    monkeypatch.delenv("LG_COORDINATOR_TLS", raising=False)
+
+    if tls_env:
+        monkeypatch.setenv("LG_COORDINATOR_TLS", "true")
+
+    class DummySession:
+        loop = None
+
+        def get_place(self, name):
+            return argparse.Namespace(tags={}, acquired_resources=[])
+
+        def get_target_resources(self, place):
+            return {}
+
+    captured = {}
+
+    def get_client_credentials(args):
+        captured["args"] = args
+        return "credentials" if args.tls else None
+
+    def start_session(address, *, extra=None, credentials=None, **kwargs):
+        captured["credentials"] = credentials
+        return DummySession()
+
+    monkeypatch.setattr("labgrid.remote.common.get_client_credentials", get_client_credentials)
+    monkeypatch.setattr("labgrid.remote.client.start_session", start_session)
+
+    config = _make_remote_place_config(tmpdir, options=options)
+    env = Environment(str(config))
+    target = Target("test", env=env)
+    RemotePlace(target, name="test")
+
+    return captured
+
+
+@pytest.mark.parametrize(
+    ("options", "tls_env", "expected_tls", "expected_cert"),
+    [
+        pytest.param({}, False, False, None, id="default-no-tls"),
+        pytest.param({}, True, True, None, id="tls-env"),
+        pytest.param(
+            {"coordinator_tls": True, "coordinator_cert": "cert.pem"},
+            False,
+            True,
+            "cert.pem",
+            id="tls-config",
+        ),
+        pytest.param({"coordinator_tls": "TRUE"}, False, True, None, id="tls-config-string"),
+        pytest.param({"coordinator_tls": False}, True, False, None, id="config-overrides-env"),
+        pytest.param({"coordinator_tls": "false"}, True, False, None, id="config-string-overrides-env"),
+    ],
+)
+def test_remote_place_client_credentials(monkeypatch, tmpdir, options, tls_env, expected_tls, expected_cert):
+    cert_path, _ = setup_tmp_cert_key(tmpdir)
+    assert cert_path.basename == "cert.pem"
+    if expected_cert:
+        expected_cert = str(tmpdir.join(expected_cert))
+
+    captured = _capture_remote_place_credentials(monkeypatch, tmpdir, options=options, tls_env=tls_env)
+
+    assert captured["args"].tls is expected_tls
+    assert captured["args"].cert == expected_cert
+    assert captured["credentials"] == ("credentials" if expected_tls else None)