Support client side tls certificates reload

[kezhuw]

This allows creating a client with dynamic tls certificates. When created this way, on reconnection the client will use latest tls certificates.

This allows us to have auto-reloading of refreshed certificates stored anywhere in client side.

Resolves #59.

[kezhuw]

@behos Would you mind take a look ? Does it solve your concerns ? I included a file-based certs in test.

zookeeper-client-rust/src/tls/client.rs

Lines 352 to 452 in a7a17be

	struct FileBasedDynamicCerts {
	ca: Ca,
	dir: TempDir,
	certs: TlsDynamicCerts,
	feedback: UnboundedReceiver<()>,
	_task: TaskHandle<()>,
	}
	struct EventSender {
	sender: UnboundedSender<Event>,
	}
	impl notify::EventHandler for EventSender {
	fn handle_event(&mut self, event: Result<Event, notify::Error>) {
	if let Ok(event) = event {
	self.sender.unbounded_send(event).unwrap();
	}
	}
	}
	impl FileBasedDynamicCerts {
	pub fn new(ca: Ca, client_name: &str) -> Self {
	let dir = TempDir::new().unwrap();
	Self::generate_cert(&ca, dir.path(), client_name);
	let (certs, feedback, _task) = Self::load_dynamic_certs(dir.path());
	Self { ca, dir, certs, feedback, _task }
	}
	fn load_dynamic_certs(dir: &Path) -> (TlsDynamicCerts, UnboundedReceiver<()>, TaskHandle<()>) {
	let cert_path = dir.join("cert.pem").to_path_buf();
	let key_path = dir.join("cert.key.pem").to_path_buf();
	let mut cert_modified = std::fs::metadata(&cert_path).unwrap().modified().unwrap();
	let mut key_modified = std::fs::metadata(&key_path).unwrap().modified().unwrap();
	let client_cert = std::fs::read_to_string(&cert_path).unwrap();
	let client_key = std::fs::read_to_string(&key_path).unwrap();
	let dynamic_certs =
	TlsDynamicCerts::new(TlsCerts::default().with_pem_identity(&client_cert, &client_key).unwrap());
	let dynamic_certs_updator = dynamic_certs.clone();
	let (feedback_sender, feedback_receiver) = mpsc::unbounded();
	let task = asyncs::spawn(async move {
	let (tx, mut rx) = mpsc::unbounded();
	let mut watcher = notify::recommended_watcher(EventSender { sender: tx }).unwrap();
	watcher.watch(&cert_path, RecursiveMode::NonRecursive).unwrap();
	watcher.watch(&key_path, RecursiveMode::NonRecursive).unwrap();
	while rx.next().await.is_some() {
	let updated_cert_modified = std::fs::metadata(&cert_path).unwrap().modified().unwrap();
	let updated_key_modified = std::fs::metadata(&key_path).unwrap().modified().unwrap();
	if updated_cert_modified <= cert_modified || updated_key_modified <= key_modified {
	continue;
	}
	cert_modified = updated_cert_modified;
	key_modified = updated_key_modified;
	let client_cert = std::fs::read_to_string(&cert_path).unwrap();
	let client_key = std::fs::read_to_string(&key_path).unwrap();
	dynamic_certs_updator
	.update(TlsCerts::default().with_pem_identity(&client_cert, &client_key).unwrap());
	feedback_sender.unbounded_send(()).unwrap();
	}
	})
	.attach();
	(dynamic_certs, feedback_receiver, task)
	}
	fn generate_cert(ca: &Ca, dir: &Path, name: &str) {
	let client_cert = generate_client_cert(name, &ca.issuer);
	let file = AtomicWriteFile::open(dir.join("cert.pem")).unwrap();
	write!(&file, "{}", client_cert.cert.pem()).unwrap();
	file.commit().unwrap();
	let file = AtomicWriteFile::open(dir.join("cert.key.pem")).unwrap();
	write!(&file, "{}", client_cert.signing_key.serialize_pem()).unwrap();
	file.commit().unwrap();
	}
	pub async fn regenerate_cert(&mut self, client_name: &str) {
	Self::generate_cert(&self.ca, self.dir.path(), client_name);
	self.feedback.next().await;
	}
	}
	#[asyncs::test]
	async fn with_file_based_dynamic_certs() {
	let (ca, listener) = listen().await;
	let options = TlsOptions::new().with_pem_ca_certs(&ca.cert.pem()).unwrap();
	let mut certs = FileBasedDynamicCerts::new(ca, "client1");
	let options = options.with_certs(certs.certs.clone());
	let client = options.into_client().unwrap();
	assert_client_name(&listener, &client, "client1").await;
	certs.regenerate_cert("client2").await;
	assert_client_name(&listener, &client, "client2").await;
	}

[behos]

LGTM, the file based implementation can either be exposed here or delegated to external services.

[behos]

Do you think it's worth having a FileBased implementation into the main package so that it's easily reusable?

[kezhuw]

I think such an official file based implementation may have biased on the change detection. And, worse, it will propgate this to applications. I think we should avoid such a thing in library.

[behos]

That sounds good to me! The example looks clean enough to use as a basis for an implementation anyway. Thanks

[behos]

I'm trying to use this from the branch and it seems it's not visible.

[kezhuw]

My fault! I have referenced it in integration test.

[behos]

Thanks, I was able to create and test a simple file-based reloader that can be plugged into the new structs. It works great