Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Eureka Registration when ATTLS (v2) #581

Open
wants to merge 3 commits into
base: v2.x/staging
Choose a base branch
from
Open

Fix Eureka Registration when ATTLS (v2) #581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
75b0dcb
Update apiml.js for attls
1000TurquoisePogs Dec 20, 2024
de26485
Update CHANGELOG.md
1000TurquoisePogs Dec 20, 2024
183bfcf
Update apiml.js
1000TurquoisePogs Dec 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
All notable changes to the Zlux Server Framework package will be documented in this file..
This repo is part of the app-server Zowe Component, and the change logs here may appear on Zowe.org in that section.

## 2.18.1
- Bugfix: App-server could not register with discovery server when AT-TLS was enabled for app-server. (#581)

## 2.17.0
- Enhancement: Added function `isClientAttls(zoweConfig)` within `libs/util.js`. Whenever a plugin makes a network request, it should always use this to determine if a normally HTTPS request should instead be made as HTTP due to AT-TLS handling the TLS when enabled. (#544)
- Bugfix: Fixed function `isServerAttls(zoweConfig)` within `libs/util.js`, which was preventing using AT-TLS with app-server. (#544)
Expand Down
21 changes: 13 additions & 8 deletions lib/apiml.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,9 +171,8 @@ ApimlConnector.prototype = {
httpEnabled: false,
httpsEnabled: true
};
const proto = 'https';

log.debug("ZWED0141I", proto, this.port); //"Protocol:", proto, "Port", port);
log.debug("ZWED0141I", 'https', this.port); //"Protocol:", proto, "Port", port);
log.debug("ZWED0142I", JSON.stringify(protocolObject)); //"Protocol Object:", JSON.stringify(protocolObject));

const instance = Object.assign({}, MEDIATION_LAYER_INSTANCE_DEFAULTS(proto, this.hostName, this.port));
Expand All @@ -183,9 +182,9 @@ ApimlConnector.prototype = {
hostName: this.hostName,
ipAddr: this.ipAddr,
vipAddress: "zlux",//this.vipAddress,
statusPageUrl: `${proto}://${this.hostName}:${this.port}/server/eureka/info`,
healthCheckUrl: `${proto}://${this.hostName}:${this.port}/server/eureka/health`,
homePageUrl: `${proto}://${this.hostName}:${this.port}/`,
statusPageUrl: `https://${this.hostName}:${this.port}/server/eureka/info`,
healthCheckUrl: `https://${this.hostName}:${this.port}/server/eureka/health`,
homePageUrl: `https://${this.hostName}:${this.port}/`,
port: {
"$": protocolObject.httpPort, // This is a workaround for the mediation layer
"@enabled": ''+protocolObject.httpEnabled
Expand Down Expand Up @@ -228,7 +227,7 @@ ApimlConnector.prototype = {
},*/

registerMainServerInstance() {
const overrideOptions = Object.assign({},this.tlsOptions);
const overrideOptions = this.isClientAttls ? {} : Object.assign({},this.tlsOptions)
if (!this.tlsOptions.rejectUnauthorized) {
//Keeping these certs causes an openssl error 46, unknown cert error in a dev environment
delete overrideOptions.cert;
Expand All @@ -240,7 +239,8 @@ ApimlConnector.prototype = {
eureka: Object.assign({}, MEDIATION_LAYER_EUREKA_DEFAULTS, this.eurekaOverrides),
requestMiddleware: function (requestOpts, done) {
done(Object.assign(requestOpts, overrideOptions));
}
},
ssl: !this.isClientAttls
}
log.debug("ZWED0144I", JSON.stringify(zluxProxyServerInstanceConfig, null, 2)); //log.debug("zluxProxyServerInstanceConfig: "
//+ JSON.stringify(zluxProxyServerInstanceConfig, null, 2))
Expand Down Expand Up @@ -280,7 +280,12 @@ ApimlConnector.prototype = {
},

getServiceUrls() {
return this.discoveryUrls.map(url => url + (url.endsWith('/') ? '' : '/') + 'apps');
let urls = this.discoveryUrls.map(url => url + (url.endsWith('/') ? '' : '/') + 'apps');
if (this.isClientAttls) {
return urls.map(url => url.replaceAll('https', 'http'));
} else {
return urls;
}
},

getRequestOptionsArray(method, path) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Sean, great to see that, yes i've come up to the same results, that app server is still trying to use https to contact Eureka in at-tls, was hoping to address that with different pagent rules, wouldn't be correct at-tls i just wanted to find a workaround.
Anyway, i'll be able to test this PR only after holidays, but there a few things that are pop up in my head from previous tests:
The function below (getRequestOptionsArray) uses hardcoded 8 characters to slice for "https://" and so it will cut one char from host name in case of "http://"
Also a minor schema thing, we allow using custom URL for discoveryUrls in zowe.yaml
app-server.node.mediationLayer.server.discoveryUrls
However schema will expect https there and will break if we use http url there.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

discoveryUrls comes from the discovery env var unless from this override of app-server.node.mediationLayer.server.discoveryUrls
in that env var, it's always "https://"
getServiceUrls() is now returning URLs that could be https or http.
But getRequestOptionsArray() isnt transforming the input, it's just extracting host & port. So I think it's okay that it's hardcoded to https:// still.
I also think app-server.node.mediationLayer.server.discoveryUrls should never have "http", it should always be "https".

The code could be improved to guarantee these things?

Expand Down
Loading