make more insecure options configurable and change insecure defaults from true to false

.drone.star

@@ -1474,11 +1474,17 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = []):
         "IDP_IDENTIFIER_REGISTRATION_CONF": "/drone/src/tests/config/drone/identifier-registration.yml",
         "OCIS_LOG_LEVEL": "error",
         "SETTINGS_DATA_PATH": "/srv/app/tmp/ocis/settings",
-        "STORAGE_HOME_DATAPROVIDER_INSECURE": True,
-        "STORAGE_METADATA_DATAPROVIDER_INSECURE": True,
-        "STORAGE_FRONTEND_OCDAV_INSECURE": True,
-        "STORAGE_FRONTEND_ARCHIVER_INSECURE": True,
-        "STORAGE_FRONTEND_APPPROVIDER_INSECURE": True,
+        "PROXY_OIDC_INSECURE": "true",
+        "THUMBNAILS_WEBDAVSOURCE_INSECURE": "true",
+        "THUMBNAILS_CS3SOURCE_INSECURE": "true",
+        "REVA_GATEWAY_INSECURE": "true",
+        "STORAGE_OIDC_INSECURE": "true",
+        "STORAGE_HOME_DATAPROVIDER_INSECURE": "true",
+        "STORAGE_METADATA_DATAPROVIDER_INSECURE": "true",
+        "STORAGE_USERS_DATAPROVIDER_INSECURE": "true",
+        "STORAGE_FRONTEND_OCDAV_INSECURE": "true",
+        "STORAGE_FRONTEND_ARCHIVER_INSECURE": "true",
+        "STORAGE_FRONTEND_APPPROVIDER_INSECURE": "true",
     }
 
     # Pass in "default" accounts_hash_difficulty to not set this environment variable.

.vscode/launch.json

@@ -7,14 +7,25 @@
             "request": "launch",
             "mode": "debug",
             "program": "${workspaceFolder}/ocis/cmd/ocis",
-            "args": ["server"],
+            "args": [
+                "server"
+            ],
             "env": {
+                // log settings for human developers
                 "OCIS_LOG_LEVEL": "debug",
                 "OCIS_LOG_PRETTY": "true",
                 "OCIS_LOG_COLOR": "true",
+                // enable basic auth for dev setup so that we can use curl for testing
                 "PROXY_ENABLE_BASIC_AUTH": "true",
+                // set insecure options because we don't have valid certificates in dev environments
+                "PROXY_OIDC_INSECURE": "true",
+                "THUMBNAILS_WEBDAVSOURCE_INSECURE": "true",
+                "THUMBNAILS_CS3SOURCE_INSECURE": "true",
+                "REVA_GATEWAY_INSECURE": "true",
+                "STORAGE_OIDC_INSECURE": "true",
                 "STORAGE_HOME_DATAPROVIDER_INSECURE": "true",
                 "STORAGE_METADATA_DATAPROVIDER_INSECURE": "true",
+                "STORAGE_USERS_DATAPROVIDER_INSECURE": "true",
                 "STORAGE_FRONTEND_OCDAV_INSECURE": "true",
                 "STORAGE_FRONTEND_ARCHIVER_INSECURE": "true",
                 "STORAGE_FRONTEND_APPPROVIDER_INSECURE": "true",

changelog/unreleased/insecure-options.md

@@ -1,13 +1,19 @@
 Enhancement: Make insecure options configurable
 
-We had several hard-coded 'insecure' flags. These options are now configurable. In development environments using self signed certs (the default) you need to set these flags:
+We had several hard-coded 'insecure' flags. These options are now configurable and default to false. Also we changed all other 'insecure' flags with a previous default of true to false. In development environments using self signed certs (the default) you need to set these flags:
 
 ```
+PROXY_OIDC_INSECURE=true
+REVA_GATEWAY_INSECURE=true
+STORAGE_FRONTEND_APPPROVIDER_INSECURE=true
+STORAGE_FRONTEND_ARCHIVER_INSECURE=true
+STORAGE_FRONTEND_OCDAV_INSECURE=true
 STORAGE_HOME_DATAPROVIDER_INSECURE=true
 STORAGE_METADATA_DATAPROVIDER_INSECURE=true
-STORAGE_FRONTEND_OCDAV_INSECURE=true
-STORAGE_FRONTEND_ARCHIVER_INSECURE=true
-STORAGE_FRONTEND_APPPROVIDER_INSECURE=true
+STORAGE_OIDC_INSECURE=true
+STORAGE_USERS_DATAPROVIDER_INSECURE=true
+THUMBNAILS_CS3SOURCE_INSECURE=true
+THUMBNAILS_WEBDAVSOURCE_INSECURE=true
 ```
 
 https://github.com/owncloud/ocis/issues/2700

graph/pkg/cs3/client.go

@@ -1,26 +0,0 @@
-package cs3
-
-import (
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-
-	"google.golang.org/grpc"
-)
-
-func newConn(endpoint string) (*grpc.ClientConn, error) {
-	conn, err := grpc.Dial(endpoint, grpc.WithInsecure())
-	if err != nil {
-		return nil, err
-	}
-
-	return conn, nil
-}
-
-// GetGatewayServiceClient returns a new cs3 gateway client
-func GetGatewayServiceClient(endpoint string) (gateway.GatewayAPIClient, error) {
-	conn, err := newConn(endpoint)
-	if err != nil {
-		return nil, err
-	}
-
-	return gateway.NewGatewayAPIClient(conn), nil
-}

graph/pkg/service/v0/graph.go

@@ -4,9 +4,9 @@ import (
 	"net/http"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	"github.com/cs3org/reva/pkg/rgrpc/todo/pool"
 	"github.com/go-chi/chi/v5"
 	"github.com/owncloud/ocis/graph/pkg/config"
-	"github.com/owncloud/ocis/graph/pkg/cs3"
 	"github.com/owncloud/ocis/ocis-pkg/log"
 )
 
@@ -24,7 +24,7 @@ func (g Graph) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // GetClient returns a gateway client to talk to reva
 func (g Graph) GetClient() (gateway.GatewayAPIClient, error) {
-	return cs3.GetGatewayServiceClient(g.config.Reva.Address)
+	return pool.GetGatewayServiceClient(g.config.Reva.Address) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216
 }
 
 // The key type is unexported to prevent collisions with context keys defined in

idp/pkg/flagset/flagset.go

@@ -355,6 +355,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		&cli.BoolFlag{
 			Name:        "insecure",
 			Usage:       "Disable TLS certificate and hostname validation",
+			Value:       flags.OverrideDefaultBool(cfg.IDP.Insecure, false),
 			EnvVars:     []string{"IDP_INSECURE"},
 			Destination: &cfg.IDP.Insecure,
 		},

ocs/pkg/config/config.go

@@ -49,6 +49,11 @@ type Tracing struct {
 	Service   string
 }
 
+// Reva defines all available REVA configuration.
+type Reva struct {
+	Address string
+}
+
 // TokenManager is the config for using the reva token manager
 type TokenManager struct {
 	JWTSecret string
@@ -71,7 +76,7 @@ type Config struct {
 	TokenManager       TokenManager
 	Service            Service
 	AccountBackend     string
-	RevaAddress        string
+	Reva               Reva
 	StorageUsersDriver string
 	MachineAuthAPIKey  string
 	IdentityManagement IdentityManagement

ocs/pkg/flagset/flagset.go

@@ -184,10 +184,10 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "reva-gateway-addr",
-			Value:       flags.OverrideDefaultString(cfg.RevaAddress, "127.0.0.1:9142"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.Address, "127.0.0.1:9142"),
 			Usage:       "Address of REVA gateway endpoint",
 			EnvVars:     []string{"REVA_GATEWAY"},
-			Destination: &cfg.RevaAddress,
+			Destination: &cfg.Reva.Address,
 		},
 		&cli.StringFlag{
 			Name:        "machine-auth-api-key",

ocs/pkg/service/v0/service.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/cs3org/reva/pkg/rgrpc/todo/pool"
 	"github.com/owncloud/ocis/ocis-pkg/service/grpc"
 
 	"github.com/go-chi/chi/v5"
@@ -19,7 +20,6 @@ import (
 	ocsm "github.com/owncloud/ocis/ocs/pkg/middleware"
 	"github.com/owncloud/ocis/ocs/pkg/service/v0/data"
 	"github.com/owncloud/ocis/ocs/pkg/service/v0/response"
-	"github.com/owncloud/ocis/proxy/pkg/cs3"
 	"github.com/owncloud/ocis/proxy/pkg/user/backend"
 	settings "github.com/owncloud/ocis/settings/pkg/proto/v0"
 )
@@ -161,9 +161,9 @@ func (o Ocs) getAccountService() accounts.AccountsService {
 }
 
 func (o Ocs) getCS3Backend() backend.UserBackend {
-	revaClient, err := cs3.GetGatewayServiceClient(o.config.RevaAddress)
+	revaClient, err := pool.GetGatewayServiceClient(o.config.Reva.Address) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216
 	if err != nil {
-		o.logger.Fatal().Msgf("could not get reva client at address %s", o.config.RevaAddress)
+		o.logger.Fatal().Msgf("could not get reva client at address %s", o.config.Reva.Address)
 	}
 	return backend.NewCS3UserBackend(nil, revaClient, o.config.MachineAuthAPIKey, o.logger)
 }

ocs/pkg/service/v0/users.go

@@ -375,7 +375,7 @@ func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if o.config.RevaAddress != "" && o.config.StorageUsersDriver != "owncloud" {
+	if o.config.Reva.Address != "" && o.config.StorageUsersDriver != "owncloud" {
 		t, err := o.mintTokenForUser(r.Context(), account)
 		if err != nil {
 			mustNotFail(render.Render(w, r, response.ErrRender(data.MetaServerError.StatusCode, errors.Wrap(err, "error minting token").Error())))
@@ -384,7 +384,7 @@ func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) {
 
 		ctx := metadata.AppendToOutgoingContext(r.Context(), revactx.TokenHeader, t)
 
-		gwc, err := pool.GetGatewayServiceClient(o.config.RevaAddress)
+		gwc, err := pool.GetGatewayServiceClient(o.config.Reva.Address) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216
 		if err != nil {
 			o.logger.Error().Err(err).Msg("error securing a connection to Reva gateway")
 		}

proxy/pkg/command/server.go

@@ -149,7 +149,7 @@ func Server(cfg *config.Config) *cli.Command {
 
 func loadMiddlewares(ctx context.Context, logger log.Logger, cfg *config.Config) alice.Chain {
 	rolesClient := settings.NewRoleService("com.owncloud.api.settings", grpc.DefaultClient)
-	revaClient, err := cs3.GetGatewayServiceClient(cfg.Reva.Address)
+	revaClient, err := cs3.GetGatewayServiceClient(cfg.Reva.Address, cfg.Reva.Insecure) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216
 	var userProvider backend.UserBackend
 	switch cfg.AccountBackend {
 	case "accounts":

proxy/pkg/config/config.go

@@ -81,6 +81,7 @@ var (
 // Reva defines all available REVA configuration.
 type Reva struct {
 	Address    string
+	Insecure   bool
 	Middleware Middleware
 }
 

proxy/pkg/cs3/client.go

@@ -7,17 +7,24 @@ import (
 	"google.golang.org/grpc"
 )
 
-func newConn(endpoint string) (*grpc.ClientConn, error) {
-	conn, err := grpc.Dial(
-		endpoint,
-		grpc.WithInsecure(),
-		grpc.WithUnaryInterceptor(
-			otelgrpc.UnaryClientInterceptor(
-				otelgrpc.WithTracerProvider(
-					proxytracing.TraceProvider,
-				),
+func newConn(endpoint string, insecure bool) (*grpc.ClientConn, error) {
+	opts := []grpc.DialOption{}
+
+	opts = append(opts, grpc.WithUnaryInterceptor(
+		otelgrpc.UnaryClientInterceptor(
+			otelgrpc.WithTracerProvider(
+				proxytracing.TraceProvider,
 			),
 		),
+	))
+
+	if insecure {
+		opts = append(opts, grpc.WithInsecure())
+	}
+
+	conn, err := grpc.Dial(
+		endpoint,
+		opts...,
 	)
 	if err != nil {
 		return nil, err
@@ -27,8 +34,8 @@ func newConn(endpoint string) (*grpc.ClientConn, error) {
 }
 
 // GetGatewayServiceClient returns a new cs3 gateway client
-func GetGatewayServiceClient(endpoint string) (gateway.GatewayAPIClient, error) {
-	conn, err := newConn(endpoint)
+func GetGatewayServiceClient(endpoint string, insecure bool) (gateway.GatewayAPIClient, error) {
+	conn, err := newConn(endpoint, insecure)
 	if err != nil {
 		return nil, err
 	}

proxy/pkg/flagset/flagset.go

@@ -189,6 +189,13 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 			EnvVars:     []string{"REVA_GATEWAY"},
 			Destination: &cfg.Reva.Address,
 		},
+		&cli.BoolFlag{
+			Name:        "reva-gateway-insecure",
+			Value:       flags.OverrideDefaultBool(cfg.Reva.Insecure, false),
+			Usage:       "allow insecure communication to REVA gateway endpoint",
+			EnvVars:     []string{"REVA_GATEWAY_INSECURE"},
+			Destination: &cfg.Reva.Insecure,
+		},
 		&cli.BoolFlag{
 			Name:        "insecure",
 			Value:       flags.OverrideDefaultBool(cfg.InsecureBackends, false),
@@ -208,7 +215,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.BoolFlag{
 			Name:        "oidc-insecure",
-			Value:       flags.OverrideDefaultBool(cfg.OIDC.Insecure, true),
+			Value:       flags.OverrideDefaultBool(cfg.OIDC.Insecure, false),
 			Usage:       "OIDC allow insecure communication",
 			EnvVars:     []string{"PROXY_OIDC_INSECURE"},
 			Destination: &cfg.OIDC.Insecure,

storage/pkg/command/storageusers.go

@@ -128,7 +128,7 @@ func storageUsersConfigFromStruct(c *cli.Context, cfg *config.Config) map[string
 					"driver":      cfg.Reva.StorageUsers.Driver,
 					"drivers":     storagedrivers.UserDrivers(cfg),
 					"timeout":     86400,
-					"insecure":    true,
+					"insecure":    cfg.Reva.StorageUsers.DataProvider.Insecure,
 					"disable_tus": false,
 				},
 			},

storage/pkg/flagset/authbearer.go

@@ -30,7 +30,7 @@ func AuthBearerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.BoolFlag{
 			Name:        "oidc-insecure",
-			Value:       flags.OverrideDefaultBool(cfg.Reva.OIDC.Insecure, true),
+			Value:       flags.OverrideDefaultBool(cfg.Reva.OIDC.Insecure, false),
 			Usage:       "OIDC allow insecure communication",
 			EnvVars:     []string{"STORAGE_OIDC_INSECURE"},
 			Destination: &cfg.Reva.OIDC.Insecure,

storage/pkg/flagset/storageusers.go

@@ -78,6 +78,13 @@ func StorageUsersWithConfig(cfg *config.Config) []cli.Flag {
 			EnvVars:     []string{"STORAGE_USERS_DRIVER"},
 			Destination: &cfg.Reva.StorageUsers.Driver,
 		},
+		&cli.BoolFlag{
+			Name:        "dataprovider-insecure",
+			Value:       flags.OverrideDefaultBool(cfg.Reva.StorageUsers.DataProvider.Insecure, false),
+			Usage:       "dataprovider insecure",
+			EnvVars:     []string{"STORAGE_USERS_DATAPROVIDER_INSECURE"},
+			Destination: &cfg.Reva.StorageUsers.DataProvider.Insecure,
+		},
 		&cli.BoolFlag{
 			Name:        "read-only",
 			Value:       flags.OverrideDefaultBool(cfg.Reva.StorageUsers.ReadOnly, false),

thumbnails/pkg/config/config.go

@@ -63,6 +63,7 @@ type Thumbnail struct {
 	Resolutions         []string
 	FileSystemStorage   FileSystemStorage
 	WebdavAllowInsecure bool
+	CS3AllowInsecure    bool
 	RevaGateway         string
 	WebdavNamespace     string
 }

thumbnails/pkg/flagset/flagset.go

@@ -154,11 +154,18 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.BoolFlag{
 			Name:        "webdavsource-insecure",
-			Value:       flags.OverrideDefaultBool(cfg.Thumbnail.WebdavAllowInsecure, true),
+			Value:       flags.OverrideDefaultBool(cfg.Thumbnail.WebdavAllowInsecure, false),
 			Usage:       "Whether to skip certificate checks",
 			EnvVars:     []string{"THUMBNAILS_WEBDAVSOURCE_INSECURE"},
 			Destination: &cfg.Thumbnail.WebdavAllowInsecure,
 		},
+		&cli.BoolFlag{
+			Name:        "cs3source-insecure",
+			Value:       flags.OverrideDefaultBool(cfg.Thumbnail.CS3AllowInsecure, false),
+			Usage:       "Whether to skip certificate checks",
+			EnvVars:     []string{"THUMBNAILS_CS3SOURCE_INSECURE"},
+			Destination: &cfg.Thumbnail.CS3AllowInsecure,
+		},
 		&cli.StringSliceFlag{
 			Name:    "thumbnail-resolution",
 			Value:   cli.NewStringSlice("16x16", "32x32", "64x64", "128x128", "1920x1080", "3840x2160", "7680x4320"),

thumbnails/pkg/server/grpc/server.go

@@ -25,7 +25,7 @@ func NewService(opts ...Option) grpc.Service {
 		grpc.Version(options.Config.Server.Version),
 	)
 	tconf := options.Config.Thumbnail
-	gc, err := pool.GetGatewayServiceClient(tconf.RevaGateway)
+	gc, err := pool.GetGatewayServiceClient(tconf.RevaGateway) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216
 	if err != nil {
 		options.Logger.Error().Err(err).Msg("could not get gateway client")
 		return grpc.Service{}
@@ -42,7 +42,7 @@ func NewService(opts ...Option) grpc.Service {
 					options.Logger,
 				),
 			),
-			svc.CS3Source(imgsource.NewCS3Source(gc)),
+			svc.CS3Source(imgsource.NewCS3Source(tconf, gc)),
 			svc.CS3Client(gc),
 		)
 		thumbnail = svc.NewInstrument(thumbnail, options.Metrics)

thumbnails/pkg/thumbnail/imgsource/cs3.go

@@ -12,6 +12,7 @@ import (
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	revactx "github.com/cs3org/reva/pkg/ctx"
 	"github.com/cs3org/reva/pkg/rhttp"
+	"github.com/owncloud/ocis/thumbnails/pkg/config"
 	"github.com/pkg/errors"
 	"google.golang.org/grpc/metadata"
 )
@@ -23,12 +24,14 @@ const (
 )
 
 type CS3 struct {
-	client gateway.GatewayAPIClient
+	client   gateway.GatewayAPIClient
+	insecure bool
 }
 
-func NewCS3Source(c gateway.GatewayAPIClient) CS3 {
+func NewCS3Source(cfg config.Thumbnail, c gateway.GatewayAPIClient) CS3 {
 	return CS3{
-		client: c,
+		client:   c,
+		insecure: cfg.CS3AllowInsecure,
 	}
 }
 
@@ -67,7 +70,9 @@ func (s CS3) Get(ctx context.Context, path string) (io.ReadCloser, error) {
 	httpReq.Header.Set(revactx.TokenHeader, auth)
 	httpReq.Header.Set(TokenTransportHeader, tk)
 
-	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec
+	http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{
+		InsecureSkipVerify: s.insecure, //nolint:gosec
+	}
 	client := &http.Client{}
 
 	resp, err := client.Do(httpReq) // nolint:bodyclose