7185393028

Committed 12 Dec 2023 05:57PM UTC coverage: 59.913% (+0.02%) from 59.891%

Build # 7185393028

Build Type

push

github

Committed by

web-flow

Commit Message

config: no longer stub out HPKE public key fetch (#4853)

This partially reverts commit a1388592d.

Fetching the authenticate service HPKE public key is required only for 
the stateless authentication flow. Now that Pomerium will instead use 
the older (stateful) authentication flow when configured for a
self-hosted authenticate service, this logic shouldn't be needed at all.

Removing this logic should also make it easier to test against a local
instance of the hosted authenticate service.

Run Details

0 of 4 new or added lines in 1 file covered. (0.0%)

2 existing lines in 1 file now uncovered.

15080 of 25170 relevant lines covered (59.91%)

111.48 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

16.03

/config/config.go

package config

import (
        "bytes"
        "crypto/tls"
        "crypto/x509"
        "encoding/base64"
        "fmt"
        "net/http"
        "net/url"

        "github.com/pomerium/pomerium/internal/fileutil"
        "github.com/pomerium/pomerium/internal/hashutil"
        "github.com/pomerium/pomerium/internal/httputil"
        "github.com/pomerium/pomerium/internal/telemetry/metrics"
        "github.com/pomerium/pomerium/internal/urlutil"
        "github.com/pomerium/pomerium/pkg/cryptutil"
        "github.com/pomerium/pomerium/pkg/derivecert"
        "github.com/pomerium/pomerium/pkg/hpke"
)

// MetricsScrapeEndpoint defines additional metrics endpoints that would be scraped and exposed by pomerium
type MetricsScrapeEndpoint metrics.ScrapeEndpoint

// Config holds pomerium configuration options.
type Config struct {
        Options          *Options
        AutoCertificates []tls.Certificate
        EnvoyVersion     string

        // DerivedCertificates are TLS certificates derived from the shared secret
        DerivedCertificates []tls.Certificate
        // DerivedCAPEM is a PEM-encoded certificate authority
        // derived from the shared secret
        DerivedCAPEM []byte

        // GRPCPort is the port the gRPC server is running on.
        GRPCPort string
        // HTTPPort is the port the HTTP server is running on.
        HTTPPort string
        // OutboundPort is the port the outbound gRPC listener is running on.
        OutboundPort string
        // MetricsPort is the port the metrics listener is running on.
        MetricsPort string
        // DebugPort is the port the debug listener is running on.
        DebugPort string
        // ACMETLSPort is the port that handles the ACME TLS-ALPN challenge.
        ACMETLSALPNPort string

        // MetricsScrapeEndpoints additional metrics endpoints to scrape and provide part of metrics
        MetricsScrapeEndpoints []MetricsScrapeEndpoint
}

// Clone creates a clone of the config.
func (cfg *Config) Clone() *Config {
        newOptions := new(Options)
        if cfg.Options != nil {
                *newOptions = *cfg.Options
        }

        endpoints := make([]MetricsScrapeEndpoint, len(cfg.MetricsScrapeEndpoints))
        _ = copy(endpoints, cfg.MetricsScrapeEndpoints)

        return &Config{
                Options:          newOptions,
                AutoCertificates: cfg.AutoCertificates,
                EnvoyVersion:     cfg.EnvoyVersion,

                GRPCPort:        cfg.GRPCPort,
                HTTPPort:        cfg.HTTPPort,
                OutboundPort:    cfg.OutboundPort,
                MetricsPort:     cfg.MetricsPort,
                DebugPort:       cfg.DebugPort,
                ACMETLSALPNPort: cfg.ACMETLSALPNPort,

                MetricsScrapeEndpoints: endpoints,

                DerivedCertificates: cfg.DerivedCertificates,
                DerivedCAPEM:        cfg.DerivedCAPEM,
        }
}

// AllCertificateAuthoritiesPEM returns all CAs as PEM bundle bytes
func (cfg *Config) AllCertificateAuthoritiesPEM() ([]byte, error) {
        var combined bytes.Buffer
        if cfg.Options.CA != "" {
                bs, err := base64.StdEncoding.DecodeString(cfg.Options.CA)
                if err != nil {
                        return nil, err
                }
                _, _ = combined.Write(bs)
                _, _ = combined.WriteRune('\n')
        }

        if cfg.Options.CAFile != "" {
                if err := fileutil.CopyFileUpTo(&combined, cfg.Options.CAFile, 5<<20); err != nil {
                        return nil, err
                }
                _, _ = combined.WriteRune('\n')
        }

        if cfg.DerivedCAPEM != nil {
                _, _ = combined.Write(cfg.DerivedCAPEM)
                _, _ = combined.WriteRune('\n')
        }

        return combined.Bytes(), nil
}

// AllCertificates returns all the certificates in the config.
func (cfg *Config) AllCertificates() ([]tls.Certificate, error) {
        optionCertificates, err := cfg.Options.GetCertificates()
        if err != nil {
                return nil, err
        }

        var certs []tls.Certificate
        certs = append(certs, optionCertificates...)
        certs = append(certs, cfg.AutoCertificates...)
        certs = append(certs, cfg.DerivedCertificates...)
        return certs, nil
}

// Checksum returns the config checksum.
func (cfg *Config) Checksum() uint64 {
        return hashutil.MustHash(cfg)
}

// AllocatePorts populates
func (cfg *Config) AllocatePorts(ports [6]string) {
        cfg.GRPCPort = ports[0]
        cfg.HTTPPort = ports[1]
        cfg.OutboundPort = ports[2]
        cfg.MetricsPort = ports[3]
        cfg.DebugPort = ports[4]
        cfg.ACMETLSALPNPort = ports[5]
}

// GetTLSClientConfig returns TLS configuration that accounts for additional CA entries
func (cfg *Config) GetTLSClientConfig() (*tls.Config, error) {
        roots, err := cfg.GetCertificatePool()
        if err != nil {
                return nil, err
        }
        return &tls.Config{
                RootCAs:    roots,
                MinVersion: tls.VersionTLS12,
        }, nil
}

// GenerateCatchAllCertificate generates a catch-all certificate. If no derived CA is defined a
// self-signed certificate will be generated.
func (cfg *Config) GenerateCatchAllCertificate() (*tls.Certificate, error) {
        if cfg.Options.DeriveInternalDomainCert != nil {
                sharedKey, err := cfg.Options.GetSharedKey()
                if err != nil {
                        return nil, fmt.Errorf("failed to generate cert, invalid shared key: %w", err)
                }

                ca, err := derivecert.NewCA(sharedKey)
                if err != nil {
                        return nil, fmt.Errorf("failed to generate cert, invalid derived CA: %w", err)
                }

                pem, err := ca.NewServerCert([]string{"*"})
                if err != nil {
                        return nil, fmt.Errorf("failed to generate cert, error creating server certificate: %w", err)
                }

                cert, err := pem.TLS()
                if err != nil {
                        return nil, fmt.Errorf("failed to generate cert, error converting generated certificate into TLS certificate: %w", err)
                }
                return &cert, nil
        }

        sharedKey, err := cfg.Options.GetSharedKey()
        if err != nil {
                return nil, fmt.Errorf("failed to generate cert, invalid shared key: %w", err)
        }

        // finally fall back to a generated, self-signed certificate
        return cryptutil.GenerateCertificate(sharedKey, "*")
}

// WillHaveCertificateForServerName returns true if there will be a certificate for the given server name.
func (cfg *Config) WillHaveCertificateForServerName(serverName string) (bool, error) {
        certificates, err := cfg.AllCertificates()
        if err != nil {
                return false, err
        }

        // first try a direct name match
        for i := range certificates {
                if cryptutil.MatchesServerName(&certificates[i], serverName) {
                        return true, nil
                }
        }

        return cfg.Options.GetDeriveInternalDomain() == serverName, nil
}

// GetCertificatePool gets the certificate pool for the config.
func (cfg *Config) GetCertificatePool() (*x509.CertPool, error) {
        pool, err := cryptutil.GetCertPool(cfg.Options.CA, cfg.Options.CAFile)
        if err != nil {
                return nil, err
        }

        if cfg.Options.DeriveInternalDomainCert != nil {
                sharedKey, err := cfg.Options.GetSharedKey()
                if err != nil {
                        return nil, fmt.Errorf("failed to derive CA, invalid shared key: %w", err)
                }

                ca, err := derivecert.NewCA(sharedKey)
                if err != nil {
                        return nil, fmt.Errorf("failed to derive CA: %w", err)
                }

                pem, err := ca.PEM()
                if err != nil {
                        return nil, fmt.Errorf("failed to derive CA PEM: %w", err)
                }

                if !pool.AppendCertsFromPEM(pem.Cert) {
                        return nil, fmt.Errorf("failed to derive CA PEM, error appending to pool")
                }
        }

        return pool, nil
}

// GetAuthenticateKeyFetcher returns a key fetcher for the authenticate service
func (cfg *Config) GetAuthenticateKeyFetcher() (hpke.KeyFetcher, error) {
        authenticateURL, transport, err := cfg.resolveAuthenticateURL()
        if err != nil {
                return nil, err
        }
        hpkeURL := authenticateURL.ResolveReference(&url.URL{
                Path: urlutil.HPKEPublicKeyPath,
        }).String()
        return hpke.NewKeyFetcher(hpkeURL, transport), nil
}

func (cfg *Config) resolveAuthenticateURL() (*url.URL, *http.Transport, error) {
        authenticateURL, err := cfg.Options.GetInternalAuthenticateURL()
        if err != nil {
                return nil, nil, fmt.Errorf("invalid authenticate service url: %w", err)
        }
        ok, err := cfg.WillHaveCertificateForServerName(authenticateURL.Hostname())
        if err != nil {
                return nil, nil, fmt.Errorf("error determining if authenticate service will have a certificate name: %w", err)
        }
        if !ok {
                return authenticateURL, httputil.GetInsecureTransport(), nil
        }

        transport, err := GetTLSClientTransport(cfg)
        if err != nil {
                return nil, nil, fmt.Errorf("get tls client config: %w", err)
        }

        return authenticateURL, transport, nil
}

1	package config
2
3	import (
4	"bytes"
5	"crypto/tls"
6	"crypto/x509"
7	"encoding/base64"
8	"fmt"
9	"net/http"
10	"net/url"
11
12	"github.com/pomerium/pomerium/internal/fileutil"
13	"github.com/pomerium/pomerium/internal/hashutil"
14	"github.com/pomerium/pomerium/internal/httputil"
15	"github.com/pomerium/pomerium/internal/telemetry/metrics"
16	"github.com/pomerium/pomerium/internal/urlutil"
17	"github.com/pomerium/pomerium/pkg/cryptutil"
18	"github.com/pomerium/pomerium/pkg/derivecert"
19	"github.com/pomerium/pomerium/pkg/hpke"
20	)
21
22	// MetricsScrapeEndpoint defines additional metrics endpoints that would be scraped and exposed by pomerium
23	type MetricsScrapeEndpoint metrics.ScrapeEndpoint
24
25	// Config holds pomerium configuration options.
26	type Config struct {
27	Options *Options
28	AutoCertificates []tls.Certificate
29	EnvoyVersion string
30
31	// DerivedCertificates are TLS certificates derived from the shared secret
32	DerivedCertificates []tls.Certificate
33	// DerivedCAPEM is a PEM-encoded certificate authority
34	// derived from the shared secret
35	DerivedCAPEM []byte
36
37	// GRPCPort is the port the gRPC server is running on.
38	GRPCPort string
39	// HTTPPort is the port the HTTP server is running on.
40	HTTPPort string
41	// OutboundPort is the port the outbound gRPC listener is running on.
42	OutboundPort string
43	// MetricsPort is the port the metrics listener is running on.
44	MetricsPort string
45	// DebugPort is the port the debug listener is running on.
46	DebugPort string
47	// ACMETLSPort is the port that handles the ACME TLS-ALPN challenge.
48	ACMETLSALPNPort string
49
50	// MetricsScrapeEndpoints additional metrics endpoints to scrape and provide part of metrics
51	MetricsScrapeEndpoints []MetricsScrapeEndpoint
52	}
53
54	// Clone creates a clone of the config.
55	func (cfg Config) Clone() Config {	5✔
56	newOptions := new(Options)	5✔
57	if cfg.Options != nil {	9✔
58	newOptions = cfg.Options	4✔
59	}	4✔
60
61	endpoints := make([]MetricsScrapeEndpoint, len(cfg.MetricsScrapeEndpoints))	5✔
62	_ = copy(endpoints, cfg.MetricsScrapeEndpoints)	5✔
63		5✔
64	return &Config{	5✔
65	Options: newOptions,	5✔
66	AutoCertificates: cfg.AutoCertificates,	5✔
67	EnvoyVersion: cfg.EnvoyVersion,	5✔
68		5✔
69	GRPCPort: cfg.GRPCPort,	5✔
70	HTTPPort: cfg.HTTPPort,	5✔
71	OutboundPort: cfg.OutboundPort,	5✔
72	MetricsPort: cfg.MetricsPort,	5✔
73	DebugPort: cfg.DebugPort,	5✔
74	ACMETLSALPNPort: cfg.ACMETLSALPNPort,	5✔
75		5✔
76	MetricsScrapeEndpoints: endpoints,	5✔
77		5✔
78	DerivedCertificates: cfg.DerivedCertificates,	5✔
79	DerivedCAPEM: cfg.DerivedCAPEM,	5✔
80	}	5✔
81	}
82
83	// AllCertificateAuthoritiesPEM returns all CAs as PEM bundle bytes
84	func (cfg *Config) AllCertificateAuthoritiesPEM() ([]byte, error) {	×
85	var combined bytes.Buffer	×
86	if cfg.Options.CA != "" {	×
87	bs, err := base64.StdEncoding.DecodeString(cfg.Options.CA)	×
88	if err != nil {	×
89	return nil, err	×
90	}	×
91	_, _ = combined.Write(bs)	×
92	_, _ = combined.WriteRune('\n')	×
93	}
94
95	if cfg.Options.CAFile != "" {	×
96	if err := fileutil.CopyFileUpTo(&combined, cfg.Options.CAFile, 5<<20); err != nil {	×
97	return nil, err	×
98	}	×
99	_, _ = combined.WriteRune('\n')	×
100	}
101
102	if cfg.DerivedCAPEM != nil {	×
103	_, _ = combined.Write(cfg.DerivedCAPEM)	×
104	_, _ = combined.WriteRune('\n')	×
105	}	×
106
107	return combined.Bytes(), nil	×
108	}
109
110	// AllCertificates returns all the certificates in the config.
111	func (cfg *Config) AllCertificates() ([]tls.Certificate, error) {	×
112	optionCertificates, err := cfg.Options.GetCertificates()	×
113	if err != nil {	×
114	return nil, err	×
115	}	×
116
117	var certs []tls.Certificate	×
118	certs = append(certs, optionCertificates...)	×
119	certs = append(certs, cfg.AutoCertificates...)	×
120	certs = append(certs, cfg.DerivedCertificates...)	×
121	return certs, nil	×
122	}
123
124	// Checksum returns the config checksum.
125	func (cfg *Config) Checksum() uint64 {	×
126	return hashutil.MustHash(cfg)	×
127	}	×
128
129	// AllocatePorts populates
130	func (cfg *Config) AllocatePorts(ports [6]string) {	×
131	cfg.GRPCPort = ports[0]	×
132	cfg.HTTPPort = ports[1]	×
133	cfg.OutboundPort = ports[2]	×
134	cfg.MetricsPort = ports[3]	×
135	cfg.DebugPort = ports[4]	×
136	cfg.ACMETLSALPNPort = ports[5]	×
137	}	×
138
139	// GetTLSClientConfig returns TLS configuration that accounts for additional CA entries
140	func (cfg Config) GetTLSClientConfig() (tls.Config, error) {	×
141	roots, err := cfg.GetCertificatePool()	×
142	if err != nil {	×
143	return nil, err	×
144	}	×
145	return &tls.Config{	×
146	RootCAs: roots,	×
147	MinVersion: tls.VersionTLS12,	×
148	}, nil	×
149	}
150
151	// GenerateCatchAllCertificate generates a catch-all certificate. If no derived CA is defined a
152	// self-signed certificate will be generated.
153	func (cfg Config) GenerateCatchAllCertificate() (tls.Certificate, error) {	×
154	if cfg.Options.DeriveInternalDomainCert != nil {	×
155	sharedKey, err := cfg.Options.GetSharedKey()	×
156	if err != nil {	×
157	return nil, fmt.Errorf("failed to generate cert, invalid shared key: %w", err)	×
158	}	×
159
160	ca, err := derivecert.NewCA(sharedKey)	×
161	if err != nil {	×
162	return nil, fmt.Errorf("failed to generate cert, invalid derived CA: %w", err)	×
163	}	×
164
165	pem, err := ca.NewServerCert([]string{"*"})	×
166	if err != nil {	×
167	return nil, fmt.Errorf("failed to generate cert, error creating server certificate: %w", err)	×
168	}	×
169
170	cert, err := pem.TLS()	×
171	if err != nil {	×
172	return nil, fmt.Errorf("failed to generate cert, error converting generated certificate into TLS certificate: %w", err)	×
173	}	×
174	return &cert, nil	×
175	}
176
177	sharedKey, err := cfg.Options.GetSharedKey()	×
178	if err != nil {	×
179	return nil, fmt.Errorf("failed to generate cert, invalid shared key: %w", err)	×
180	}	×
181
182	// finally fall back to a generated, self-signed certificate
183	return cryptutil.GenerateCertificate(sharedKey, "*")	×
184	}
185
186	// WillHaveCertificateForServerName returns true if there will be a certificate for the given server name.
187	func (cfg *Config) WillHaveCertificateForServerName(serverName string) (bool, error) {	×
188	certificates, err := cfg.AllCertificates()	×
189	if err != nil {	×
190	return false, err	×
191	}	×
192
193	// first try a direct name match
194	for i := range certificates {	×
195	if cryptutil.MatchesServerName(&certificates[i], serverName) {	×
196	return true, nil	×
197	}	×
198	}
199
200	return cfg.Options.GetDeriveInternalDomain() == serverName, nil	×
201	}
202
203	// GetCertificatePool gets the certificate pool for the config.
204	func (cfg Config) GetCertificatePool() (x509.CertPool, error) {	×
205	pool, err := cryptutil.GetCertPool(cfg.Options.CA, cfg.Options.CAFile)	×
206	if err != nil {	×
207	return nil, err	×
208	}	×
209
210	if cfg.Options.DeriveInternalDomainCert != nil {	×
211	sharedKey, err := cfg.Options.GetSharedKey()	×
212	if err != nil {	×
213	return nil, fmt.Errorf("failed to derive CA, invalid shared key: %w", err)	×
214	}	×
215
216	ca, err := derivecert.NewCA(sharedKey)	×
217	if err != nil {	×
218	return nil, fmt.Errorf("failed to derive CA: %w", err)	×
219	}	×
220
221	pem, err := ca.PEM()	×
222	if err != nil {	×
223	return nil, fmt.Errorf("failed to derive CA PEM: %w", err)	×
224	}	×
225
226	if !pool.AppendCertsFromPEM(pem.Cert) {	×
227	return nil, fmt.Errorf("failed to derive CA PEM, error appending to pool")	×
228	}	×
229	}
230
231	return pool, nil	×
232	}
233
234	// GetAuthenticateKeyFetcher returns a key fetcher for the authenticate service
235	func (cfg *Config) GetAuthenticateKeyFetcher() (hpke.KeyFetcher, error) {	×
236	authenticateURL, transport, err := cfg.resolveAuthenticateURL()	×
237	if err != nil {	×
238	return nil, err	×
239	}	×
NEW 240	hpkeURL := authenticateURL.ResolveReference(&url.URL{	×
NEW 241	Path: urlutil.HPKEPublicKeyPath,	×
NEW 242	}).String()	×
NEW 243	return hpke.NewKeyFetcher(hpkeURL, transport), nil	×
244	}
245
246	func (cfg Config) resolveAuthenticateURL() (url.URL, *http.Transport, error) {	×
247	authenticateURL, err := cfg.Options.GetInternalAuthenticateURL()	×
248	if err != nil {	×
249	return nil, nil, fmt.Errorf("invalid authenticate service url: %w", err)	×
250	}	×
251	ok, err := cfg.WillHaveCertificateForServerName(authenticateURL.Hostname())	×
252	if err != nil {	×
253	return nil, nil, fmt.Errorf("error determining if authenticate service will have a certificate name: %w", err)	×
254	}	×
255	if !ok {	×
256	return authenticateURL, httputil.GetInsecureTransport(), nil	×
257	}	×
258
259	transport, err := GetTLSClientTransport(cfg)	×
260	if err != nil {	×
261	return nil, nil, fmt.Errorf("get tls client config: %w", err)	×
262	}	×
263
264	return authenticateURL, transport, nil	×
265	}

pomerium / pomerium / 7185393028

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous