enable GIN mTLS support #7

alvinlee001 · 2022-05-16T07:57:33Z

pull request for #6

malwaredllc · 2022-05-16T21:01:06Z

@alvinlee001 nice! can we make the client_auth option more general, so it applies to all TLS (not just client side auth)?

alvinlee001 · 2022-05-16T23:07:59Z

Hi @malwaredllc, are u saying that you just want it to be https disabled or enabled? If https enabled, implies opting for mTLS? What about opting for TLS but not mTLS? It totally depends on you, but right now TLS is mandatory, while mTLS is optional.

malwaredllc · 2022-05-17T01:17:21Z

@alvinlee001 Basically TLS should be optional. The problem I want to solve is that right now, if a server's hostname or IP does not appear in this TLS certificate config file here, then it will be unable to communicate with other servers.

This means that unless all of your servers are in the same subdomain that you can use a wildcard for (i.e. *.example.com), then if you want to add a new server, you must add its hostname/IP to that config file and run the ./gen.sh script to regenerate the TLS certificates, which is not ideal.

For example, if I want to add cacheserver4 to my docker-compose.yml to spin up an extra server in a container, I will need to add DNS:cacheserver4 to the certs/server-ext.cnf and regenerate the certificates first.

One way around this is to simply not use TLS (make it optional) to not have to worry about this, so the cluster size can dynamically change without issue. Alternatively, I need to figure out a more flexible way of doing TLS.

alvinlee001 · 2022-05-17T01:42:49Z

I see, @malwaredllc can we have an additional property called https-enabled and this will control whether we want to enable or disable HTTPS? So we can do it as separate from forcing mTLS, is that okay? If not, I could just remove my previous commit of making mTLS an option, and just have this new property, this will work too.

malwaredllc · 2022-05-17T01:57:53Z

@alvinlee001 Yeah I think https-enabled sounds great

alvinlee001 · 2022-05-17T03:52:39Z

Hi @malwaredllc, i have implemented it. There will be a flag in CLI and json to specify if https should be enabled, it is enabled by default unless specified otherwise. I have pushed the new commit, kindly have a look.

malwaredllc · 2022-05-17T04:01:58Z

@alvinlee001 thanks for your help with this, looks like the build is failing though (see build tests ran on this PR), can you take a look?

alvinlee001 · 2022-05-17T04:02:33Z

Ok wait

… enable or disable HTTPS

alvinlee001 · 2022-05-17T04:07:17Z

Hi @malwaredllc , sorry I have force pushed again, missed some changes previously. Now the tests are passing.

malwaredllc · 2022-05-17T04:25:48Z

@alvinlee001 Looks good! Last thing will be to add a test to make sure that HTTP without TLS works properly (you can basically copy/paste this test in main_test.go but tweak the params to not use HTTPS. Note you may need to modify this function to accept the https_enabled flag to do this.

alvinlee001 · 2022-05-17T04:29:55Z

Alright, sure @malwaredllc

alvinlee001 · 2022-05-17T05:27:33Z

hi @malwaredllc , added test and it is passing, previously has been testing the HTTP rest locally as well, it is working

main_test.go

malwaredllc · 2022-05-17T05:45:30Z

node/node.go

@@ -59,7 +61,7 @@ func HashId(key string) uint32 {
 // Load nodes config file
 func LoadNodesConfig(config_file string) NodesConfig {
 	file, _ := ioutil.ReadFile(config_file)
-	nodes_config := NodesConfig{}
+	nodes_config := NodesConfig{EnableClientAuth: true, EnableHttps: true}


Quick question, why are EnableClientAuth and EnableHttps hard coded to true here? Shouldn't these values come from the config file or command line flag?

Hi @malwaredllc, if unspecified, these will be the default values, meaning if the config have the fields to be absent, it will have https and mTLS as enabled by default

malwaredllc · 2022-05-17T05:48:12Z

@alvinlee001 looks awesome thanks for doing that! I left a couple of comments on small things to address above but besides that it looks ready to go

alvinlee001 · 2022-05-17T05:56:36Z

Hi @malwaredllc , I resolved the 2 comments just now, and pushed changes. pls have a look

malwaredllc · 2022-05-17T06:04:51Z

main_test.go

-	RELATIVE_CONFIG_PATH = "configs/nodes-local.json"
-	RELATIVE_CLIENT_CERT_DIR = "certs"
+	RELATIVE_CONFIG_PATH      = "configs/nodes-local.json"
+	RELATIVE_CONFIG_PATH_HTTP = "configs/nodes-local-insecure.json"


Can you add this file to the commit

malwaredllc · 2022-05-17T06:08:01Z

@alvinlee001 after further investigation, it appears the integration tests are passing but they shouldn't be (see here: https://github.com/malwaredllc/minicache/runs/6465112038?check_suite_focus=true#step:8:33) - it is unable to connect to any nodes now, it visits them all then loops forever because it is skipping visited nodes - we can fix this test but still the main issue is that the connections to the server are failing

malwaredllc · 2022-05-17T06:12:02Z

I am fixing the issue causing the test to appear to pass here and will merge it momentarily

malwaredllc · 2022-05-17T06:14:30Z

@alvinlee001 ok I fixed the issue causing the test to appear to pass when it should fail. You can merge in the latest changes from the main branch

… all at once

alvinlee001 · 2022-05-17T07:37:34Z

Hi @malwaredllc , sorry for the late reply, I was busy with my day job. I tried to find the issue with my code, which I think there are a few, and fixed them... but the tests still fail. However, if I run each of the tests individually by commenting out the others, all tests pass... I am not sure why though.

malwaredllc · 2022-05-17T17:07:03Z

@alvinlee001 No worries, if you look at the test output here you'lll see the test failing is Test10kConcurrentRestApiPutsInsecure and the error message is:

2022/05/17 17:00:22 GetLeader failed rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"...

So this indicates either the client or server is still trying to use TLS, but one side isn't.

I think it is may be because the config file you are trying to use configs/nodes-local-insecure.json doesn't exist?

malwaredllc · 2022-05-17T17:18:28Z

I added a print statement which revealed "enable_https" and "enable_client_auth" are both set to true in the test Test10kConcurrentRestApiPutsInsecure, which should not be the case.

2022/05/17 11:17:34 enable https: %!b(bool=true), insecure: %!b(bool=true), client_auth: %!b(bool=true)

malwaredllc · 2022-05-17T18:10:09Z

I figured out the problem, the StartClusterConfigWatcher goroutine has no shutdown mechanism, so the goroutine from the first test was interferring with the 2nd test. That is why if you run the 2nd test individually it works, but all tests won't work.

I am fixing it now and will push changes to your branch here.

malwaredllc · 2022-05-17T18:22:56Z

@alvinlee001 I'm not able to modify your PR directly so I made a PR with your changes + the fix I added: #9

Either you can copy over the changes to your branch and we can merge it (so you get credit for your contribution), or we can merge that PR.

alvinlee001 · 2022-05-18T01:21:23Z

Hi @malwaredllc , I have patched my changes with yours. U may merge this PR. Thanks

malwaredllc · 2022-05-18T03:54:12Z

client/cache_client/cache_client.go

@@ -257,7 +276,7 @@ func (c *ClientWrapper) Put(key string, value string) error {
 	// check response
 	res, err := new(http.Client).Do(req)
 	defer res.Body.Close()


@alvinlee001 I think this line is causing the test to fail with a segfault. The error check needs to go before using the res object

Wokay, done pushing the fix.

malwaredllc · 2022-05-18T04:17:13Z

Merged! Thanks for the contribution, feel free to add any ideas for other features or improvements

malwaredllc · 2022-05-18T04:21:03Z

I also just updated the setup/usage information in the readme to include these new changes: https://github.com/malwaredllc/minicache#set-up-and-usage

alvinlee001 added 2 commits May 16, 2022 15:55

enable GIN mTLS support

c46ca07

--client-auth param and "client_auth" json param to enable/disable mTLS

e8d8f6d

added 'https-enabled' CLI param and 'https_enabled' json parameter to…

d4fca5e

… enable or disable HTTPS

alvinlee001 force-pushed the main branch from c7ca30e to d4fca5e Compare May 17, 2022 04:06

added test for http rest

62f6d49

malwaredllc reviewed May 17, 2022

View reviewed changes

main_test.go Outdated Show resolved Hide resolved

malwaredllc reviewed May 17, 2022

View reviewed changes

fix text in test

9e256a7

malwaredllc reviewed May 17, 2022

View reviewed changes

alvinlee001 added 2 commits May 17, 2022 14:23

Merge pull request #1 from malwaredllc/main

fe73d44

fix some errors, but tests can only pass if run individually, but not…

5dacdfc

… all at once

alvinlee001 force-pushed the main branch from 61b596c to 5dacdfc Compare May 18, 2022 01:01

patched changes provided by author

a607383

fix port clashing issue

6968b4a

malwaredllc reviewed May 18, 2022

View reviewed changes

move err checking before Body.Close()

b0a214e

malwaredllc merged commit 91bb0bc into danielvegamyhre:main May 18, 2022

This was referenced May 18, 2022

TLS support for REST API #6

Closed

Make using TLS optional #5

Closed

danielvegamyhre pushed a commit that referenced this pull request Jul 8, 2024

enable GIN mTLS support (#7)

4648c85

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

enable GIN mTLS support #7

enable GIN mTLS support #7

alvinlee001 commented May 16, 2022

malwaredllc commented May 16, 2022

alvinlee001 commented May 16, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022 •

edited

Loading

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc commented May 17, 2022 •

edited

Loading

alvinlee001 commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc May 17, 2022

alvinlee001 May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc May 17, 2022

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc commented May 17, 2022 •

edited

Loading

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 18, 2022

malwaredllc May 18, 2022 •

edited

Loading

alvinlee001 May 18, 2022

malwaredllc commented May 18, 2022

malwaredllc commented May 18, 2022

enable GIN mTLS support #7

enable GIN mTLS support #7

Conversation

alvinlee001 commented May 16, 2022

malwaredllc commented May 16, 2022

alvinlee001 commented May 16, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022 • edited Loading

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc commented May 17, 2022 • edited Loading

alvinlee001 commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc May 17, 2022

Choose a reason for hiding this comment

alvinlee001 May 17, 2022

Choose a reason for hiding this comment

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc May 17, 2022

Choose a reason for hiding this comment

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 17, 2022

malwaredllc commented May 17, 2022 • edited Loading

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

malwaredllc commented May 17, 2022

alvinlee001 commented May 18, 2022

malwaredllc May 18, 2022 • edited Loading

Choose a reason for hiding this comment

alvinlee001 May 18, 2022

Choose a reason for hiding this comment

malwaredllc commented May 18, 2022

malwaredllc commented May 18, 2022

alvinlee001 commented May 17, 2022 •

edited

Loading

malwaredllc commented May 17, 2022 •

edited

Loading

malwaredllc commented May 17, 2022 •

edited

Loading

malwaredllc May 18, 2022 •

edited

Loading