dstepanov-yadro/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#1170] morph: Support mTLS

Browse source 
Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>
This commit is contained in:
Evgenii Stratonikov 2024-06-10 11:48:14 +03:00
parent 68ac490729
commit 42ecc2f2b9
5 changed files with 40 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
go.mod
View file

@ -127,3 +127,5 @@ require (
lukechampine.com/blake3 v1.2.1 // indirect
rsc.io/tmplfunc v0.0.3 // indirect
)
replace github.com/nspcc-dev/neo-go => git.frostfs.info/TrueCloudLab/neoneo-go v0.106.1-0.20240611123832-594f716b3d18

BIN
go.sum
View file

Binary file not shown.

11
pkg/morph/client/constructor.go
View file

@ -141,7 +141,7 @@ func New(ctx context.Context, key *keys.PrivateKey, opts ...Option) (*Client, er
} else {
var endpoint Endpoint
for cli.endpoints.curr, endpoint = range cli.endpoints.list {
cli.client, act, err = cli.newCli(ctx, endpoint.Address)
cli.client, act, err = cli.newCli(ctx, endpoint)
if err != nil {
cli.logger.Warn(logs.FrostFSIRCouldntCreateRPCClientForEndpoint,
zap.Error(err), zap.String("endpoint", endpoint.Address))
@ -162,10 +162,15 @@ func New(ctx context.Context, key *keys.PrivateKey, opts ...Option) (*Client, er
return cli, nil
}
func (c *Client) newCli(ctx context.Context, endpoint string) (*rpcclient.WSClient, *actor.Actor, error) {
cli, err := rpcclient.NewWS(ctx, endpoint, rpcclient.WSOptions{
func (c *Client) newCli(ctx context.Context, endpoint Endpoint) (*rpcclient.WSClient, *actor.Actor, error) {
cfg, err := endpoint.MTLSConfig.parse()
if err != nil {
return nil, nil, fmt.Errorf("read mtls certificates: %w", err)
}
cli, err := rpcclient.NewWS(ctx, endpoint.Address, rpcclient.WSOptions{
Options: rpcclient.Options{
DialTimeout: c.cfg.dialTimeout,
TLSClientConfig: cfg,
},
})
if err != nil {

22
pkg/morph/client/mtls.go Normal file
View file

@ -0,0 +1,22 @@
package client
import (
"crypto/tls"
"github.com/nspcc-dev/neo-go/pkg/rpcclient"
)
// MTLSConfig represents endpoint mTLS configuration.
type MTLSConfig struct {
TrustedCAList []string
KeyFile string
CertFile string
}
func (m *MTLSConfig) parse() (*tls.Config, error) {
if m == nil {
return nil, nil
}
return rpcclient.TLSClientConfig(m.TrustedCAList, m.CertFile, m.KeyFile)
}

9
pkg/morph/client/multi.go
View file

@ -13,6 +13,7 @@ import (
type Endpoint struct {
Address string
Priority int
MTLSConfig *MTLSConfig
}
type endpoints struct {
@ -38,11 +39,11 @@ func (c *Client) SwitchRPC(ctx context.Context) bool {
// Iterate endpoints in the order of decreasing priority.
for c.endpoints.curr = range c.endpoints.list {
newEndpoint := c.endpoints.list[c.endpoints.curr].Address
newEndpoint := c.endpoints.list[c.endpoints.curr]
cli, act, err := c.newCli(ctx, newEndpoint)
if err != nil {
c.logger.Warn(logs.ClientCouldNotEstablishConnectionToTheSwitchedRPCNode,
zap.String("endpoint", newEndpoint),
zap.String("endpoint", newEndpoint.Address),
zap.Error(err),
)
@ -52,7 +53,7 @@ func (c *Client) SwitchRPC(ctx context.Context) bool {
c.cache.invalidate()
c.logger.Info(logs.ClientConnectionToTheNewRPCNodeHasBeenEstablished,
zap.String("endpoint", newEndpoint))
zap.String("endpoint", newEndpoint.Address))
c.client = cli
c.setActor(act)
@ -119,7 +120,7 @@ mainLoop:
tryE := e.Address
cli, act, err := c.newCli(ctx, tryE)
cli, act, err := c.newCli(ctx, e)
if err != nil {
c.logger.Warn(logs.ClientCouldNotCreateClientToTheHigherPriorityNode,
zap.String("endpoint", tryE),