Skip to content

Commit 7e0baaf

Browse files
everesioeveresio
committed
Refactor certfile location
1 parent 6afb0d6 commit 7e0baaf

File tree

31 files changed

+894
-161
lines changed

31 files changed

+894
-161
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
- name: Setup go
1313
uses: actions/setup-go@v3
1414
with:
15-
go-version: 1.18
15+
go-version: 1.19
1616
- name: Run build
1717
run: make clean build
1818
- name: Run test

‎.github/workflows/release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
- name: Setup go
2020
uses: actions/setup-go@v3
2121
with:
22-
go-version: 1.18
22+
go-version: 1.19
2323
- name: Run build
2424
run: make clean build
2525
- name: Run test

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
## Changelog

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.18-alpine3.16 as builder
1+
FROM golang:1.19-alpine3.16 as builder
22

33
RUN apk add alpine-sdk ca-certificates
44

‎Earthfile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
VERSION 0.6
2+
FROM golang:1.19-alpine3.16
3+
WORKDIR "/code"
4+
RUN apk add alpine-sdk ca-certificates
5+
ARG BUILD_FLAGS='-tags musl'
6+
7+
tidy:
8+
LOCALLY
9+
RUN go mod tidy
10+
11+
fmt:
12+
LOCALLY
13+
RUN go fmt ./...
14+
15+
build:
16+
FROM +sources
17+
RUN make BINARY=mqtt-proxy BUILD_FLAGS="${BUILD_FLAGS}" GOOS=linux GOARCH=amd64 build
18+
19+
test:
20+
FROM +sources
21+
RUN go test -mod=vendor ${BUILD_FLAGS} -v ./...
22+
23+
sources:
24+
COPY . /code

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
.PHONY: clean build fmt test
44

5-
TAG ?= v0.0.2
5+
TAG ?= v0.1.0
66

77
BUILD_FLAGS ?=
88
BINARY ?= mqtt-proxy
@@ -47,7 +47,7 @@ lint: ## Lint
4747
golint $$(go list ./...) 2>&1
4848

4949
test: ## Test
50-
GO111MODULE=on go test -mod=vendor -v ./...
50+
GO111MODULE=on go test -mod=vendor $(BUILD_FLAGS) -v ./...
5151

5252
build: vet ## Build executable
5353
CGO_ENABLED=1 GO111MODULE=on go build -mod=vendor -o $(BINARY) $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" .

‎README.md‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,10 @@ MQTT Proxy allows MQTT clients to send messages to other messaging systems
2424
* [x] Plain
2525
* [ ] Others
2626
* [x] Helm chart
27+
* [x] Client certificate revocation list
2728
* [ ] Server certificate rotation
28-
* [ ] Self sign / intermediate certificates
29-
* [ ] Let's Encrypt certificates
30-
* [ ] HashiCorp Vault certificates
31-
* [ ] K8S cert-manager
29+
* [x] Files certificate source
30+
* [ ] HashiCorp Vault certificate source
3231

3332

3433
### Install binary release

‎cmd/server.go‎

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package cmd
22

33
import (
4+
"crypto/tls"
45
"github.com/grepplabs/mqtt-proxy/apis"
56
authinst "github.com/grepplabs/mqtt-proxy/pkg/auth/instrument"
67
authnoop "github.com/grepplabs/mqtt-proxy/pkg/auth/noop"
@@ -14,7 +15,9 @@ import (
1415
pubnoop "github.com/grepplabs/mqtt-proxy/pkg/publisher/noop"
1516
httpserver "github.com/grepplabs/mqtt-proxy/pkg/server/http"
1617
mqttserver "github.com/grepplabs/mqtt-proxy/pkg/server/mqtt"
17-
"github.com/grepplabs/mqtt-proxy/pkg/tls"
18+
servertls "github.com/grepplabs/mqtt-proxy/pkg/tls"
19+
"github.com/grepplabs/mqtt-proxy/pkg/tls/cert/filesource"
20+
tlscert "github.com/grepplabs/mqtt-proxy/pkg/tls/cert/source"
1821
"github.com/oklog/run"
1922
"github.com/pkg/errors"
2023
"github.com/prometheus/client_golang/prometheus"
@@ -42,9 +45,14 @@ func registerServer(m map[string]setupFunc, app *kingpin.Application) {
4245
cmd.Flag("mqtt.reader-buffer-size", "Read buffer size pro tcp connection.").Default("1024").IntVar(&cfg.MQTT.ReaderBufferSize)
4346
cmd.Flag("mqtt.writer-buffer-size", "Write buffer size pro tcp connection.").Default("1024").IntVar(&cfg.MQTT.WriterBufferSize)
4447

45-
cmd.Flag("mqtt.server-tls-cert", "TLS Certificate for MQTT server, leave blank to disable TLS").Default("").StringVar(&cfg.MQTT.TLSSrv.Cert)
46-
cmd.Flag("mqtt.server-tls-key", "TLS Key for the MQTT server, leave blank to disable TLS").Default("").StringVar(&cfg.MQTT.TLSSrv.Key)
47-
cmd.Flag("mqtt.server-tls-client-ca", "TLS CA to verify clients against. If no client CA is specified, there is no client verification on server side. (tls.NoClientCert)").Default("").StringVar(&cfg.MQTT.TLSSrv.ClientCA)
48+
cmd.Flag("mqtt.server-tls.enable", "Enable server side TLS").Default("false").BoolVar(&cfg.MQTT.TLSSrv.Enable)
49+
cmd.Flag("mqtt.server-tls.cert-source", "TLS certificate source").Default(config.CertSourceFile).EnumVar(&cfg.MQTT.TLSSrv.CertSource, config.CertSourceFile)
50+
cmd.Flag("mqtt.server-tls.refresh", "Option to specify the refresh interval for the TLS certificates.").Default("0s").DurationVar(&cfg.MQTT.TLSSrv.Refresh)
51+
52+
cmd.Flag("mqtt.server-tls.file.cert", "TLS Certificate for MQTT server, leave blank to disable TLS").Default("").StringVar(&cfg.MQTT.TLSSrv.File.Cert)
53+
cmd.Flag("mqtt.server-tls.file.key", "TLS Key for the MQTT server, leave blank to disable TLS").Default("").StringVar(&cfg.MQTT.TLSSrv.File.Key)
54+
cmd.Flag("mqtt.server-tls.file.client-ca", "TLS CA to verify clients against. If no client CA is specified, there is no client verification on server side.").Default("").StringVar(&cfg.MQTT.TLSSrv.File.ClientCA)
55+
cmd.Flag("mqtt.server-tls.file.client-clr", "TLS X509 CLR signed be the client CA. If no revocation list is specified, only client CA is verified").Default("").StringVar(&cfg.MQTT.TLSSrv.File.ClientCLR)
4856

4957
cmd.Flag("mqtt.handler.ignore-unsupported", "List of unsupported messages which are ignored. One of: [SUBSCRIBE, UNSUBSCRIBE]").PlaceHolder("MSG").EnumsVar(&cfg.MQTT.Handler.IgnoreUnsupported, "SUBSCRIBE", "UNSUBSCRIBE")
5058
cmd.Flag("mqtt.handler.allow-unauthenticated", "List of messages for which connection is not disconnected if unauthenticated request is received. One of: [PUBLISH, PUBREL, PINGREQ]").PlaceHolder("MSG").EnumsVar(&cfg.MQTT.Handler.AllowUnauthenticated, "PUBLISH", "PUBREL", "PINGREQ")
@@ -162,9 +170,32 @@ func runServer(
162170
{
163171
logger.Infof("setting up MQTT server")
164172

165-
tlsCfg, err := tls.NewServerConfig(logger, cfg.MQTT.TLSSrv.Cert, cfg.MQTT.TLSSrv.Key, cfg.MQTT.TLSSrv.ClientCA)
166-
if err != nil {
167-
return errors.Wrap(err, "setup MQTT server")
173+
var tlsConfig *tls.Config
174+
if cfg.MQTT.TLSSrv.Enable {
175+
logger.Infof("enabling server side TLS")
176+
var (
177+
source tlscert.ServerSource
178+
err error
179+
)
180+
switch cfg.MQTT.TLSSrv.CertSource {
181+
case config.CertSourceFile:
182+
source, err = filesource.New(
183+
filesource.WithLogger(logger),
184+
filesource.WithX509KeyPair(cfg.MQTT.TLSSrv.File.Cert, cfg.MQTT.TLSSrv.File.Key),
185+
filesource.WithClientAuthFile(cfg.MQTT.TLSSrv.File.ClientCA),
186+
filesource.WithClientCRLFile(cfg.MQTT.TLSSrv.File.ClientCLR),
187+
filesource.WithRefresh(cfg.MQTT.TLSSrv.Refresh),
188+
)
189+
if err != nil {
190+
return errors.Wrap(err, "setup cert file source")
191+
}
192+
default:
193+
return errors.Errorf("unknown cert source %s", cfg.MQTT.TLSSrv.CertSource)
194+
}
195+
tlsConfig, err = servertls.NewServerConfig(logger, source)
196+
if err != nil {
197+
return errors.Wrap(err, "setup server TLS config")
198+
}
168199
}
169200

170201
handler := mqtthandler.New(logger, registry, publisher,
@@ -186,7 +217,7 @@ func runServer(
186217
mqttserver.WithReaderBufferSize(cfg.MQTT.ReaderBufferSize),
187218
mqttserver.WithWriterBufferSize(cfg.MQTT.WriterBufferSize),
188219
mqttserver.WithHandler(handler),
189-
mqttserver.WithTLSConfig(tlsCfg),
220+
mqttserver.WithTLSConfig(tlsConfig),
190221
)
191222

192223
_ = promauto.With(registry).NewGaugeFunc(prometheus.GaugeOpts{

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/grepplabs/mqtt-proxy
22

3-
go 1.18
3+
go 1.19
44

55
require (
66
github.com/confluentinc/confluent-kafka-go v1.9.2

‎pkg/config/config.go‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ const (
2222
AuthPlain = "plain"
2323
)
2424

25+
// server certificate source
26+
const (
27+
CertSourceFile = "file"
28+
)
29+
2530
type Server struct {
2631
HTTP struct {
2732
ListenAddress string
@@ -36,9 +41,15 @@ type Server struct {
3641
ReaderBufferSize int
3742
WriterBufferSize int
3843
TLSSrv struct {
39-
Cert string
40-
Key string
41-
ClientCA string
44+
Enable bool
45+
CertSource string
46+
Refresh time.Duration
47+
File struct {
48+
Cert string
49+
Key string
50+
ClientCA string
51+
ClientCLR string
52+
}
4253
}
4354
Handler struct {
4455
IgnoreUnsupported []string

0 commit comments

Comments
 (0)