fix: add tls config to unix socket when https is used

[huikang]

Description

Add tls config to unix socket when https is used

Testing & Reproduction steps

Manually tested with the following agent config

"addresses": {
        "grpc_tls" : "unix://consul/consul_grpc.sock",
        "http" : "unix://consul/consul_http.sock",
        "https" : "unix://consul/consul_https.sock"
    },

export CONSUL_HTTP_ADDR=unix://consul/consul_https.sock
CONSUL_HTTP_SSL=true consul connect 

Links

fix #16252

PR Checklist

• updated test coverage
• external facing docs updated
• not a security concern

[mkeeler]

To not be surprising this fix is necessary (although in this case TLS isn't really providing any extra security).

Should we have a test somewhere that starts a unix https listener and attempts to connect via TLS to ensure its working?

[huikang]

To not be surprising this fix is necessary (although in this case TLS isn't really providing any extra security).

Should we have a test somewhere that starts a unix https listener and attempts to connect via TLS to ensure its working?

Thanks for the prompt response.

Agreed that we need some form of test on this agent configuration. The closet example I can find is

consul/agent/agent_test.go

Lines 3905 to 3908 in 2460ac9

	// Should still succeed with only HTTPS addresses
	newConf.HTTPSAddrs = newConf.HTTPAddrs
	newConf.HTTPAddrs = make([]net.Addr, 0)
	newConf.Watches = []map[string]interface{}{

Or do you have any recommendation on which example I shall follow? Thanks.

[mkeeler]

@huikang You could probably copy/paste + modify this test:

consul/agent/http_test.go

Lines 39 to 99 in 8dab825

	func TestHTTPServer_UnixSocket(t *testing.T) {
	if testing.Short() {
	t.Skip("too slow for testing.Short")
	}
	t.Parallel()
	if runtime.GOOS == "windows" {
	t.SkipNow()
	}
	tempDir := testutil.TempDir(t, "consul")
	socket := filepath.Join(tempDir, "test.sock")
	// Only testing mode, since uid/gid might not be settable
	// from test environment.
	a := NewTestAgent(t, `
	addresses {
	http = "unix://`+socket+`"
	}
	unix_sockets {
	mode = "0777"
	}
	`)
	defer a.Shutdown()
	// Ensure the socket was created
	if _, err := os.Stat(socket); err != nil {
	t.Fatalf("err: %s", err)
	}
	// Ensure the mode was set properly
	fi, err := os.Stat(socket)
	if err != nil {
	t.Fatalf("err: %s", err)
	}
	if fi.Mode().String() != "Srwxrwxrwx" {
	t.Fatalf("bad permissions: %s", fi.Mode())
	}
	// Ensure we can get a response from the socket.
	trans := cleanhttp.DefaultTransport()
	trans.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
	return net.Dial("unix", socket)
	}
	client := &http.Client{
	Transport: trans,
	}
	// This URL doesn't look like it makes sense, but the scheme (http://) and
	// the host (127.0.0.1) are required by the HTTP client library. In reality
	// this will just use the custom dialer and talk to the socket.
	resp, err := client.Get("http://127.0.0.1/v1/agent/self")
	if err != nil {
	t.Fatalf("err: %s", err)
	}
	defer resp.Body.Close()
	if body, err := io.ReadAll(resp.Body); err != nil || len(body) == 0 {
	t.Fatalf("bad: %s %v", body, err)
	}
	}

[huikang]

deprecated

[huikang]

@mkeeler , the unit test is added. Please take a look whenever you have a chance. Thanks.