move serve and connecter into transports package

2018-10-11 21:20:55 +02:00
parent a97684923a
commit be962998ba
13 changed files with 4 additions and 4 deletions
@@ -0,0 +1,107 @@
+package serve
+
+import (
+	"github.com/pkg/errors"
+	"github.com/zrepl/zrepl/config"
+	"net"
+	"github.com/zrepl/zrepl/daemon/streamrpcconfig"
+	"github.com/problame/go-streamrpc"
+	"context"
+	"github.com/zrepl/zrepl/logger"
+	"github.com/zrepl/zrepl/zfs"
+)
+
+type contextKey int
+
+const contextKeyLog contextKey = 0
+
+type Logger = logger.Logger
+
+func WithLogger(ctx context.Context, log Logger) context.Context {
+	return context.WithValue(ctx, contextKeyLog, log)
+}
+
+func getLogger(ctx context.Context) Logger {
+	if log, ok := ctx.Value(contextKeyLog).(Logger); ok {
+		return log
+	}
+	return logger.NewNullLogger()
+}
+
+type AuthenticatedConn interface {
+	net.Conn
+	// ClientIdentity must be a string that satisfies ValidateClientIdentity
+	ClientIdentity() string
+}
+
+// A client identity must be a single component in a ZFS filesystem path
+func ValidateClientIdentity(in string) (err error) {
+	path, err := zfs.NewDatasetPath(in)
+	if err != nil {
+		return err
+	}
+	if path.Length() != 1 {
+		return errors.New("client identity must be a single path comonent (not empty, no '/')")
+	}
+	return nil
+}
+
+type authConn struct {
+	net.Conn
+	clientIdentity string
+}
+
+var _ AuthenticatedConn = authConn{}
+
+func (c authConn) ClientIdentity() string {
+	if err := ValidateClientIdentity(c.clientIdentity); err != nil {
+		panic(err)
+	}
+	return c.clientIdentity
+}
+
+// like net.Listener, but with an AuthenticatedConn instead of net.Conn
+type AuthenticatedListener interface {
+	Addr() (net.Addr)
+	Accept(ctx context.Context) (AuthenticatedConn, error)
+	Close() error
+}
+
+type ListenerFactory interface {
+	Listen() (AuthenticatedListener, error)
+}
+
+func FromConfig(g *config.Global, in config.ServeEnum) (lf ListenerFactory, conf *streamrpc.ConnConfig, _ error) {
+
+	var (
+		lfError, rpcErr error
+	)
+	switch v := in.Ret.(type) {
+	case *config.TCPServe:
+		lf, lfError = TCPListenerFactoryFromConfig(g, v)
+		conf, rpcErr = streamrpcconfig.FromDaemonConfig(g, v.RPC)
+	case *config.TLSServe:
+		lf, lfError = TLSListenerFactoryFromConfig(g, v)
+		conf, rpcErr = streamrpcconfig.FromDaemonConfig(g, v.RPC)
+	case *config.StdinserverServer:
+		lf, lfError = MultiStdinserverListenerFactoryFromConfig(g, v)
+		conf, rpcErr = streamrpcconfig.FromDaemonConfig(g, v.RPC)
+	case *config.LocalServe:
+		lf, lfError = LocalListenerFactoryFromConfig(g, v)
+		conf, rpcErr = streamrpcconfig.FromDaemonConfig(g, v.RPC)
+	default:
+		return nil, nil, errors.Errorf("internal error: unknown serve type %T", v)
+	}
+
+	if lfError != nil {
+		return nil, nil, lfError
+	}
+	if rpcErr != nil {
+		return nil, nil, rpcErr
+	}
+
+	return lf, conf, nil
+
+}
+
+
@@ -0,0 +1,187 @@
+package serve
+
+import (
+	"context"
+	"fmt"
+	"github.com/zrepl/zrepl/config"
+	"github.com/zrepl/zrepl/util/socketpair"
+	"net"
+	"sync"
+)
+
+var localListeners struct {
+	m map[string]*LocalListener // listenerName -> listener
+	init sync.Once
+	mtx sync.Mutex
+}
+
+func GetLocalListener(listenerName string) (*LocalListener) {
+
+	localListeners.init.Do(func() {
+		localListeners.m = make(map[string]*LocalListener)
+	})
+
+	localListeners.mtx.Lock()
+	defer localListeners.mtx.Unlock()
+
+	l, ok := localListeners.m[listenerName]
+	if !ok {
+		l = newLocalListener()
+		localListeners.m[listenerName] = l
+	}
+	return l
+
+}
+
+type connectRequest struct {
+	clientIdentity string
+	callback chan connectResult
+}
+
+type connectResult struct {
+	conn net.Conn
+	err error
+}
+
+type LocalListener struct {
+	connects chan connectRequest
+}
+
+func newLocalListener() *LocalListener {
+	return &LocalListener{
+		connects: make(chan connectRequest),
+	}
+}
+
+// Connect to the LocalListener from a client with identity clientIdentity
+func (l *LocalListener) Connect(dialCtx context.Context, clientIdentity string) (conn net.Conn, err error) {
+
+	// place request
+	req := connectRequest{
+		clientIdentity: clientIdentity,
+		callback: make(chan connectResult),
+	}
+	select {
+	case l.connects <- req:
+	case <-dialCtx.Done():
+		return nil, dialCtx.Err()
+	}
+
+	// wait for listener response
+	select {
+	case connRes := <- req.callback:
+		conn, err = connRes.conn, connRes.err
+	case <-dialCtx.Done():
+		close(req.callback) // sending to the channel afterwards will panic, the listener has to catch this
+		conn, err = nil, dialCtx.Err()
+	}
+
+	return conn, err
+}
+
+type localAddr struct {
+	S string
+}
+
+func (localAddr) Network() string { return "local" }
+
+func (a localAddr) String() string { return a.S }
+
+func (l *LocalListener) Addr() (net.Addr) { return localAddr{"<listening>"} }
+
+type localConn struct {
+	net.Conn
+	clientIdentity string
+}
+
+func (l localConn) ClientIdentity() string { return l.clientIdentity }
+
+func (l *LocalListener) Accept(ctx context.Context) (AuthenticatedConn, error) {
+	respondToRequest := func(req connectRequest, res connectResult) (err error) {
+		getLogger(ctx).
+			WithField("res.conn", res.conn).WithField("res.err", res.err).
+			Debug("responding to client request")
+		defer func() {
+			errv := recover()
+			getLogger(ctx).WithField("recover_err", errv).
+				Debug("panic on send to client callback, likely a legitimate client-side timeout")
+		}()
+		select {
+		case req.callback <- res:
+			err = nil
+		default:
+			err = fmt.Errorf("client-provided callback did block on send")
+		}
+		close(req.callback)
+		return err
+	}
+
+	getLogger(ctx).Debug("waiting for local client connect requests")
+	var req connectRequest
+	select {
+	case req = <-l.connects:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	getLogger(ctx).WithField("client_identity", req.clientIdentity).Debug("got connect request")
+	if req.clientIdentity == "" {
+		res := connectResult{nil, fmt.Errorf("client identity must not be empty")}
+		if err := respondToRequest(req, res); err != nil {
+			return nil, err
+		}
+		return nil, fmt.Errorf("client connected with empty client identity")
+	}
+
+	getLogger(ctx).Debug("creating socketpair")
+	left, right, err := socketpair.SocketPair()
+	if err != nil {
+		res := connectResult{nil, fmt.Errorf("server error: %s", err)}
+		if respErr := respondToRequest(req, res); respErr != nil {
+			// returning the socketpair error properly is more important than the error sent to the client
+			getLogger(ctx).WithError(respErr).Error("error responding to client")
+		}
+		return nil, err
+	}
+
+	getLogger(ctx).Debug("responding with left side of socketpair")
+	res := connectResult{left, nil}
+	if err := respondToRequest(req, res); err != nil {
+		getLogger(ctx).WithError(err).Error("error responding to client")
+		if err := left.Close(); err != nil {
+			getLogger(ctx).WithError(err).Error("cannot close left side of socketpair")
+		}
+		if err := right.Close(); err != nil {
+			getLogger(ctx).WithError(err).Error("cannot close right side of socketpair")
+		}
+		return nil, err
+	}
+
+	return localConn{right, req.clientIdentity}, nil
+}
+
+func (l *LocalListener) Close() error {
+	// FIXME: make sure concurrent Accepts return with error, and further Accepts return that error, too
+	// Example impl: for each accept, do context.WithCancel, and store the cancel in a list
+	// When closing, set a member variable to state=closed, make sure accept will exit early
+	// and then call all cancels in the list
+	// The code path from Accept entry over check if state=closed to list entry must be protected by a mutex.
+	return nil
+}
+
+type LocalListenerFactory struct {
+	listenerName string
+}
+
+func LocalListenerFactoryFromConfig(g *config.Global, in *config.LocalServe) (f *LocalListenerFactory, err error) {
+	if in.ListenerName == "" {
+		return nil, fmt.Errorf("ListenerName must not be empty")
+	}
+	return &LocalListenerFactory{listenerName: in.ListenerName}, nil
+}
+
+
+func (lf *LocalListenerFactory) Listen() (AuthenticatedListener, error) {
+	return GetLocalListener(lf.listenerName), nil
+}
+
@@ -0,0 +1,158 @@
+package serve
+
+import (
+	"github.com/problame/go-netssh"
+	"github.com/zrepl/zrepl/config"
+	"github.com/zrepl/zrepl/daemon/nethelpers"
+	"io"
+	"net"
+	"path"
+	"time"
+	"context"
+	"github.com/pkg/errors"
+	"sync/atomic"
+)
+
+type StdinserverListenerFactory struct {
+	ClientIdentities []string
+	Sockdir string
+}
+
+func MultiStdinserverListenerFactoryFromConfig(g *config.Global, in *config.StdinserverServer) (f *multiStdinserverListenerFactory, err error) {
+
+	for _, ci := range in.ClientIdentities {
+		if err := ValidateClientIdentity(ci); err != nil {
+			return nil, errors.Wrapf(err, "invalid client identity %q", ci)
+		}
+	}
+
+	f = &multiStdinserverListenerFactory{
+		ClientIdentities: in.ClientIdentities,
+		Sockdir: g.Serve.StdinServer.SockDir,
+	}
+
+	return
+}
+
+type multiStdinserverListenerFactory struct {
+	ClientIdentities []string
+	Sockdir string
+}
+
+func (f *multiStdinserverListenerFactory) Listen() (AuthenticatedListener, error) {
+	return multiStdinserverListenerFromClientIdentities(f.Sockdir, f.ClientIdentities)
+}
+
+type multiStdinserverAcceptRes struct {
+	conn AuthenticatedConn
+	err error
+}
+
+type MultiStdinserverListener struct {
+	listeners []*stdinserverListener
+	accepts chan multiStdinserverAcceptRes
+	closed int32
+}
+
+// client identities must be validated
+func multiStdinserverListenerFromClientIdentities(sockdir string, cis []string) (*MultiStdinserverListener, error) {
+	listeners := make([]*stdinserverListener, 0, len(cis))
+	var err error
+	for _, ci := range cis {
+		sockpath := path.Join(sockdir, ci)
+		l  := &stdinserverListener{clientIdentity: ci}
+		if err = nethelpers.PreparePrivateSockpath(sockpath); err != nil {
+			break
+		}
+		if l.l, err = netssh.Listen(sockpath); err != nil {
+			break
+		}
+		listeners = append(listeners, l)
+	}
+	if err != nil {
+		for _, l := range listeners {
+			l.Close() // FIXME error reporting?
+		}
+		return nil, err
+	}
+	return &MultiStdinserverListener{listeners: listeners}, nil
+}
+
+func (m *MultiStdinserverListener) Accept(ctx context.Context) (AuthenticatedConn, error){
+
+	if m.accepts == nil {
+		m.accepts = make(chan multiStdinserverAcceptRes, len(m.listeners))
+		for i := range m.listeners {
+			go func(i int) {
+				for atomic.LoadInt32(&m.closed) == 0 {
+					conn, err := m.listeners[i].Accept(context.TODO())
+					m.accepts <- multiStdinserverAcceptRes{conn, err}
+				}
+			}(i)
+		}
+	}
+
+	res := <- m.accepts
+	return res.conn, res.err
+
+}
+
+func (m *MultiStdinserverListener) Addr() (net.Addr) {
+	return netsshAddr{}
+}
+
+func (m *MultiStdinserverListener) Close() error {
+	atomic.StoreInt32(&m.closed, 1)
+	var oneErr error
+	for _, l := range m.listeners {
+		if err := l.Close(); err != nil && oneErr == nil {
+			oneErr = err
+		}
+	}
+	return oneErr
+}
+
+// a single stdinserverListener (part of multiStinserverListener)
+type stdinserverListener struct {
+	l *netssh.Listener
+	clientIdentity string
+}
+
+func (l stdinserverListener) Addr() net.Addr {
+	return netsshAddr{}
+}
+
+func (l stdinserverListener) Accept(ctx context.Context) (AuthenticatedConn, error) {
+	c, err := l.l.Accept()
+	if err != nil {
+		return nil, err
+	}
+	return netsshConnToNetConnAdatper{c, l.clientIdentity}, nil
+}
+
+func (l stdinserverListener) Close() (err error) {
+	return l.l.Close()
+}
+
+type netsshAddr struct{}
+
+func (netsshAddr) Network() string { return "netssh" }
+func (netsshAddr) String() string  { return "???" }
+
+type netsshConnToNetConnAdatper struct {
+	io.ReadWriteCloser // works for both netssh.SSHConn and netssh.ServeConn
+	clientIdentity string
+}
+
+func (a netsshConnToNetConnAdatper) ClientIdentity() string { return a.clientIdentity }
+
+func (netsshConnToNetConnAdatper) LocalAddr() net.Addr { return netsshAddr{} }
+
+func (netsshConnToNetConnAdatper) RemoteAddr() net.Addr { return netsshAddr{} }
+
+// FIXME log warning once!
+func (netsshConnToNetConnAdatper) SetDeadline(t time.Time) error { return nil }
+
+func (netsshConnToNetConnAdatper) SetReadDeadline(t time.Time) error { return nil }
+
+func (netsshConnToNetConnAdatper) SetWriteDeadline(t time.Time) error { return nil }
@@ -0,0 +1,91 @@
+package serve
+
+import (
+	"github.com/zrepl/zrepl/config"
+	"net"
+	"github.com/pkg/errors"
+	"context"
+)
+
+type TCPListenerFactory struct {
+	address *net.TCPAddr
+	clientMap *ipMap
+}
+
+type ipMapEntry struct {
+	ip net.IP
+	ident string
+}
+
+type ipMap struct {
+	entries []ipMapEntry
+}
+
+func ipMapFromConfig(clients map[string]string) (*ipMap, error) {
+	entries := make([]ipMapEntry, 0, len(clients))
+	for clientIPString, clientIdent := range clients {
+		clientIP := net.ParseIP(clientIPString)
+		if clientIP == nil {
+			return nil, errors.Errorf("cannot parse client IP %q", clientIPString)
+		}
+		if err := ValidateClientIdentity(clientIdent); err != nil {
+			return nil, errors.Wrapf(err,"invalid client identity for IP %q", clientIPString)
+		}
+		entries = append(entries, ipMapEntry{clientIP, clientIdent})
+	}
+	return &ipMap{entries: entries}, nil
+}
+
+func (m *ipMap) Get(ip net.IP) (string, error) {
+	for _, e := range m.entries {
+		if e.ip.Equal(ip) {
+			return e.ident, nil
+		}
+	}
+	return "", errors.Errorf("no identity mapping for client IP %s", ip)
+}
+
+func TCPListenerFactoryFromConfig(c *config.Global, in *config.TCPServe) (*TCPListenerFactory, error) {
+	addr, err := net.ResolveTCPAddr("tcp", in.Listen)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse listen address")
+	}
+	clientMap, err := ipMapFromConfig(in.Clients)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse client IP map")
+	}
+	lf := &TCPListenerFactory{
+		address: addr,
+		clientMap: clientMap,
+	}
+	return lf, nil
+}
+
+func (f *TCPListenerFactory) Listen() (AuthenticatedListener, error) {
+	l, err := net.ListenTCP("tcp", f.address)
+	if err != nil {
+		return nil, err
+	}
+	return &TCPAuthListener{l, f.clientMap}, nil
+}
+
+type TCPAuthListener struct {
+	*net.TCPListener
+	clientMap *ipMap
+}
+
+func (f *TCPAuthListener) Accept(ctx context.Context) (AuthenticatedConn, error) {
+	nc, err := f.TCPListener.Accept()
+	if err != nil {
+		return nil, err
+	}
+	clientIP := nc.RemoteAddr().(*net.TCPAddr).IP
+	clientIdent, err := f.clientMap.Get(clientIP)
+	if err != nil {
+		getLogger(ctx).WithField("ip", clientIP).Error("client IP not in client map")
+		nc.Close()
+		return nil, err
+	}
+	return authConn{nc, clientIdent}, nil
+}
+
@@ -0,0 +1,83 @@
+package serve
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"github.com/pkg/errors"
+	"github.com/zrepl/zrepl/config"
+	"github.com/zrepl/zrepl/tlsconf"
+	"net"
+	"time"
+	"context"
+)
+
+type TLSListenerFactory struct {
+	address          string
+	clientCA         *x509.CertPool
+	serverCert       tls.Certificate
+	handshakeTimeout time.Duration
+	clientCNs map[string]struct{}
+}
+
+func TLSListenerFactoryFromConfig(c *config.Global, in *config.TLSServe) (lf *TLSListenerFactory, err error) {
+	lf = &TLSListenerFactory{
+		address: in.Listen,
+		handshakeTimeout: in.HandshakeTimeout,
+	}
+
+	if in.Ca == "" || in.Cert == "" || in.Key == "" {
+		return nil, errors.New("fields 'ca', 'cert' and 'key'must be specified")
+	}
+
+	lf.clientCA, err = tlsconf.ParseCAFile(in.Ca)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse ca file")
+	}
+
+	lf.serverCert, err = tls.LoadX509KeyPair(in.Cert, in.Key)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse cer/key pair")
+	}
+
+	lf.clientCNs = make(map[string]struct{}, len(in.ClientCNs))
+	for i, cn := range in.ClientCNs {
+		if err := ValidateClientIdentity(cn); err != nil {
+			return nil, errors.Wrapf(err, "unsuitable client_cn #%d %q", i, cn)
+		}
+		// dupes are ok fr now
+		lf.clientCNs[cn] = struct{}{}
+	}
+
+	return lf, nil
+}
+
+func (f *TLSListenerFactory) Listen() (AuthenticatedListener, error) {
+	l, err := net.Listen("tcp", f.address)
+	if err != nil {
+		return nil, err
+	}
+	tl := tlsconf.NewClientAuthListener(l, f.clientCA, f.serverCert, f.handshakeTimeout)
+	return tlsAuthListener{tl, f.clientCNs}, nil
+}
+
+type tlsAuthListener struct {
+	*tlsconf.ClientAuthListener
+	clientCNs map[string]struct{}
+}
+
+func (l tlsAuthListener) Accept(ctx context.Context) (AuthenticatedConn, error) {
+	c, cn, err := l.ClientAuthListener.Accept()
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := l.clientCNs[cn]; !ok {
+		if err := c.Close(); err != nil {
+			getLogger(ctx).WithError(err).Error("error closing connection with unauthorized common name")
+		}
+		return nil, fmt.Errorf("unauthorized client common name %q from %s", cn, c.RemoteAddr())
+	}
+	return authConn{c, cn}, nil
+}
+
+