2014-11-18 16:03:36 +00:00
|
|
|
package tlsutil
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
"fmt"
|
2019-06-27 20:22:07 +00:00
|
|
|
"io/ioutil"
|
2014-11-18 16:03:36 +00:00
|
|
|
"net"
|
2019-06-27 20:22:07 +00:00
|
|
|
"os"
|
|
|
|
"path/filepath"
|
2020-02-19 22:22:31 +00:00
|
|
|
"sort"
|
2015-05-11 23:05:39 +00:00
|
|
|
"strings"
|
2019-02-27 09:14:59 +00:00
|
|
|
"sync"
|
2021-06-17 23:35:58 +00:00
|
|
|
"sync/atomic"
|
2014-11-18 16:03:36 +00:00
|
|
|
"time"
|
2020-02-19 22:22:31 +00:00
|
|
|
|
|
|
|
"github.com/hashicorp/go-hclog"
|
2020-10-14 20:12:47 +00:00
|
|
|
|
|
|
|
"github.com/hashicorp/consul/logging"
|
2014-11-18 16:03:36 +00:00
|
|
|
)
|
|
|
|
|
2020-03-09 20:59:02 +00:00
|
|
|
// ALPNWrapper is a function that is used to wrap a non-TLS connection and
|
|
|
|
// returns an appropriate TLS connection or error. This taks a datacenter and
|
|
|
|
// node name as argument to configure the desired SNI value and the desired
|
|
|
|
// next proto for configuring ALPN.
|
|
|
|
type ALPNWrapper func(dc, nodeName, alpnProto string, conn net.Conn) (net.Conn, error)
|
|
|
|
|
2015-05-11 22:14:56 +00:00
|
|
|
// DCWrapper is a function that is used to wrap a non-TLS connection
|
|
|
|
// and returns an appropriate TLS connection or error. This takes
|
|
|
|
// a datacenter as an argument.
|
|
|
|
type DCWrapper func(dc string, conn net.Conn) (net.Conn, error)
|
|
|
|
|
|
|
|
// Wrapper is a variant of DCWrapper, where the DC is provided as
|
|
|
|
// a constant value. This is usually done by currying DCWrapper.
|
|
|
|
type Wrapper func(conn net.Conn) (net.Conn, error)
|
2015-05-08 22:54:42 +00:00
|
|
|
|
2021-06-21 15:42:32 +00:00
|
|
|
// tlsLookup maps the tls_min_version configuration to the internal value
|
|
|
|
var tlsLookup = map[string]uint16{
|
2019-03-13 09:29:06 +00:00
|
|
|
"": tls.VersionTLS10, // default in golang
|
2017-02-01 20:52:04 +00:00
|
|
|
"tls10": tls.VersionTLS10,
|
|
|
|
"tls11": tls.VersionTLS11,
|
|
|
|
"tls12": tls.VersionTLS12,
|
2020-02-19 22:22:31 +00:00
|
|
|
"tls13": tls.VersionTLS13,
|
2017-02-01 20:52:04 +00:00
|
|
|
}
|
|
|
|
|
2014-11-18 16:03:36 +00:00
|
|
|
// Config used to create tls.Config
|
|
|
|
type Config struct {
|
2019-03-05 20:35:43 +00:00
|
|
|
// VerifyIncoming is used to verify the authenticity of incoming
|
|
|
|
// connections. This means that TCP requests are forbidden, only
|
|
|
|
// allowing for TLS. TLS connections must match a provided certificate
|
|
|
|
// authority. This can be used to force client auth.
|
2019-02-27 09:14:59 +00:00
|
|
|
VerifyIncoming bool
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// VerifyIncomingRPC is used to verify the authenticity of incoming RPC
|
|
|
|
// connections. This means that TCP requests are forbidden, only
|
|
|
|
// allowing for TLS. TLS connections must match a provided certificate
|
|
|
|
// authority. This can be used to force client auth.
|
2019-02-27 09:14:59 +00:00
|
|
|
VerifyIncomingRPC bool
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// VerifyIncomingHTTPS is used to verify the authenticity of incoming
|
|
|
|
// HTTPS connections. This means that TCP requests are forbidden, only
|
|
|
|
// allowing for TLS. TLS connections must match a provided certificate
|
|
|
|
// authority. This can be used to force client auth.
|
2019-02-26 15:52:07 +00:00
|
|
|
VerifyIncomingHTTPS bool
|
2014-11-18 16:03:36 +00:00
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// VerifyOutgoing is used to verify the authenticity of outgoing
|
|
|
|
// connections. This means that TLS requests are used, and TCP
|
|
|
|
// requests are not made. TLS connections must match a provided
|
|
|
|
// certificate authority. This is used to verify authenticity of server
|
|
|
|
// nodes.
|
2014-11-18 16:03:36 +00:00
|
|
|
VerifyOutgoing bool
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// VerifyServerHostname is used to enable hostname verification of
|
|
|
|
// servers. This ensures that the certificate presented is valid for
|
|
|
|
// server.<datacenter>.<domain>. This prevents a compromised client
|
|
|
|
// from being restarted as a server, and then intercepting request
|
|
|
|
// traffic as well as being added as a raft peer. This should be
|
|
|
|
// enabled by default with VerifyOutgoing, but for legacy reasons we
|
|
|
|
// cannot break existing clients.
|
2015-05-11 22:14:56 +00:00
|
|
|
VerifyServerHostname bool
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// CAFile is a path to a certificate authority file. This is used with
|
|
|
|
// VerifyIncoming or VerifyOutgoing to verify the TLS connection.
|
2014-11-18 16:03:36 +00:00
|
|
|
CAFile string
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// CAPath is a path to a directory containing certificate authority
|
|
|
|
// files. This is used with VerifyIncoming or VerifyOutgoing to verify
|
|
|
|
// the TLS connection.
|
2017-04-27 08:29:39 +00:00
|
|
|
CAPath string
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// CertFile is used to provide a TLS certificate that is used for
|
|
|
|
// serving TLS connections. Must be provided to serve TLS connections.
|
2014-11-18 16:03:36 +00:00
|
|
|
CertFile string
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// KeyFile is used to provide a TLS key that is used for serving TLS
|
|
|
|
// connections. Must be provided to serve TLS connections.
|
2014-11-18 16:03:36 +00:00
|
|
|
KeyFile string
|
|
|
|
|
|
|
|
// Node name is the name we use to advertise. Defaults to hostname.
|
|
|
|
NodeName string
|
|
|
|
|
|
|
|
// ServerName is used with the TLS certificate to ensure the name we
|
|
|
|
// provide matches the certificate
|
|
|
|
ServerName string
|
2015-05-11 22:14:56 +00:00
|
|
|
|
|
|
|
// Domain is the Consul TLD being used. Defaults to "consul."
|
|
|
|
Domain string
|
2017-02-01 20:52:04 +00:00
|
|
|
|
|
|
|
// TLSMinVersion is the minimum accepted TLS version that can be used.
|
|
|
|
TLSMinVersion string
|
2017-04-27 08:29:39 +00:00
|
|
|
|
|
|
|
// CipherSuites is the list of TLS cipher suites to use.
|
|
|
|
CipherSuites []uint16
|
|
|
|
|
2019-03-05 20:35:43 +00:00
|
|
|
// PreferServerCipherSuites specifies whether to prefer the server's
|
|
|
|
// ciphersuite over the client ciphersuites.
|
2017-04-27 08:29:39 +00:00
|
|
|
PreferServerCipherSuites bool
|
2019-02-26 15:52:07 +00:00
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// EnableAgentTLSForChecks is used to apply the agent's TLS settings in
|
|
|
|
// order to configure the HTTP client used for health checks. Enabling
|
|
|
|
// this allows HTTP checks to present a client certificate and verify
|
|
|
|
// the server using the same TLS configuration as the agent (CA, cert,
|
|
|
|
// and key).
|
2019-02-26 15:52:07 +00:00
|
|
|
EnableAgentTLSForChecks bool
|
2019-06-27 20:22:07 +00:00
|
|
|
|
2020-07-30 14:15:12 +00:00
|
|
|
// AutoTLS opts the agent into provisioning agent
|
2019-06-27 20:22:07 +00:00
|
|
|
// TLS certificates.
|
2020-07-30 14:15:12 +00:00
|
|
|
AutoTLS bool
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
|
|
|
|
2020-02-19 22:22:31 +00:00
|
|
|
func tlsVersions() []string {
|
|
|
|
versions := []string{}
|
2021-06-21 15:42:32 +00:00
|
|
|
for v := range tlsLookup {
|
2020-02-19 22:22:31 +00:00
|
|
|
if v != "" {
|
|
|
|
versions = append(versions, v)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
sort.Strings(versions)
|
|
|
|
return versions
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
|
|
|
|
2015-05-11 22:14:56 +00:00
|
|
|
// SpecificDC is used to invoke a static datacenter
|
|
|
|
// and turns a DCWrapper into a Wrapper type.
|
|
|
|
func SpecificDC(dc string, tlsWrap DCWrapper) Wrapper {
|
|
|
|
if tlsWrap == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return func(conn net.Conn) (net.Conn, error) {
|
|
|
|
return tlsWrap(dc, conn)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-06-21 16:20:39 +00:00
|
|
|
// autoTLS stores configuration that is received from the auto-encrypt or
|
|
|
|
// auto-config features.
|
2020-07-30 14:15:12 +00:00
|
|
|
type autoTLS struct {
|
2019-06-27 20:22:07 +00:00
|
|
|
manualCAPems []string
|
|
|
|
connectCAPems []string
|
|
|
|
cert *tls.Certificate
|
|
|
|
verifyServerHostname bool
|
|
|
|
}
|
|
|
|
|
2021-06-21 16:20:39 +00:00
|
|
|
func (a autoTLS) caPems() []string {
|
2019-06-27 20:22:07 +00:00
|
|
|
return append(a.manualCAPems, a.connectCAPems...)
|
|
|
|
}
|
|
|
|
|
2021-06-21 16:36:52 +00:00
|
|
|
// manual stores the TLS CA and cert received from Configurator.Update which
|
|
|
|
// generally comes from the agent configuration.
|
2019-06-27 20:22:07 +00:00
|
|
|
type manual struct {
|
|
|
|
caPems []string
|
|
|
|
cert *tls.Certificate
|
|
|
|
}
|
|
|
|
|
2021-06-21 16:29:07 +00:00
|
|
|
// Configurator provides tls.Config and net.Dial wrappers to enable TLS for
|
|
|
|
// clients and servers, for both HTTPS and RPC requests.
|
|
|
|
// Configurator receives an initial TLS configuration from agent configuration,
|
|
|
|
// and receives updates from config reloads, auto-encrypt, and auto-config.
|
2019-03-13 09:29:06 +00:00
|
|
|
type Configurator struct {
|
2021-06-17 23:35:58 +00:00
|
|
|
// lock synchronizes access to all fields on this struct except for logger and version.
|
2021-06-21 16:29:07 +00:00
|
|
|
lock sync.RWMutex
|
|
|
|
base *Config
|
|
|
|
autoTLS autoTLS
|
2021-06-21 16:36:52 +00:00
|
|
|
manual manual
|
2021-06-21 16:29:07 +00:00
|
|
|
caPool *x509.CertPool
|
|
|
|
// peerDatacenterUseTLS is a map of DC name to a bool indicating if the DC
|
|
|
|
// uses TLS for RPC requests.
|
2020-04-30 20:12:17 +00:00
|
|
|
peerDatacenterUseTLS map[string]bool
|
2019-06-27 20:22:07 +00:00
|
|
|
|
2021-06-17 23:35:58 +00:00
|
|
|
// logger is not protected by a lock. It must never be changed after
|
|
|
|
// Configurator is created.
|
|
|
|
logger hclog.Logger
|
|
|
|
// version is increased each time the Configurator is updated. Must be accessed
|
|
|
|
// using sync/atomic.
|
|
|
|
version uint64
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
2014-11-18 16:03:36 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// NewConfigurator creates a new Configurator and sets the provided
|
|
|
|
// configuration.
|
2020-01-28 23:50:41 +00:00
|
|
|
func NewConfigurator(config Config, logger hclog.Logger) (*Configurator, error) {
|
|
|
|
if logger == nil {
|
|
|
|
logger = hclog.New(&hclog.LoggerOptions{
|
|
|
|
Level: hclog.Debug,
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
c := &Configurator{
|
2020-04-30 20:12:17 +00:00
|
|
|
logger: logger.Named(logging.TLSUtil),
|
|
|
|
peerDatacenterUseTLS: map[string]bool{},
|
2020-01-28 23:50:41 +00:00
|
|
|
}
|
2019-03-13 09:29:06 +00:00
|
|
|
err := c.Update(config)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
2019-03-13 09:29:06 +00:00
|
|
|
return c, nil
|
|
|
|
}
|
2014-11-18 16:03:36 +00:00
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
// CAPems returns the currently loaded CAs in PEM format.
|
|
|
|
func (c *Configurator) CAPems() []string {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2020-07-30 14:15:12 +00:00
|
|
|
return append(c.manual.caPems, c.autoTLS.caPems()...)
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ManualCAPems returns the currently loaded CAs in PEM format.
|
|
|
|
func (c *Configurator) ManualCAPems() []string {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
return c.manual.caPems
|
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// Update updates the internal configuration which is used to generate
|
|
|
|
// *tls.Config.
|
|
|
|
// This function acquires a write lock because it writes the new config.
|
|
|
|
func (c *Configurator) Update(config Config) error {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.Lock()
|
|
|
|
defer c.lock.Unlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
cert, err := loadKeyPair(config.CertFile, config.KeyFile)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
2018-12-17 17:56:18 +00:00
|
|
|
}
|
2020-09-08 10:16:16 +00:00
|
|
|
pems, err := LoadCAs(config.CAFile, config.CAPath)
|
2019-06-27 20:22:07 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2020-07-30 14:15:12 +00:00
|
|
|
pool, err := pool(append(pems, c.autoTLS.caPems()...))
|
2019-03-13 09:29:06 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
2021-06-17 23:05:21 +00:00
|
|
|
if err = validateConfig(config, pool, cert); err != nil {
|
2019-06-27 20:22:07 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
c.base = &config
|
|
|
|
c.manual.cert = cert
|
|
|
|
c.manual.caPems = pems
|
|
|
|
c.caPool = pool
|
2021-06-17 23:35:58 +00:00
|
|
|
atomic.AddUint64(&c.version, 1)
|
|
|
|
c.log("Update")
|
2019-06-27 20:22:07 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-07-30 14:15:12 +00:00
|
|
|
// UpdateAutoTLSCA updates the autoEncrypt.caPems. This is supposed to be called
|
2019-06-27 20:22:07 +00:00
|
|
|
// from the server in order to be able to accept TLS connections with TLS
|
|
|
|
// certificates.
|
|
|
|
// Or it is being called on the client side when CA changes are detected.
|
2020-07-30 14:15:12 +00:00
|
|
|
func (c *Configurator) UpdateAutoTLSCA(connectCAPems []string) error {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.Lock()
|
|
|
|
defer c.lock.Unlock()
|
2014-11-18 16:03:36 +00:00
|
|
|
|
2020-07-30 14:15:12 +00:00
|
|
|
pool, err := pool(append(c.manual.caPems, append(c.autoTLS.manualCAPems, connectCAPems...)...))
|
2019-06-27 20:22:07 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-06-17 23:05:21 +00:00
|
|
|
if err = validateConfig(*c.base, pool, c.manual.cert); err != nil {
|
2019-03-13 09:29:06 +00:00
|
|
|
return err
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
2020-07-30 14:15:12 +00:00
|
|
|
c.autoTLS.connectCAPems = connectCAPems
|
2019-06-27 20:22:07 +00:00
|
|
|
c.caPool = pool
|
2021-06-17 23:35:58 +00:00
|
|
|
atomic.AddUint64(&c.version, 1)
|
|
|
|
c.log("UpdateAutoTLSCA")
|
2019-06-27 20:22:07 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-06-21 16:20:39 +00:00
|
|
|
// UpdateAutoTLSCert receives the updated Auto-Encrypt certificate.
|
2020-07-30 14:15:12 +00:00
|
|
|
func (c *Configurator) UpdateAutoTLSCert(pub, priv string) error {
|
2019-06-27 20:22:07 +00:00
|
|
|
cert, err := tls.X509KeyPair([]byte(pub), []byte(priv))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Failed to load cert/key pair: %v", err)
|
|
|
|
}
|
|
|
|
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.Lock()
|
|
|
|
defer c.lock.Unlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
|
2020-07-30 14:15:12 +00:00
|
|
|
c.autoTLS.cert = &cert
|
2021-06-17 23:35:58 +00:00
|
|
|
atomic.AddUint64(&c.version, 1)
|
|
|
|
c.log("UpdateAutoTLSCert")
|
2019-06-27 20:22:07 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-06-21 16:20:39 +00:00
|
|
|
// UpdateAutoTLS receives updates from Auto-Config, only expected to be called on
|
|
|
|
// client agents.
|
2020-07-30 14:15:12 +00:00
|
|
|
func (c *Configurator) UpdateAutoTLS(manualCAPems, connectCAPems []string, pub, priv string, verifyServerHostname bool) error {
|
2019-06-27 20:22:07 +00:00
|
|
|
cert, err := tls.X509KeyPair([]byte(pub), []byte(priv))
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Failed to load cert/key pair: %v", err)
|
|
|
|
}
|
|
|
|
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.Lock()
|
|
|
|
defer c.lock.Unlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
|
|
|
|
pool, err := pool(append(c.manual.caPems, append(manualCAPems, connectCAPems...)...))
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2020-07-30 14:15:12 +00:00
|
|
|
c.autoTLS.manualCAPems = manualCAPems
|
|
|
|
c.autoTLS.connectCAPems = connectCAPems
|
|
|
|
c.autoTLS.cert = &cert
|
2019-06-27 20:22:07 +00:00
|
|
|
c.caPool = pool
|
2020-07-30 14:15:12 +00:00
|
|
|
c.autoTLS.verifyServerHostname = verifyServerHostname
|
2021-06-17 23:35:58 +00:00
|
|
|
atomic.AddUint64(&c.version, 1)
|
|
|
|
c.log("UpdateAutoTLS")
|
2019-03-13 09:29:06 +00:00
|
|
|
return nil
|
|
|
|
}
|
2014-11-18 16:03:36 +00:00
|
|
|
|
2020-04-30 20:12:17 +00:00
|
|
|
func (c *Configurator) UpdateAreaPeerDatacenterUseTLS(peerDatacenter string, useTLS bool) {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.Lock()
|
|
|
|
defer c.lock.Unlock()
|
2021-06-17 23:35:58 +00:00
|
|
|
atomic.AddUint64(&c.version, 1)
|
|
|
|
c.log("UpdateAreaPeerDatacenterUseTLS")
|
2020-04-30 20:12:17 +00:00
|
|
|
c.peerDatacenterUseTLS[peerDatacenter] = useTLS
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Configurator) getAreaForPeerDatacenterUseTLS(peerDatacenter string) bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2020-04-30 20:12:17 +00:00
|
|
|
if v, ok := c.peerDatacenterUseTLS[peerDatacenter]; ok {
|
|
|
|
return v
|
|
|
|
}
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
func (c *Configurator) Base() Config {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
return *c.base
|
|
|
|
}
|
|
|
|
|
|
|
|
func pool(pems []string) (*x509.CertPool, error) {
|
|
|
|
pool := x509.NewCertPool()
|
|
|
|
for _, pem := range pems {
|
|
|
|
if !pool.AppendCertsFromPEM([]byte(pem)) {
|
|
|
|
return nil, fmt.Errorf("Couldn't parse PEM %s", pem)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if len(pool.Subjects()) == 0 {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
return pool, nil
|
|
|
|
}
|
|
|
|
|
2021-06-17 23:05:21 +00:00
|
|
|
// validateConfig checks that config is valid and does not conflict with the pool
|
|
|
|
// or cert.
|
|
|
|
func validateConfig(config Config, pool *x509.CertPool, cert *tls.Certificate) error {
|
2019-03-13 09:29:06 +00:00
|
|
|
// Check if a minimum TLS version was set
|
|
|
|
if config.TLSMinVersion != "" {
|
2021-06-21 15:42:32 +00:00
|
|
|
if _, ok := tlsLookup[config.TLSMinVersion]; !ok {
|
|
|
|
versions := strings.Join(tlsVersions(), ", ")
|
|
|
|
return fmt.Errorf("TLSMinVersion: value %s not supported, please specify one of [%s]", config.TLSMinVersion, versions)
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// Ensure we have a CA if VerifyOutgoing is set
|
2019-06-27 20:22:07 +00:00
|
|
|
if config.VerifyOutgoing && pool == nil {
|
2019-03-13 09:29:06 +00:00
|
|
|
return fmt.Errorf("VerifyOutgoing set, and no CA certificate provided!")
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// Ensure we have a CA and cert if VerifyIncoming is set
|
2019-06-27 20:22:07 +00:00
|
|
|
if config.anyVerifyIncoming() {
|
|
|
|
if pool == nil {
|
2020-07-30 14:15:12 +00:00
|
|
|
// both auto-config and auto-encrypt require verifying the connection from the client to the server for secure
|
|
|
|
// operation. In order to be able to verify the servers certificate we must have some CA certs already provided.
|
|
|
|
// Therefore, even though both of those features can push down extra CA certificates which could be used to
|
|
|
|
// verify incoming connections, we still must consider it an error if none are provided in the initial configuration
|
|
|
|
// as those features cannot be successfully enabled without providing CA certificates to use those features.
|
|
|
|
return fmt.Errorf("VerifyIncoming set but no CA certificates were provided")
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
2020-07-30 14:15:12 +00:00
|
|
|
|
|
|
|
// We will use the auto_encrypt/auto_config cert for TLS in the incoming APIs when available. Therefore the check
|
|
|
|
// here will ensure that either we enabled one of those two features or a certificate and key were provided manually
|
|
|
|
if cert == nil && !config.AutoTLS {
|
|
|
|
return fmt.Errorf("VerifyIncoming requires either a Cert and Key pair in the configuration file, or auto_encrypt/auto_config be enabled")
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
func (c Config) anyVerifyIncoming() bool {
|
2021-06-24 18:32:30 +00:00
|
|
|
return c.VerifyIncoming || c.VerifyIncomingRPC || c.VerifyIncomingHTTPS
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c Config) verifyIncomingRPC() bool {
|
2021-06-24 18:32:30 +00:00
|
|
|
return c.VerifyIncoming || c.VerifyIncomingRPC
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
func loadKeyPair(certFile, keyFile string) (*tls.Certificate, error) {
|
|
|
|
if certFile == "" || keyFile == "" {
|
2019-11-12 18:40:32 +00:00
|
|
|
return nil, nil
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("Failed to load cert/key pair: %v", err)
|
|
|
|
}
|
|
|
|
return &cert, nil
|
2019-02-27 09:14:59 +00:00
|
|
|
}
|
|
|
|
|
2020-09-08 10:16:16 +00:00
|
|
|
func LoadCAs(caFile, caPath string) ([]string, error) {
|
2019-06-27 20:22:07 +00:00
|
|
|
if caFile == "" && caPath == "" {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
pems := []string{}
|
|
|
|
|
|
|
|
readFn := func(path string) error {
|
|
|
|
pem, err := ioutil.ReadFile(path)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error loading from %s: %s", path, err)
|
|
|
|
}
|
|
|
|
pems = append(pems, string(pem))
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
walkFn := func(path string, info os.FileInfo, err error) error {
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if !info.IsDir() {
|
|
|
|
if err := readFn(path); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
if caFile != "" {
|
2019-06-27 20:22:07 +00:00
|
|
|
err := readFn(caFile)
|
|
|
|
if err != nil {
|
|
|
|
return pems, err
|
|
|
|
}
|
2019-03-13 09:29:06 +00:00
|
|
|
} else if caPath != "" {
|
2019-06-27 20:22:07 +00:00
|
|
|
err := filepath.Walk(caPath, walkFn)
|
2019-03-13 09:29:06 +00:00
|
|
|
if err != nil {
|
2019-06-27 20:22:07 +00:00
|
|
|
return pems, err
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
2019-06-27 20:22:07 +00:00
|
|
|
if len(pems) == 0 {
|
|
|
|
return pems, fmt.Errorf("Error loading from CAPath: no CAs found")
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
}
|
2019-06-27 20:22:07 +00:00
|
|
|
return pems, nil
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// commonTLSConfig generates a *tls.Config from the base configuration the
|
|
|
|
// Configurator has. It accepts an additional flag in case a config is needed
|
|
|
|
// for incoming TLS connections.
|
2019-03-13 09:29:06 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
2019-06-27 20:22:07 +00:00
|
|
|
func (c *Configurator) commonTLSConfig(verifyIncoming bool) *tls.Config {
|
|
|
|
// this needs to be outside of RLock because it acquires an RLock itself
|
|
|
|
verifyServerHostname := c.VerifyServerHostname()
|
|
|
|
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2014-11-18 16:03:36 +00:00
|
|
|
tlsConfig := &tls.Config{
|
2019-06-27 20:22:07 +00:00
|
|
|
InsecureSkipVerify: !verifyServerHostname,
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
|
|
|
|
2017-04-27 08:29:39 +00:00
|
|
|
// Set the cipher suites
|
2019-02-26 15:52:07 +00:00
|
|
|
if len(c.base.CipherSuites) != 0 {
|
|
|
|
tlsConfig.CipherSuites = c.base.CipherSuites
|
2017-04-27 08:29:39 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
tlsConfig.PreferServerCipherSuites = c.base.PreferServerCipherSuites
|
2019-02-26 15:52:07 +00:00
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
// GetCertificate is used when acting as a server and responding to
|
2019-11-12 18:40:32 +00:00
|
|
|
// client requests. Default to the manually configured cert, but allow
|
|
|
|
// autoEncrypt cert too so that a client can encrypt incoming
|
|
|
|
// connections without having a manual cert configured.
|
2019-03-13 09:29:06 +00:00
|
|
|
tlsConfig.GetCertificate = func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
|
2020-01-22 10:32:17 +00:00
|
|
|
return c.Cert(), nil
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
2019-06-27 20:22:07 +00:00
|
|
|
|
|
|
|
// GetClientCertificate is used when acting as a client and responding
|
|
|
|
// to a server requesting a certificate. Return the autoEncrypt certificate
|
|
|
|
// if possible, otherwise default to the manually provisioned one.
|
2019-03-13 09:29:06 +00:00
|
|
|
tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
|
2020-07-30 14:15:12 +00:00
|
|
|
cert := c.autoTLS.cert
|
2019-06-27 20:22:07 +00:00
|
|
|
if cert == nil {
|
|
|
|
cert = c.manual.cert
|
|
|
|
}
|
|
|
|
|
2020-06-30 17:52:57 +00:00
|
|
|
if cert == nil {
|
|
|
|
// the return value MUST not be nil but an empty certificate will be
|
|
|
|
// treated the same as having no client certificate
|
|
|
|
cert = &tls.Certificate{}
|
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
return cert, nil
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
tlsConfig.ClientCAs = c.caPool
|
|
|
|
tlsConfig.RootCAs = c.caPool
|
2019-03-13 09:29:06 +00:00
|
|
|
|
2021-06-21 15:42:32 +00:00
|
|
|
// This is possible because tlsLookup also contains "" with golang's
|
2019-03-13 09:29:06 +00:00
|
|
|
// default (tls10). And because the initial check makes sure the
|
|
|
|
// version correctly matches.
|
2021-06-21 15:42:32 +00:00
|
|
|
tlsConfig.MinVersion = tlsLookup[c.base.TLSMinVersion]
|
2014-11-18 16:03:36 +00:00
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// Set ClientAuth if necessary
|
2019-06-27 20:22:07 +00:00
|
|
|
if verifyIncoming {
|
2019-02-27 09:14:59 +00:00
|
|
|
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
2019-02-27 09:14:59 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
return tlsConfig
|
|
|
|
}
|
|
|
|
|
2020-01-22 10:32:17 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) Cert() *tls.Certificate {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2020-01-22 10:32:17 +00:00
|
|
|
cert := c.manual.cert
|
|
|
|
if cert == nil {
|
2020-07-30 14:15:12 +00:00
|
|
|
cert = c.autoTLS.cert
|
2020-01-22 10:32:17 +00:00
|
|
|
}
|
|
|
|
return cert
|
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) VerifyIncomingRPC() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
return c.base.verifyIncomingRPC()
|
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) outgoingRPCTLSDisabled() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
|
|
|
|
// if AutoEncrypt enabled, always use TLS
|
2020-07-30 14:15:12 +00:00
|
|
|
if c.base.AutoTLS {
|
2019-06-27 20:22:07 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// if CAs are provided or VerifyOutgoing is set, use TLS
|
2020-04-30 20:12:17 +00:00
|
|
|
if c.base.VerifyOutgoing {
|
2019-06-27 20:22:07 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return true
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
|
2021-06-24 18:31:17 +00:00
|
|
|
// MutualTLSCapable returns true if Configurator has a CA and a local TLS
|
|
|
|
// certificate configured.
|
2020-03-09 20:59:02 +00:00
|
|
|
func (c *Configurator) MutualTLSCapable() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2020-07-30 14:15:12 +00:00
|
|
|
return c.caPool != nil && (c.autoTLS.cert != nil || c.manual.cert != nil)
|
2020-03-09 20:59:02 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
2019-06-27 20:22:07 +00:00
|
|
|
func (c *Configurator) verifyOutgoing() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
|
|
|
|
// If AutoEncryptTLS is enabled and there is a CA, then verify
|
|
|
|
// outgoing.
|
2020-07-30 14:15:12 +00:00
|
|
|
if c.base.AutoTLS && c.caPool != nil {
|
2019-06-27 20:22:07 +00:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
return c.base.VerifyOutgoing
|
|
|
|
}
|
|
|
|
|
2020-03-09 20:59:02 +00:00
|
|
|
func (c *Configurator) ServerSNI(dc, nodeName string) string {
|
|
|
|
// Strip the trailing '.' from the domain if any
|
|
|
|
domain := strings.TrimSuffix(c.domain(), ".")
|
|
|
|
|
|
|
|
if nodeName == "" || nodeName == "*" {
|
|
|
|
return "server." + dc + "." + domain
|
|
|
|
}
|
|
|
|
|
|
|
|
return nodeName + ".server." + dc + "." + domain
|
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) domain() string {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
return c.base.Domain
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) verifyIncomingRPC() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-06-27 20:22:07 +00:00
|
|
|
return c.base.verifyIncomingRPC()
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) verifyIncomingHTTPS() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2021-06-24 18:32:30 +00:00
|
|
|
return c.base.VerifyIncoming || c.base.VerifyIncomingHTTPS
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) serverNameOrNodeName() string {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2019-03-13 09:29:06 +00:00
|
|
|
if c.base.ServerName != "" {
|
|
|
|
return c.base.ServerName
|
|
|
|
}
|
|
|
|
return c.base.NodeName
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
2017-02-01 20:52:04 +00:00
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
// This function acquires a read lock because it reads from the config.
|
|
|
|
func (c *Configurator) VerifyServerHostname() bool {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2020-07-30 14:15:12 +00:00
|
|
|
return c.base.VerifyServerHostname || c.autoTLS.verifyServerHostname
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
|
|
|
|
2020-01-22 10:32:17 +00:00
|
|
|
// IncomingGRPCConfig generates a *tls.Config for incoming GRPC connections.
|
|
|
|
func (c *Configurator) IncomingGRPCConfig() *tls.Config {
|
|
|
|
c.log("IncomingGRPCConfig")
|
|
|
|
|
|
|
|
// false has the effect that this config doesn't require a client cert
|
|
|
|
// verification. This is because there is no verify_incoming_grpc
|
|
|
|
// configuration option. And using verify_incoming would be backwards
|
|
|
|
// incompatible, because even if it was set before, it didn't have an
|
|
|
|
// effect on the grpc server.
|
|
|
|
config := c.commonTLSConfig(false)
|
|
|
|
config.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
|
|
|
return c.IncomingGRPCConfig(), nil
|
|
|
|
}
|
|
|
|
return config
|
|
|
|
}
|
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// IncomingRPCConfig generates a *tls.Config for incoming RPC connections.
|
2019-03-13 09:29:06 +00:00
|
|
|
func (c *Configurator) IncomingRPCConfig() *tls.Config {
|
|
|
|
c.log("IncomingRPCConfig")
|
|
|
|
config := c.commonTLSConfig(c.verifyIncomingRPC())
|
|
|
|
config.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
|
|
|
return c.IncomingRPCConfig(), nil
|
|
|
|
}
|
|
|
|
return config
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
|
|
|
|
2020-03-09 20:59:02 +00:00
|
|
|
// IncomingALPNRPCConfig generates a *tls.Config for incoming RPC connections
|
|
|
|
// directly using TLS with ALPN instead of the older byte-prefixed protocol.
|
|
|
|
func (c *Configurator) IncomingALPNRPCConfig(alpnProtos []string) *tls.Config {
|
|
|
|
c.log("IncomingALPNRPCConfig")
|
|
|
|
// Since the ALPN-RPC variation is indirectly exposed to the internet via
|
|
|
|
// mesh gateways we force mTLS and full server name verification.
|
|
|
|
config := c.commonTLSConfig(true)
|
|
|
|
config.InsecureSkipVerify = false
|
|
|
|
|
|
|
|
config.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
|
|
|
return c.IncomingALPNRPCConfig(alpnProtos), nil
|
|
|
|
}
|
|
|
|
config.NextProtos = alpnProtos
|
|
|
|
return config
|
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
// IncomingInsecureRPCConfig means that it doesn't verify incoming even thought
|
|
|
|
// it might have been configured. This is only supposed to be used by the
|
|
|
|
// servers for the insecure RPC server. At the time of writing only the
|
|
|
|
// AutoEncrypt.Sign call is supported on that server. And it might be the only
|
|
|
|
// usecase ever.
|
|
|
|
func (c *Configurator) IncomingInsecureRPCConfig() *tls.Config {
|
|
|
|
c.log("IncomingInsecureRPCConfig")
|
|
|
|
config := c.commonTLSConfig(false)
|
|
|
|
config.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
|
|
|
return c.IncomingInsecureRPCConfig(), nil
|
|
|
|
}
|
|
|
|
return config
|
|
|
|
}
|
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// IncomingHTTPSConfig generates a *tls.Config for incoming HTTPS connections.
|
2019-03-13 09:29:06 +00:00
|
|
|
func (c *Configurator) IncomingHTTPSConfig() *tls.Config {
|
|
|
|
c.log("IncomingHTTPSConfig")
|
|
|
|
config := c.commonTLSConfig(c.verifyIncomingHTTPS())
|
|
|
|
config.NextProtos = []string{"h2", "http/1.1"}
|
|
|
|
config.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
|
|
|
return c.IncomingHTTPSConfig(), nil
|
|
|
|
}
|
|
|
|
return config
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
|
|
|
|
2021-02-25 06:35:34 +00:00
|
|
|
// OutgoingTLSConfigForCheck generates a *tls.Config for outgoing TLS connections
|
|
|
|
// for checks. This function is separated because there is an extra flag to
|
2019-02-27 09:14:59 +00:00
|
|
|
// consider for checks. EnableAgentTLSForChecks and InsecureSkipVerify has to
|
|
|
|
// be checked for checks.
|
2021-02-25 06:35:34 +00:00
|
|
|
func (c *Configurator) OutgoingTLSConfigForCheck(skipVerify bool, serverName string) *tls.Config {
|
2019-03-13 09:29:06 +00:00
|
|
|
c.log("OutgoingTLSConfigForCheck")
|
2021-02-25 06:35:34 +00:00
|
|
|
|
2021-06-24 18:31:17 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
useAgentTLS := c.base.EnableAgentTLSForChecks
|
|
|
|
c.lock.RUnlock()
|
|
|
|
|
|
|
|
if !useAgentTLS {
|
2019-02-27 09:14:59 +00:00
|
|
|
return &tls.Config{
|
2019-03-13 09:29:06 +00:00
|
|
|
InsecureSkipVerify: skipVerify,
|
2021-02-25 06:35:34 +00:00
|
|
|
ServerName: serverName,
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
2019-02-27 09:14:59 +00:00
|
|
|
}
|
|
|
|
|
2021-06-24 17:36:58 +00:00
|
|
|
if serverName == "" {
|
|
|
|
serverName = c.serverNameOrNodeName()
|
|
|
|
}
|
2019-03-13 09:29:06 +00:00
|
|
|
config := c.commonTLSConfig(false)
|
|
|
|
config.InsecureSkipVerify = skipVerify
|
2021-02-25 06:35:34 +00:00
|
|
|
config.ServerName = serverName
|
2019-03-05 20:35:43 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
return config
|
2019-02-27 09:14:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// OutgoingRPCConfig generates a *tls.Config for outgoing RPC connections. If
|
|
|
|
// there is a CA or VerifyOutgoing is set, a *tls.Config will be provided,
|
|
|
|
// otherwise we assume that no TLS should be used.
|
2019-03-13 09:29:06 +00:00
|
|
|
func (c *Configurator) OutgoingRPCConfig() *tls.Config {
|
|
|
|
c.log("OutgoingRPCConfig")
|
|
|
|
if c.outgoingRPCTLSDisabled() {
|
|
|
|
return nil
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
2019-02-27 09:14:59 +00:00
|
|
|
return c.commonTLSConfig(false)
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
|
|
|
|
2021-06-24 18:31:17 +00:00
|
|
|
// outgoingALPNRPCConfig generates a *tls.Config for outgoing RPC connections
|
2020-03-09 20:59:02 +00:00
|
|
|
// directly using TLS with ALPN instead of the older byte-prefixed protocol.
|
|
|
|
// If there is a CA or VerifyOutgoing is set, a *tls.Config will be provided,
|
|
|
|
// otherwise we assume that no TLS should be used which completely disables the
|
|
|
|
// ALPN variation.
|
2021-06-24 18:31:17 +00:00
|
|
|
func (c *Configurator) outgoingALPNRPCConfig() *tls.Config {
|
|
|
|
c.log("outgoingALPNRPCConfig")
|
|
|
|
if !c.MutualTLSCapable() {
|
2020-03-09 20:59:02 +00:00
|
|
|
return nil // ultimately this will hard-fail as TLS is required
|
|
|
|
}
|
|
|
|
|
|
|
|
// Since the ALPN-RPC variation is indirectly exposed to the internet via
|
|
|
|
// mesh gateways we force mTLS and full server name verification.
|
|
|
|
config := c.commonTLSConfig(true)
|
|
|
|
config.InsecureSkipVerify = false
|
|
|
|
return config
|
|
|
|
}
|
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// OutgoingRPCWrapper wraps the result of OutgoingRPCConfig in a DCWrapper. It
|
|
|
|
// decides if verify server hostname should be used.
|
2019-03-13 09:29:06 +00:00
|
|
|
func (c *Configurator) OutgoingRPCWrapper() DCWrapper {
|
|
|
|
c.log("OutgoingRPCWrapper")
|
2019-02-26 15:52:07 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// Generate the wrapper based on dc
|
|
|
|
return func(dc string, conn net.Conn) (net.Conn, error) {
|
2020-04-30 20:12:17 +00:00
|
|
|
if c.UseTLS(dc) {
|
|
|
|
return c.wrapTLSClient(dc, conn)
|
|
|
|
}
|
|
|
|
return conn, nil
|
2019-02-26 15:52:07 +00:00
|
|
|
}
|
2019-03-13 09:29:06 +00:00
|
|
|
}
|
2019-02-26 15:52:07 +00:00
|
|
|
|
2020-04-30 20:12:17 +00:00
|
|
|
func (c *Configurator) UseTLS(dc string) bool {
|
|
|
|
return !c.outgoingRPCTLSDisabled() && c.getAreaForPeerDatacenterUseTLS(dc)
|
|
|
|
}
|
|
|
|
|
2021-06-24 18:31:17 +00:00
|
|
|
// OutgoingALPNRPCWrapper wraps the result of outgoingALPNRPCConfig in an
|
2020-03-09 20:59:02 +00:00
|
|
|
// ALPNWrapper. It configures all of the negotiation plumbing.
|
|
|
|
func (c *Configurator) OutgoingALPNRPCWrapper() ALPNWrapper {
|
|
|
|
c.log("OutgoingALPNRPCWrapper")
|
2021-06-24 18:31:17 +00:00
|
|
|
if !c.MutualTLSCapable() {
|
2020-03-09 20:59:02 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-06-21 15:42:32 +00:00
|
|
|
return c.wrapALPNTLSClient
|
2020-03-09 20:59:02 +00:00
|
|
|
}
|
|
|
|
|
2021-06-21 19:19:34 +00:00
|
|
|
// AutoEncryptCert returns the TLS certificate received from auto-encrypt.
|
|
|
|
func (c *Configurator) AutoEncryptCert() *x509.Certificate {
|
2021-06-17 22:48:44 +00:00
|
|
|
c.lock.RLock()
|
|
|
|
defer c.lock.RUnlock()
|
2020-07-30 14:15:12 +00:00
|
|
|
tlsCert := c.autoTLS.cert
|
2019-11-12 18:40:32 +00:00
|
|
|
if tlsCert == nil || tlsCert.Certificate == nil {
|
2021-06-21 19:19:34 +00:00
|
|
|
return nil
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
|
|
|
cert, err := x509.ParseCertificate(tlsCert.Certificate[0])
|
|
|
|
if err != nil {
|
2021-06-21 19:19:34 +00:00
|
|
|
return nil
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
2021-06-21 19:19:34 +00:00
|
|
|
return cert
|
2019-06-27 20:22:07 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
func (c *Configurator) log(name string) {
|
2021-06-17 23:35:58 +00:00
|
|
|
if c.logger != nil && c.logger.IsTrace() {
|
|
|
|
c.logger.Trace(name, "version", atomic.LoadUint64(&c.version))
|
2017-02-01 20:52:04 +00:00
|
|
|
}
|
2014-11-18 16:03:36 +00:00
|
|
|
}
|
2017-04-27 08:29:39 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
// Wrap a net.Conn into a client tls connection, performing any
|
|
|
|
// additional verification as needed.
|
|
|
|
//
|
|
|
|
// As of go 1.3, crypto/tls only supports either doing no certificate
|
|
|
|
// verification, or doing full verification including of the peer's
|
|
|
|
// DNS name. For consul, we want to validate that the certificate is
|
|
|
|
// signed by a known CA, but because consul doesn't use DNS names for
|
|
|
|
// node names, we don't verify the certificate DNS names. Since go 1.3
|
|
|
|
// no longer supports this mode of operation, we have to do it
|
|
|
|
// manually.
|
|
|
|
func (c *Configurator) wrapTLSClient(dc string, conn net.Conn) (net.Conn, error) {
|
|
|
|
config := c.OutgoingRPCConfig()
|
2019-06-27 20:22:07 +00:00
|
|
|
verifyServerHostname := c.VerifyServerHostname()
|
|
|
|
verifyOutgoing := c.verifyOutgoing()
|
|
|
|
domain := c.domain()
|
2019-02-27 09:14:59 +00:00
|
|
|
|
2019-03-13 09:29:06 +00:00
|
|
|
if verifyServerHostname {
|
|
|
|
// Strip the trailing '.' from the domain if any
|
|
|
|
domain = strings.TrimSuffix(domain, ".")
|
|
|
|
config.ServerName = "server." + dc + "." + domain
|
|
|
|
}
|
2019-06-27 20:22:07 +00:00
|
|
|
tlsConn := tls.Client(conn, config)
|
2019-03-13 09:29:06 +00:00
|
|
|
|
|
|
|
// If crypto/tls is doing verification, there's no need to do
|
|
|
|
// our own.
|
|
|
|
if !config.InsecureSkipVerify {
|
|
|
|
return tlsConn, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// If verification is not turned on, don't do it.
|
|
|
|
if !verifyOutgoing {
|
|
|
|
return tlsConn, nil
|
|
|
|
}
|
|
|
|
|
2019-06-27 20:22:07 +00:00
|
|
|
err := tlsConn.Handshake()
|
|
|
|
if err != nil {
|
2019-03-13 09:29:06 +00:00
|
|
|
tlsConn.Close()
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// The following is lightly-modified from the doFullHandshake
|
|
|
|
// method in crypto/tls's handshake_client.go.
|
|
|
|
opts := x509.VerifyOptions{
|
|
|
|
Roots: config.RootCAs,
|
|
|
|
CurrentTime: time.Now(),
|
|
|
|
DNSName: "",
|
|
|
|
Intermediates: x509.NewCertPool(),
|
|
|
|
}
|
|
|
|
|
|
|
|
certs := tlsConn.ConnectionState().PeerCertificates
|
|
|
|
for i, cert := range certs {
|
|
|
|
if i == 0 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
opts.Intermediates.AddCert(cert)
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = certs[0].Verify(opts)
|
|
|
|
if err != nil {
|
|
|
|
tlsConn.Close()
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return tlsConn, err
|
2019-02-27 09:14:59 +00:00
|
|
|
}
|
|
|
|
|
2020-03-09 20:59:02 +00:00
|
|
|
// Wrap a net.Conn into a client tls connection suitable for secure ALPN-RPC,
|
|
|
|
// performing any additional verification as needed.
|
|
|
|
func (c *Configurator) wrapALPNTLSClient(dc, nodeName, alpnProto string, conn net.Conn) (net.Conn, error) {
|
|
|
|
if dc == "" {
|
|
|
|
return nil, fmt.Errorf("cannot dial using ALPN-RPC without a target datacenter")
|
|
|
|
} else if nodeName == "" {
|
|
|
|
return nil, fmt.Errorf("cannot dial using ALPN-RPC without a target node")
|
|
|
|
} else if alpnProto == "" {
|
|
|
|
return nil, fmt.Errorf("cannot dial using ALPN-RPC without a target alpn protocol")
|
|
|
|
}
|
|
|
|
|
2021-06-24 18:31:17 +00:00
|
|
|
config := c.outgoingALPNRPCConfig()
|
2020-03-09 20:59:02 +00:00
|
|
|
if config == nil {
|
|
|
|
return nil, fmt.Errorf("cannot dial via a mesh gateway when outgoing TLS is disabled")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Since the ALPN-RPC variation is indirectly exposed to the internet via
|
|
|
|
// mesh gateways we force mTLS and full hostname validation (forcing
|
|
|
|
// verify_server_hostname and verify_outgoing to be effectively true).
|
|
|
|
|
|
|
|
config.ServerName = c.ServerSNI(dc, nodeName)
|
|
|
|
config.NextProtos = []string{alpnProto}
|
|
|
|
|
|
|
|
tlsConn := tls.Client(conn, config)
|
|
|
|
|
|
|
|
// NOTE: For this handshake to succeed the server must have key material
|
|
|
|
// for either "<nodename>.server.<datacenter>.<domain>" or
|
|
|
|
// "*.server.<datacenter>.<domain>" in addition to the
|
|
|
|
// "server.<datacenter>.<domain>" required for standard TLS'd RPC.
|
|
|
|
if err := tlsConn.Handshake(); err != nil {
|
|
|
|
tlsConn.Close()
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return tlsConn, nil
|
|
|
|
}
|
|
|
|
|
2019-02-27 09:14:59 +00:00
|
|
|
// ParseCiphers parse ciphersuites from the comma-separated string into
|
|
|
|
// recognized slice
|
2017-04-27 08:29:39 +00:00
|
|
|
func ParseCiphers(cipherStr string) ([]uint16, error) {
|
|
|
|
suites := []uint16{}
|
|
|
|
|
|
|
|
cipherStr = strings.TrimSpace(cipherStr)
|
|
|
|
if cipherStr == "" {
|
|
|
|
return []uint16{}, nil
|
|
|
|
}
|
|
|
|
ciphers := strings.Split(cipherStr, ",")
|
|
|
|
|
2020-06-05 19:56:19 +00:00
|
|
|
// Note: this needs to be kept up to date with the cipherMap in CipherString
|
2017-04-27 08:29:39 +00:00
|
|
|
cipherMap := map[string]uint16{
|
2020-03-10 20:44:26 +00:00
|
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
|
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
2017-04-27 08:29:39 +00:00
|
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
2020-03-10 20:44:26 +00:00
|
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
2017-04-27 08:29:39 +00:00
|
|
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
2018-03-13 16:50:41 +00:00
|
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
2020-03-10 20:44:26 +00:00
|
|
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
|
|
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
2018-03-13 16:50:41 +00:00
|
|
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
2020-03-10 20:44:26 +00:00
|
|
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
2017-04-27 08:29:39 +00:00
|
|
|
}
|
|
|
|
for _, cipher := range ciphers {
|
|
|
|
if v, ok := cipherMap[cipher]; ok {
|
|
|
|
suites = append(suites, v)
|
|
|
|
} else {
|
|
|
|
return suites, fmt.Errorf("unsupported cipher %q", cipher)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return suites, nil
|
|
|
|
}
|
2020-06-05 19:56:19 +00:00
|
|
|
|
|
|
|
// CipherString performs the inverse operation of ParseCiphers
|
|
|
|
func CipherString(ciphers []uint16) (string, error) {
|
|
|
|
// Note: this needs to be kept up to date with the cipherMap in ParseCiphers
|
|
|
|
cipherMap := map[uint16]string{
|
|
|
|
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
|
|
|
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
|
|
|
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
|
|
|
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
|
|
|
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
|
|
|
}
|
|
|
|
|
|
|
|
cipherStrings := make([]string, len(ciphers))
|
|
|
|
for i, cipher := range ciphers {
|
|
|
|
if v, ok := cipherMap[cipher]; ok {
|
|
|
|
cipherStrings[i] = v
|
|
|
|
} else {
|
|
|
|
return "", fmt.Errorf("unsupported cipher %d", cipher)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return strings.Join(cipherStrings, ","), nil
|
|
|
|
}
|