diff --git a/.drone.star b/.drone.star index db2982e53..34ab845f4 100644 --- a/.drone.star +++ b/.drone.star @@ -1474,11 +1474,17 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = []): "IDP_IDENTIFIER_REGISTRATION_CONF": "/drone/src/tests/config/drone/identifier-registration.yml", "OCIS_LOG_LEVEL": "error", "SETTINGS_DATA_PATH": "/srv/app/tmp/ocis/settings", - "STORAGE_HOME_DATAPROVIDER_INSECURE": True, - "STORAGE_METADATA_DATAPROVIDER_INSECURE": True, - "STORAGE_FRONTEND_OCDAV_INSECURE": True, - "STORAGE_FRONTEND_ARCHIVER_INSECURE": True, - "STORAGE_FRONTEND_APPPROVIDER_INSECURE": True, + "PROXY_OIDC_INSECURE": "true", + "THUMBNAILS_WEBDAVSOURCE_INSECURE": "true", + "THUMBNAILS_CS3SOURCE_INSECURE": "true", + "REVA_GATEWAY_INSECURE": "true", + "STORAGE_OIDC_INSECURE": "true", + "STORAGE_HOME_DATAPROVIDER_INSECURE": "true", + "STORAGE_METADATA_DATAPROVIDER_INSECURE": "true", + "STORAGE_USERS_DATAPROVIDER_INSECURE": "true", + "STORAGE_FRONTEND_OCDAV_INSECURE": "true", + "STORAGE_FRONTEND_ARCHIVER_INSECURE": "true", + "STORAGE_FRONTEND_APPPROVIDER_INSECURE": "true", } # Pass in "default" accounts_hash_difficulty to not set this environment variable. diff --git a/.vscode/launch.json b/.vscode/launch.json index 2a231cc67..d00d1d4f4 100644 --- a/.vscode/launch.json +++ b/.vscode/launch.json @@ -7,14 +7,25 @@ "request": "launch", "mode": "debug", "program": "${workspaceFolder}/ocis/cmd/ocis", - "args": ["server"], + "args": [ + "server" + ], "env": { + // log settings for human developers "OCIS_LOG_LEVEL": "debug", "OCIS_LOG_PRETTY": "true", "OCIS_LOG_COLOR": "true", + // enable basic auth for dev setup so that we can use curl for testing "PROXY_ENABLE_BASIC_AUTH": "true", + // set insecure options because we don't have valid certificates in dev environments + "PROXY_OIDC_INSECURE": "true", + "THUMBNAILS_WEBDAVSOURCE_INSECURE": "true", + "THUMBNAILS_CS3SOURCE_INSECURE": "true", + "REVA_GATEWAY_INSECURE": "true", + "STORAGE_OIDC_INSECURE": "true", "STORAGE_HOME_DATAPROVIDER_INSECURE": "true", "STORAGE_METADATA_DATAPROVIDER_INSECURE": "true", + "STORAGE_USERS_DATAPROVIDER_INSECURE": "true", "STORAGE_FRONTEND_OCDAV_INSECURE": "true", "STORAGE_FRONTEND_ARCHIVER_INSECURE": "true", "STORAGE_FRONTEND_APPPROVIDER_INSECURE": "true", diff --git a/changelog/unreleased/insecure-options.md b/changelog/unreleased/insecure-options.md index 34f53f657..ec7e032e5 100644 --- a/changelog/unreleased/insecure-options.md +++ b/changelog/unreleased/insecure-options.md @@ -1,13 +1,19 @@ Enhancement: Make insecure options configurable -We had several hard-coded 'insecure' flags. These options are now configurable. In development environments using self signed certs (the default) you need to set these flags: +We had several hard-coded 'insecure' flags. These options are now configurable and default to false. Also we changed all other 'insecure' flags with a previous default of true to false. In development environments using self signed certs (the default) you need to set these flags: ``` +PROXY_OIDC_INSECURE=true +REVA_GATEWAY_INSECURE=true +STORAGE_FRONTEND_APPPROVIDER_INSECURE=true +STORAGE_FRONTEND_ARCHIVER_INSECURE=true +STORAGE_FRONTEND_OCDAV_INSECURE=true STORAGE_HOME_DATAPROVIDER_INSECURE=true STORAGE_METADATA_DATAPROVIDER_INSECURE=true -STORAGE_FRONTEND_OCDAV_INSECURE=true -STORAGE_FRONTEND_ARCHIVER_INSECURE=true -STORAGE_FRONTEND_APPPROVIDER_INSECURE=true +STORAGE_OIDC_INSECURE=true +STORAGE_USERS_DATAPROVIDER_INSECURE=true +THUMBNAILS_CS3SOURCE_INSECURE=true +THUMBNAILS_WEBDAVSOURCE_INSECURE=true ``` https://github.com/owncloud/ocis/issues/2700 diff --git a/graph/pkg/cs3/client.go b/graph/pkg/cs3/client.go deleted file mode 100644 index 9eed1a361..000000000 --- a/graph/pkg/cs3/client.go +++ /dev/null @@ -1,26 +0,0 @@ -package cs3 - -import ( - gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1" - - "google.golang.org/grpc" -) - -func newConn(endpoint string) (*grpc.ClientConn, error) { - conn, err := grpc.Dial(endpoint, grpc.WithInsecure()) - if err != nil { - return nil, err - } - - return conn, nil -} - -// GetGatewayServiceClient returns a new cs3 gateway client -func GetGatewayServiceClient(endpoint string) (gateway.GatewayAPIClient, error) { - conn, err := newConn(endpoint) - if err != nil { - return nil, err - } - - return gateway.NewGatewayAPIClient(conn), nil -} diff --git a/graph/pkg/service/v0/graph.go b/graph/pkg/service/v0/graph.go index 97005ce5a..fb0c1c505 100644 --- a/graph/pkg/service/v0/graph.go +++ b/graph/pkg/service/v0/graph.go @@ -4,9 +4,9 @@ import ( "net/http" gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1" + "github.com/cs3org/reva/pkg/rgrpc/todo/pool" "github.com/go-chi/chi/v5" "github.com/owncloud/ocis/graph/pkg/config" - "github.com/owncloud/ocis/graph/pkg/cs3" "github.com/owncloud/ocis/ocis-pkg/log" ) @@ -24,7 +24,7 @@ func (g Graph) ServeHTTP(w http.ResponseWriter, r *http.Request) { // GetClient returns a gateway client to talk to reva func (g Graph) GetClient() (gateway.GatewayAPIClient, error) { - return cs3.GetGatewayServiceClient(g.config.Reva.Address) + return pool.GetGatewayServiceClient(g.config.Reva.Address) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216 } // The key type is unexported to prevent collisions with context keys defined in diff --git a/idp/pkg/flagset/flagset.go b/idp/pkg/flagset/flagset.go index fbb36d219..d9c9af81b 100644 --- a/idp/pkg/flagset/flagset.go +++ b/idp/pkg/flagset/flagset.go @@ -355,6 +355,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag { &cli.BoolFlag{ Name: "insecure", Usage: "Disable TLS certificate and hostname validation", + Value: flags.OverrideDefaultBool(cfg.IDP.Insecure, false), EnvVars: []string{"IDP_INSECURE"}, Destination: &cfg.IDP.Insecure, }, diff --git a/ocs/pkg/config/config.go b/ocs/pkg/config/config.go index 6ee0377a4..5b3e9affc 100644 --- a/ocs/pkg/config/config.go +++ b/ocs/pkg/config/config.go @@ -49,6 +49,11 @@ type Tracing struct { Service string } +// Reva defines all available REVA configuration. +type Reva struct { + Address string +} + // TokenManager is the config for using the reva token manager type TokenManager struct { JWTSecret string @@ -71,7 +76,7 @@ type Config struct { TokenManager TokenManager Service Service AccountBackend string - RevaAddress string + Reva Reva StorageUsersDriver string MachineAuthAPIKey string IdentityManagement IdentityManagement diff --git a/ocs/pkg/flagset/flagset.go b/ocs/pkg/flagset/flagset.go index 378d07eaf..4eef288e2 100644 --- a/ocs/pkg/flagset/flagset.go +++ b/ocs/pkg/flagset/flagset.go @@ -184,10 +184,10 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag { }, &cli.StringFlag{ Name: "reva-gateway-addr", - Value: flags.OverrideDefaultString(cfg.RevaAddress, "127.0.0.1:9142"), + Value: flags.OverrideDefaultString(cfg.Reva.Address, "127.0.0.1:9142"), Usage: "Address of REVA gateway endpoint", EnvVars: []string{"REVA_GATEWAY"}, - Destination: &cfg.RevaAddress, + Destination: &cfg.Reva.Address, }, &cli.StringFlag{ Name: "machine-auth-api-key", diff --git a/ocs/pkg/service/v0/service.go b/ocs/pkg/service/v0/service.go index a6875cc4b..1262ccdf1 100644 --- a/ocs/pkg/service/v0/service.go +++ b/ocs/pkg/service/v0/service.go @@ -4,6 +4,7 @@ import ( "net/http" "time" + "github.com/cs3org/reva/pkg/rgrpc/todo/pool" "github.com/owncloud/ocis/ocis-pkg/service/grpc" "github.com/go-chi/chi/v5" @@ -19,7 +20,6 @@ import ( ocsm "github.com/owncloud/ocis/ocs/pkg/middleware" "github.com/owncloud/ocis/ocs/pkg/service/v0/data" "github.com/owncloud/ocis/ocs/pkg/service/v0/response" - "github.com/owncloud/ocis/proxy/pkg/cs3" "github.com/owncloud/ocis/proxy/pkg/user/backend" settings "github.com/owncloud/ocis/settings/pkg/proto/v0" ) @@ -161,9 +161,9 @@ func (o Ocs) getAccountService() accounts.AccountsService { } func (o Ocs) getCS3Backend() backend.UserBackend { - revaClient, err := cs3.GetGatewayServiceClient(o.config.RevaAddress) + revaClient, err := pool.GetGatewayServiceClient(o.config.Reva.Address) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216 if err != nil { - o.logger.Fatal().Msgf("could not get reva client at address %s", o.config.RevaAddress) + o.logger.Fatal().Msgf("could not get reva client at address %s", o.config.Reva.Address) } return backend.NewCS3UserBackend(nil, revaClient, o.config.MachineAuthAPIKey, o.logger) } diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go index 78763f47d..5b039016c 100644 --- a/ocs/pkg/service/v0/users.go +++ b/ocs/pkg/service/v0/users.go @@ -375,7 +375,7 @@ func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) { return } - if o.config.RevaAddress != "" && o.config.StorageUsersDriver != "owncloud" { + if o.config.Reva.Address != "" && o.config.StorageUsersDriver != "owncloud" { t, err := o.mintTokenForUser(r.Context(), account) if err != nil { mustNotFail(render.Render(w, r, response.ErrRender(data.MetaServerError.StatusCode, errors.Wrap(err, "error minting token").Error()))) @@ -384,7 +384,7 @@ func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) { ctx := metadata.AppendToOutgoingContext(r.Context(), revactx.TokenHeader, t) - gwc, err := pool.GetGatewayServiceClient(o.config.RevaAddress) + gwc, err := pool.GetGatewayServiceClient(o.config.Reva.Address) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216 if err != nil { o.logger.Error().Err(err).Msg("error securing a connection to Reva gateway") } diff --git a/proxy/pkg/command/server.go b/proxy/pkg/command/server.go index 8b4341103..162ee2843 100644 --- a/proxy/pkg/command/server.go +++ b/proxy/pkg/command/server.go @@ -149,7 +149,7 @@ func Server(cfg *config.Config) *cli.Command { func loadMiddlewares(ctx context.Context, logger log.Logger, cfg *config.Config) alice.Chain { rolesClient := settings.NewRoleService("com.owncloud.api.settings", grpc.DefaultClient) - revaClient, err := cs3.GetGatewayServiceClient(cfg.Reva.Address) + revaClient, err := cs3.GetGatewayServiceClient(cfg.Reva.Address, cfg.Reva.Insecure) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216 var userProvider backend.UserBackend switch cfg.AccountBackend { case "accounts": diff --git a/proxy/pkg/config/config.go b/proxy/pkg/config/config.go index 9dd370118..7f839ef54 100644 --- a/proxy/pkg/config/config.go +++ b/proxy/pkg/config/config.go @@ -81,6 +81,7 @@ var ( // Reva defines all available REVA configuration. type Reva struct { Address string + Insecure bool Middleware Middleware } diff --git a/proxy/pkg/cs3/client.go b/proxy/pkg/cs3/client.go index 68f52d2d7..91a5c566a 100644 --- a/proxy/pkg/cs3/client.go +++ b/proxy/pkg/cs3/client.go @@ -7,17 +7,24 @@ import ( "google.golang.org/grpc" ) -func newConn(endpoint string) (*grpc.ClientConn, error) { - conn, err := grpc.Dial( - endpoint, - grpc.WithInsecure(), - grpc.WithUnaryInterceptor( - otelgrpc.UnaryClientInterceptor( - otelgrpc.WithTracerProvider( - proxytracing.TraceProvider, - ), +func newConn(endpoint string, insecure bool) (*grpc.ClientConn, error) { + opts := []grpc.DialOption{} + + opts = append(opts, grpc.WithUnaryInterceptor( + otelgrpc.UnaryClientInterceptor( + otelgrpc.WithTracerProvider( + proxytracing.TraceProvider, ), ), + )) + + if insecure { + opts = append(opts, grpc.WithInsecure()) + } + + conn, err := grpc.Dial( + endpoint, + opts..., ) if err != nil { return nil, err @@ -27,8 +34,8 @@ func newConn(endpoint string) (*grpc.ClientConn, error) { } // GetGatewayServiceClient returns a new cs3 gateway client -func GetGatewayServiceClient(endpoint string) (gateway.GatewayAPIClient, error) { - conn, err := newConn(endpoint) +func GetGatewayServiceClient(endpoint string, insecure bool) (gateway.GatewayAPIClient, error) { + conn, err := newConn(endpoint, insecure) if err != nil { return nil, err } diff --git a/proxy/pkg/flagset/flagset.go b/proxy/pkg/flagset/flagset.go index 2f1d6b885..c16699f24 100644 --- a/proxy/pkg/flagset/flagset.go +++ b/proxy/pkg/flagset/flagset.go @@ -189,6 +189,13 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag { EnvVars: []string{"REVA_GATEWAY"}, Destination: &cfg.Reva.Address, }, + &cli.BoolFlag{ + Name: "reva-gateway-insecure", + Value: flags.OverrideDefaultBool(cfg.Reva.Insecure, false), + Usage: "allow insecure communication to REVA gateway endpoint", + EnvVars: []string{"REVA_GATEWAY_INSECURE"}, + Destination: &cfg.Reva.Insecure, + }, &cli.BoolFlag{ Name: "insecure", Value: flags.OverrideDefaultBool(cfg.InsecureBackends, false), @@ -208,7 +215,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag { }, &cli.BoolFlag{ Name: "oidc-insecure", - Value: flags.OverrideDefaultBool(cfg.OIDC.Insecure, true), + Value: flags.OverrideDefaultBool(cfg.OIDC.Insecure, false), Usage: "OIDC allow insecure communication", EnvVars: []string{"PROXY_OIDC_INSECURE"}, Destination: &cfg.OIDC.Insecure, diff --git a/storage/pkg/command/storageusers.go b/storage/pkg/command/storageusers.go index 6f01defad..99ae03348 100644 --- a/storage/pkg/command/storageusers.go +++ b/storage/pkg/command/storageusers.go @@ -128,7 +128,7 @@ func storageUsersConfigFromStruct(c *cli.Context, cfg *config.Config) map[string "driver": cfg.Reva.StorageUsers.Driver, "drivers": storagedrivers.UserDrivers(cfg), "timeout": 86400, - "insecure": true, + "insecure": cfg.Reva.StorageUsers.DataProvider.Insecure, "disable_tus": false, }, }, diff --git a/storage/pkg/flagset/authbearer.go b/storage/pkg/flagset/authbearer.go index 73bfeb91e..90b14b7af 100644 --- a/storage/pkg/flagset/authbearer.go +++ b/storage/pkg/flagset/authbearer.go @@ -30,7 +30,7 @@ func AuthBearerWithConfig(cfg *config.Config) []cli.Flag { }, &cli.BoolFlag{ Name: "oidc-insecure", - Value: flags.OverrideDefaultBool(cfg.Reva.OIDC.Insecure, true), + Value: flags.OverrideDefaultBool(cfg.Reva.OIDC.Insecure, false), Usage: "OIDC allow insecure communication", EnvVars: []string{"STORAGE_OIDC_INSECURE"}, Destination: &cfg.Reva.OIDC.Insecure, diff --git a/storage/pkg/flagset/storageusers.go b/storage/pkg/flagset/storageusers.go index b801d2dd8..9c6e7d1ed 100644 --- a/storage/pkg/flagset/storageusers.go +++ b/storage/pkg/flagset/storageusers.go @@ -78,6 +78,13 @@ func StorageUsersWithConfig(cfg *config.Config) []cli.Flag { EnvVars: []string{"STORAGE_USERS_DRIVER"}, Destination: &cfg.Reva.StorageUsers.Driver, }, + &cli.BoolFlag{ + Name: "dataprovider-insecure", + Value: flags.OverrideDefaultBool(cfg.Reva.StorageUsers.DataProvider.Insecure, false), + Usage: "dataprovider insecure", + EnvVars: []string{"STORAGE_USERS_DATAPROVIDER_INSECURE"}, + Destination: &cfg.Reva.StorageUsers.DataProvider.Insecure, + }, &cli.BoolFlag{ Name: "read-only", Value: flags.OverrideDefaultBool(cfg.Reva.StorageUsers.ReadOnly, false), diff --git a/thumbnails/pkg/config/config.go b/thumbnails/pkg/config/config.go index 7f8a97a81..4a19e13f4 100644 --- a/thumbnails/pkg/config/config.go +++ b/thumbnails/pkg/config/config.go @@ -63,6 +63,7 @@ type Thumbnail struct { Resolutions []string FileSystemStorage FileSystemStorage WebdavAllowInsecure bool + CS3AllowInsecure bool RevaGateway string WebdavNamespace string } diff --git a/thumbnails/pkg/flagset/flagset.go b/thumbnails/pkg/flagset/flagset.go index 6a877400e..c9e0edc0d 100644 --- a/thumbnails/pkg/flagset/flagset.go +++ b/thumbnails/pkg/flagset/flagset.go @@ -154,11 +154,18 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag { }, &cli.BoolFlag{ Name: "webdavsource-insecure", - Value: flags.OverrideDefaultBool(cfg.Thumbnail.WebdavAllowInsecure, true), + Value: flags.OverrideDefaultBool(cfg.Thumbnail.WebdavAllowInsecure, false), Usage: "Whether to skip certificate checks", EnvVars: []string{"THUMBNAILS_WEBDAVSOURCE_INSECURE"}, Destination: &cfg.Thumbnail.WebdavAllowInsecure, }, + &cli.BoolFlag{ + Name: "cs3source-insecure", + Value: flags.OverrideDefaultBool(cfg.Thumbnail.CS3AllowInsecure, false), + Usage: "Whether to skip certificate checks", + EnvVars: []string{"THUMBNAILS_CS3SOURCE_INSECURE"}, + Destination: &cfg.Thumbnail.CS3AllowInsecure, + }, &cli.StringSliceFlag{ Name: "thumbnail-resolution", Value: cli.NewStringSlice("16x16", "32x32", "64x64", "128x128", "1920x1080", "3840x2160", "7680x4320"), diff --git a/thumbnails/pkg/server/grpc/server.go b/thumbnails/pkg/server/grpc/server.go index 866868d12..ccc99cbae 100644 --- a/thumbnails/pkg/server/grpc/server.go +++ b/thumbnails/pkg/server/grpc/server.go @@ -25,7 +25,7 @@ func NewService(opts ...Option) grpc.Service { grpc.Version(options.Config.Server.Version), ) tconf := options.Config.Thumbnail - gc, err := pool.GetGatewayServiceClient(tconf.RevaGateway) + gc, err := pool.GetGatewayServiceClient(tconf.RevaGateway) //TODO: insecure defaults to true, https://github.com/cs3org/reva/issues/2216 if err != nil { options.Logger.Error().Err(err).Msg("could not get gateway client") return grpc.Service{} @@ -42,7 +42,7 @@ func NewService(opts ...Option) grpc.Service { options.Logger, ), ), - svc.CS3Source(imgsource.NewCS3Source(gc)), + svc.CS3Source(imgsource.NewCS3Source(tconf, gc)), svc.CS3Client(gc), ) thumbnail = svc.NewInstrument(thumbnail, options.Metrics) diff --git a/thumbnails/pkg/thumbnail/imgsource/cs3.go b/thumbnails/pkg/thumbnail/imgsource/cs3.go index 68cf63750..072713978 100644 --- a/thumbnails/pkg/thumbnail/imgsource/cs3.go +++ b/thumbnails/pkg/thumbnail/imgsource/cs3.go @@ -12,6 +12,7 @@ import ( provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" revactx "github.com/cs3org/reva/pkg/ctx" "github.com/cs3org/reva/pkg/rhttp" + "github.com/owncloud/ocis/thumbnails/pkg/config" "github.com/pkg/errors" "google.golang.org/grpc/metadata" ) @@ -23,12 +24,14 @@ const ( ) type CS3 struct { - client gateway.GatewayAPIClient + client gateway.GatewayAPIClient + insecure bool } -func NewCS3Source(c gateway.GatewayAPIClient) CS3 { +func NewCS3Source(cfg config.Thumbnail, c gateway.GatewayAPIClient) CS3 { return CS3{ - client: c, + client: c, + insecure: cfg.CS3AllowInsecure, } } @@ -67,7 +70,9 @@ func (s CS3) Get(ctx context.Context, path string) (io.ReadCloser, error) { httpReq.Header.Set(revactx.TokenHeader, auth) httpReq.Header.Set(TokenTransportHeader, tk) - http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec + http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{ + InsecureSkipVerify: s.insecure, //nolint:gosec + } client := &http.Client{} resp, err := client.Do(httpReq) // nolint:bodyclose