Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HPCC-30131 Cloud: Support HPCC Remote Trust via shared cert authority #17690

Closed
wants to merge 2 commits into from
Closed

HPCC-30131 Cloud: Support HPCC Remote Trust via shared cert authority #17690

wants to merge 2 commits into from

Conversation

afishbeck
Copy link
Member

@afishbeck afishbeck commented Aug 21, 2023 •
edited
Loading

Type of change:

  • This change is a bug fix (non-breaking change which fixes an issue).
  • This change is a new feature (non-breaking change which adds functionality).
  • This change improves the code (refactor or other change that does not change the functionality)
  • This change fixes warnings (the fix does not alter the functionality or the generated code)
  • This change is a breaking change (fix or feature that will cause existing behavior to change).
  • This change alters the query API (existing queries will have to be recompiled)

Checklist:

  • My code follows the code style of this project.
    • My code does not create any new warnings from compiler, build system, or lint.
  • The commit message is properly formatted and free of typos.
    • The commit message title makes sense in a changelog, by itself.
    • The commit is signed.
  • My change requires a change to the documentation.
    • I have updated the documentation accordingly, or...
    • I have created a JIRA ticket to update the documentation.
    • Any new interfaces or exported functions are appropriately commented.
  • I have read the CONTRIBUTORS document.
  • The change has been fully tested:
    • I have added tests to cover my changes.
    • All new and existing tests passed.
    • I have checked that this change does not introduce memory leaks.
    • I have used Valgrind or similar tools to check for potential issues.
  • I have given due consideration to all of the following potential concerns:
    • Scalability
    • Performance
    • Security
    • Thread-safety
    • Cloud-compatibility
    • Premature optimization
    • Existing deployed queries will not be broken
    • This change fixes the problem, not just the symptom
    • The target branch of this pull request is appropriate for such a change.
  • There are no similar instances of the same problem that should be addressed
    • I have addressed them here
    • I have raised JIRA issues to address them separately
  • This is a user interface / front-end modification
    • I have tested my changes in multiple modern browsers
    • The component(s) render as expected

Smoketest:

  • Send notifications about my Pull Request position in Smoketest queue.
  • Test my draft Pull Request.

Testing:

@github-actions
Copy link

https://track.hpccsystems.com/browse/HPCC-30131
Jira updated

@afishbeck
Copy link
Member Author

@ghalliday this is the PR for the new model for establishing trust between two HPCC cloud environments. A draft for the moment. Will try and get Milind or Godji to test.

@afishbeck
Copy link
Member Author

afishbeck commented Aug 21, 2023 •
edited
Loading

Note that to make a SOAPCALL/HTTPCALL from one environment to another (when they have trust set up the new way), the URL would look something like this:

"remote-mtls:https://roxie1.abcprod.example.com:9876"

Which means "use the remote trust client certificates to establish an https connection to the roxie in abcprod at the domain example.com".

Similarly combining remote trust with a connection secret:

"remote-mtls:secret:abc_prod_connect"

@ghalliday

@ghalliday ghalliday self-requested a review September 5, 2023 14:15
ghalliday
ghalliday reviewed Sep 7, 2023
View reviewed changes
Copy link
Member

@ghalliday ghalliday left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@afishbeck I didn't see any obvious flaws. I am not sure I have enough knowledge to catch. Is this ready to become a full PR?

system/jlib/jsmartsock.ipp Outdated
@@ -104,6 +105,7 @@ public:
virtual StringBuffer & getUrlStr(StringBuffer &str, bool useHostName);
virtual bool isTlsService() const override { return tlsService; }
virtual const IPropertyTree *queryTlsConfig() const { return tlsConfig; };
const char *queryTlsIssuer(){return issuer.str();}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

trivial: could be const and missing spaces compared with above and normal.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated.

system/security/securesocket/securesocket.cpp
@@ -1868,6 +1868,7 @@ SECURESOCKET_API ISecureSocketContext* createSecureSocketContextEx2(const IPrope
if (config == NULL)
return createSecureSocketContext(sockettype);

dbglogXML(config);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Debugging left in?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oops.

system/jlib/jsecrets.cpp Outdated
verify->setPropBool("@address_match", false);
verify->setPropBool("@accept_selfsigned", false);
verify->setProp("trusted_peers", "anyone");
}
return info;
}

IPropertyTree *getIssuerTlsServerConfigWithTrustedPeers(const char *issuer, const char *trusted_peers)
{
IPropertyTree *issuerConfig = queryIssuerTlsServerConfig(issuer);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If items are ever evicted from the mtlsInfoCache then this would cause problems because it may not be valid any longer.

Copy link
Member Author

@afishbeck afishbeck Sep 20, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. Changed to getIssuerTlsServerConfig() to return a linked instance.

@afishbeck
review update 1
5c38c21 
Signed-off-by: Anthony Fishbeck <[email protected]>
@afishbeck afishbeck changed the base branch from master to candidate-9.4.x September 20, 2023 20:11
@afishbeck afishbeck closed this Sep 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ghalliday ghalliday ghalliday left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@afishbeck @ghalliday