-
Notifications
You must be signed in to change notification settings - Fork 34
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(config-cache): replace map with explicit CQL and Alternator TLS c…
…onfig Fixes #3815
- Loading branch information
1 parent
fb0e100
commit d5e6eac
Showing
4 changed files
with
142 additions
and
71 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| // Copyright (C) 2024 ScyllaDB | ||
|
|
||
| package configcache | ||
|
|
||
| import ( | ||
| "github.com/pkg/errors" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/scyllaclient" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/service/cluster" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/store" | ||
| ) | ||
|
|
||
| // NodeConfig keeps the node current node configuration together with the TLS details per different type of connection. | ||
| type NodeConfig struct { | ||
| *scyllaclient.NodeInfo | ||
|
|
||
| cqlTLSConfig *TLSConfigWithAddress | ||
| alternatorTLSConfig *TLSConfigWithAddress | ||
| } | ||
|
|
||
| // NewNodeConfig creates and initializes new node configuration struct containing TLS configuration of CQL and Alternator. | ||
| func NewNodeConfig(c *cluster.Cluster, nodeInfo *scyllaclient.NodeInfo, secretsStore store.Store, host string) (config NodeConfig, err error) { | ||
| cqlTLS, err := newCQLTLSConfigIfEnabled(c, nodeInfo, secretsStore, host) | ||
| if err != nil { | ||
| return NodeConfig{}, errors.Wrap(err, "building node config") | ||
| } | ||
| alternatorTLS, err := newAlternatorTLSConfigIfEnabled(c, nodeInfo, secretsStore, host) | ||
| if err != nil { | ||
| return NodeConfig{}, errors.Wrap(err, "building node config") | ||
| } | ||
| return NodeConfig{ | ||
| NodeInfo: nodeInfo, | ||
| cqlTLSConfig: cqlTLS, | ||
| alternatorTLSConfig: alternatorTLS, | ||
| }, nil | ||
| } | ||
|
|
||
| // CQLTLSConfig is a getter of TLS configuration for CQL session. | ||
| func (nc NodeConfig) CQLTLSConfig() *TLSConfigWithAddress { | ||
| return nc.cqlTLSConfig | ||
| } | ||
|
|
||
| // AlternatorTLSConfig is a getter of TLS configuration for Alternator session. | ||
| func (nc NodeConfig) AlternatorTLSConfig() *TLSConfigWithAddress { | ||
| return nc.alternatorTLSConfig | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| // Copyright (C) 2024 ScyllaDB | ||
|
|
||
| package configcache | ||
|
|
||
| import ( | ||
| "crypto/tls" | ||
|
|
||
| "github.com/pkg/errors" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/scyllaclient" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/secrets" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/service" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/service/cluster" | ||
| "github.com/scylladb/scylla-manager/v3/pkg/store" | ||
| ) | ||
|
|
||
| // TLSConfigWithAddress is a concatenation of tls.Config and Address. | ||
| type TLSConfigWithAddress struct { | ||
| *tls.Config | ||
| Address string | ||
| } | ||
|
|
||
| func newCQLTLSConfigIfEnabled(c *cluster.Cluster, nodeInfo *scyllaclient.NodeInfo, secretsStore store.Store, | ||
| host string, | ||
| ) (*TLSConfigWithAddress, error) { | ||
| cqlTLSEnabled, cqlClientCertAuth := nodeInfo.CQLTLSEnabled() | ||
| if !cqlTLSEnabled || c.ForceTLSDisabled { | ||
| return nil, nil // nolint: nilnil | ||
| } | ||
| cqlAddress := nodeInfo.CQLAddr(host) | ||
| if !c.ForceNonSSLSessionPort { | ||
| cqlAddress = nodeInfo.CQLSSLAddr(host) | ||
| } | ||
| tlsConfig := &tls.Config{ | ||
| InsecureSkipVerify: true, | ||
| } | ||
| if cqlClientCertAuth { | ||
| cert, err := prepareCertificates(c, secretsStore) | ||
| if err != nil { | ||
| return nil, errors.Wrap(err, "unable to create TLS configuration for CQL session") | ||
| } | ||
| tlsConfig.Certificates = []tls.Certificate{cert} | ||
| } | ||
| return &TLSConfigWithAddress{ | ||
| Address: cqlAddress, | ||
| Config: tlsConfig, | ||
| }, nil | ||
| } | ||
|
|
||
| func newAlternatorTLSConfigIfEnabled(c *cluster.Cluster, nodeInfo *scyllaclient.NodeInfo, secretsStore store.Store, | ||
| host string, | ||
| ) (*TLSConfigWithAddress, error) { | ||
| alternatorTLSEnabled, alternatorClientCertAuth := nodeInfo.AlternatorTLSEnabled() | ||
| if !alternatorTLSEnabled { | ||
| return nil, nil // nolint: nilnil | ||
| } | ||
| alternatorAddress := nodeInfo.AlternatorAddr(host) | ||
|
|
||
| tlsConfig := &tls.Config{ | ||
| InsecureSkipVerify: true, | ||
| } | ||
| if alternatorClientCertAuth { | ||
| cert, err := prepareCertificates(c, secretsStore) | ||
| if err != nil { | ||
| return nil, errors.Wrap(err, "unable to create TLS configuration for Alternator session") | ||
| } | ||
| tlsConfig.Certificates = []tls.Certificate{cert} | ||
| } | ||
| return &TLSConfigWithAddress{ | ||
| Address: alternatorAddress, | ||
| Config: tlsConfig, | ||
| }, nil | ||
| } | ||
|
|
||
| func prepareCertificates(c *cluster.Cluster, secretsStore store.Store) (cert tls.Certificate, err error) { | ||
| id := &secrets.TLSIdentity{ | ||
| ClusterID: c.ID, | ||
| } | ||
| if err := secretsStore.Get(id); err != nil { | ||
| if !errors.Is(err, service.ErrNotFound) { | ||
| return tls.Certificate{}, errors.Wrap(err, "fetch TLS config") | ||
| } | ||
| return tls.Certificate{}, errors.Wrap(err, "client encryption is enabled, but certificate is missing") | ||
| } | ||
|
|
||
| keyPair, err := tls.X509KeyPair(id.Cert, id.PrivateKey) | ||
| if err != nil { | ||
| return tls.Certificate{}, errors.Wrap(err, "invalid SSL user key pair") | ||
| } | ||
| return keyPair, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters