Skip to content

Add client-side TLS options support to Consul peer discovery #5155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Parent: SI binary prefix fix (ki => Ki)
merged 4 commits into from
Jul 6, 2022
Merged

Add client-side TLS options support to Consul peer discovery #5155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
18b1c88
Add TLS options to Consul peer discovery schema
michaelklishin Jul 4, 2022
b77d863
Peer discovery HTTP client: more override that accept HTTP options
michaelklishin Jul 5, 2022
f70ea8e
Pass on TLS options to httpc options
michaelklishin Jul 5, 2022
a4f8621
Consul peer discovery: pass TLS options to httpc in one more place
michaelklishin Jul 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 50 additions & 5 deletions deps/rabbitmq_peer_discovery_common/src/rabbit_peer_discovery_httpc.erl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,14 @@
build_uri/5,
build_path/1,
delete/6,
delete/7,
get/5,
get/7,
post/6,
post/8,
put/6,
put/7,
put/8,
maybe_configure_proxy/0,
maybe_configure_inet6/0]).

Expand Down Expand Up @@ -234,14 +236,38 @@ put(Scheme, Host, Port, Path, Args, Body) ->
Headers :: list(),
Body :: string() | binary() | tuple().
put(Scheme, Host, Port, Path, Args, Headers, Body) ->
put(Scheme, Host, Port, Path, Args, Headers, [], Body).

%% @spec put(Scheme, Host, Port, Path, Args, Headers, HttpOptions, Body) -> Result
%% @where Scheme = string(),
%% Host = string(),
%% Port = integer(),
%% Path = string(),
%% Args = proplist(),
%% Headers = proplist(),
%% HttpOpts = proplist(),
%% Body = string(),
%% Result = {ok, mixed}|{error, Reason::string()}
%% @doc Perform a HTTP PUT request
%% @end
%%
-spec put(Scheme, Host, Port, Path, Args, Headers, HttpOpts, Body) -> {ok, string()} | {error, any()} when
Scheme :: atom() | string(),
Host :: string() | binary(),
Port :: integer(),
Path :: string() | binary(),
Args :: list(),
Headers :: list(),
HttpOpts :: list(),
Body :: string() | binary() | tuple().
put(Scheme, Host, Port, Path, Args, Headers, HttpOpts, Body) ->
URL = build_uri(Scheme, Host, Port, Path, Args),
?LOG_DEBUG("PUT ~s [~p] [~p]", [URL, Headers, Body], #{domain => ?RMQLOG_DOMAIN_PEER_DIS}),
HttpOpts = ensure_timeout(),
Response = httpc:request(put, {URL, Headers, ?CONTENT_URLENCODED, Body}, HttpOpts, []),
HttpOpts1 = ensure_timeout(HttpOpts),
Response = httpc:request(put, {URL, Headers, ?CONTENT_URLENCODED, Body}, HttpOpts1, []),
?LOG_DEBUG("Response: [~p]", [Response], #{domain => ?RMQLOG_DOMAIN_PEER_DIS}),
parse_response(Response).


%% @public
%% @spec delete(Scheme, Host, Port, Path, Args, Body) -> Result
%% @where Scheme = string(),
Expand All @@ -258,10 +284,29 @@ delete(Scheme, Host, Port, PathSegments, Args, Body) when is_list(PathSegments)
Path = uri_string:recompose(#{path => lists:join("/", [rabbit_data_coercion:to_list(PS) || PS <- PathSegments])}),
delete(Scheme, Host, Port, Path, Args, Body);
delete(Scheme, Host, Port, Path, Args, Body) ->
delete(Scheme, Host, Port, Path, Args, [], Body).

%% @public
%% @spec delete(Scheme, Host, Port, Path, Args, Body) -> Result
%% @where Scheme = string(),
%% Host = string(),
%% Port = integer(),
%% Path = string(),
%% Args = proplist(),
%% HttpOpts = proplist(),
%% Body = string(),
%% Result = {ok, mixed}|{error, Reason::string()}
%% @doc Perform a HTTP DELETE request
%% @end
%%
delete(Scheme, Host, Port, PathSegments, Args, HttpOpts, Body) when is_list(PathSegments) ->
Path = uri_string:recompose(#{path => lists:join("/", [rabbit_data_coercion:to_list(PS) || PS <- PathSegments])}),
delete(Scheme, Host, Port, Path, Args, HttpOpts, Body);
delete(Scheme, Host, Port, Path, Args, HttpOpts, Body) ->
URL = build_uri(Scheme, Host, Port, Path, Args),
?LOG_DEBUG("DELETE ~s [~p]", [URL, Body], #{domain => ?RMQLOG_DOMAIN_PEER_DIS}),
HttpOpts = ensure_timeout(),
Response = httpc:request(delete, {URL, [], ?CONTENT_URLENCODED, Body}, HttpOpts, []),
HttpOpts1 = ensure_timeout(HttpOpts),
Response = httpc:request(delete, {URL, [], ?CONTENT_URLENCODED, Body}, HttpOpts1, []),
?LOG_DEBUG("Response: [~p]", [Response], #{domain => ?RMQLOG_DOMAIN_PEER_DIS}),
parse_response(Response).

Expand Down
116 changes: 116 additions & 0 deletions deps/rabbitmq_peer_discovery_consul/priv/schema/rabbitmq_peer_discovery_consul.schema
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,3 +322,119 @@ fun(Conf) ->
Value -> Value
end
end}.


%%
%% TLS client options
%%

{mapping, "cluster_formation.consul.ssl_options", "rabbit.cluster_formation.peer_discovery_consul.ssl_options", [
{datatype, {enum, [none]}}
]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options",
fun(Conf) ->
case cuttlefish:conf_get("cluster_formation.consul.ssl_options", Conf, undefined) of
none -> [];
_ -> cuttlefish:invalid("Invalid cluster_formation.consul.ssl_options")
end
end}.

{mapping, "cluster_formation.consul.ssl_options.verify", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.verify", [
{datatype, {enum, [verify_peer, verify_none]}}]}.

{mapping, "cluster_formation.consul.ssl_options.fail_if_no_peer_cert", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.fail_if_no_peer_cert", [
{datatype, {enum, [true, false]}}]}.

{mapping, "cluster_formation.consul.ssl_options.cacertfile", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.cacertfile",
[{datatype, string}, {validators, ["file_accessible"]}]}.

{mapping, "cluster_formation.consul.ssl_options.certfile", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.certfile",
[{datatype, string}, {validators, ["file_accessible"]}]}.

{mapping, "cluster_formation.consul.ssl_options.cacerts.$name", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.cacerts",
[{datatype, string}]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options.cacerts",
fun(Conf) ->
Settings = cuttlefish_variable:filter_by_prefix("cluster_formation.consul.ssl_options.cacerts", Conf),
[ list_to_binary(V) || {_, V} <- Settings ]
end}.

{mapping, "cluster_formation.consul.ssl_options.cert", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.cert",
[{datatype, string}]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options.cert",
fun(Conf) ->
list_to_binary(cuttlefish:conf_get("cluster_formation.consul.ssl_options.cert", Conf))
end}.

{mapping, "cluster_formation.consul.ssl_options.crl_check", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.crl_check",
[{datatype, [{enum, [true, false, peer, best_effort]}]}]}.

{mapping, "cluster_formation.consul.ssl_options.depth", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.depth",
[{datatype, integer}, {validators, ["byte"]}]}.

{mapping, "cluster_formation.consul.ssl_options.dh", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.dh",
[{datatype, string}]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options.dh",
fun(Conf) ->
list_to_binary(cuttlefish:conf_get("cluster_formation.consul.ssl_options.dh", Conf))
end}.

{mapping, "cluster_formation.consul.ssl_options.dhfile", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.dhfile",
[{datatype, string}, {validators, ["file_accessible"]}]}.

{mapping, "cluster_formation.consul.ssl_options.key.RSAPrivateKey", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.key",
[{datatype, string}]}.

{mapping, "cluster_formation.consul.ssl_options.key.DSAPrivateKey", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.key",
[{datatype, string}]}.

{mapping, "cluster_formation.consul.ssl_options.key.PrivateKeyInfo", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.key",
[{datatype, string}]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options.key",
fun(Conf) ->
case cuttlefish_variable:filter_by_prefix("cluster_formation.consul.ssl_options.key", Conf) of
[{[_,_,Key], Val}|_] -> {list_to_atom(Key), list_to_binary(Val)};
_ -> undefined
end
end}.

{mapping, "cluster_formation.consul.ssl_options.keyfile", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.keyfile",
[{datatype, string}, {validators, ["file_accessible"]}]}.

{mapping, "cluster_formation.consul.ssl_options.log_alert", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.log_alert",
[{datatype, {enum, [true, false]}}]}.

{mapping, "cluster_formation.consul.ssl_options.password", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.password",
[{datatype, string}]}.

{mapping, "cluster_formation.consul.ssl_options.psk_identity", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.psk_identity",
[{datatype, string}]}.

{mapping, "cluster_formation.consul.ssl_options.reuse_sessions", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.reuse_sessions",
[{datatype, {enum, [true, false]}}]}.

{mapping, "cluster_formation.consul.ssl_options.secure_renegotiate", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.secure_renegotiate",
[{datatype, {enum, [true, false]}}]}.

{mapping, "cluster_formation.consul.ssl_options.versions.$version", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.versions",
[{datatype, atom}]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options.versions",
fun(Conf) ->
Settings = cuttlefish_variable:filter_by_prefix("cluster_formation.consul.ssl_options.versions", Conf),
[V || {_, V} <- Settings]
end}.

{mapping, "cluster_formation.consul.ssl_options.ciphers.$cipher", "rabbit.cluster_formation.peer_discovery_consul.ssl_options.ciphers",
[{datatype, string}]}.

{translation, "rabbit.cluster_formation.peer_discovery_consul.ssl_options.ciphers",
fun(Conf) ->
Settings = cuttlefish_variable:filter_by_prefix("cluster_formation.consul.ssl_options.ciphers", Conf),
lists:reverse([V || {_, V} <- Settings])
end}.
Loading