From f4340b8dc005b40997134ae3add5e6720c42d15e Mon Sep 17 00:00:00 2001 From: Paul Lorenz Date: Wed, 31 May 2023 15:04:25 -0400 Subject: [PATCH] Fix hosting unecnrypted service on ER/T. Fixes #1507 --- router/xgress_edge_transport/dialer.go | 10 ++++----- router/xgress_edge_tunnel/fabric.go | 30 +++++++++++--------------- 2 files changed, 18 insertions(+), 22 deletions(-) diff --git a/router/xgress_edge_transport/dialer.go b/router/xgress_edge_transport/dialer.go index 45c20926f..90e7cf54b 100644 --- a/router/xgress_edge_transport/dialer.go +++ b/router/xgress_edge_transport/dialer.go @@ -63,14 +63,14 @@ func (txd *dialer) Dial(params xgress.DialParams) (xt.PeerData, error) { if timeToDeadline > 0 && timeToDeadline < to { to = timeToDeadline } - peer, err := txDestination.Dial("x/"+circuitId.Token, circuitId, to, nil) + conn, err := txDestination.Dial("x/"+circuitId.Token, circuitId, to, nil) if err != nil { return nil, err } - log.Debugf("successful connection to %v from %v (s/%v)", destination, peer.LocalAddr(), circuitId.Token) + log.Debugf("successful connection to %v from %v (s/%v)", destination, conn.LocalAddr(), circuitId.Token) - xgConn := xgress_common.NewXgressConn(peer, true, true) + xgConn := xgress_common.NewXgressConn(conn, true, true) peerData := make(xt.PeerData, 3) if peerKey, ok := circuitId.Data[edge.PublicKeyHeader]; ok { if publicKey, err := xgConn.SetupServerCrypto(peerKey); err != nil { @@ -80,8 +80,8 @@ func (txd *dialer) Dial(params xgress.DialParams) (xt.PeerData, error) { } } - peerData[uint32(ctrl_msg.TerminatorLocalAddressHeader)] = []byte(peer.LocalAddr().String()) - peerData[uint32(ctrl_msg.TerminatorRemoteAddressHeader)] = []byte(peer.RemoteAddr().String()) + peerData[uint32(ctrl_msg.TerminatorLocalAddressHeader)] = []byte(conn.LocalAddr().String()) + peerData[uint32(ctrl_msg.TerminatorRemoteAddressHeader)] = []byte(conn.RemoteAddr().String()) x := xgress.NewXgress(circuitId.Token, params.GetCtrlId(), params.GetAddress(), xgConn, xgress.Terminator, txd.options, params.GetCircuitTags()) params.GetBindHandler().HandleXgressBind(x) diff --git a/router/xgress_edge_tunnel/fabric.go b/router/xgress_edge_tunnel/fabric.go index 6ef8d9134..d1338b355 100644 --- a/router/xgress_edge_tunnel/fabric.go +++ b/router/xgress_edge_tunnel/fabric.go @@ -21,7 +21,6 @@ import ( "github.com/cenkalti/backoff/v4" "github.com/google/uuid" "github.com/michaelquigley/pfxlog" - "github.com/openziti/secretstream/kx" "github.com/openziti/channel/v2" "github.com/openziti/channel/v2/protobufs" "github.com/openziti/edge-api/rest_model" @@ -36,6 +35,7 @@ import ( "github.com/openziti/sdk-golang/ziti" "github.com/openziti/sdk-golang/ziti/edge" "github.com/openziti/sdk-golang/ziti/sdkinfo" + "github.com/openziti/secretstream/kx" cmap "github.com/orcaman/concurrent-map/v2" "github.com/pkg/errors" "github.com/sirupsen/logrus" @@ -205,7 +205,9 @@ func (self *fabricProvider) TunnelService(service tunnel.Service, terminatorInst log := logrus.WithField("service", service.GetName()) peerData := make(map[uint32][]byte) - peerData[edge.PublicKeyHeader] = keyPair.Public() + if service.IsEncryptionRequired() { + peerData[edge.PublicKeyHeader] = keyPair.Public() + } if len(appData) > 0 { peerData[edge.AppDataHeader] = appData } @@ -232,7 +234,7 @@ func (self *fabricProvider) TunnelService(service tunnel.Service, terminatorInst response := &edge_ctrl_pb.CreateCircuitForServiceResponse{} if err = xgress_common.GetResultOrFailure(responseMsg, err, response); err != nil { - log.Warn("failed to dial fabric") + log.WithError(err).Warn("failed to dial fabric") return err } @@ -246,10 +248,15 @@ func (self *fabricProvider) TunnelService(service tunnel.Service, terminatorInst self.dialSessions.Set(service.GetName(), response.Session.SessionId) } + peerKey, peerKeyFound := response.PeerData[edge.PublicKeyHeader] + if service.IsEncryptionRequired() && !peerKeyFound { + return errors.New("service requires encryption, but public key header not returned") + } + xgConn := xgress_common.NewXgressConn(conn, halfClose, false) - if peerKey, ok := response.PeerData[edge.PublicKeyHeader]; ok { - if err := xgConn.SetupClientCrypto(keyPair, peerKey); err != nil { + if peerKeyFound { + if err = xgConn.SetupClientCrypto(keyPair, peerKey); err != nil { return err } } @@ -271,17 +278,8 @@ func (self *fabricProvider) TunnelService(service tunnel.Service, terminatorInst func (self *fabricProvider) HostService(hostCtx tunnel.HostingContext) (tunnel.HostControl, error) { id := uuid.NewString() - keyPair, err := kx.NewKeyPair() - if err != nil { - return nil, err - } - - hostData := make(map[uint32][]byte) - hostData[edge.PublicKeyHeader] = keyPair.Public() - terminator := &tunnelTerminator{ id: id, - hostData: hostData, provider: self, context: hostCtx, notifyCreated: make(chan struct{}, 1), @@ -289,7 +287,7 @@ func (self *fabricProvider) HostService(hostCtx tunnel.HostingContext) (tunnel.H self.tunneler.terminators.Set(terminator.id, terminator) - err = self.factory.env.GetRateLimiterPool().QueueWithTimeout(func() { + err := self.factory.env.GetRateLimiterPool().QueueWithTimeout(func() { self.establishTerminatorWithRetry(terminator) }, math.MaxInt64) @@ -349,7 +347,6 @@ func (self *fabricProvider) establishTerminator(terminator *tunnelTerminator) er ServiceName: terminator.context.ServiceName(), SessionId: sessionId, Address: terminator.id, - PeerData: terminator.hostData, Cost: uint32(terminator.context.ListenOptions().Cost), Precedence: precedence, InstanceId: terminator.context.ListenOptions().Identity, @@ -520,7 +517,6 @@ func (self *fabricProvider) requestServiceList(ctrlCh channel.Channel, lastUpdat type tunnelTerminator struct { id string - hostData map[uint32][]byte provider *fabricProvider context tunnel.HostingContext created atomic.Bool