Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(cdc): Add superflag to enable TLS without CA or certs. (#7946) #8097

Merged
merged 2 commits into from
Nov 30, 2021
Merged

feat(cdc): Add superflag to enable TLS without CA or certs. (#7946) #8097

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad003a5
feat(cdc): Add superflag to enable TLS without CA or certs. (#7946)
danielmai Aug 13, 2021
dbdc9ec
Add trailing semi-colon.
danielmai Nov 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion worker/server_state.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ const (
BadgerDefaults = `compression=snappy; numgoroutines=8;`
CacheDefaults = `size-mb=1024; percentage=50,30,20;`
CDCDefaults = `file=; kafka=; sasl_user=; sasl_password=; ca_cert=; client_cert=; ` +
`client_key=; sasl-mechanism=PLAIN;`
`client_key=; sasl-mechanism=PLAIN; tls=false`
GraphQLDefaults = `introspection=true; debug=false; extensions=true; poll-interval=1s; `
LambdaDefaults = `url=; num=1; port=20000; restart-after=30s; `
LimitDefaults = `mutations=allow; query-edge=1000000; normalize-node=10000; ` +
Expand Down
14 changes: 12 additions & 2 deletions worker/sink_handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,18 @@ func newKafkaSink(config *z.SuperFlag) (Sink, error) {
saramaConf.Producer.Return.Successes = true
saramaConf.Producer.Return.Errors = true

if config.GetPath("ca-cert") != "" {
tlsCfg := &tls.Config{}
if config.GetBool("tls") && config.GetPath("ca-cert") == "" {
tlsCfg := x.TLSBaseConfig()
var pool *x509.CertPool
var err error
if pool, err = x509.SystemCertPool(); err != nil {
return nil, err
}
tlsCfg.RootCAs = pool
saramaConf.Net.TLS.Enable = true
saramaConf.Net.TLS.Config = tlsCfg
} else if config.GetPath("ca-cert") != "" {
tlsCfg := x.TLSBaseConfig()
var pool *x509.CertPool
var err error
if pool, err = x509.SystemCertPool(); err != nil {
Expand Down
42 changes: 24 additions & 18 deletions x/tls_helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,11 +263,34 @@ func setupClientAuth(authType string) (tls.ClientAuthType, error) {
return tls.NoClientCert, nil
}

// TLSBaseConfig returns a *tls.Config with the base set of security
// requirements (minimum TLS v1.2 and set of cipher suites)
func TLSBaseConfig() *tls.Config {
tlsCfg := new(tls.Config)
tlsCfg.MinVersion = tls.VersionTLS12
tlsCfg.CipherSuites = []uint16{
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
}
return tlsCfg
}

// GenerateServerTLSConfig creates and returns a new *tls.Config with the
// configuration provided.
func GenerateServerTLSConfig(config *TLSHelperConfig) (tlsCfg *tls.Config, err error) {
if config.CertRequired {
tlsCfg = new(tls.Config)
tlsCfg = TLSBaseConfig()
cert, err := tls.LoadX509KeyPair(config.Cert, config.Key)
if err != nil {
return nil, err
Expand All @@ -286,23 +309,6 @@ func GenerateServerTLSConfig(config *TLSHelperConfig) (tlsCfg *tls.Config, err e
}
tlsCfg.ClientAuth = auth

tlsCfg.MinVersion = tls.VersionTLS12
tlsCfg.CipherSuites = []uint16{
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
}

return tlsCfg, nil
}
return nil, nil
Expand Down