asteris-llc/converge

// Copyright © 2016 Asteris, LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package rpc

import (
    "crypto/tls"
    "crypto/x509"
    "io/ioutil"
    "net"

    "github.com/Sirupsen/logrus"
    "github.com/pkg/errors"
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
)

// Security configuration for
type Security struct {
    Token string

    UseSSL   bool
    CAFile   string
    CertFile string // server only
    KeyFile  string // server only
}

// Server return a server option with the certificate credentials
func (s *Security) Server() (out []grpc.ServerOption) {
    if s.Token != "" {
        jwt := NewJWTAuth(s.Token)
        out = append(out, grpc.UnaryInterceptor(jwt.UnaryInterceptor))
        out = append(out, grpc.StreamInterceptor(jwt.StreamInterceptor))
    }

    return out
}

// WrapListener wraps a listener in a tls.Listener
func (s *Security) WrapListener(lis net.Listener) (net.Listener, error) {
    if s.CertFile == "" || s.KeyFile == "" {
        return nil, errors.New("need both certificate and key file")
    }

    cert, err := tls.LoadX509KeyPair(s.CertFile, s.KeyFile)
    if err != nil {
        return nil, errors.Wrap(err, "failed to load certificates")
    }

    config := &tls.Config{
        MinVersion:               tls.VersionTLS12,
        CurvePreferences:         []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256},
        PreferServerCipherSuites: true,
        CipherSuites: []uint16{
            tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
            tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_RSA_WITH_AES_256_CBC_SHA,
        },

        Certificates: []tls.Certificate{cert},
    }

    return tls.NewListener(lis, config), nil
}

// Client returns a dial option for clients
func (s *Security) Client() (out []grpc.DialOption, err error) {
    if s.Token != "" {
        out = append(out, grpc.WithPerRPCCredentials(NewJWTAuth(s.Token)))
    }

    if s.UseSSL {
        logrus.Debug("setting up SSL")

        config, err := s.TLSConfig()
        if err != nil {
            return nil, err
        }

        out = append(out, grpc.WithTransportCredentials(credentials.NewTLS(config)))
    } else {
        logrus.Debug("not using SSL for client")

        out = append(out, grpc.WithInsecure())
    }

    return out, nil
}

// TLSConfig gets a TLS Config from this Security
func (s *Security) TLSConfig() (*tls.Config, error) {
    config := new(tls.Config)
    if s.CAFile != "" {
        certBytes, err := ioutil.ReadFile(s.CAFile)
        if err != nil {
            return nil, errors.Wrap(err, "could not load CA certificate")
        }
        logrus.WithField("cafile", s.CAFile).Debug("read CA certificate")

        roots := x509.NewCertPool()
        if !roots.AppendCertsFromPEM(certBytes) {
            return nil, errors.New("could not append CA certificate as PEM")
        }
        logrus.WithField("cafile", s.CAFile).Debug("loaded CA certificate as PEM")

        config.RootCAs = roots
    }

    return config, nil
}