Merge pull request #499 from positiveblue/lit-tls-cert

multi: always use Lit's TLS cert

Author: guggero

cmd/litcli/main.go

@@ -11,7 +11,6 @@ import (
 	"github.com/lightninglabs/lndclient"
 	"github.com/lightninglabs/protobuf-hex-display/jsonpb"
 	"github.com/lightninglabs/protobuf-hex-display/proto"
-	"github.com/lightningnetwork/lnd"
 	"github.com/lightningnetwork/lnd/lncfg"
 	"github.com/lightningnetwork/lnd/macaroons"
 	"github.com/urfave/cli"
@@ -47,16 +46,6 @@ var (
 		Usage: "path to lit's TLS certificate",
 		Value: terminal.DefaultTLSCertPath,
 	}
-	lndMode = cli.StringFlag{
-		Name:  "lndmode",
-		Usage: "the mode that lnd is running in: remote or integrated",
-		Value: terminal.ModeIntegrated,
-	}
-	lndTlsCertFlag = cli.StringFlag{
-		Name:  "lndtlscertpath",
-		Usage: "path to lnd's TLS certificate",
-		Value: lnd.DefaultConfig().TLSCertPath,
-	}
 	macaroonPathFlag = cli.StringFlag{
 		Name:  "macaroonpath",
 		Usage: "path to lit's macaroon file",
@@ -78,9 +67,7 @@ func main() {
 		},
 		networkFlag,
 		baseDirFlag,
-		lndMode,
 		tlsCertFlag,
-		lndTlsCertFlag,
 		macaroonPathFlag,
 	}
 	app.Commands = append(app.Commands, sessionCommands...)
@@ -175,18 +162,6 @@ func extractPathArgs(ctx *cli.Context) (string, string, error) {
 		)
 	}
 
-	// Get the LND mode. If Lit is in integrated LND mode, then LND's tls
-	// cert is used directly. Otherwise, Lit's own tls cert is used.
-	lndmode := strings.ToLower(ctx.GlobalString(lndMode.Name))
-	if lndmode == terminal.ModeIntegrated {
-		tlsCertPath := lncfg.CleanAndExpandPath(ctx.GlobalString(
-			lndTlsCertFlag.Name,
-		))
-
-		return tlsCertPath, macaroonPath, nil
-	}
-
-	// Lit is in remote LND mode. So we need Lit's tls cert.
 	tlsCertPath := lncfg.CleanAndExpandPath(ctx.GlobalString(
 		tlsCertFlag.Name,
 	))

config.go

@@ -152,6 +152,9 @@ type Config struct {
 	LetsEncryptDir    string `long:"letsencryptdir" description:"The directory where the Let's Encrypt library will store its key and certificate."`
 	LetsEncryptListen string `long:"letsencryptlisten" description:"The IP:port on which LiT will listen for Let's Encrypt challenges. Let's Encrypt will always try to contact on port 80. Often non-root processes are not allowed to bind to ports lower than 1024. This configuration option allows a different port to be used, but must be used in combination with port forwarding from port 80. This configuration can also be used to specify another IP address to listen on, for example an IPv6 address."`
 
+	TLSCertPath string `long:"tlscertpath" description:"Path to write the self signed TLS certificate for LiT's RPC and REST proxy service (if Let's Encrypt is not used). This only applies to the HTTPSListen port."`
+	TLSKeyPath  string `long:"tlskeypath" description:"Path to write the self signed TLS private key for LiT's RPC and REST proxy service (if Let's Encrypt is not used). This only applies to the HTTPSListen port."`
+
 	LitDir     string `long:"lit-dir" description:"The main directory where LiT looks for its configuration file. If LiT is running in 'remote' lnd mode, this is also the directory where the TLS certificates and log files are stored by default."`
 	ConfigFile string `long:"configfile" description:"Path to LiT's configuration file."`
 
@@ -211,9 +214,6 @@ type Config struct {
 // RemoteConfig holds the configuration parameters that are needed when running
 // LiT in the "remote" lnd mode.
 type RemoteConfig struct {
-	LitTLSCertPath string `long:"lit-tlscertpath" description:"For lnd remote mode only: Path to write the self signed TLS certificate for LiT's RPC and REST proxy service (if Let's Encrypt is not used)."`
-	LitTLSKeyPath  string `long:"lit-tlskeypath" description:"For lnd remote mode only: Path to write the self signed TLS private key for LiT's RPC and REST proxy service (if Let's Encrypt is not used)."`
-
 	LitLogDir         string `long:"lit-logdir" description:"For lnd remote mode only: Directory to log output."`
 	LitMaxLogFiles    int    `long:"lit-maxlogfiles" description:"For lnd remote mode only: Maximum logfiles to keep (0 for no rotation)"`
 	LitMaxLogFileSize int    `long:"lit-maxlogfilesize" description:"For lnd remote mode only: Maximum logfile size in MB"`
@@ -286,9 +286,9 @@ func (c *Config) lndConnectParams() (string, lndclient.Network, string,
 func defaultConfig() *Config {
 	return &Config{
 		HTTPSListen: defaultHTTPSListen,
+		TLSCertPath: DefaultTLSCertPath,
+		TLSKeyPath:  defaultTLSKeyPath,
 		Remote: &RemoteConfig{
-			LitTLSCertPath:    DefaultTLSCertPath,
-			LitTLSKeyPath:     defaultTLSKeyPath,
 			LitDebugLevel:     defaultLogLevel,
 			LitLogDir:         defaultLogDir,
 			LitMaxLogFiles:    defaultMaxLogFiles,
@@ -598,6 +598,33 @@ func loadConfigFile(preCfg *Config, interceptor signal.Interceptor) (*Config,
 		return nil, fmt.Errorf("invalid lnd mode %v", cfg.LndMode)
 	}
 
+	// If the provided lit directory is not the default, we'll modify the
+	// path to all of the files and directories that will live within it.
+	if litDir != DefaultLitDir {
+		if cfg.TLSKeyPath == defaultTLSKeyPath {
+			cfg.TLSKeyPath = filepath.Join(
+				litDir, DefaultTLSKeyFilename,
+			)
+		}
+
+		if cfg.TLSCertPath == DefaultTLSCertPath {
+			cfg.TLSCertPath = filepath.Join(
+				litDir, DefaultTLSCertFilename,
+			)
+		}
+	}
+
+	cfg.TLSCertPath = lncfg.CleanAndExpandPath(cfg.TLSCertPath)
+	cfg.TLSKeyPath = lncfg.CleanAndExpandPath(cfg.TLSKeyPath)
+
+	// Make sure the parent directories of our certificate files exist.
+	if err := makeDirectories(filepath.Dir(cfg.TLSCertPath)); err != nil {
+		return nil, err
+	}
+	if err := makeDirectories(filepath.Dir(cfg.TLSKeyPath)); err != nil {
+		return nil, err
+	}
+
 	// Warn about missing config file only after all other configuration is
 	// done. This prevents the warning on help messages and invalid options.
 	// Note this should go directly before the return.
@@ -637,25 +664,15 @@ func validateRemoteModeConfig(cfg *Config) error {
 	// path to all of the files and directories that will live within it.
 	litDir := lnd.CleanAndExpandPath(cfg.LitDir)
 	if litDir != DefaultLitDir {
-		r.LitTLSCertPath = filepath.Join(litDir, DefaultTLSCertFilename)
-		r.LitTLSKeyPath = filepath.Join(litDir, DefaultTLSKeyFilename)
-		r.LitLogDir = filepath.Join(litDir, defaultLogDirname)
+		if r.LitLogDir == defaultLogDir {
+			r.LitLogDir = filepath.Join(
+				litDir, defaultLogDirname,
+			)
+		}
 	}
 
-	r.LitTLSCertPath = lncfg.CleanAndExpandPath(r.LitTLSCertPath)
-	r.LitTLSKeyPath = lncfg.CleanAndExpandPath(r.LitTLSKeyPath)
 	r.LitLogDir = lncfg.CleanAndExpandPath(r.LitLogDir)
 
-	// Make sure the parent directories of our certificate files exist. We
-	// don't need to do the same for the log dir as the log rotator will do
-	// just that.
-	if err := makeDirectories(filepath.Dir(r.LitTLSCertPath)); err != nil {
-		return err
-	}
-	if err := makeDirectories(filepath.Dir(r.LitTLSKeyPath)); err != nil {
-		return err
-	}
-
 	// In remote mode, we don't call lnd's ValidateConfig that sets up a
 	// logging backend for us. We need to manually create and start one. The
 	// root logger should've already been created as part of the default
@@ -745,8 +762,7 @@ func readUIPassword(config *Config) error {
 func buildTLSConfigForHttp2(config *Config) (*tls.Config, error) {
 	var tlsConfig *tls.Config
 
-	switch {
-	case config.LetsEncrypt:
+	if config.LetsEncrypt {
 		serverName := config.LetsEncryptHost
 		if serverName == "" {
 			return nil, errors.New("let's encrypt host name " +
@@ -782,10 +798,9 @@ func buildTLSConfigForHttp2(config *Config) (*tls.Config, error) {
 		tlsConfig = &tls.Config{
 			GetCertificate: manager.GetCertificate,
 		}
-
-	case config.LndMode == ModeRemote:
-		tlsCertPath := config.Remote.LitTLSCertPath
-		tlsKeyPath := config.Remote.LitTLSKeyPath
+	} else {
+		tlsCertPath := config.TLSCertPath
+		tlsKeyPath := config.TLSKeyPath
 
 		if !lnrpc.FileExists(tlsCertPath) &&
 			!lnrpc.FileExists(tlsKeyPath) {
@@ -807,16 +822,6 @@ func buildTLSConfigForHttp2(config *Config) (*tls.Config, error) {
 				"keys: %v", err)
 		}
 		tlsConfig = cert.TLSConfFromCert(tlsCert)
-
-	default:
-		tlsCert, _, err := cert.LoadCert(
-			config.Lnd.TLSCertPath, config.Lnd.TLSKeyPath,
-		)
-		if err != nil {
-			return nil, fmt.Errorf("failed reading TLS server "+
-				"keys: %v", err)
-		}
-		tlsConfig = cert.TLSConfFromCert(tlsCert)
 	}
 
 	// lnd's cipher suites are too restrictive for HTTP/2, we need to add

doc/config-lnd-integrated.md

@@ -71,6 +71,8 @@ Example `~/.lit/lit.conf`:
 ```text
 # Application Options
 httpslisten=0.0.0.0:8443
+tlscertpath=~/.lit/tls.cert
+tlskeypath=~/.lit/tls.key
 letsencrypt=true
 letsencrypthost=loop.merchant.com
 lnd-mode=integrated
@@ -117,6 +119,15 @@ system:
 - **On Linux**: `~/.lit/lit.conf`
 - **On Windows**: `~/AppData/Roaming/Lit/lit.conf`
 
+## LiT and LND interfaces
+
+Port 10009 is the port that LND uses to expose its gRPC interface. LND's tls 
+cert and macaroons will be required when making requests to this interface.
+
+Port 8443 is a port that LiT uses to expose a variety of interfaces: gRPC, 
+REST, grpc-web. When making requests using this interface, LiT's tls cert and 
+macaroons should be used. 
+
 ## Upgrade Existing Nodes
 
 If you already have existing `lnd`, `loop`, or `faraday` nodes, you can easily
@@ -294,7 +305,7 @@ running standalone. The `--lnddir` flag does not need to be specified as long
 as it is the default directory (`~/.lnd` on Linux).
 
 ```shell
-⛰  lncli --network=testnet getinfo
+⛰  lncli --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert getinfo
 ```
 
 ### Example `loop` command
@@ -305,7 +316,7 @@ runs on the same gRPC server as `lnd`. That's why we have to both specify the
 own macaroon, so we have to specify that one from the `.loop` directory.
 
 ```shell
-⛰  loop --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert \
+⛰  loop --rpcserver=localhost:8443 --tlscertpath=~/.lit/tls.cert \
   --macaroonpath=~/.loop/testnet/loop.macaroon \
   quote out 500000
 ```
@@ -314,7 +325,7 @@ You can easily create an alias for this by adding the following line to your
 `~/.bashrc` file:
 
 ```shell
-⛰  alias lit-loop="loop --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert --macaroonpath=~/.loop/testnet/loop.macaroon"
+⛰  alias lit-loop="loop --rpcserver=localhost:8443 --tlscertpath=~/.lit/tls.cert --macaroonpath=~/.loop/testnet/loop.macaroon"
 ```
 
 ### Example `pool` command
@@ -324,7 +335,7 @@ the `host:port` and the TLS certificate of `lnd` but use the macaroon from the
 `.pool` directory.
 
 ```shell
-⛰  pool --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert \
+⛰  pool --rpcserver=localhost:8443 --tlscertpath=~/.lit/tls.cert \
   --macaroonpath=~/.pool/testnet/pool.macaroon \
   accounts list
 ```
@@ -333,7 +344,7 @@ You can easily create an alias for this by adding the following line to your
 `~/.bashrc` file:
 
 ```shell
-⛰  alias lit-pool="pool --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert --macaroonpath=~/.pool/testnet/pool.macaroon"
+⛰  alias lit-pool="pool --rpcserver=localhost:8443 --tlscertpath=~/.lit/tls.cert --macaroonpath=~/.pool/testnet/pool.macaroon"
 ```
 
 ### Example `frcli` command
@@ -342,7 +353,7 @@ Faraday's command line tool follows the same pattern as loop. We also have to
 specify the server and TLS flags for `lnd` but use `faraday`'s macaroon:
 
 ```shell
-⛰  frcli --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert \
+⛰  frcli --rpcserver=localhost:8443 --tlscertpath=~/.lit/tls.cert \
   --macaroonpath=~/.faraday/testnet/faraday.macaroon \
   audit
 ```
@@ -351,7 +362,7 @@ You can easily create an alias for this by adding the following line to your
 `~/.bashrc` file:
 
 ```shell
-⛰  alias lit-frcli="frcli --rpcserver=localhost:10009 --tlscertpath=~/.lnd/tls.cert --macaroonpath=~/.faraday/testnet/faraday.macaroon"
+⛰  alias lit-frcli="frcli --rpcserver=localhost:8443 --tlscertpath=~/.lit/tls.cert --macaroonpath=~/.faraday/testnet/faraday.macaroon"
 ```
 
 ## Shutting down LiT

itest/litd_accounts_test.go

@@ -91,6 +91,7 @@ func runAccountSystemTest(t *harnessTest, node *HarnessNode, hostPort,
 	// authentication mechanism.
 	rawConn, err := connectRPC(ctxt, hostPort, tlsCertPath)
 	require.NoError(t.t, err)
+	defer rawConn.Close()
 
 	macBytes, err := ioutil.ReadFile(macPath)
 	require.NoError(t.t, err)
@@ -192,6 +193,7 @@ func testAccountRestrictionsLNC(ctxm context.Context, t *harnessTest,
 
 	rawLNCConn, err := connectMailboxWithPairingPhrase(ctxt, connectPhrase)
 	require.NoError(t.t, err)
+	defer rawLNCConn.Close()
 
 	lightningClient := lnrpc.NewLightningClient(rawLNCConn)
 

itest/litd_firewall_test.go

@@ -168,8 +168,9 @@ func testFWRateLimitAndPrivacyMapper(net *NetworkHarness, t *harnessTest) {
 
 	// We create a connection to the Alice node's RPC server.
 	cfg := net.Alice.Cfg
-	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.TLSCertPath)
+	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.LitTLSCertPath)
 	require.NoError(t.t, err)
+	defer rawConn.Close()
 
 	macBytes, err := ioutil.ReadFile(cfg.LitMacPath)
 	require.NoError(t.t, err)
@@ -377,8 +378,8 @@ func assertStatusErr(t *testing.T, err error, code codes.Code) {
 
 // testFirewallRules tests that the various firewall rules are enforced
 // correctly.
-func testFirewallRules(net *NetworkHarness, t *harnessTest) {
-	ctx := context.Background()
+func testFirewallRules(ctx context.Context, net *NetworkHarness,
+	t *harnessTest) {
 
 	// Some very basic functionality tests to make sure lnd is working fine
 	// in integrated mode.
@@ -419,8 +420,9 @@ func testHistoryLimitRule(net *NetworkHarness, t *harnessTest) {
 
 	// We create a connection to the Alice node's RPC server.
 	cfg := net.Alice.Cfg
-	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.TLSCertPath)
+	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.LitTLSCertPath)
 	require.NoError(t.t, err)
+	defer rawConn.Close()
 
 	macBytes, err := ioutil.ReadFile(cfg.LitMacPath)
 	require.NoError(t.t, err)
@@ -595,8 +597,9 @@ func testChanPolicyBoundsRule(net *NetworkHarness, t *harnessTest) {
 
 	// We create a connection to the Alice node's RPC server.
 	cfg := net.Alice.Cfg
-	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.TLSCertPath)
+	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.LitTLSCertPath)
 	require.NoError(t.t, err)
+	defer rawConn.Close()
 
 	macBytes, err := ioutil.ReadFile(cfg.LitMacPath)
 	require.NoError(t.t, err)
@@ -843,8 +846,9 @@ func testPeerAndChannelRestrictRules(net *NetworkHarness, t *harnessTest) {
 
 	// We create a connection to the Alice node's RPC server.
 	cfg := net.Alice.Cfg
-	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.TLSCertPath)
+	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.LitTLSCertPath)
 	require.NoError(t.t, err)
+	defer rawConn.Close()
 
 	macBytes, err := ioutil.ReadFile(cfg.LitMacPath)
 	require.NoError(t.t, err)
@@ -1138,8 +1142,8 @@ func testPeerAndChannelRestrictRules(net *NetworkHarness, t *harnessTest) {
 	require.NoError(t.t, err)
 }
 
-func testLargeHttpHeader(net *NetworkHarness, t *harnessTest) {
-	ctx := context.Background()
+func testLargeHttpHeader(ctx context.Context, net *NetworkHarness,
+	t *harnessTest) {
 
 	// First we add all LND's permissions so that any call we make to LND to
 	// test that the connection is working will succeed.
@@ -1175,8 +1179,9 @@ func testLargeHttpHeader(net *NetworkHarness, t *harnessTest) {
 
 	// We create a connection to the Alice node's RPC server.
 	cfg := net.Alice.Cfg
-	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.TLSCertPath)
+	rawConn, err := connectRPC(ctx, cfg.LitAddr(), cfg.LitTLSCertPath)
 	require.NoError(t.t, err)
+	defer rawConn.Close()
 
 	macBytes, err := ioutil.ReadFile(cfg.LitMacPath)
 	require.NoError(t.t, err)