Nats tls (#4781)

* use tls for nats connections

* add config options for nats client tls config

* add nats tls config to CI

* add function to create a certpool

* add option to provide a rootCA to validate the server's TLS certificate

* add option to provide a rootCA to validate the server's TLS certificate

* add option to provide a rootCA to validate the server's TLS certificate

* add option to provide a rootCA to validate the server's TLS certificate

* configure nats clients in reva to use tls

ocis-pkg/crypto/crypto.go

@@ -0,0 +1,28 @@
+// Package crypto implements utility functions for handling crypto related files.
+package crypto
+
+import (
+	"bytes"
+	"crypto/x509"
+	"errors"
+	"io"
+)
+
+// NewCertPoolFromPEM reads certificates from io.Reader and returns a x509.CertPool
+// containing those certificates.
+func NewCertPoolFromPEM(crts ...io.Reader) (*x509.CertPool, error) {
+	certPool := x509.NewCertPool()
+
+	var buf bytes.Buffer
+	for _, c := range crts {
+		if _, err := io.Copy(&buf, c); err != nil {
+			return nil, err
+		}
+		if !certPool.AppendCertsFromPEM(buf.Bytes()) {
+			return nil, errors.New("failed to append cert from PEM")
+		}
+		buf.Reset()
+	}
+
+	return certPool, nil
+}

ocis-pkg/crypto/crypto_test.go

@@ -40,7 +40,7 @@ var _ = Describe("Crypto", func() {
 	Describe("Creating key / certificate pair", func() {
 		Context("For ocis-proxy in the location of the user config directory", func() {
 			It(fmt.Sprintf("Creates the cert / key tuple in: %s", filepath.Join(userConfigDir, "ocis")), func() {
-				if err := crypto.GenCert(config.Proxy.HTTP.TLSCert, config.Proxy.HTTP.TLSKey, log.NewLogger()); err != nil {
+				if err := crypto.GenCert(config.Proxy.HTTP.TLSCert, config.Proxy.HTTP.TLSKey, log.NopLogger()); err != nil {
 					Fail(err.Error())
 				}
 
@@ -54,4 +54,50 @@ var _ = Describe("Crypto", func() {
 			})
 		})
 	})
+	Describe("Creating a new cert pool", func() {
+		var (
+			crtOne string
+			keyOne string
+			crtTwo string
+			keyTwo string
+		)
+		BeforeEach(func() {
+			crtOne = filepath.Join(userConfigDir, "ocis/one.cert")
+			keyOne = filepath.Join(userConfigDir, "ocis/one.key")
+			crtTwo = filepath.Join(userConfigDir, "ocis/two.cert")
+			keyTwo = filepath.Join(userConfigDir, "ocis/two.key")
+			if err := crypto.GenCert(crtOne, keyOne, log.NopLogger()); err != nil {
+				Fail(err.Error())
+			}
+			if err := crypto.GenCert(crtTwo, keyTwo, log.NopLogger()); err != nil {
+				Fail(err.Error())
+			}
+		})
+		It("handles one certificate", func() {
+			f1, _ := os.Open(crtOne)
+			defer f1.Close()
+
+			c, err := crypto.NewCertPoolFromPEM(f1)
+			if err != nil {
+				Fail(err.Error())
+			}
+			if len(c.Subjects()) != 1 {
+				Fail("expected 1 certificate in the cert pool")
+			}
+		})
+		It("handles multiple certificates", func() {
+			f1, _ := os.Open(crtOne)
+			f2, _ := os.Open(crtTwo)
+			defer f1.Close()
+			defer f2.Close()
+
+			c, err := crypto.NewCertPoolFromPEM(f1, f2)
+			if err != nil {
+				Fail(err.Error())
+			}
+			if len(c.Subjects()) != 2 {
+				Fail("expected 2 certificates in the cert pool")
+			}
+		})
+	})
 })

ocis-pkg/crypto/gencert_test.go

@@ -58,7 +58,6 @@ func TestPersistKey(t *testing.T) {
 
 	type args struct {
 		keyName string
-		l       log.Logger
 		pk      interface{}
 	}
 	tests := []struct {
@@ -69,7 +68,6 @@ func TestPersistKey(t *testing.T) {
 			name: "writes a private key (rsa) to the specified location",
 			args: args{
 				keyName: keyPath,
-				l:       log.NewLogger(),
 				pk:      rsaPk,
 			},
 		},
@@ -77,14 +75,13 @@ func TestPersistKey(t *testing.T) {
 			name: "writes a private key (ecdsa) to the specified location",
 			args: args{
 				keyName: keyPath,
-				l:       log.NewLogger(),
 				pk:      ecdsaPk,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := persistKey(tt.args.keyName, tt.args.l, tt.args.pk); err != nil {
+			if err := persistKey(tt.args.keyName, log.NopLogger(), tt.args.pk); err != nil {
 				t.Error(err)
 			}
 		})
@@ -107,7 +104,6 @@ func TestPersistCertificate(t *testing.T) {
 
 	type args struct {
 		certName string
-		l        log.Logger
 		pk       interface{}
 	}
 	tests := []struct {
@@ -119,7 +115,6 @@ func TestPersistCertificate(t *testing.T) {
 			name: "store a certificate with an rsa private key",
 			args: args{
 				certName: certPath,
-				l:        log.NewLogger(),
 				pk:       rsaPk,
 			},
 			wantErr: false,
@@ -128,7 +123,6 @@ func TestPersistCertificate(t *testing.T) {
 			name: "store a certificate with an ecdsa private key",
 			args: args{
 				certName: certPath,
-				l:        log.NewLogger(),
 				pk:       ecdsaPk,
 			},
 			wantErr: false,
@@ -137,7 +131,6 @@ func TestPersistCertificate(t *testing.T) {
 			name: "should fail",
 			args: args{
 				certName: certPath,
-				l:        log.NewLogger(),
 				pk:       42,
 			},
 			wantErr: true,
@@ -146,7 +139,7 @@ func TestPersistCertificate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Run(tt.name, func(t *testing.T) {
-				if err := persistCertificate(tt.args.certName, tt.args.l, tt.args.pk); err != nil {
+				if err := persistCertificate(tt.args.certName, log.NopLogger(), tt.args.pk); err != nil {
 					if !tt.wantErr {
 						t.Error(err)
 					}

ocis-pkg/log/log.go

@@ -53,6 +53,11 @@ func LoggerFromConfig(name string, cfg *shared.Log) Logger {
 	)
 }
 
+// NopLogger initializes a no-operation logger.
+func NopLogger() Logger {
+	return Logger{zerolog.Nop()}
+}
+
 // NewLogger initializes a new logger instance.
 func NewLogger(opts ...Option) Logger {
 	options := newOptions(opts...)