Allow proxy agent to connect to non local server.

Added configuration for where the proxy server is.
Also improvend cert related errors for easier debug.

Author: cheftako

Makefile

@@ -63,8 +63,10 @@ cfssljson:
 	chmod +x cfssljson
 
 certs: easy-rsa-master cfssl cfssljson
+	# set up easy-rsa
 	cp -rf easy-rsa-master/easyrsa3 easy-rsa-master/master
 	cp -rf easy-rsa-master/easyrsa3 easy-rsa-master/agent
+	# create the client <-> server-proxy connection certs
 	cd easy-rsa-master/master; \
 	./easyrsa init-pki; \
 	./easyrsa --batch "--req-cn=127.0.0.1@$(date +%s)" build-ca nopass; \
@@ -76,6 +78,7 @@ certs: easy-rsa-master cfssl cfssljson
 	cp -r easy-rsa-master/master/pki/private certs/master
 	cp -r easy-rsa-master/master/pki/issued certs/master
 	cp easy-rsa-master/master/pki/ca.crt certs/master/issued
+	# create the agent <-> server-proxy connection certs
 	cd easy-rsa-master/agent; \
 	./easyrsa init-pki; \
 	./easyrsa --batch "--req-cn=127.0.0.1@$(date +%s)" build-ca nopass; \

cmd/agent/main.go

@@ -55,47 +55,59 @@ func main() {
 }
 
 type GrpcProxyAgentOptions struct {
+	// Configuration for authenticating with the proxy-server
 	agentCert string
 	agentKey  string
 	caCert    string
+
+	// Configuration for connecting to the proxy-server
+	proxyServerHost string
+	proxyServerPort int
 }
 
 func (o *GrpcProxyAgentOptions) Flags() *pflag.FlagSet {
 	flags := pflag.NewFlagSet("proxy-agent", pflag.ContinueOnError)
 	flags.StringVar(&o.agentCert, "agentCert", o.agentCert, "If non-empty secure communication with this cert.")
 	flags.StringVar(&o.agentKey, "agentKey", o.agentKey, "If non-empty secure communication with this key.")
 	flags.StringVar(&o.caCert, "caCert", o.caCert, "If non-empty the CAs we use to validate clients.")
+	flags.StringVar(&o.proxyServerHost, "proxyServerHost", o.proxyServerHost, "The hostname to use to connect to the proxy-server.")
+	flags.IntVar(&o.proxyServerPort, "proxyServerPort", o.proxyServerPort, "The port the proxy server is listening on.")
 	return flags
 }
 
 func (o *GrpcProxyAgentOptions) Print() {
 	klog.Warningf("AgentCert set to \"%s\".\n", o.agentCert)
 	klog.Warningf("AgentKey set to \"%s\".\n", o.agentKey)
 	klog.Warningf("CACert set to \"%s\".\n", o.caCert)
+	klog.Warningf("ProxyServerHost set to \"%s\".\n", o.proxyServerHost)
+	klog.Warningf("ProxyServerPort set to %d.\n", o.proxyServerPort)
 }
 
 func (o *GrpcProxyAgentOptions) Validate() error {
 	if o.agentKey != "" {
 		if _, err := os.Stat(o.agentKey); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking agent key %s, got %v", o.agentKey, err)
 		}
 		if o.agentCert == "" {
 			return fmt.Errorf("cannot have agent cert empty when agent key is set to \"%s\"", o.agentKey)
 		}
 	}
 	if o.agentCert != "" {
 		if _, err := os.Stat(o.agentCert); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking agent cert %s, got %v", o.agentCert, err)
 		}
 		if o.agentKey == "" {
 			return fmt.Errorf("cannot have agent key empty when agent cert is set to \"%s\"", o.agentCert)
 		}
 	}
 	if o.caCert != "" {
 		if _, err := os.Stat(o.caCert); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking agent CA cert %s, got %v", o.caCert, err)
 		}
 	}
+	if o.proxyServerPort <= 0 {
+		return fmt.Errorf("proxy server port %d must be greater than 0", o.proxyServerPort)
+	}
 	return nil
 }
 
@@ -104,6 +116,8 @@ func newGrpcProxyAgentOptions() *GrpcProxyAgentOptions {
 		agentCert: "",
 		agentKey:  "",
 		caCert:    "",
+		proxyServerHost: "127.0.0.1",
+		proxyServerPort: 8091,
 	}
 	return &o
 }
@@ -126,15 +140,15 @@ type Agent struct {
 func (a *Agent) run(o *GrpcProxyAgentOptions) error {
 	o.Print()
 	if err := o.Validate(); err != nil {
-		return err
+		return fmt.Errorf("failed to validate agent options with %v", err)
 	}
 
 	if err := a.runProxyConnection(o); err != nil {
-		return err
+		return fmt.Errorf("failed to run proxy connection with %v", err)
 	}
 
 	if err := a.runAdminServer(o); err != nil {
-		return err
+		return fmt.Errorf("failed to run admin server with %v", err)
 	}
 
 	stopCh := make(chan struct{})
@@ -146,28 +160,28 @@ func (a *Agent) run(o *GrpcProxyAgentOptions) error {
 func (p *Agent) runProxyConnection(o *GrpcProxyAgentOptions) error {
 	agentCert, err := tls.LoadX509KeyPair(o.agentCert, o.agentKey)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to load X509 key pair %s and %s: %v", o.agentCert, o.agentKey, err)
 	}
 	certPool := x509.NewCertPool()
 	caCert, err := ioutil.ReadFile(o.caCert)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to read agent CA cert %s: %v", o.caCert, err)
 	}
 	ok := certPool.AppendCertsFromPEM(caCert)
 	if !ok {
 		return fmt.Errorf("failed to append CA cert to the cert pool")
 	}
 
 	transportCreds := credentials.NewTLS(&tls.Config{
-		ServerName:   "127.0.0.1",
+		ServerName:   o.proxyServerHost,
 		Certificates: []tls.Certificate{agentCert},
 		RootCAs:      certPool,
 	})
 	dialOption := grpc.WithTransportCredentials(transportCreds)
-	client := agentclient.NewAgentClient("localhost:8091")
+	client := agentclient.NewAgentClient(fmt.Sprintf("%s:%d", o.proxyServerHost, o.proxyServerPort))
 
 	if err := client.Connect(dialOption); err != nil {
-		return err
+		return fmt.Errorf("failed to connect to proxy-server: %v", err)
 	}
 
 	stopCh := make(chan struct{})

cmd/proxy/main.go

@@ -107,44 +107,44 @@ func (o *ProxyRunOptions) Print() {
 func (o *ProxyRunOptions) Validate() error {
 	if o.serverKey != "" {
 		if _, err := os.Stat(o.serverKey); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking server key %s, got %v", o.serverKey, err)
 		}
 		if o.serverCert == "" {
 			return fmt.Errorf("cannot have server cert empty when server key is set to %q", o.serverKey)
 		}
 	}
 	if o.serverCert != "" {
 		if _, err := os.Stat(o.serverCert); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking server cert %s, got %v", o.serverCert, err)
 		}
 		if o.serverKey == "" {
 			return fmt.Errorf("cannot have server key empty when server cert is set to %q", o.serverCert)
 		}
 	}
 	if o.serverCaCert != "" {
 		if _, err := os.Stat(o.serverCaCert); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking server CA cert %s, got %v", o.serverCaCert, err)
 		}
 	}
 	if o.clusterKey != "" {
 		if _, err := os.Stat(o.clusterKey); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking cluster key %s, got %v", o.clusterKey, err)
 		}
 		if o.clusterCert == "" {
 			return fmt.Errorf("cannot have cluster cert empty when cluster key is set to %q", o.clusterKey)
 		}
 	}
 	if o.clusterCert != "" {
 		if _, err := os.Stat(o.clusterCert); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking cluster cert %s, got %v", o.clusterCert, err)
 		}
 		if o.clusterKey == "" {
 			return fmt.Errorf("cannot have cluster key empty when cluster cert is set to %q", o.clusterCert)
 		}
 	}
 	if o.clusterCaCert != "" {
 		if _, err := os.Stat(o.clusterCaCert); os.IsNotExist(err) {
-			return err
+			return fmt.Errorf("error checking cluster CA cert %s, got %v", o.clusterCaCert, err)
 		}
 	}
 	if o.mode != "grpc" && o.mode != "http-connect" {
@@ -205,26 +205,26 @@ type Proxy struct {
 func (p *Proxy) run(o *ProxyRunOptions) error {
 	o.Print()
 	if err := o.Validate(); err != nil {
-		return err
+		return fmt.Errorf("failed to validate server options with %v", err)
 	}
 	server := agentserver.NewProxyServer()
 
 	klog.Info("Starting master server for client connections.")
 	err := p.runMasterServer(o, server)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to run the master server: %v", err)
 	}
 
 	klog.Info("Starting agent server for tunnel connections.")
 	err = p.runAgentServer(o, server)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to run the agent server: %v", err)
 	}
 
 	klog.Info("Starting admin server for debug connections.")
 	err = p.runAdminServer(o, server)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to run the admin server: %v", err)
 	}
 
 	stopCh := make(chan struct{})
@@ -236,12 +236,12 @@ func (p *Proxy) run(o *ProxyRunOptions) error {
 func (p *Proxy) runMasterServer(o *ProxyRunOptions, server *agentserver.ProxyServer) error {
 	proxyCert, err := tls.LoadX509KeyPair(o.serverCert, o.serverKey)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to load X509 key pair %s and %s: %v", o.serverCert, o.serverKey, err)
 	}
 	certPool := x509.NewCertPool()
 	caCert, err := ioutil.ReadFile(o.serverCaCert)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to read server CA cert %s: %v", o.serverCaCert, err)
 	}
 	ok := certPool.AppendCertsFromPEM(caCert)
 	if !ok {
@@ -261,7 +261,7 @@ func (p *Proxy) runMasterServer(o *ProxyRunOptions, server *agentserver.ProxySer
 		agent.RegisterProxyServiceServer(grpcServer, server)
 		lis, err := net.Listen("tcp", addr)
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to listen on %s: %v", addr, err)
 		}
 		go grpcServer.Serve(lis)
 	} else {
@@ -288,12 +288,12 @@ func (p *Proxy) runMasterServer(o *ProxyRunOptions, server *agentserver.ProxySer
 func (p *Proxy) runAgentServer(o *ProxyRunOptions, server *agentserver.ProxyServer) error {
 	clusterCert, err := tls.LoadX509KeyPair(o.clusterCert, o.clusterKey)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to load X509 key pair %s and %s: %v", o.clusterCert, o.clusterKey, err)
 	}
 	certPool := x509.NewCertPool()
 	caCert, err := ioutil.ReadFile(o.clusterCaCert)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to read cluster CA cert %s: %v", o.clusterCaCert, err)
 	}
 	ok := certPool.AppendCertsFromPEM(caCert)
 	if !ok {
@@ -311,7 +311,7 @@ func (p *Proxy) runAgentServer(o *ProxyRunOptions, server *agentserver.ProxyServ
 	agent.RegisterAgentServiceServer(grpcServer, server)
 	lis, err := net.Listen("tcp", addr)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to listen on %s: %v", addr, err)
 	}
 	go grpcServer.Serve(lis)