agents: add root certs API and use it in OTLPAgent

Also, make all our existing agents code to use it.
Ideally having an API like this being exposed from the `node::crypto`
namespace (crypto_context specifically) would be ideal, but for the time
being this should do.

PR-URL: #340
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

Author: santigimeno

agents/grpc/src/grpc_agent.cc

@@ -5,6 +5,7 @@
 #include "nsolid/nsolid_api.h"
 #include "nsolid/nsolid_util.h"
 #include "../../otlp/src/otlp_common.h"
+#include "../../src/root_certs.h"
 #include "../../src/span_collector.h"
 #include "absl/log/initialize.h"
 #include "opentelemetry/sdk/metrics/data/metric_data.h"
@@ -73,10 +74,6 @@ const size_t GRPC_MAX_SIZE = 4L * 1024 * 1024;  // 4GB
 const int PUB_KEY_SIZE = 40;
 const int CONSOLE_ID_SIZE = 36;
 
-static const char* const root_certs[] = {
-#include "node_root_certs.h"  // NOLINT(build/include_order)
-};
-
 template <typename... Args>
 inline void Debug(Args&&... args) {
   per_process::Debug(DebugCategory::NSOLID_GRPC_AGENT,
@@ -457,8 +454,8 @@ GrpcAgent::GrpcAgent(): hooks_init_(false),
 
   if (custom_certs_.empty()) {
     Debug("Using default certs\n");
-    for (size_t i = 0; i < sizeof(root_certs) / sizeof(root_certs[0]); i++) {
-      cacert_ += root_certs[i];
+    for (size_t i = 0; i < GetRootCertsCount(); i++) {
+      cacert_ += GetRootCerts()[i];
       cacert_ += "\n";
     }
   }

agents/otlp/src/otlp_agent.cc

@@ -18,6 +18,7 @@
 #include "opentelemetry/exporters/otlp/otlp_http_exporter.h"
 #include "opentelemetry/ext/http/client/curl/http_client_curl.h"
 #include "opentelemetry/trace/propagation/detail/hex.h"
+#include "../../src/root_certs.h"
 #include "../../src/span_collector.h"
 
 using ThreadMetricsStor = node::nsolid::ThreadMetrics::MetricsStor;
@@ -96,6 +97,11 @@ OTLPAgent::OTLPAgent(): ready_(false),
   ASSERT_EQ(0, uv_mutex_init(&start_lock_));
   ASSERT_EQ(0, exit_lock_.init(true));
   is_running_ = true;
+
+  for (size_t i = 0; i < GetRootCertsCount(); i++) {
+    cacert_ += GetRootCerts()[i];
+    cacert_ += "\n";
+  }
 }
 
 
@@ -538,7 +544,7 @@ void OTLPAgent::config_otlp_endpoint(const json& config) {
     }
 
     metrics_exporter_.reset(
-      new OTLPMetrics(&loop_, GetScope()));
+      new OTLPMetrics(&loop_, GetScope(), cacert_));
     return;
   }
 
@@ -563,7 +569,7 @@ void OTLPAgent::config_otlp_endpoint(const json& config) {
   }
 
   metrics_exporter_.reset(
-    new OTLPMetrics(&loop_, url, "", is_http, GetScope()));
+    new OTLPMetrics(&loop_, url, "", is_http, GetScope(), cacert_));
 }
 
 
@@ -582,12 +588,14 @@ void OTLPAgent::setup_trace_otlp_exporter(
     exporter::otlp::OtlpHttpExporterOptions& opts) {
   opts.content_type  = exporter::otlp::HttpRequestContentType::kBinary;
   opts.console_debug = true;
+  opts.ssl_ca_cert_string = cacert_;
   otlp_exporter_.reset(new exporter::otlp::OtlpHttpExporter(opts));
 }
 
 
 void OTLPAgent::setup_trace_grpc_otlp_exporter(
     exporter::otlp::OtlpGrpcExporterOptions& opts) {
+  opts.ssl_credentials_cacert_as_string = cacert_;
   otlp_exporter_.reset(new exporter::otlp::OtlpGrpcExporter(opts));
 }
 

agents/otlp/src/otlp_agent.h

@@ -149,6 +149,8 @@ class OTLPAgent {
   nsuv::ns_async config_msg_;
   TSQueue<nlohmann::json> config_msg_q_;
   nlohmann::json config_;
+
+  std::string cacert_;
 };
 
 }  // namespace otlp

agents/otlp/src/otlp_metrics.cc

@@ -60,15 +60,18 @@ static std::vector<std::string> discarded_metrics = {
 };
 
 OTLPMetrics::OTLPMetrics(uv_loop_t* loop,
-                         InstrumentationScope* scope):
+                         InstrumentationScope* scope,
+                         const std::string& cacert):
     scope_(scope) {
   const std::string prot = GetOtlpDefaultHttpMetricsProtocol();
   if (prot == "grpc") {
     OtlpGrpcMetricExporterOptions opts;
+    opts.ssl_credentials_cacert_as_string = cacert;
     otlp_metric_exporter_ = std::make_unique<OtlpGrpcMetricExporter>(opts);
   } else {
     OtlpHttpMetricExporterOptions opts;
     opts.console_debug = true;
+    opts.ssl_ca_cert_string = cacert;
     otlp_metric_exporter_ = std::make_unique<OtlpHttpMetricExporter>(opts);
   }
 }
@@ -77,7 +80,8 @@ OTLPMetrics::OTLPMetrics(uv_loop_t* loop,
                          const std::string& url,
                          const std::string& key,
                          bool is_http,
-                         InstrumentationScope* scope):
+                         InstrumentationScope* scope,
+                         const std::string& cacert):
     scope_(scope),
     key_(key),
     url_(url) {
@@ -86,10 +90,12 @@ OTLPMetrics::OTLPMetrics(uv_loop_t* loop,
     opts.url = url + "/v1/metrics";
     opts.content_type = HttpRequestContentType::kBinary;
     opts.console_debug = true;
+    opts.ssl_ca_cert_string = cacert;
     otlp_metric_exporter_ = std::make_unique<OtlpHttpMetricExporter>(opts);
   } else {
     OtlpGrpcMetricExporterOptions opts;
     opts.endpoint = url + "/v1/metrics";
+    opts.ssl_credentials_cacert_as_string = cacert;
     otlp_metric_exporter_ = std::make_unique<OtlpGrpcMetricExporter>(opts);
   }
 }

agents/otlp/src/otlp_metrics.h

@@ -31,13 +31,15 @@ class OTLPMetrics final: public MetricsExporter {
  public:
   explicit OTLPMetrics(
     uv_loop_t* loop,
-    OPENTELEMETRY_NAMESPACE::sdk::instrumentationscope::InstrumentationScope*);
+    OPENTELEMETRY_NAMESPACE::sdk::instrumentationscope::InstrumentationScope*,
+    const std::string& cacert);
   explicit OTLPMetrics(
     uv_loop_t* loop,
     const std::string& url,
     const std::string& key,
     bool is_http,
-    OPENTELEMETRY_NAMESPACE::sdk::instrumentationscope::InstrumentationScope*);
+    OPENTELEMETRY_NAMESPACE::sdk::instrumentationscope::InstrumentationScope*,
+    const std::string& cacert);
 
   virtual ~OTLPMetrics();
 

agents/src/http_client.cc

@@ -1,5 +1,5 @@
 #include "http_client.h"
-#include "util.h"
+#include "root_certs.h"
 
 #include <queue>
 
@@ -8,10 +8,6 @@
 namespace node {
 namespace nsolid {
 
-static const char* const root_certs[] = {
-#include "node_root_certs.h"  // NOLINT(build/include_order)
-};
-
 CurlContext::CurlContext(HttpClient* http_client, curl_socket_t sockfd):
     http_client_(http_client),
     poll_handle_(new nsuv::ns_poll),
@@ -43,8 +39,8 @@ HttpClient::HttpClient(uv_loop_t* loop): loop_(loop),
                                  CURLMOPT_TIMERFUNCTION,
                                  start_timeout_));
   ASSERT_EQ(0, curl_multi_setopt(curl_handle_, CURLMOPT_TIMERDATA, this));
-  for (size_t i = 0; i < node::arraysize(root_certs); i++) {
-    cacert_ += root_certs[i];
+  for (size_t i = 0; i < GetRootCertsCount(); i++) {
+    cacert_ += GetRootCerts()[i];
     cacert_ += "\n";
   }
 }

agents/src/root_certs.cc

@@ -0,0 +1,19 @@
+#include "root_certs.h"
+
+namespace node {
+namespace nsolid {
+
+static const char* const root_certs[] = {
+#include "node_root_certs.h"
+};
+
+const char* const* GetRootCerts() {
+  return root_certs;
+}
+
+size_t GetRootCertsCount() {
+  return sizeof(root_certs) / sizeof(root_certs[0]);
+}
+
+}  // namespace nsolid
+}  // namespace node

agents/src/root_certs.h

@@ -0,0 +1,17 @@
+#ifndef AGENTS_SRC_ROOT_CERTS_H_
+#define AGENTS_SRC_ROOT_CERTS_H_
+
+#include <cstddef>
+
+namespace node {
+namespace nsolid {
+
+// Accessor for the root certificates array
+const char* const* GetRootCerts();
+// Accessor for the number of root certificates
+size_t GetRootCertsCount();
+
+}  // namespace nsolid
+}  // namespace node
+
+#endif  // AGENTS_SRC_ROOT_CERTS_H_

node.gyp

@@ -395,6 +395,8 @@
       'agents/src/http_client.h',
       'agents/src/profile_collector.cc',
       'agents/src/profile_collector.h',
+      'agents/src/root_certs.cc',
+      'agents/src/root_certs.h',
       'agents/src/span_collector.cc',
       'agents/src/span_collector.h',
       'agents/grpc/src/asset_stream.cc',