From 42ecc2f2b9c7750a864b6388c1d29c9802ca4fb1 Mon Sep 17 00:00:00 2001
From: Evgenii Stratonikov <e.stratonikov@yadro.com>
Date: Mon, 10 Jun 2024 11:48:14 +0300
Subject: [PATCH] [#1170] morph: Support mTLS

Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>
---
 go.mod                          |   2 ++
 go.sum                          | Bin 42654 -> 42738 bytes
 pkg/morph/client/constructor.go |  13 +++++++++----
 pkg/morph/client/mtls.go        |  22 ++++++++++++++++++++++
 pkg/morph/client/multi.go       |  13 +++++++------
 5 files changed, 40 insertions(+), 10 deletions(-)
 create mode 100644 pkg/morph/client/mtls.go

diff --git a/go.mod b/go.mod
index 42896ed8..4ce8a0d2 100644
--- a/go.mod
+++ b/go.mod
@@ -127,3 +127,5 @@ require (
 	lukechampine.com/blake3 v1.2.1 // indirect
 	rsc.io/tmplfunc v0.0.3 // indirect
 )
+
+replace github.com/nspcc-dev/neo-go => git.frostfs.info/TrueCloudLab/neoneo-go v0.106.1-0.20240611123832-594f716b3d18
diff --git a/go.sum b/go.sum
index 07632a032d68965f7acf9b87a75f56e256637a4a..cb97af3d42c28174a2f8bea873d28f2c7203d0af 100644
GIT binary patch
delta 230
zcmbPtmg&=3rVYJp@p-BFK%|?VuTW;7XJ}xiXQ*qSXJlYxVqj)yXlP_?VQi#pYH5;Y
zZfKTdoMLF9kYQ-$6_iz;?2#Clm=%%~?Cj+1ZCn|ZS6Ei*QI;O=l$alq;o@EzVv=3v
z>6tuPo<$*zR6F$3^YwD`Q$SWFMOAvGRygGpWhI*ArB`G+rRQ5DRhkxrd6YUPWu#l?
f7+C6CRED{`RHlQh+T6?LW<UAAoBrm_Zm;73tBXip

delta 144
zcmex#mTBHurVYJpn<ufm*;^=-8R!`rnCTfPWEfgSX8Nau>$@lW<R*m$msR)%rMZ|U
zR+jji<r#;#coexhTAGJ>_$HQDnx#+P?Ivpv*Q}qOua}#j0y4ug+q}%FurM$+HJ~)h
nB-zNh(AUqhG{CJmt)i?vINP!;FVL+h+toBR-D2}@H}eDlolh`v

diff --git a/pkg/morph/client/constructor.go b/pkg/morph/client/constructor.go
index 50a9572d..c499aa89 100644
--- a/pkg/morph/client/constructor.go
+++ b/pkg/morph/client/constructor.go
@@ -141,7 +141,7 @@ func New(ctx context.Context, key *keys.PrivateKey, opts ...Option) (*Client, er
 	} else {
 		var endpoint Endpoint
 		for cli.endpoints.curr, endpoint = range cli.endpoints.list {
-			cli.client, act, err = cli.newCli(ctx, endpoint.Address)
+			cli.client, act, err = cli.newCli(ctx, endpoint)
 			if err != nil {
 				cli.logger.Warn(logs.FrostFSIRCouldntCreateRPCClientForEndpoint,
 					zap.Error(err), zap.String("endpoint", endpoint.Address))
@@ -162,10 +162,15 @@ func New(ctx context.Context, key *keys.PrivateKey, opts ...Option) (*Client, er
 	return cli, nil
 }
 
-func (c *Client) newCli(ctx context.Context, endpoint string) (*rpcclient.WSClient, *actor.Actor, error) {
-	cli, err := rpcclient.NewWS(ctx, endpoint, rpcclient.WSOptions{
+func (c *Client) newCli(ctx context.Context, endpoint Endpoint) (*rpcclient.WSClient, *actor.Actor, error) {
+	cfg, err := endpoint.MTLSConfig.parse()
+	if err != nil {
+		return nil, nil, fmt.Errorf("read mtls certificates: %w", err)
+	}
+	cli, err := rpcclient.NewWS(ctx, endpoint.Address, rpcclient.WSOptions{
 		Options: rpcclient.Options{
-			DialTimeout: c.cfg.dialTimeout,
+			DialTimeout:     c.cfg.dialTimeout,
+			TLSClientConfig: cfg,
 		},
 	})
 	if err != nil {
diff --git a/pkg/morph/client/mtls.go b/pkg/morph/client/mtls.go
new file mode 100644
index 00000000..3de51afe
--- /dev/null
+++ b/pkg/morph/client/mtls.go
@@ -0,0 +1,22 @@
+package client
+
+import (
+	"crypto/tls"
+
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
+)
+
+// MTLSConfig represents endpoint mTLS configuration.
+type MTLSConfig struct {
+	TrustedCAList []string
+	KeyFile       string
+	CertFile      string
+}
+
+func (m *MTLSConfig) parse() (*tls.Config, error) {
+	if m == nil {
+		return nil, nil
+	}
+
+	return rpcclient.TLSClientConfig(m.TrustedCAList, m.CertFile, m.KeyFile)
+}
diff --git a/pkg/morph/client/multi.go b/pkg/morph/client/multi.go
index 25ec626d..10ed2158 100644
--- a/pkg/morph/client/multi.go
+++ b/pkg/morph/client/multi.go
@@ -11,8 +11,9 @@ import (
 
 // Endpoint represents morph endpoint together with its priority.
 type Endpoint struct {
-	Address  string
-	Priority int
+	Address    string
+	Priority   int
+	MTLSConfig *MTLSConfig
 }
 
 type endpoints struct {
@@ -38,11 +39,11 @@ func (c *Client) SwitchRPC(ctx context.Context) bool {
 
 	// Iterate endpoints in the order of decreasing priority.
 	for c.endpoints.curr = range c.endpoints.list {
-		newEndpoint := c.endpoints.list[c.endpoints.curr].Address
+		newEndpoint := c.endpoints.list[c.endpoints.curr]
 		cli, act, err := c.newCli(ctx, newEndpoint)
 		if err != nil {
 			c.logger.Warn(logs.ClientCouldNotEstablishConnectionToTheSwitchedRPCNode,
-				zap.String("endpoint", newEndpoint),
+				zap.String("endpoint", newEndpoint.Address),
 				zap.Error(err),
 			)
 
@@ -52,7 +53,7 @@ func (c *Client) SwitchRPC(ctx context.Context) bool {
 		c.cache.invalidate()
 
 		c.logger.Info(logs.ClientConnectionToTheNewRPCNodeHasBeenEstablished,
-			zap.String("endpoint", newEndpoint))
+			zap.String("endpoint", newEndpoint.Address))
 
 		c.client = cli
 		c.setActor(act)
@@ -119,7 +120,7 @@ mainLoop:
 
 				tryE := e.Address
 
-				cli, act, err := c.newCli(ctx, tryE)
+				cli, act, err := c.newCli(ctx, e)
 				if err != nil {
 					c.logger.Warn(logs.ClientCouldNotCreateClientToTheHigherPriorityNode,
 						zap.String("endpoint", tryE),