-
Notifications
You must be signed in to change notification settings - Fork 137
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* initial grpc impl Signed-off-by: Bob Callaway <bcallaway@google.com> * fix cmd line arg with viper alias Signed-off-by: Bob Callaway <bcallaway@google.com> * add debugging, install protoc via apt Signed-off-by: Bob Callaway <bcallaway@google.com> * remove debugging and trailing newline Signed-off-by: Bob Callaway <bcallaway@google.com> * write header and value together Signed-off-by: Bob Callaway <bcallaway@google.com> * fix docker-compose, revert last fix Signed-off-by: Bob Callaway <bob.callaway@gmail.com> * fix logging, add grpc mw Signed-off-by: Bob Callaway <bcallaway@google.com> * update protobuf defs, implement legacy interface Signed-off-by: Bob Callaway <bcallaway@google.com> * fix spacing Signed-off-by: Bob Callaway <bcallaway@google.com> * use abstract unix domain socket Signed-off-by: Bob Callaway <bcallaway@google.com> * send 201 and SCT with response Signed-off-by: Bob Callaway <bcallaway@google.com> * address code review comments Signed-off-by: Bob Callaway <bcallaway@google.com> * debugging k8s failure Signed-off-by: Bob Callaway <bcallaway@google.com> * trim space on chain before sending Signed-off-by: Bob Callaway <bcallaway@google.com> * trim space on CSC call as well Signed-off-by: Bob Callaway <bcallaway@google.com> * fix prom and address review comments Signed-off-by: Bob Callaway <bcallaway@google.com> * s/@/:/ Signed-off-by: Bob Callaway <bcallaway@google.com> * update version num, tweak cert chain nomenclature Signed-off-by: Bob Callaway <bcallaway@google.com> * modify api_test to use grpc server Signed-off-by: Bob Callaway <bcallaway@google.com> * remove unused code Signed-off-by: Bob Callaway <bcallaway@google.com> * remove ctl logger, fix newlines Signed-off-by: Bob Callaway <bcallaway@google.com> * fix test to not send nil challenge Signed-off-by: Bob Callaway <bcallaway@google.com> * address review comments Signed-off-by: Bob Callaway <bcallaway@google.com> * commit generated file Signed-off-by: Bob Callaway <bcallaway@google.com> * opt for message with 0 fields over empty for forward compatibility Signed-off-by: Bob Callaway <bcallaway@google.com>
- Loading branch information
1 parent
2605dbf
commit d464219
Showing
45 changed files
with
4,490 additions
and
769 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| /pkg/generated/protobuf/** linguist-generated |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,151 @@ | ||
| // Copyright 2022 The Sigstore Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
|
|
||
| package app | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net" | ||
|
|
||
| "github.com/goadesign/goa/grpc/middleware" | ||
| ctclient "github.com/google/certificate-transparency-go/client" | ||
| grpcmw "github.com/grpc-ecosystem/go-grpc-middleware" | ||
| grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap" | ||
| grpc_recovery "github.com/grpc-ecosystem/go-grpc-middleware/recovery" | ||
| grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus" | ||
| "github.com/prometheus/client_golang/prometheus" | ||
| "github.com/sigstore/fulcio/pkg/api" | ||
| "github.com/sigstore/fulcio/pkg/ca" | ||
| "github.com/sigstore/fulcio/pkg/config" | ||
| gw "github.com/sigstore/fulcio/pkg/generated/protobuf" | ||
| gw_legacy "github.com/sigstore/fulcio/pkg/generated/protobuf/legacy" | ||
| "github.com/sigstore/fulcio/pkg/log" | ||
| "github.com/spf13/viper" | ||
| "google.golang.org/grpc" | ||
| ) | ||
|
|
||
| const ( | ||
| LegacyUnixDomainSocket = "@fulcio-legacy-grpc-socket" | ||
| ) | ||
|
|
||
| type grpcServer struct { | ||
| *grpc.Server | ||
| grpcServerEndpoint string | ||
| caService gw.CAServer | ||
| } | ||
|
|
||
| func passFulcioConfigThruContext(cfg *config.FulcioConfig) grpc.UnaryServerInterceptor { | ||
| return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { | ||
| // For each request, infuse context with our snapshot of the FulcioConfig. | ||
| // TODO(mattmoor): Consider periodically (every minute?) refreshing the ConfigMap | ||
| // from disk, so that we don't need to cycle pods to pick up config updates. | ||
| // Alternately we could take advantage of Knative's configmap watcher. | ||
| ctx = config.With(ctx, cfg) | ||
| ctx, cancel := context.WithCancel(ctx) | ||
| defer cancel() | ||
|
|
||
| // Calls the inner handler | ||
| return handler(ctx, req) | ||
| } | ||
| } | ||
|
|
||
| func createGRPCServer(cfg *config.FulcioConfig, ctClient *ctclient.LogClient, baseca ca.CertificateAuthority) (*grpcServer, error) { | ||
| logger, opts := log.SetupGRPCLogging() | ||
|
|
||
| myServer := grpc.NewServer(grpc.UnaryInterceptor( | ||
| grpcmw.ChainUnaryServer( | ||
| grpc_recovery.UnaryServerInterceptor(grpc_recovery.WithRecoveryHandlerContext(panicRecoveryHandler)), // recovers from per-transaction panics elegantly, so put it first | ||
| middleware.UnaryRequestID(middleware.UseXRequestIDMetadataOption(true), middleware.XRequestMetadataLimitOption(128)), | ||
| grpc_zap.UnaryServerInterceptor(logger, opts...), | ||
| passFulcioConfigThruContext(cfg), | ||
| grpc_prometheus.UnaryServerInterceptor, | ||
| )), | ||
| grpc.MaxRecvMsgSize(int(maxMsgSize))) | ||
|
|
||
| grpcCAServer := api.NewGRPCCAServer(ctClient, baseca) | ||
| // Register your gRPC service implementations. | ||
| gw.RegisterCAServer(myServer, grpcCAServer) | ||
|
|
||
| grpcServerEndpoint := fmt.Sprintf("%s:%s", viper.GetString("grpc-host"), viper.GetString("grpc-port")) | ||
| return &grpcServer{myServer, grpcServerEndpoint, grpcCAServer}, nil | ||
| } | ||
|
|
||
| func (g *grpcServer) setupPrometheus(reg *prometheus.Registry) { | ||
| grpcMetrics := grpc_prometheus.DefaultServerMetrics | ||
| grpcMetrics.EnableHandlingTimeHistogram() | ||
| reg.MustRegister(grpcMetrics, api.MetricLatency, api.RequestsCount) | ||
| grpc_prometheus.Register(g.Server) | ||
| } | ||
|
|
||
| func (g *grpcServer) startTCPListener() { | ||
| go func() { | ||
| lis, err := net.Listen("tcp", g.grpcServerEndpoint) | ||
| if err != nil { | ||
| log.Logger.Fatal(err) | ||
| } | ||
| defer lis.Close() | ||
|
|
||
| tcpAddr := lis.Addr().(*net.TCPAddr) | ||
| g.grpcServerEndpoint = fmt.Sprintf("%v:%d", tcpAddr.IP, tcpAddr.Port) | ||
| log.Logger.Infof("listening on grpc at %s", g.grpcServerEndpoint) | ||
|
|
||
| log.Logger.Fatal(g.Server.Serve(lis)) | ||
| }() | ||
| } | ||
|
|
||
| func (g *grpcServer) startUnixListener() { | ||
| go func() { | ||
| unixAddr, err := net.ResolveUnixAddr("unix", LegacyUnixDomainSocket) | ||
| if err != nil { | ||
| log.Logger.Fatal(err) | ||
| } | ||
| lis, err := net.ListenUnix("unix", unixAddr) | ||
| if err != nil { | ||
| log.Logger.Fatal(err) | ||
| } | ||
| defer lis.Close() | ||
|
|
||
| log.Logger.Infof("listening on grpc at %s", unixAddr.String()) | ||
|
|
||
| log.Logger.Fatal(g.Server.Serve(lis)) | ||
| }() | ||
| } | ||
|
|
||
| func createLegacyGRPCServer(cfg *config.FulcioConfig, v2Server gw.CAServer) (*grpcServer, error) { | ||
| logger, opts := log.SetupGRPCLogging() | ||
|
|
||
| myServer := grpc.NewServer(grpc.UnaryInterceptor( | ||
| grpcmw.ChainUnaryServer( | ||
| grpc_recovery.UnaryServerInterceptor(grpc_recovery.WithRecoveryHandlerContext(panicRecoveryHandler)), // recovers from per-transaction panics elegantly, so put it first | ||
| middleware.UnaryRequestID(middleware.UseXRequestIDMetadataOption(true), middleware.XRequestMetadataLimitOption(128)), | ||
| grpc_zap.UnaryServerInterceptor(logger, opts...), | ||
| passFulcioConfigThruContext(cfg), | ||
| grpc_prometheus.UnaryServerInterceptor, | ||
| )), | ||
| grpc.MaxRecvMsgSize(int(maxMsgSize))) | ||
|
|
||
| legacyGRPCCAServer := api.NewLegacyGRPCCAServer(v2Server) | ||
|
|
||
| // Register your gRPC service implementations. | ||
| gw_legacy.RegisterCAServer(myServer, legacyGRPCCAServer) | ||
|
|
||
| return &grpcServer{myServer, LegacyUnixDomainSocket, v2Server}, nil | ||
| } | ||
|
|
||
| func panicRecoveryHandler(ctx context.Context, p interface{}) error { | ||
| log.ContextLogger(ctx).Error(p) | ||
| return fmt.Errorf("panic: %v", p) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| // Copyright 2022 The Sigstore Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
|
|
||
| package app | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
| "strconv" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/grpc-ecosystem/grpc-gateway/v2/runtime" | ||
| "github.com/pkg/errors" | ||
| "github.com/prometheus/client_golang/prometheus/promhttp" | ||
| "github.com/sigstore/fulcio/pkg/api" | ||
| gw "github.com/sigstore/fulcio/pkg/generated/protobuf" | ||
| legacy_gw "github.com/sigstore/fulcio/pkg/generated/protobuf/legacy" | ||
| "github.com/sigstore/fulcio/pkg/log" | ||
| "google.golang.org/grpc" | ||
| "google.golang.org/grpc/credentials/insecure" | ||
| "google.golang.org/grpc/metadata" | ||
| "google.golang.org/protobuf/proto" | ||
| ) | ||
|
|
||
| type httpServer struct { | ||
| *http.Server | ||
| httpServerEndpoint string | ||
| } | ||
|
|
||
| func extractOIDCTokenFromAuthHeader(ctx context.Context, req *http.Request) metadata.MD { | ||
| token := strings.Replace(req.Header.Get("Authorization"), "Bearer ", "", 1) | ||
| return metadata.Pairs(api.MetadataOIDCTokenKey, token) | ||
| } | ||
|
|
||
| func createHTTPServer(ctx context.Context, serverEndpoint string, grpcServer, legacyGRPCServer *grpcServer) httpServer { | ||
| mux := runtime.NewServeMux(runtime.WithMetadata(extractOIDCTokenFromAuthHeader), | ||
| runtime.WithForwardResponseOption(setResponseCodeModifier)) | ||
|
|
||
| opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())} | ||
| if err := gw.RegisterCAHandlerFromEndpoint(ctx, mux, grpcServer.grpcServerEndpoint, opts); err != nil { | ||
| log.Logger.Fatal(err) | ||
| } | ||
|
|
||
| if legacyGRPCServer != nil { | ||
| endpoint := fmt.Sprintf("unix:%v", legacyGRPCServer.grpcServerEndpoint) | ||
| if err := legacy_gw.RegisterCAHandlerFromEndpoint(ctx, mux, endpoint, opts); err != nil { | ||
| log.Logger.Fatal(err) | ||
| } | ||
| } | ||
|
|
||
| // Limit request size | ||
| handler := api.WithMaxBytes(mux, maxMsgSize) | ||
| handler = promhttp.InstrumentHandlerDuration(api.MetricLatency, handler) | ||
| handler = promhttp.InstrumentHandlerCounter(api.RequestsCount, handler) | ||
|
|
||
| api := http.Server{ | ||
| Addr: serverEndpoint, | ||
| Handler: handler, | ||
|
|
||
| // Timeouts | ||
| ReadTimeout: 60 * time.Second, | ||
| ReadHeaderTimeout: 60 * time.Second, | ||
| WriteTimeout: 60 * time.Second, | ||
| IdleTimeout: 60 * time.Second, | ||
| } | ||
| return httpServer{&api, serverEndpoint} | ||
| } | ||
|
|
||
| func (h httpServer) startListener() { | ||
| log.Logger.Infof("listening on http at %s", h.httpServerEndpoint) | ||
| go func() { | ||
| if err := h.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) { | ||
| log.Logger.Fatal(err) | ||
| } | ||
| }() | ||
| } | ||
|
|
||
| func setResponseCodeModifier(ctx context.Context, w http.ResponseWriter, _ proto.Message) error { | ||
| md, ok := runtime.ServerMetadataFromContext(ctx) | ||
| if !ok { | ||
| return nil | ||
| } | ||
|
|
||
| // set SCT if present ahead of modifying response code | ||
| if vals := md.HeaderMD.Get(api.SCTMetadataKey); len(vals) > 0 { | ||
| delete(md.HeaderMD, api.SCTMetadataKey) | ||
| delete(w.Header(), "Grpc-Metadata-sct") | ||
| w.Header().Set("SCT", vals[0]) | ||
| } | ||
|
|
||
| // set http status code | ||
| if vals := md.HeaderMD.Get(api.HTTPResponseCodeMetadataKey); len(vals) > 0 { | ||
| code, err := strconv.Atoi(vals[0]) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| // delete the headers to not expose any grpc-metadata in http response | ||
| delete(md.HeaderMD, api.HTTPResponseCodeMetadataKey) | ||
| delete(w.Header(), "Grpc-Metadata-X-Http-Code") | ||
| w.WriteHeader(code) | ||
| } | ||
|
|
||
| return nil | ||
| } |
Oops, something went wrong.