From e39c21b6a1481b5b70ac00b1ddd376a0ba502d55 Mon Sep 17 00:00:00 2001 From: Andrew M Date: Mon, 27 Jul 2020 16:18:46 -0400 Subject: [PATCH 1/3] e2e support fixes #173 - adds edge level edge_transport xgress - adds service encyrptionRequired flag (rest API, protobuffs) - adds edge router encryption checks --- controller/env/broker.go | 1 + .../internal/routes/service_api_model.go | 4 + controller/model/service_model.go | 9 +- controller/persistence/edge_service_store.go | 13 +- gateway/xgress_edge/dialer.go | 17 +- gateway/xgress_edge/listener.go | 19 +++ gateway/xgress_edge_transport/client.go | 50 ++++++ gateway/xgress_edge_transport/connection.go | 152 ++++++++++++++++++ gateway/xgress_edge_transport/dialer.go | 135 ++++++++++++++++ gateway/xgress_edge_transport/factory.go | 45 ++++++ gateway/xgress_edge_transport/listener.go | 94 +++++++++++ pb/edge_ctrl_pb/README.md | 2 +- pb/edge_ctrl_pb/edge_ctrl.pb.go | 102 ++++++------ pb/edge_ctrl_pb/edge_ctrl.proto | 1 + rest_model/service_create.go | 3 + rest_model/service_detail.go | 27 +++- rest_model/service_patch.go | 3 + rest_model/service_update.go | 3 + rest_server/embedded_spec.go | 34 +++- specs/swagger.yml | 11 +- 20 files changed, 661 insertions(+), 64 deletions(-) create mode 100644 gateway/xgress_edge_transport/client.go create mode 100644 gateway/xgress_edge_transport/connection.go create mode 100644 gateway/xgress_edge_transport/dialer.go create mode 100644 gateway/xgress_edge_transport/factory.go create mode 100644 gateway/xgress_edge_transport/listener.go diff --git a/controller/env/broker.go b/controller/env/broker.go index 2ba0c9c8a..1439c09a9 100644 --- a/controller/env/broker.go +++ b/controller/env/broker.go @@ -415,6 +415,7 @@ func (b *Broker) modelServiceToProto(service *model.Service) (*edge_ctrl_pb.Serv return &edge_ctrl_pb.Service{ Name: service.Name, Id: service.Id, + EncryptionRequired: service.EncryptionRequired, }, nil } diff --git a/controller/internal/routes/service_api_model.go b/controller/internal/routes/service_api_model.go index cbc3bce0e..8d07fe66d 100644 --- a/controller/internal/routes/service_api_model.go +++ b/controller/internal/routes/service_api_model.go @@ -60,6 +60,7 @@ func MapCreateServiceToModel(service *rest_model.ServiceCreate) *model.Service { TerminatorStrategy: service.TerminatorStrategy, RoleAttributes: service.RoleAttributes, Configs: service.Configs, + EncryptionRequired: service.EncryptionRequired, } return ret @@ -75,6 +76,7 @@ func MapUpdateServiceToModel(id string, service *rest_model.ServiceUpdate) *mode TerminatorStrategy: service.TerminatorStrategy, RoleAttributes: service.RoleAttributes, Configs: service.Configs, + EncryptionRequired: service.EncryptionRequired, } return ret @@ -90,6 +92,7 @@ func MapPatchServiceToModel(id string, service *rest_model.ServicePatch) *model. TerminatorStrategy: service.TerminatorStrategy, RoleAttributes: service.RoleAttributes, Configs: service.Configs, + EncryptionRequired: service.EncryptionRequired, } return ret @@ -141,6 +144,7 @@ func MapServiceToRestModel(service *model.ServiceDetail) (*rest_model.ServiceDet RoleAttributes: service.RoleAttributes, Configs: service.Configs, Config: service.Config, + EncryptionRequired: &service.EncryptionRequired, } for _, permission := range service.Permissions { diff --git a/controller/model/service_model.go b/controller/model/service_model.go index 3296e26ee..2ee33d29c 100644 --- a/controller/model/service_model.go +++ b/controller/model/service_model.go @@ -34,6 +34,7 @@ type Service struct { TerminatorStrategy string `json:"terminatorStrategy"` RoleAttributes []string `json:"roleAttributes"` Configs []string `json:"configs"` + EncryptionRequired bool `json:"encryptionRequired"` } func (entity *Service) toBoltEntity(tx *bbolt.Tx, handler Handler) (boltz.Entity, error) { @@ -47,8 +48,9 @@ func (entity *Service) toBoltEntity(tx *bbolt.Tx, handler Handler) (boltz.Entity Name: entity.Name, TerminatorStrategy: entity.TerminatorStrategy, }, - RoleAttributes: entity.RoleAttributes, - Configs: entity.Configs, + RoleAttributes: entity.RoleAttributes, + Configs: entity.Configs, + EncryptionRequired: entity.EncryptionRequired, } return edgeService, nil } @@ -98,6 +100,7 @@ func (entity *Service) fillFrom(_ Handler, _ *bbolt.Tx, boltEntity boltz.Entity) entity.TerminatorStrategy = boltService.TerminatorStrategy entity.RoleAttributes = boltService.RoleAttributes entity.Configs = boltService.Configs + entity.EncryptionRequired = boltService.EncryptionRequired return nil } @@ -109,6 +112,7 @@ type ServiceDetail struct { Permissions []string `json:"permissions"` Configs []string `json:"configs"` Config map[string]map[string]interface{} `json:"config"` + EncryptionRequired bool `json:"encryptionRequired"` } func (entity *ServiceDetail) fillFrom(_ Handler, _ *bbolt.Tx, boltEntity boltz.Entity) error { @@ -121,6 +125,7 @@ func (entity *ServiceDetail) fillFrom(_ Handler, _ *bbolt.Tx, boltEntity boltz.E entity.TerminatorStrategy = boltService.TerminatorStrategy entity.RoleAttributes = boltService.RoleAttributes entity.Configs = boltService.Configs + entity.EncryptionRequired = boltService.EncryptionRequired return nil } diff --git a/controller/persistence/edge_service_store.go b/controller/persistence/edge_service_store.go index 910c4839a..80cf75704 100644 --- a/controller/persistence/edge_service_store.go +++ b/controller/persistence/edge_service_store.go @@ -27,10 +27,15 @@ import ( "reflect" ) +const ( + FieldServiceEncryptionRequired = "encryptionRequired" +) + type EdgeService struct { db.Service - RoleAttributes []string - Configs []string + RoleAttributes []string + Configs []string + EncryptionRequired bool } func newEdgeService(name string, roleAttributes ...string) *EdgeService { @@ -50,6 +55,9 @@ func (entity *EdgeService) LoadValues(store boltz.CrudStore, bucket *boltz.Typed entity.Name = bucket.GetStringOrError(FieldName) entity.RoleAttributes = bucket.GetStringList(FieldRoleAttributes) entity.Configs = bucket.GetStringList(EntityTypeConfigs) + + //default to true for old services w/o any value explicitly set + entity.EncryptionRequired = bucket.GetBoolWithDefault(FieldServiceEncryptionRequired, true) } func (entity *EdgeService) SetValues(ctx *boltz.PersistContext) { @@ -59,6 +67,7 @@ func (entity *EdgeService) SetValues(ctx *boltz.PersistContext) { ctx.SetString(FieldName, entity.Name) ctx.SetStringList(FieldRoleAttributes, entity.RoleAttributes) ctx.SetLinkedIds(EntityTypeConfigs, entity.Configs) + ctx.SetBool(FieldServiceEncryptionRequired, entity.EncryptionRequired) // index change won't fire if we don't have any roles on create, but we need to evaluate if we match any #all roles if ctx.IsCreate && len(entity.RoleAttributes) == 0 { diff --git a/gateway/xgress_edge/dialer.go b/gateway/xgress_edge/dialer.go index 8271e96f5..ba229a78b 100644 --- a/gateway/xgress_edge/dialer.go +++ b/gateway/xgress_edge/dialer.go @@ -19,6 +19,7 @@ package xgress_edge import ( "fmt" "github.com/michaelquigley/pfxlog" + "github.com/openziti/fabric/controller/xt" "github.com/openziti/fabric/router/xgress" "github.com/openziti/foundation/identity/identity" "github.com/openziti/sdk-golang/ziti/edge" @@ -57,15 +58,15 @@ func newDialer(factory *Factory, options *Options) xgress.Dialer { return txd } -func (dialer *dialer) Dial(destination string, sessionId *identity.TokenId, address xgress.Address, bindHandler xgress.BindHandler) error { +func (dialer *dialer) Dial(destination string, sessionId *identity.TokenId, address xgress.Address, bindHandler xgress.BindHandler) (xt.PeerData, error) { log := pfxlog.Logger().WithField("token", sessionId.Token) destParts := strings.Split(destination, ":") if len(destParts) != 2 { - return fmt.Errorf("destination '%v' format is incorrect", destination) + return nil, fmt.Errorf("destination '%v' format is incorrect", destination) } if destParts[0] != "hosted" { - return fmt.Errorf("unsupported destination type: '%v'", destParts[0]) + return nil, fmt.Errorf("unsupported destination type: '%v'", destParts[0]) } token := destParts[1] @@ -73,7 +74,7 @@ func (dialer *dialer) Dial(destination string, sessionId *identity.TokenId, addr log.Debugf("looking up hosted service conn for token %v", token) listenConn, found := dialer.factory.hostedServices.Get(token) if !found { - return fmt.Errorf("host for token '%v' not found", token) + return nil, fmt.Errorf("host for token '%v' not found", token) } log.Debug("dialing sdk client hosting service") @@ -82,16 +83,16 @@ func (dialer *dialer) Dial(destination string, sessionId *identity.TokenId, addr reply, err := listenConn.SendAndWaitWithTimeout(dialRequest, 5*time.Second) if err != nil { - return err + return nil, err } result, err := edge.UnmarshalDialResult(reply) if err != nil { - return err + return nil, err } if !result.Success { - return fmt.Errorf("failed to establish connection with token %v. error: (%v)", token, result.Message) + return nil, fmt.Errorf("failed to establish connection with token %v. error: (%v)", token, result.Message) } conn := listenConn.newSink(result.NewConnId, dialer.options) @@ -101,5 +102,5 @@ func (dialer *dialer) Dial(destination string, sessionId *identity.TokenId, addr start := edge.NewStateConnectedMsg(result.ConnId) start.ReplyTo(reply) - return listenConn.SendState(start) + return nil, listenConn.SendState(start) } diff --git a/gateway/xgress_edge/listener.go b/gateway/xgress_edge/listener.go index 725e38c2d..ed942faa8 100644 --- a/gateway/xgress_edge/listener.go +++ b/gateway/xgress_edge/listener.go @@ -150,6 +150,16 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha log.Debug("dialing fabric") peerData := make(map[uint32][]byte) peerData[edge.PublicKeyHeader] = req.Headers[edge.PublicKeyHeader] + + if ns.Service.EncryptionRequired && req.Headers[edge.PublicKeyHeader] == nil { + //what is necessary to close this properly? + msg := "encryption required on service, initiator did not send public header" + pfxlog.Logger().WithField("connId", conn.Id()).Error(msg) + proxy.sendStateClosedReply(msg, req) + conn.close(true, msg) + return + } + sessionInfo, err := xgress.GetSession(proxy.listener.factory, ns.Token, ns.Service.Id, peerData) if err != nil { log.Warn("failed to dial fabric ", err) @@ -157,6 +167,15 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha return } + if ns.Service.EncryptionRequired && sessionInfo.SessionId.Data[edge.PublicKeyHeader] == nil { + //what is necessary to close this properly? + msg := "encryption required on service, terminator did not send public header" + pfxlog.Logger().WithField("connId", conn.Id()).Error(msg) + proxy.sendStateClosedReply(msg, req) + conn.close(true, msg) + return + } + x := xgress.NewXgress(sessionInfo.SessionId, sessionInfo.Address, conn, xgress.Initiator, &proxy.listener.options.Options) proxy.listener.bindHandler.HandleXgressBind(sessionInfo.SessionId, sessionInfo.Address, xgress.Initiator, x) x.Start() diff --git a/gateway/xgress_edge_transport/client.go b/gateway/xgress_edge_transport/client.go new file mode 100644 index 000000000..f6b2b4cd5 --- /dev/null +++ b/gateway/xgress_edge_transport/client.go @@ -0,0 +1,50 @@ +/* + Copyright NetFoundry, Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +package xgress_edge_transport + +import ( + "errors" + "github.com/openziti/fabric/router/xgress" + "github.com/openziti/foundation/identity/identity" + "github.com/openziti/foundation/transport" +) + +// ClientDial dials the given xgress address and handles authentication, returning an authed connection or an error +func ClientDial(addr transport.Address, id *identity.TokenId, serviceId *identity.TokenId) (transport.Connection, error) { + peer, err := addr.Dial("i/"+id.Token, id) + if err != nil { + return nil, err + } + + request := &xgress.Request{ + Id: id.Token, + ServiceId: serviceId.Token, + } + err = xgress.SendRequest(request, peer.Writer()) + if err != nil { + return nil, err + } + response, err := xgress.ReceiveResponse(peer) + if err != nil { + return nil, err + } + if !response.Success { + return nil, errors.New(response.Message) + } + + return peer, nil +} diff --git a/gateway/xgress_edge_transport/connection.go b/gateway/xgress_edge_transport/connection.go new file mode 100644 index 000000000..fdc6530ed --- /dev/null +++ b/gateway/xgress_edge_transport/connection.go @@ -0,0 +1,152 @@ +/* + Copyright NetFoundry, Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +package xgress_edge_transport + +import ( + "fmt" + "github.com/netfoundry/secretstream" + "github.com/openziti/foundation/transport" + "io" + "sync" +) + +type readResult struct { + data []byte + headers map[uint8]byte + encrypt bool + err error +} + +type edgeTransportXgressConn struct { + transport.Connection + cryptoCtx *cryptoContext + readCh chan *readResult + startRead sync.Once + startCrypto sync.Once +} + +func newEdgeTransportXgressConn(conn transport.Connection) *edgeTransportXgressConn { + return &edgeTransportXgressConn{ + Connection: conn, + cryptoCtx: nil, + readCh: make(chan *readResult), + } +} + +func (c *edgeTransportXgressConn) LogContext() string { + return c.Detail().String() +} + +func (c *edgeTransportXgressConn) readFromServer() { + for { + buffer := make([]byte, 10240) + n, err := c.Reader().Read(buffer) + + result := &readResult{ + data: buffer[:n], + headers: nil, + err: err, + encrypt: true, + } + + c.readCh <- result + + if err == io.EOF { + return + } + } +} + +func (c *edgeTransportXgressConn) read() *readResult { + return <-c.readCh +} + +func (c *edgeTransportXgressConn) ReadPayload() ([]byte, map[uint8][]byte, error) { + readResult := c.read() + + if readResult.err != nil { + return nil, nil, readResult.err + } + + if readResult.encrypt && c.cryptoCtx != nil && c.cryptoCtx.toClientEncryptor != nil { + data, err := c.cryptoCtx.toClientEncryptor.Push(readResult.data, secretstream.TagMessage) + if err != nil { + return nil, nil, err + } + return data, nil, nil + } + + return readResult.data, nil, nil +} + +func (c *edgeTransportXgressConn) writeClearToClient(p []byte) { + c.readCh <- &readResult{ + data: p, + headers: nil, + err: nil, + encrypt: false, + } +} + +func (c *edgeTransportXgressConn) startServerRead() { + c.startRead.Do(func() { //do once + go c.readFromServer() + }) +} + +func (c *edgeTransportXgressConn) Write(p []byte) (n int, err error) { + //"write" from client to server + if c.cryptoCtx != nil { + //if crypto enabled and we have not setup e2e + if c.cryptoCtx.rxKey != nil { + if len(p) != secretstream.StreamHeaderBytes { + return 0, fmt.Errorf("error establishing crypto: expected key length %d got %d", len(p), secretstream.StreamHeaderBytes) + } + + c.cryptoCtx.fromClientDecryptor, err = secretstream.NewDecryptor(c.cryptoCtx.rxKey, p) + if err != nil { + return 0, fmt.Errorf("error establishing crypto: %v", err) + } + + c.cryptoCtx.rxKey = nil + + c.writeClearToClient(c.cryptoCtx.publicTxHeader) + + //start reading from the server only after we have written to the client + c.startServerRead() + + return len(p), nil //don't actually forward this just say we did + } else { + data, _, err := c.cryptoCtx.fromClientDecryptor.Pull(p) + + if err != nil { + return 0, fmt.Errorf("could not decrypt data from client: %v", err) + } + + p = data + } + } else { + //no crypto start server reading + c.startServerRead() + } + + return c.Writer().Write(p) +} + +func (c *edgeTransportXgressConn) WritePayload(p []byte, headers map[uint8][]byte) (n int, err error) { + return c.Write(p) +} diff --git a/gateway/xgress_edge_transport/dialer.go b/gateway/xgress_edge_transport/dialer.go new file mode 100644 index 000000000..250a7f388 --- /dev/null +++ b/gateway/xgress_edge_transport/dialer.go @@ -0,0 +1,135 @@ +/* + Copyright NetFoundry, Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +package xgress_edge_transport + +import ( + "fmt" + "github.com/netfoundry/secretstream" + "github.com/netfoundry/secretstream/kx" + "github.com/openziti/fabric/controller/xt" + "github.com/openziti/fabric/router/xgress" + "github.com/openziti/foundation/identity/identity" + "github.com/openziti/foundation/transport" + "github.com/openziti/sdk-golang/ziti/edge" +) + +type dialer struct { + id *identity.TokenId + ctrl xgress.CtrlChannel + options *xgress.Options +} + +func (txd *dialer) IsTerminatorValid(string, string) bool { + return true +} + +func newDialer(id *identity.TokenId, ctrl xgress.CtrlChannel, options *xgress.Options) (xgress.Dialer, error) { + txd := &dialer{ + id: id, + ctrl: ctrl, + options: options, + } + return txd, nil +} + +type cryptoContext struct { + keyPair *kx.KeyPair + + clientPublicKey []byte + publicTxHeader []byte + + rxKey []byte + + rx []byte + tx []byte + + toClientEncryptor secretstream.Encryptor + fromClientDecryptor secretstream.Decryptor +} + +func (ctx *cryptoContext) SetClientPublicKey(clientPublicKey []byte) error { + var err error + var tx []byte + + if ctx.rxKey, tx, err = ctx.keyPair.ServerSessionKeys(clientPublicKey); err != nil { + return fmt.Errorf("failed key exchange: %v", err) + } + + if ctx.toClientEncryptor, ctx.publicTxHeader, err = secretstream.NewEncryptor(tx); err != nil { + return fmt.Errorf("failed to establish crypto stream: %v", err) + } + + return nil +} + +func newCryptoContext() (*cryptoContext, error) { + var err error + + ctx := &cryptoContext{} + ctx.keyPair, err = kx.NewKeyPair() + + if err != nil { + return nil, fmt.Errorf("could not create new key pair: %v", err) + } + + return ctx, nil +} + +func (txd *dialer) Dial(destination string, sessionId *identity.TokenId, address xgress.Address, bindHandler xgress.BindHandler) (xt.PeerData, error) { + txDestination, err := transport.ParseAddress(destination) + if err != nil { + return nil, fmt.Errorf("cannot dial on invalid address [%s] (%s)", destination, err) + } + + peer, err := txDestination.Dial("x/"+sessionId.Token, sessionId) + if err != nil { + return nil, err + } + + conn := newEdgeTransportXgressConn(peer) + + peerData := make(xt.PeerData, 1) + if cryptoCtx, err := txd.prepareCrypto(sessionId); err != nil { + return nil, fmt.Errorf("error preparing e2e crypto: %v", err) + } else if cryptoCtx != nil { + conn.cryptoCtx = cryptoCtx + peerData[edge.PublicKeyHeader] = cryptoCtx.keyPair.Public() + } + + x := xgress.NewXgress(sessionId, address, conn, xgress.Terminator, txd.options) + bindHandler.HandleXgressBind(sessionId, address, xgress.Terminator, x) + + return peerData, nil +} + +func (txd *dialer) prepareCrypto(sessionId *identity.TokenId) (*cryptoContext, error) { + var cryptoCtx *cryptoContext + if clientPublicKey, ok := sessionId.Data[edge.PublicKeyHeader]; ok { + var err error + cryptoCtx, err = newCryptoContext() + + if err != nil { + return nil, fmt.Errorf("error establishing crypto context: %v", err) + } + + if err := cryptoCtx.SetClientPublicKey(clientPublicKey); err != nil { + return nil, err + } + } + + return cryptoCtx, nil +} diff --git a/gateway/xgress_edge_transport/factory.go b/gateway/xgress_edge_transport/factory.go new file mode 100644 index 000000000..cb4583f93 --- /dev/null +++ b/gateway/xgress_edge_transport/factory.go @@ -0,0 +1,45 @@ +/* + Copyright NetFoundry, Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +package xgress_edge_transport + +import ( + "github.com/openziti/fabric/router/xgress" + "github.com/openziti/foundation/identity/identity" +) + +const BindingName = "edge_transport" + +type factory struct { + id *identity.TokenId + ctrl xgress.CtrlChannel + options *xgress.Options +} + +// NewFactory returns a new Transport Xgress factory +func NewFactory(id *identity.TokenId, ctrl xgress.CtrlChannel) xgress.Factory { + return &factory{id: id, ctrl: ctrl} +} + +func (factory *factory) CreateListener(optionsData xgress.OptionsData) (xgress.Listener, error) { + options := xgress.LoadOptions(optionsData) + return newListener(factory.id, factory.ctrl, options), nil +} + +func (factory *factory) CreateDialer(optionsData xgress.OptionsData) (xgress.Dialer, error) { + options := xgress.LoadOptions(optionsData) + return newDialer(factory.id, factory.ctrl, options) +} diff --git a/gateway/xgress_edge_transport/listener.go b/gateway/xgress_edge_transport/listener.go new file mode 100644 index 000000000..d949468ca --- /dev/null +++ b/gateway/xgress_edge_transport/listener.go @@ -0,0 +1,94 @@ +/* + Copyright NetFoundry, Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +package xgress_edge_transport + +import ( + "fmt" + "github.com/michaelquigley/pfxlog" + "github.com/openziti/fabric/router/xgress" + "github.com/openziti/foundation/identity/identity" + "github.com/openziti/foundation/transport" +) + +type listener struct { + id *identity.TokenId + ctrl xgress.CtrlChannel + options *xgress.Options + closeHelper *xgress.CloseHelper +} + +func newListener(id *identity.TokenId, ctrl xgress.CtrlChannel, options *xgress.Options) xgress.Listener { + return &listener{ + id: id, + ctrl: ctrl, + options: options, + closeHelper: &xgress.CloseHelper{}, + } +} + +func (listener *listener) Listen(address string, bindHandler xgress.BindHandler) error { + txAddress, err := transport.ParseAddress(address) + if err != nil { + return fmt.Errorf("cannot listen on invalid address [%s] (%s)", address, err) + } + + incomingPeers := make(chan transport.Connection) + go listener.closeHelper.Init(txAddress.MustListen("tcp", listener.id, incomingPeers)) + go func() { + for { + select { + case peer := <-incomingPeers: + if peer != nil { + go listener.handleConnect(peer, bindHandler) + } else { + return + } + } + } + }() + + return nil +} + +func (listener *listener) Close() error { + return listener.closeHelper.Close() +} + +func (listener *listener) handleConnect(peer transport.Connection, bindHandler xgress.BindHandler) { + conn := &edgeTransportXgressConn{Connection: peer} + log := pfxlog.ContextLogger(conn.LogContext()) + + request, err := xgress.ReceiveRequest(peer) + if err == nil { + response := xgress.CreateSession(listener.ctrl, conn, request, bindHandler, listener.options) + err = xgress.SendResponse(response, peer.Writer()) + if err != nil { + log.Errorf("error sending response (%s)", err) + } + + if err != nil || !response.Success { + if err := peer.Close(); err != nil { + log.Errorf("error closing transport connection (%s)", err) + } + } + } else { + log.Errorf("error receiving request from peer (%s)", err) + if err := peer.Close(); err != nil { + log.Errorf("error closing transport connection (%s)", err) + } + } +} diff --git a/pb/edge_ctrl_pb/README.md b/pb/edge_ctrl_pb/README.md index 0c21bf3fd..787029cec 100644 --- a/pb/edge_ctrl_pb/README.md +++ b/pb/edge_ctrl_pb/README.md @@ -7,5 +7,5 @@ #Generate Go Code -1) Navigate to the ziti-edge project root +1) Navigate to the project root 1) Run: ```protoc -I ./pb/edge_ctrl_pb/ ./pb/edge_ctrl_pb/edge_ctrl.proto --go_out=./pb/edge_ctrl_pb``` diff --git a/pb/edge_ctrl_pb/edge_ctrl.pb.go b/pb/edge_ctrl_pb/edge_ctrl.pb.go index 9dcb408d1..d346224f6 100644 --- a/pb/edge_ctrl_pb/edge_ctrl.pb.go +++ b/pb/edge_ctrl_pb/edge_ctrl.pb.go @@ -271,6 +271,7 @@ func (m *Error) GetCause() string { type Service struct { Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + EncryptionRequired bool `protobuf:"varint,3,opt,name=encryptionRequired,proto3" json:"encryptionRequired,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -315,6 +316,13 @@ func (m *Service) GetName() string { return "" } +func (m *Service) GetEncryptionRequired() bool { + if m != nil { + return m.EncryptionRequired + } + return false +} + type Session struct { Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` Type SessionType `protobuf:"varint,2,opt,name=type,proto3,enum=edge_ctrl.pb.SessionType" json:"type,omitempty"` @@ -766,51 +774,55 @@ func init() { proto.RegisterType((*SessionUpdated)(nil), "edge_ctrl.pb.SessionUpdated") } -func init() { proto.RegisterFile("edge_ctrl.proto", fileDescriptor_23f46a161f139ee1) } +func init() { + proto.RegisterFile("edge_ctrl.proto", fileDescriptor_23f46a161f139ee1) +} var fileDescriptor_23f46a161f139ee1 = []byte{ - // 685 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xac, 0x55, 0xcd, 0x4e, 0x14, 0x4f, - 0x10, 0xff, 0xcf, 0xee, 0x02, 0xbb, 0xb5, 0x84, 0x9d, 0x7f, 0xeb, 0xe2, 0x82, 0x9a, 0xe0, 0x78, - 0x21, 0x18, 0xd6, 0x88, 0x07, 0x0c, 0x37, 0xe4, 0x23, 0x24, 0x26, 0x9a, 0x0c, 0x7a, 0xf1, 0x62, - 0x86, 0x99, 0x0e, 0x4e, 0x18, 0xa6, 0x37, 0xdd, 0xbd, 0x24, 0xdc, 0xd5, 0x77, 0x30, 0x51, 0xa2, - 0xbe, 0x88, 0x2f, 0xa0, 0x27, 0x1f, 0xc1, 0x8b, 0x1f, 0x2f, 0x61, 0x75, 0xcd, 0xc7, 0xf6, 0xc2, - 0xa8, 0x90, 0x78, 0xab, 0xfa, 0xfd, 0xaa, 0x7f, 0x53, 0x55, 0x5d, 0x5d, 0x03, 0x1d, 0x1e, 0xed, - 0xf3, 0x67, 0xa1, 0x96, 0x49, 0x7f, 0x20, 0x85, 0x16, 0x6c, 0xda, 0x02, 0xf6, 0xbc, 0xd7, 0x0e, - 0xb4, 0x77, 0xb9, 0x3c, 0xe2, 0x72, 0x87, 0x27, 0x89, 0x60, 0x3d, 0x98, 0x42, 0x5b, 0xc5, 0x22, - 0xed, 0x39, 0x0b, 0xce, 0x62, 0xcb, 0x2f, 0x5c, 0xb6, 0x0a, 0x8d, 0x28, 0xd0, 0x41, 0xaf, 0xb6, - 0x50, 0x5f, 0x6c, 0xaf, 0xdc, 0xec, 0xdb, 0x32, 0x7d, 0x4b, 0xa2, 0xbf, 0x89, 0x51, 0x5b, 0xa9, - 0x96, 0xc7, 0x3e, 0x1d, 0x98, 0x5f, 0x85, 0x56, 0x09, 0x31, 0x17, 0xea, 0x07, 0xfc, 0x38, 0xd7, - 0x36, 0x26, 0xbb, 0x0c, 0x13, 0x47, 0x41, 0x32, 0xe4, 0x28, 0x6c, 0xb0, 0xcc, 0x59, 0xab, 0xdd, - 0x73, 0xbc, 0x2f, 0x98, 0xdb, 0x46, 0x12, 0xf3, 0x54, 0xff, 0x2d, 0xb7, 0x79, 0x68, 0x3e, 0x17, - 0x4a, 0xa7, 0xc1, 0x61, 0x21, 0x53, 0xfa, 0xec, 0x1a, 0xb4, 0xa8, 0xf0, 0x50, 0x24, 0xaa, 0x57, - 0xc7, 0xe4, 0x5b, 0xfe, 0x08, 0x28, 0xab, 0x6a, 0x54, 0x55, 0x65, 0x7d, 0xfc, 0xdf, 0x55, 0xf5, - 0x00, 0x26, 0xb6, 0xa4, 0x14, 0x92, 0x31, 0x68, 0x84, 0x22, 0xe2, 0xf9, 0x29, 0xb2, 0x4d, 0x89, - 0x87, 0x5c, 0xa9, 0x60, 0xbf, 0x38, 0x58, 0xb8, 0x46, 0x30, 0x0c, 0x86, 0x8a, 0x63, 0x09, 0x24, - 0x48, 0x8e, 0xb7, 0x0c, 0x53, 0xa6, 0xf5, 0x71, 0xc8, 0xd9, 0x0c, 0xd4, 0xe2, 0x28, 0x17, 0x43, - 0xcb, 0xc8, 0x5b, 0xfd, 0x20, 0xdb, 0xfb, 0xea, 0x98, 0x78, 0x45, 0x3d, 0x43, 0x41, 0x2d, 0x0e, - 0x78, 0xd1, 0xcb, 0xcc, 0x61, 0xcb, 0xd0, 0xd0, 0xc7, 0x83, 0xec, 0xd4, 0xcc, 0xca, 0xdc, 0xe9, - 0x5b, 0xa6, 0xa3, 0x8f, 0x31, 0xc0, 0xa7, 0x30, 0xb6, 0x04, 0x6e, 0xc8, 0xa5, 0xde, 0x8e, 0xd3, - 0x7d, 0x2e, 0x07, 0x32, 0x4e, 0x75, 0xd1, 0xe3, 0x33, 0xb8, 0x49, 0x68, 0x28, 0xf1, 0x0e, 0x1a, - 0xc4, 0x93, 0xcd, 0x6e, 0xc3, 0x94, 0xca, 0xf2, 0xef, 0x4d, 0xe0, 0x17, 0xdb, 0x2b, 0xdd, 0xb3, - 0x73, 0x85, 0xa4, 0x5f, 0x44, 0x31, 0x0f, 0xa6, 0x55, 0x9e, 0x05, 0x25, 0x3f, 0x49, 0xc9, 0x8f, - 0x61, 0xde, 0x43, 0x80, 0xf5, 0x41, 0xfc, 0xe7, 0x3a, 0xab, 0x12, 0xaf, 0x55, 0x27, 0xee, 0x09, - 0xe8, 0x8c, 0xf4, 0xd6, 0xa3, 0x88, 0x47, 0x6c, 0x01, 0xda, 0xb1, 0xda, 0x1e, 0x26, 0xc9, 0xae, - 0x0e, 0x74, 0x76, 0x85, 0x4d, 0xdf, 0x86, 0xd8, 0x1a, 0xb4, 0x83, 0xf2, 0x90, 0xca, 0x5f, 0x4d, - 0x6f, 0xbc, 0xba, 0x91, 0xaa, 0x6f, 0x07, 0x7b, 0x8f, 0xe0, 0xff, 0x11, 0xf5, 0x64, 0x80, 0xf3, - 0x86, 0x9f, 0x3c, 0x25, 0xe8, 0x5c, 0x44, 0xf0, 0x96, 0x2d, 0xe8, 0xf3, 0x43, 0x71, 0x84, 0x82, - 0xb3, 0x30, 0x49, 0xbd, 0xc8, 0xb4, 0x5a, 0x7e, 0xee, 0xe1, 0x4c, 0x5d, 0x1a, 0x05, 0xef, 0xf0, - 0x40, 0xea, 0x3d, 0x1e, 0xe8, 0xdf, 0x86, 0x87, 0x30, 0x7d, 0xc1, 0xd6, 0xdc, 0x81, 0xa6, 0x1a, - 0xef, 0x4b, 0xb7, 0x72, 0xce, 0xfc, 0x32, 0xcc, 0x5b, 0x84, 0x99, 0x73, 0x66, 0x7f, 0x50, 0x46, - 0x16, 0x8d, 0xab, 0x1e, 0x80, 0x62, 0x1a, 0x6b, 0xd5, 0xd3, 0x58, 0x3f, 0xcf, 0x34, 0x2e, 0x7d, - 0xac, 0xe1, 0x86, 0x12, 0xa9, 0xc6, 0x2d, 0x61, 0x1e, 0x05, 0x6b, 0x42, 0xe3, 0x29, 0x97, 0xc2, - 0xfd, 0x8f, 0x75, 0xa1, 0x63, 0xed, 0x44, 0x43, 0xba, 0xef, 0xde, 0x38, 0x06, 0xb6, 0x96, 0x0a, - 0xc1, 0xef, 0x11, 0xee, 0x40, 0x8b, 0x76, 0x02, 0x01, 0x1f, 0x10, 0x98, 0x05, 0xd7, 0x6e, 0x2a, - 0xe1, 0x2f, 0xde, 0x3a, 0xb8, 0x1f, 0xd8, 0x78, 0x75, 0xc4, 0xbc, 0x1c, 0x63, 0xf2, 0x0e, 0x11, - 0xf3, 0x0a, 0x99, 0x39, 0xfb, 0x3e, 0x47, 0x72, 0xdf, 0x90, 0xba, 0x0a, 0xdd, 0x33, 0x83, 0x46, - 0xe4, 0xf7, 0xd3, 0xa4, 0x2d, 0xfa, 0x03, 0xc9, 0xeb, 0x70, 0xa5, 0x62, 0x48, 0x88, 0xfe, 0x89, - 0xb4, 0x0b, 0xb0, 0x95, 0x4a, 0x91, 0x24, 0x84, 0x7c, 0x3a, 0xa1, 0xca, 0x33, 0x64, 0x03, 0x9f, - 0x97, 0x22, 0xf8, 0xf3, 0x89, 0xb3, 0x74, 0xc3, 0xfc, 0x7e, 0xca, 0xad, 0x62, 0x1a, 0xb8, 0x19, - 0x07, 0x09, 0x36, 0x10, 0xad, 0xfb, 0x71, 0x1a, 0xb9, 0xce, 0xde, 0x24, 0x6d, 0xeb, 0xbb, 0xbf, - 0x02, 0x00, 0x00, 0xff, 0xff, 0xd3, 0xe6, 0xd9, 0x01, 0xca, 0x06, 0x00, 0x00, + // 717 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x55, 0xdd, 0x6e, 0xd3, 0x4a, + 0x10, 0xee, 0x3a, 0x49, 0x9b, 0x4c, 0xaa, 0xc6, 0x67, 0x4e, 0xd3, 0xe3, 0xf6, 0x9c, 0x23, 0x05, + 0x73, 0x13, 0x15, 0x35, 0x88, 0x72, 0x51, 0xd4, 0xbb, 0xd2, 0x1f, 0x55, 0x42, 0x02, 0xc9, 0x85, + 0x1b, 0x24, 0x84, 0x5c, 0x7b, 0x54, 0x56, 0x75, 0xbd, 0x61, 0x77, 0x13, 0x29, 0xf7, 0xc0, 0x3b, + 0x20, 0x35, 0x15, 0xf0, 0x22, 0xbc, 0x00, 0x5c, 0xf1, 0x08, 0xdc, 0xf0, 0xf3, 0x12, 0xc8, 0xeb, + 0x38, 0x71, 0x5a, 0x03, 0xad, 0xc4, 0xdd, 0xce, 0x37, 0xb3, 0x5f, 0xe6, 0xfb, 0x76, 0x3c, 0x81, + 0x06, 0x85, 0x47, 0xf4, 0x34, 0xd0, 0x32, 0xea, 0x74, 0xa5, 0xd0, 0x02, 0xe7, 0x73, 0xc0, 0xa1, + 0xfb, 0x9a, 0x41, 0xfd, 0x80, 0x64, 0x9f, 0xe4, 0x3e, 0x45, 0x91, 0x40, 0x07, 0xe6, 0xfa, 0x24, + 0x15, 0x17, 0xb1, 0xc3, 0x5a, 0xac, 0x5d, 0xf3, 0xb2, 0x10, 0x37, 0xa0, 0x1c, 0xfa, 0xda, 0x77, + 0xac, 0x56, 0xa9, 0x5d, 0x5f, 0xbf, 0xde, 0xc9, 0xd3, 0x74, 0x72, 0x14, 0x9d, 0x1d, 0x5f, 0xfb, + 0xbb, 0xb1, 0x96, 0x03, 0xcf, 0x5c, 0x58, 0xd9, 0x80, 0xda, 0x18, 0x42, 0x1b, 0x4a, 0xc7, 0x34, + 0x18, 0x71, 0x27, 0x47, 0x5c, 0x84, 0x4a, 0xdf, 0x8f, 0x7a, 0xe4, 0x58, 0x06, 0x4b, 0x83, 0x4d, + 0xeb, 0x0e, 0x73, 0x3f, 0x31, 0xa8, 0x6f, 0x47, 0x9c, 0x62, 0xfd, 0xbb, 0xde, 0x56, 0xa0, 0xfa, + 0x4c, 0x28, 0x1d, 0xfb, 0x27, 0x19, 0xcd, 0x38, 0xc6, 0xff, 0xa0, 0x66, 0x84, 0x07, 0x22, 0x52, + 0x4e, 0xa9, 0x55, 0x6a, 0xd7, 0xbc, 0x09, 0x30, 0x56, 0x55, 0x2e, 0x52, 0x95, 0xfb, 0xf1, 0x3f, + 0xa7, 0xea, 0x1e, 0x54, 0x76, 0xa5, 0x14, 0x12, 0x11, 0xca, 0x81, 0x08, 0x69, 0x74, 0xcb, 0x9c, + 0x13, 0x89, 0x27, 0xa4, 0x94, 0x7f, 0x94, 0x5d, 0xcc, 0xc2, 0x84, 0x30, 0xf0, 0x7b, 0x8a, 0x9c, + 0x52, 0x4a, 0x68, 0x02, 0xf7, 0x09, 0xcc, 0x25, 0xd6, 0xf3, 0x80, 0x70, 0x01, 0x2c, 0x1e, 0x8e, + 0xc8, 0x2c, 0x1e, 0x26, 0xf4, 0x39, 0x3f, 0xcc, 0x19, 0x3b, 0x80, 0x14, 0x07, 0x72, 0xd0, 0xd5, + 0x5c, 0xc4, 0x1e, 0x3d, 0xef, 0x71, 0x49, 0xa1, 0x61, 0xac, 0x7a, 0x05, 0x19, 0xf7, 0x33, 0x4b, + 0xf8, 0x95, 0xf1, 0x78, 0x11, 0x2a, 0x5a, 0x1c, 0x53, 0xe6, 0x7d, 0x1a, 0xe0, 0x1a, 0x94, 0xf5, + 0xa0, 0x9b, 0xfe, 0xca, 0xc2, 0xfa, 0xf2, 0xf9, 0xa9, 0x30, 0x57, 0x1f, 0x0e, 0xba, 0xe4, 0x99, + 0x32, 0x5c, 0x05, 0x3b, 0x20, 0xa9, 0xf7, 0x78, 0x7c, 0x44, 0xb2, 0x2b, 0x79, 0xac, 0xb3, 0x37, + 0xb9, 0x80, 0x27, 0x02, 0x7a, 0x32, 0x52, 0xe6, 0x69, 0x6a, 0x9e, 0x39, 0xe3, 0x4d, 0x98, 0x53, + 0xa9, 0x5e, 0xa7, 0xd2, 0x62, 0xed, 0xfa, 0x7a, 0xf3, 0xe2, 0x1c, 0xf2, 0x80, 0xbc, 0xac, 0x0a, + 0x5d, 0x98, 0x57, 0xa3, 0x2e, 0x4c, 0xf3, 0xb3, 0xa6, 0xf9, 0x29, 0xcc, 0xbd, 0x0f, 0xb0, 0xd5, + 0xe5, 0xbf, 0xd6, 0x59, 0xd4, 0xb8, 0x55, 0xdc, 0xb8, 0x2b, 0xa0, 0x31, 0xe1, 0xdb, 0x0a, 0x43, + 0x0a, 0xb1, 0x05, 0x75, 0xae, 0xf6, 0x7a, 0x51, 0x74, 0xa0, 0x7d, 0x9d, 0x3e, 0x79, 0xd5, 0xcb, + 0x43, 0xb8, 0x09, 0x75, 0x7f, 0x7c, 0x49, 0x8d, 0xbe, 0x32, 0x67, 0x5a, 0xdd, 0x84, 0xd5, 0xcb, + 0x17, 0xbb, 0x0f, 0xe0, 0xaf, 0x49, 0xea, 0x51, 0x37, 0xf4, 0x35, 0x85, 0xe7, 0x09, 0xd9, 0x55, + 0x08, 0x6f, 0xe4, 0x09, 0x3d, 0x3a, 0x11, 0x7d, 0x0a, 0x71, 0x09, 0x66, 0x8d, 0x17, 0x29, 0x57, + 0xcd, 0x1b, 0x45, 0xee, 0x1a, 0xfc, 0x3d, 0x29, 0xde, 0x27, 0x5f, 0xea, 0x43, 0xf2, 0xf5, 0x4f, + 0xcb, 0x03, 0x98, 0xbf, 0xa2, 0x35, 0xb7, 0xa0, 0xaa, 0xa6, 0x7d, 0x69, 0x16, 0xce, 0x99, 0x37, + 0x2e, 0x73, 0xdb, 0xb0, 0x70, 0xc9, 0xee, 0x8f, 0xc7, 0x95, 0x99, 0x71, 0xc5, 0x03, 0x90, 0x4d, + 0xa3, 0x55, 0x3c, 0x8d, 0xa5, 0xcb, 0x4c, 0xe3, 0xea, 0x7b, 0x0b, 0xea, 0xdb, 0x22, 0xd6, 0x14, + 0xeb, 0xe4, 0xa3, 0xc0, 0x2a, 0x94, 0x1f, 0x93, 0x14, 0xf6, 0x0c, 0x36, 0xa1, 0x91, 0xdb, 0xa1, + 0x49, 0xd2, 0x7e, 0x73, 0xca, 0x12, 0x38, 0xb7, 0x84, 0x0c, 0xfc, 0xf6, 0x94, 0x61, 0x03, 0x6a, + 0x66, 0x87, 0x18, 0xe0, 0xdd, 0x29, 0xc3, 0x25, 0xb0, 0xf3, 0xa6, 0x1a, 0xfc, 0xc5, 0x90, 0xa1, + 0x03, 0x38, 0xad, 0xce, 0x64, 0x5e, 0x4e, 0x65, 0x46, 0x0e, 0x99, 0xcc, 0xab, 0x21, 0xc3, 0xe5, + 0xfc, 0x7b, 0x4e, 0xe8, 0xbe, 0x0c, 0x19, 0xfe, 0x0b, 0xcd, 0x0b, 0x83, 0x66, 0x92, 0x5f, 0xcf, + 0x27, 0xf3, 0xa4, 0xdf, 0x86, 0x0c, 0xff, 0x87, 0x7f, 0x0a, 0x86, 0xc4, 0xa4, 0xbf, 0x0f, 0x19, + 0xda, 0x00, 0xbb, 0xb1, 0x14, 0x51, 0x64, 0x90, 0x0f, 0x67, 0x46, 0x79, 0x8a, 0x6c, 0x93, 0xd4, + 0xca, 0xc0, 0x1f, 0xcf, 0xd8, 0xea, 0xb5, 0xe4, 0xef, 0x6a, 0xbc, 0x55, 0x12, 0x03, 0x77, 0xb8, + 0x1f, 0xd9, 0x33, 0xc9, 0xe9, 0x2e, 0x8f, 0x43, 0x9b, 0x1d, 0xce, 0x9a, 0xed, 0x7e, 0xfb, 0x47, + 0x00, 0x00, 0x00, 0xff, 0xff, 0x63, 0x95, 0x7b, 0xa5, 0xfa, 0x06, 0x00, 0x00, } diff --git a/pb/edge_ctrl_pb/edge_ctrl.proto b/pb/edge_ctrl_pb/edge_ctrl.proto index 06f55ea03..627472943 100644 --- a/pb/edge_ctrl_pb/edge_ctrl.proto +++ b/pb/edge_ctrl_pb/edge_ctrl.proto @@ -44,6 +44,7 @@ message Error { message Service { string id = 1; string name = 2; + bool encryptionRequired = 3; } message Session { diff --git a/rest_model/service_create.go b/rest_model/service_create.go index 339a05dfa..0c8652259 100644 --- a/rest_model/service_create.go +++ b/rest_model/service_create.go @@ -44,6 +44,9 @@ type ServiceCreate struct { // configs Configs []string `json:"configs"` + // encryption required + EncryptionRequired bool `json:"encryptionRequired,omitempty"` + // name // Required: true Name *string `json:"name"` diff --git a/rest_model/service_detail.go b/rest_model/service_detail.go index 58610222c..66bb443d4 100644 --- a/rest_model/service_detail.go +++ b/rest_model/service_detail.go @@ -42,7 +42,7 @@ import ( type ServiceDetail struct { BaseEntity - // config + // map of config data for this service keyed by the config type name. Only configs of the types requested will be returned. // Required: true Config map[string]map[string]interface{} `json:"config"` @@ -50,6 +50,10 @@ type ServiceDetail struct { // Required: true Configs []string `json:"configs"` + // encryption required + // Required: true + EncryptionRequired *bool `json:"encryptionRequired"` + // name // Required: true Name *string `json:"name"` @@ -82,6 +86,8 @@ func (m *ServiceDetail) UnmarshalJSON(raw []byte) error { Configs []string `json:"configs"` + EncryptionRequired *bool `json:"encryptionRequired"` + Name *string `json:"name"` Permissions DialBindArray `json:"permissions"` @@ -98,6 +104,8 @@ func (m *ServiceDetail) UnmarshalJSON(raw []byte) error { m.Configs = dataAO1.Configs + m.EncryptionRequired = dataAO1.EncryptionRequired + m.Name = dataAO1.Name m.Permissions = dataAO1.Permissions @@ -123,6 +131,8 @@ func (m ServiceDetail) MarshalJSON() ([]byte, error) { Configs []string `json:"configs"` + EncryptionRequired *bool `json:"encryptionRequired"` + Name *string `json:"name"` Permissions DialBindArray `json:"permissions"` @@ -136,6 +146,8 @@ func (m ServiceDetail) MarshalJSON() ([]byte, error) { dataAO1.Configs = m.Configs + dataAO1.EncryptionRequired = m.EncryptionRequired + dataAO1.Name = m.Name dataAO1.Permissions = m.Permissions @@ -169,6 +181,10 @@ func (m *ServiceDetail) Validate(formats strfmt.Registry) error { res = append(res, err) } + if err := m.validateEncryptionRequired(formats); err != nil { + res = append(res, err) + } + if err := m.validateName(formats); err != nil { res = append(res, err) } @@ -225,6 +241,15 @@ func (m *ServiceDetail) validateConfigs(formats strfmt.Registry) error { return nil } +func (m *ServiceDetail) validateEncryptionRequired(formats strfmt.Registry) error { + + if err := validate.Required("encryptionRequired", "body", m.EncryptionRequired); err != nil { + return err + } + + return nil +} + func (m *ServiceDetail) validateName(formats strfmt.Registry) error { if err := validate.Required("name", "body", m.Name); err != nil { diff --git a/rest_model/service_patch.go b/rest_model/service_patch.go index 93ea9bebe..6b4e9aaf1 100644 --- a/rest_model/service_patch.go +++ b/rest_model/service_patch.go @@ -43,6 +43,9 @@ type ServicePatch struct { // configs Configs []string `json:"configs"` + // encryption required + EncryptionRequired bool `json:"encryptionRequired,omitempty"` + // name Name string `json:"name,omitempty"` diff --git a/rest_model/service_update.go b/rest_model/service_update.go index 939b6fd1f..a15a7a248 100644 --- a/rest_model/service_update.go +++ b/rest_model/service_update.go @@ -44,6 +44,9 @@ type ServiceUpdate struct { // configs Configs []string `json:"configs"` + // encryption required + EncryptionRequired bool `json:"encryptionRequired,omitempty"` + // name // Required: true Name *string `json:"name"` diff --git a/rest_server/embedded_spec.go b/rest_server/embedded_spec.go index 1a4fdca50..4a41f3413 100644 --- a/rest_server/embedded_spec.go +++ b/rest_server/embedded_spec.go @@ -6951,6 +6951,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -6975,7 +6978,6 @@ func init() { "$ref": "#/definitions/baseEntity" }, { - "description": "map of config data for this service keyed by the config type name. Only configs of the types requested will be returned.", "type": "object", "required": [ "name", @@ -6983,10 +6985,12 @@ func init() { "roleAttributes", "permissions", "configs", - "config" + "config", + "encryptionRequired" ], "properties": { "config": { + "description": "map of config data for this service keyed by the config type name. Only configs of the types requested will be returned.", "type": "object", "additionalProperties": { "type": "object", @@ -7001,6 +7005,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -7135,6 +7142,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -7282,6 +7292,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -22600,6 +22613,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -22624,7 +22640,6 @@ func init() { "$ref": "#/definitions/baseEntity" }, { - "description": "map of config data for this service keyed by the config type name. Only configs of the types requested will be returned.", "type": "object", "required": [ "name", @@ -22632,10 +22647,12 @@ func init() { "roleAttributes", "permissions", "configs", - "config" + "config", + "encryptionRequired" ], "properties": { "config": { + "description": "map of config data for this service keyed by the config type name. Only configs of the types requested will be returned.", "type": "object", "additionalProperties": { "type": "object", @@ -22650,6 +22667,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -22784,6 +22804,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, @@ -22931,6 +22954,9 @@ func init() { "type": "string" } }, + "encryptionRequired": { + "type": "boolean" + }, "name": { "type": "string" }, diff --git a/specs/swagger.yml b/specs/swagger.yml index ce1d2ddbc..c2d7d48b4 100644 --- a/specs/swagger.yml +++ b/specs/swagger.yml @@ -4531,6 +4531,7 @@ definitions: - permissions - configs - config + - encryptionRequired properties: name: type: string @@ -4550,7 +4551,9 @@ definitions: type: object additionalProperties: type: object - description: map of config data for this service keyed by the config type name. Only configs of the types requested will be returned. + description: map of config data for this service keyed by the config type name. Only configs of the types requested will be returned. + encryptionRequired: + type: boolean serviceCreate: type: object required: @@ -4568,6 +4571,8 @@ definitions: type: array items: type: string + encryptionRequired: + type: boolean tags: $ref: '#/definitions/tags' serviceUpdate: @@ -4587,6 +4592,8 @@ definitions: type: array items: type: string + encryptionRequired: + type: boolean tags: $ref: '#/definitions/tags' servicePatch: @@ -4604,6 +4611,8 @@ definitions: type: array items: type: string + encryptionRequired: + type: boolean tags: $ref: '#/definitions/tags' ################################################################### From 1ef4faf7cfddc282e44f70712862f4c9d3f31710 Mon Sep 17 00:00:00 2001 From: Andrew M Date: Fri, 31 Jul 2020 09:46:23 -0400 Subject: [PATCH 2/3] update fabric dep --- go.mod | 5 +++-- go.sum | 10 ++++------ 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/go.mod b/go.mod index 88f390a10..943bfb34e 100644 --- a/go.mod +++ b/go.mod @@ -31,8 +31,9 @@ require ( github.com/michaelquigley/pfxlog v0.0.0-20190813191113-2be43bd0dccc github.com/miekg/dns v1.1.30 github.com/mitchellh/mapstructure v1.3.3 - github.com/openziti/fabric v0.11.53 - github.com/openziti/foundation v0.11.15 + github.com/netfoundry/secretstream v0.1.2 + github.com/openziti/fabric v0.11.58 + github.com/openziti/foundation v0.11.16 github.com/openziti/sdk-golang v0.13.24 github.com/pkg/errors v0.9.1 github.com/sirupsen/logrus v1.6.0 diff --git a/go.sum b/go.sum index 90121db5f..be6a7bba1 100644 --- a/go.sum +++ b/go.sum @@ -179,8 +179,6 @@ github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.0 h1:/QaMHBdZ26BB3SSst0Iwl10Epc+xhTquomWX0oZEB6w= -github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k= github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= @@ -284,12 +282,12 @@ github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs= github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU= github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= -github.com/openziti/fabric v0.11.53 h1:OVT71Hmbgf5gqsO7fz4iwsyP/T/ZzUfgOD0Bp39z/3U= -github.com/openziti/fabric v0.11.53/go.mod h1:d0EueCQD4CIC3TLAMdw0EoYb+GsmwPrZz3BwRgtU28c= -github.com/openziti/foundation v0.11.11 h1:GPASO0aTtzuzwQbfvu1OMOPdAKzi/DTkxKJ0y2NTzXU= -github.com/openziti/foundation v0.11.11/go.mod h1:Qdd7eCuTrpRwEeDbvYy89sFbEY4+J7OuX8UygxNBsvY= +github.com/openziti/fabric v0.11.58 h1:wPiUZxCQrJm+t9envMf0ksfgEjCWSI97KRmeG1W1R94= +github.com/openziti/fabric v0.11.58/go.mod h1:KJN8zm/krVb4aeMRR/8QcEszHQOoaGxUmE+jm88K4iA= github.com/openziti/foundation v0.11.15 h1:+LpphupxZvABFT2lZoS+Nk5EPBe09aXE935Jyfb5sQ8= github.com/openziti/foundation v0.11.15/go.mod h1:4Jgs3HGDiP1aVk5nNzXJqwJwWhrjOYy1F+4Xtxcgxvo= +github.com/openziti/foundation v0.11.16 h1:8pWIEHGM6Stmc9QxW/R+saRzxkzDsTDlAcyO21qrh4k= +github.com/openziti/foundation v0.11.16/go.mod h1:4Jgs3HGDiP1aVk5nNzXJqwJwWhrjOYy1F+4Xtxcgxvo= github.com/openziti/sdk-golang v0.13.24 h1:gu9R7QaGwAjgBigbotZz8Qwe0jiCkCVSzMuBWNIc9FE= github.com/openziti/sdk-golang v0.13.24/go.mod h1:hPRLQHARp9OuRViYFsZ6icwn1LjudXQBJ/USswKQyTY= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw= From 7e4a6671f5d7e1dfc790780e9061cdc309b7708d Mon Sep 17 00:00:00 2001 From: Andrew M Date: Fri, 31 Jul 2020 14:40:56 -0400 Subject: [PATCH 3/3] pr fixes - remove unused functionality from xgress_edge_transport - remove listener functionality from xgress_edge_transport - fix connection closing in xgress_edge listener --- gateway/xgress_edge/listener.go | 13 ++-- gateway/xgress_edge_transport/client.go | 50 ------------ gateway/xgress_edge_transport/factory.go | 4 +- gateway/xgress_edge_transport/listener.go | 94 ----------------------- 4 files changed, 7 insertions(+), 154 deletions(-) delete mode 100644 gateway/xgress_edge_transport/client.go delete mode 100644 gateway/xgress_edge_transport/listener.go diff --git a/gateway/xgress_edge/listener.go b/gateway/xgress_edge/listener.go index ed942faa8..21d759c80 100644 --- a/gateway/xgress_edge/listener.go +++ b/gateway/xgress_edge/listener.go @@ -152,11 +152,9 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha peerData[edge.PublicKeyHeader] = req.Headers[edge.PublicKeyHeader] if ns.Service.EncryptionRequired && req.Headers[edge.PublicKeyHeader] == nil { - //what is necessary to close this properly? msg := "encryption required on service, initiator did not send public header" - pfxlog.Logger().WithField("connId", conn.Id()).Error(msg) proxy.sendStateClosedReply(msg, req) - conn.close(true, msg) + conn.close(false, msg) return } @@ -168,11 +166,9 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha } if ns.Service.EncryptionRequired && sessionInfo.SessionId.Data[edge.PublicKeyHeader] == nil { - //what is necessary to close this properly? msg := "encryption required on service, terminator did not send public header" - pfxlog.Logger().WithField("connId", conn.Id()).Error(msg) proxy.sendStateClosedReply(msg, req) - conn.close(true, msg) + conn.close(false, msg) return } @@ -181,8 +177,9 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha x.Start() if err := sessionInfo.SendStartEgress(); err != nil { - pfxlog.Logger().WithField("connId", conn.Id()).WithError(err).Error("Failed to send start egress") - conn.close(true, "egress start failed") + msg := fmt.Sprintf("failed to send start egress: %v", err) + proxy.sendStateClosedReply(msg, req) + conn.close(false, msg) } proxy.sendStateConnectedReply(req, sessionInfo.SessionId.Data) diff --git a/gateway/xgress_edge_transport/client.go b/gateway/xgress_edge_transport/client.go deleted file mode 100644 index f6b2b4cd5..000000000 --- a/gateway/xgress_edge_transport/client.go +++ /dev/null @@ -1,50 +0,0 @@ -/* - Copyright NetFoundry, Inc. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package xgress_edge_transport - -import ( - "errors" - "github.com/openziti/fabric/router/xgress" - "github.com/openziti/foundation/identity/identity" - "github.com/openziti/foundation/transport" -) - -// ClientDial dials the given xgress address and handles authentication, returning an authed connection or an error -func ClientDial(addr transport.Address, id *identity.TokenId, serviceId *identity.TokenId) (transport.Connection, error) { - peer, err := addr.Dial("i/"+id.Token, id) - if err != nil { - return nil, err - } - - request := &xgress.Request{ - Id: id.Token, - ServiceId: serviceId.Token, - } - err = xgress.SendRequest(request, peer.Writer()) - if err != nil { - return nil, err - } - response, err := xgress.ReceiveResponse(peer) - if err != nil { - return nil, err - } - if !response.Success { - return nil, errors.New(response.Message) - } - - return peer, nil -} diff --git a/gateway/xgress_edge_transport/factory.go b/gateway/xgress_edge_transport/factory.go index cb4583f93..8bff39474 100644 --- a/gateway/xgress_edge_transport/factory.go +++ b/gateway/xgress_edge_transport/factory.go @@ -17,6 +17,7 @@ package xgress_edge_transport import ( + "errors" "github.com/openziti/fabric/router/xgress" "github.com/openziti/foundation/identity/identity" ) @@ -35,8 +36,7 @@ func NewFactory(id *identity.TokenId, ctrl xgress.CtrlChannel) xgress.Factory { } func (factory *factory) CreateListener(optionsData xgress.OptionsData) (xgress.Listener, error) { - options := xgress.LoadOptions(optionsData) - return newListener(factory.id, factory.ctrl, options), nil + return nil, errors.New("listening not supported") } func (factory *factory) CreateDialer(optionsData xgress.OptionsData) (xgress.Dialer, error) { diff --git a/gateway/xgress_edge_transport/listener.go b/gateway/xgress_edge_transport/listener.go deleted file mode 100644 index d949468ca..000000000 --- a/gateway/xgress_edge_transport/listener.go +++ /dev/null @@ -1,94 +0,0 @@ -/* - Copyright NetFoundry, Inc. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package xgress_edge_transport - -import ( - "fmt" - "github.com/michaelquigley/pfxlog" - "github.com/openziti/fabric/router/xgress" - "github.com/openziti/foundation/identity/identity" - "github.com/openziti/foundation/transport" -) - -type listener struct { - id *identity.TokenId - ctrl xgress.CtrlChannel - options *xgress.Options - closeHelper *xgress.CloseHelper -} - -func newListener(id *identity.TokenId, ctrl xgress.CtrlChannel, options *xgress.Options) xgress.Listener { - return &listener{ - id: id, - ctrl: ctrl, - options: options, - closeHelper: &xgress.CloseHelper{}, - } -} - -func (listener *listener) Listen(address string, bindHandler xgress.BindHandler) error { - txAddress, err := transport.ParseAddress(address) - if err != nil { - return fmt.Errorf("cannot listen on invalid address [%s] (%s)", address, err) - } - - incomingPeers := make(chan transport.Connection) - go listener.closeHelper.Init(txAddress.MustListen("tcp", listener.id, incomingPeers)) - go func() { - for { - select { - case peer := <-incomingPeers: - if peer != nil { - go listener.handleConnect(peer, bindHandler) - } else { - return - } - } - } - }() - - return nil -} - -func (listener *listener) Close() error { - return listener.closeHelper.Close() -} - -func (listener *listener) handleConnect(peer transport.Connection, bindHandler xgress.BindHandler) { - conn := &edgeTransportXgressConn{Connection: peer} - log := pfxlog.ContextLogger(conn.LogContext()) - - request, err := xgress.ReceiveRequest(peer) - if err == nil { - response := xgress.CreateSession(listener.ctrl, conn, request, bindHandler, listener.options) - err = xgress.SendResponse(response, peer.Writer()) - if err != nil { - log.Errorf("error sending response (%s)", err) - } - - if err != nil || !response.Success { - if err := peer.Close(); err != nil { - log.Errorf("error closing transport connection (%s)", err) - } - } - } else { - log.Errorf("error receiving request from peer (%s)", err) - if err := peer.Close(); err != nil { - log.Errorf("error closing transport connection (%s)", err) - } - } -}