59 Commits (a5626a9c026dd65d741231945cebb9a533771bc0)

Author	SHA1	Message	Date
Daniel Nephin	4afc24268d	tlsutil: only AuthorizerServerConn when VerifyIncomingRPC is true ... See github.com/hashicorp/consul/issues/11207 When VerifyIncomingRPC is false the TLS conn will not have the required certificates.	3 years ago
Daniel Nephin	3f873d2257	rpc: include error for AuthorizeServerConn failures ... The errs were not being captured because the value of append was not being assigned.	3 years ago
Daniel Nephin	1502547e38	Revert "Merge pull request #10588 from hashicorp/dnephin/config-fix-ports-grpc" ... This reverts commit 74fb650b6b, reversing changes made to 58bd817336.	3 years ago
Hans Hasselberg	13238dbab6	tls: consider presented intermediates during server connection tls handshake. (#10964) ... * use intermediates when verifying * extract connection state * remove useless import * add changelog entry * golint * better error * wording * collect errors * use SAN.DNSName instead of CommonName * Add test for unknown intermediate * improve changelog entry	3 years ago
Evan Culver	79c7e73618	rpc: authorize raft requests (#10925)	3 years ago
Daniel Nephin	7d73fd7ae5	rename GRPC->XDS where appropriate	3 years ago
Daniel Nephin	dce59d9277	fix 64-bit aligment for 32-bit platforms ... sync/atomic must be used with 64-bit aligned fields, and that alignment is difficult to ensure unless the field is the first one in the struct. https://golang.org/pkg/sync/atomic/#pkg-note-BUG.	3 years ago
Daniel Nephin	dc67042eac	Invert the logic of outgoingRPCTLSDisabled ... To remove the double negatives, which should make it easier to read.	3 years ago
Daniel Nephin	39f282c425	tlsutil: inline verifyIncomingHTTPS ... This function was only used in one place, and the indirection makes it slightly harder to see what the one caller is doing. Since it's only accesing a couple fields it seems like the logic can exist in the one caller.	3 years ago
Daniel Nephin	a25c817478	tlsutil: remove indirection and duplication ... VerifyIncomingRPC and verifyIncomingRPC were duplicate functions, and once one is removed, Config.verifyIncomingRPC is only called in one place. Remove 2 of the 3 functions to make the behaviour easier to follow (less indirection).	3 years ago
Daniel Nephin	13e5448c17	tlsutil: remove unnecessary getter functions ... These functions did nothing but hide the fields they were returning.	3 years ago
Daniel Nephin	66ba2e2463	tlsutil: unexport and remove indirection ... Unexport outgoingALPNRPCConfig since it is only used internally Remove the MutualTLSCapable->mutualTLSCapable indirection, we only need the exported method. Inline enableAgentTLSForChecks to make it more clear what it does, since it only has a single caller and is wrapping a single field lookup.	3 years ago
Daniel Nephin	486b97e2c9	tlsutil: fix default server name for health checks ... Don't use the agent node name or agent server name when EnableAgentTLSForChecks=false.	3 years ago
Daniel Nephin	2aad3f80fb	tlsutil: reduce interface provided to auto-config ... Replace two methods with a single one that returns the cert. This moves more of the logic into the single caller (auto-config). tlsutil.Configurator is widely used. By keeping it smaller and focused only on storing and returning TLS config, we make the code easier to follow. These two methods were more related to auto-config than to tlsutil, so reducing the interface moves the logic closer to the feature that requires it.	3 years ago
Daniel Nephin	1ba5acb284	tlsutil: un-ptr and document the manual struct	3 years ago
Daniel Nephin	6289b68247	tlsutil: document Configurator and some of its fields	3 years ago
Daniel Nephin	a4432bb0b4	tlsutil: un-ptr and add godoc to autoTLs struct ... the autoTLS field on Configurator is only set once. By making it a value receiver it should be allocated as a single block of memory along with Configurator. Also add godoc to document what it is used for.	3 years ago
Daniel Nephin	08cd772626	tlsutil: remove unused method ... Method was only used in tests, and an equivalent function alraedy exists.	3 years ago
Daniel Nephin	8d9d6c6a09	tlsutil: unexport two types ... These types are only used internally and should not be exported. Also remove some unnecessary function wrapping.	3 years ago
Daniel Nephin	bca33d818f	tlsutil: remove the RLock from log ... The log method only needed the lock because it accessed version. By using an atomic instead of a lock, we can remove the risk that the comments call out, making log safer to use. Also updates the log name to match the function names, and adds some comments about how the lock is used.	3 years ago
Daniel Nephin	bcf23cd1b4	tlsutil: Un-method Configurator.check ... The method receiver was never used. Also rename it and add a godoc comment.	3 years ago
Daniel Nephin	b3fa778d91	tlsutil: fix a panic ... UpdateAutoTLSCA would panic if either of the calls errored, because the read lock was being unlocked incorrectly.	3 years ago
Daniel Nephin	6f51984313	tlsutil: un-embed the RWMutex ... Embedded structs make code harder to navidate because an IDE can not show all uses of the methods of that field separate from other uses. Generally embedding of structs should only be used to satisfy an interface, and in this case the Configurator type does not need to implement the RWMutex interface.	3 years ago
Christopher Broglie	f0307c73e5	Add support for configuring TLS ServerName for health checks ... Some TLS servers require SNI, but the Golang HTTP client doesn't include it in the ClientHello when connecting to an IP address. This change adds a new TLSServerName field to health check definitions to optionally set it. This fixes #9473.	4 years ago
Mike Morris	7af643ac37	ci: update to Go 1.15.4 and alpine:3.12 (#9036) ... * ci: stop building darwin/386 binaries Go 1.15 drops support for 32-bit binaries on Darwin https://golang.org/doc/go1.15#darwin * tls: ConnectionState::NegotiatedProtocolIsMutual is deprecated in Go 1.15, this value is always true * correct error messages that changed slightly * Completely regenerate some TLS test data Co-authored-by: R.B. Boyer <rb@hashicorp.com>	4 years ago
Daniel Nephin	e9479175a4	tlsutil: remove unused UseTLS field	4 years ago
Tim Arenz	a1fe711390	Add support for -ca-path option in the connect envoy command (#8606) ... * Add support for -ca-path option in the connect envoy command * Adding changelog entry	4 years ago
Matt Keeler	dbb461a5d3	Allow setting verify_incoming* when using auto_encrypt or auto_config (#8394) ... Ensure that enabling AutoConfig sets the tls configurator properly This also refactors the TLS configurator a bit so the naming doesn’t imply only AutoEncrypt as the source of the automatically setup TLS cert info.	4 years ago
Matt Keeler	6e7acfa618	Add an AutoEncrypt “integration” test ... Also fix a bug where Consul could segfault if TLS was enabled but no client certificate was provided. How no one has reported this as a problem I am not sure.	4 years ago
Matt Keeler	9b01f9423c	Implement the insecure version of the Cluster.AutoConfig RPC endpoint ... Right now this is only hooked into the insecure RPC server and requires JWT authorization. If no JWT authorizer is setup in the configuration then we inject a disabled “authorizer” to always report that JWT authorization is disabled.	5 years ago
Hans Hasselberg	51549bd232	rpc: oss changes for network area connection pooling (#7735)	5 years ago
Hans Hasselberg	7777891aa6	tls: remove old ciphers (#7282) ... Following advice from: https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices, this PR removes old ciphers.	5 years ago
R.B. Boyer	6adad71125	wan federation via mesh gateways (#6884) ... This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch: There are several distinct chunks of code that are affected: * new flags and config options for the server * retry join WAN is slightly different * retry join code is shared to discover primary mesh gateways from secondary datacenters * because retry join logic runs in the *agent* and the results of that operation for primary mesh gateways are needed in the *server* there are some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur at multiple layers of abstraction just to pass the data down to the right layer. * new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers * the function signature for RPC dialing picked up a new required field (the node name of the destination) * several new RPCs for manipulating a FederationState object: `FederationState:{Apply,Get,List,ListMeshGateways}` * 3 read-only internal APIs for debugging use to invoke those RPCs from curl * raft and fsm changes to persist these FederationStates * replication for FederationStates as they are canonically stored in the Primary and replicated to the Secondaries. * a special derivative of anti-entropy that runs in secondaries to snapshot their local mesh gateway `CheckServiceNodes` and sync them into their upstream FederationState in the primary (this works in conjunction with the replication to distribute addresses for all mesh gateways in all DCs to all other DCs) * a "gateway locator" convenience object to make use of this data to choose the addresses of gateways to use for any given RPC or gossip operation to a remote DC. This gets data from the "retry join" logic in the agent and also directly calls into the FSM. * RPC (`:8300`) on the server sniffs the first byte of a new connection to determine if it's actually doing native TLS. If so it checks the ALPN header for protocol determination (just like how the existing system uses the type-byte marker). * 2 new kinds of protocols are exclusively decoded via this native TLS mechanism: one for ferrying "packet" operations (udp-like) from the gossip layer and one for "stream" operations (tcp-like). The packet operations re-use sockets (using length-prefixing) to cut down on TLS re-negotiation overhead. * the server instances specially wrap the `memberlist.NetTransport` when running with gateway federation enabled (in a `wanfed.Transport`). The general gist is that if it tries to dial a node in the SAME datacenter (deduced by looking at the suffix of the node name) there is no change. If dialing a DIFFERENT datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh gateways to eventually end up in a server's :8300 port. * a new flag when launching a mesh gateway via `consul connect envoy` to indicate that the servers are to be exposed. This sets a special service meta when registering the gateway into the catalog. * `proxycfg/xds` notice this metadata blob to activate additional watches for the FederationState objects as well as the location of all of the consul servers in that datacenter. * `xds:` if the extra metadata is in place additional clusters are defined in a DC to bulk sink all traffic to another DC's gateways. For the current datacenter we listen on a wildcard name (`server.<dc>.consul`) that load balances all servers as well as one mini-cluster per node (`<node>.server.<dc>.consul`) * the `consul tls cert create` command got a new flag (`-node`) to help create an additional SAN in certs that can be used with this flavor of federation.	5 years ago
Hans Hasselberg	e05ac57e8f	tls: support tls 1.3 (#7325)	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130) ... * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Hans Hasselberg	11a571de95	agent: setup grpc server with auto_encrypt certs and add -https-port (#7086) ... * setup grpc server with TLS config used across consul. * add -https-port flag	5 years ago
Hans Hasselberg	9ff69194a2	tls: auto_encrypt and verify_incoming (#6811) (#6899) ... * relax requirements for auto_encrypt on server * better error message when auto_encrypt and verify_incoming on * docs: explain verify_incoming on Consul clients.	5 years ago
Hans Hasselberg	a3f49109e6	tls: return auto_encrypt cert for listeners (#6489) ... * fix cert check * fix lock * add tests * test: add comments describing expected behavior for auto-encrypt and manual certificates * test: expect nil *tls.Certificate for empty string certFile or keyFile arg	5 years ago
Hans Hasselberg	33a7df3330	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597)	5 years ago
Hans Hasselberg	7e11dd82aa	agent: enable reloading of tls config (#5419) ... This PR introduces reloading tls configuration. Consul will now be able to reload the TLS configuration which previously required a restart. It is not yet possible to turn TLS ON or OFF with these changes. Only when TLS is already turned on, the configuration can be reloaded. Most importantly the certificates and CAs.	6 years ago
R.B. Boyer	f4a3b9d518	fix typos reported by golangci-lint:misspell (#5434)	6 years ago
Hans Hasselberg	eb0895c5fb	tlsutil: don't use `server_name` config for RPC connections (#5394) ... * server name only for outgoing https for checks	6 years ago
Hans Hasselberg	80e7d63fc2	Centralise tls configuration part 2 (#5374) ... This PR is based on #5366 and continues to centralise the tls configuration in order to be reloadable eventually! This PR is another refactoring. No tests are changed, beyond calling other functions or cosmetic stuff. I added a bunch of tests, even though they might be redundant.	6 years ago
Hans Hasselberg	786b3b1095	Centralise tls configuration part 1 (#5366) ... In order to be able to reload the TLS configuration, we need one way to generate the different configurations. This PR introduces a `tlsutil.Configurator` which holds a `tlsutil.Config`. Afterwards it is responsible for rendering every `tls.Config`. In this particular PR I moved `IncomingHTTPSConfig`, `IncomingTLSConfig`, and `OutgoingTLSWrapper` into `tlsutil.Configurator`. This PR is a pure refactoring - not a single feature added. And not a single test added. I only slightly modified existing tests as necessary.	6 years ago
Hans Hasselberg	787f3f8aa6	agent: honor when ca is set but verify_outgoing is disabled (#4826) ... * honor when verify_outgoing is false but ca is set * Remove code that exists only for tests * fix formatting	6 years ago
Jack Pearkes	b64e8b262f	Documentation and changes for `verify_server_hostname` (#5069) ... * verify_server_hostname implies verify_outgoing * mention CVE in the docs.	6 years ago
Devin Canterberry	a61abcd931	🐛 Formatting changes only; add missing trailing commas	7 years ago
Devin Canterberry	c901307a47	🔒 Update supported TLS cipher suites ... The list of cipher suites included in this commit are consistent with the values and precedence in the [Golang TLS documentation](https://golang.org/src/crypto/tls/cipher_suites.go). > **Note:** Cipher suites with RC4 are still included within the list > of accepted values for compatibility, but **these cipher suites are > not safe to use** and should be deprecated with warnings and > subsequently removed. Support for RC4 ciphers has already been > removed or disabled by default in many prominent browsers and tools, > including Golang. > > **References:** > > * [RC4 on Wikipedia](https://en.wikipedia.org/wiki/RC4) > * [Mozilla Security Blog](https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/)	7 years ago
James Phillips	8324c1b9a6	Removes stale TLS config clone() in favor of new supported method.	7 years ago
Kyle Havlovitz	5bab68b9bb	Add a path for transitioning to TLS on an existing cluster (#3001) ... Fixes #1705	8 years ago