Skip to content

Commit b599968

Browse files
Alevskdvaldivia
andauthored
SNI support for Console (#352)
Co-authored-by: Daniel Valdivia <hola@danielvaldivia.com>
1 parent 24cc60f commit b599968

File tree

9 files changed

+356
-75
lines changed

9 files changed

+356
-75
lines changed

README.md

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,11 +113,41 @@ export CONSOLE_MINIO_SERVER=http://localhost:9000
113113
./console server
114114
```
115115

116+
## Run Console with TLS enable
117+
118+
Copy your `public.crt` and `private.key` to `~/.console/certs`, then:
119+
120+
```bash
121+
./console server
122+
```
123+
124+
Additionally, `Console` has support for multiple certificates, clients can request them using `SNI`. It expects the following structure:
125+
126+
```bash
127+
certs/
128+
129+
├─ public.crt
130+
├─ private.key
131+
132+
├─ example.com/
133+
│ │
134+
│ ├─ public.crt
135+
│ └─ private.key
136+
└─ foobar.org/
137+
138+
├─ public.crt
139+
└─ private.key
140+
...
141+
142+
```
143+
144+
Therefore, we read all filenames in the cert directory and check
145+
for each directory whether it contains a public.crt and private.key.
146+
116147
## Connect Console to a Minio using TLS and a self-signed certificate
117148

149+
Copy the MinIO `ca.crt` under `~/.console/certs/CAs`, then:
118150
```
119-
...
120-
export CONSOLE_MINIO_SERVER_TLS_ROOT_CAS=<certificate_file_name>
121151
export CONSOLE_MINIO_SERVER=https://localhost:9000
122152
./console server
123153
```

cmd/console/server.go

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,16 @@ import (
2020
"fmt"
2121
"log"
2222
"os"
23+
"path/filepath"
2324

2425
"github.com/go-openapi/loads"
2526
"github.com/jessevdk/go-flags"
2627
"github.com/minio/cli"
28+
"github.com/minio/console/pkg/certs"
2729
"github.com/minio/console/restapi"
2830
"github.com/minio/console/restapi/operations"
31+
"github.com/minio/minio/cmd/logger"
32+
certsx "github.com/minio/minio/pkg/certs"
2933
)
3034

3135
// starts the server
@@ -56,14 +60,9 @@ var serverCmd = cli.Command{
5660
Usage: "HTTPS server port",
5761
},
5862
cli.StringFlag{
59-
Name: "tls-certificate",
60-
Value: "",
61-
Usage: "filename of public cert",
62-
},
63-
cli.StringFlag{
64-
Name: "tls-key",
65-
Value: "",
66-
Usage: "filename of private key",
63+
Name: "certs-dir",
64+
Value: certs.GlobalCertsCADir.Get(),
65+
Usage: "path to certs directory",
6766
},
6867
},
6968
}
@@ -82,7 +81,9 @@ func startServer(ctx *cli.Context) error {
8281
parser := flags.NewParser(server, flags.Default)
8382
parser.ShortDescription = "MinIO Console Server"
8483
parser.LongDescription = swaggerSpec.Spec().Info.Description
84+
8585
server.ConfigureFlags()
86+
8687
for _, optsGroup := range api.CommandLineOptionsGroups {
8788
_, err := parser.AddGroup(optsGroup.ShortDescription, optsGroup.LongDescription, optsGroup.Options)
8889
if err != nil {
@@ -106,12 +107,19 @@ func startServer(ctx *cli.Context) error {
106107
restapi.Hostname = ctx.String("host")
107108
restapi.Port = fmt.Sprintf("%v", ctx.Int("port"))
108109

109-
tlsCertificatePath := ctx.String("tls-certificate")
110-
tlsCertificateKeyPath := ctx.String("tls-key")
110+
// Set all certs and CAs directories.
111+
globalCertsDir, _ := certs.NewConfigDirFromCtx(ctx, "certs-dir", certs.DefaultCertsDir.Get)
112+
certs.GlobalCertsCADir = &certs.ConfigDir{Path: filepath.Join(globalCertsDir.Get(), certs.CertsCADir)}
113+
logger.FatalIf(certs.MkdirAllIgnorePerm(certs.GlobalCertsCADir.Get()), "Unable to create certs CA directory at %s", certs.GlobalCertsCADir.Get())
114+
115+
// load all CAs from ~/.console/certs/CAs
116+
restapi.GlobalRootCAs, err = certsx.GetRootCAs(certs.GlobalCertsCADir.Get())
117+
logger.FatalIf(err, "Failed to read root CAs (%v)", err)
118+
// load all certs from ~/.console/certs
119+
restapi.GlobalPublicCerts, restapi.GlobalTLSCertsManager, err = certs.GetTLSConfig()
120+
logger.FatalIf(err, "Unable to load the TLS configuration")
111121

112-
if tlsCertificatePath != "" && tlsCertificateKeyPath != "" {
113-
server.TLSCertificate = flags.Filename(tlsCertificatePath)
114-
server.TLSCertificateKey = flags.Filename(tlsCertificateKeyPath)
122+
if len(restapi.GlobalPublicCerts) > 0 && restapi.GlobalRootCAs != nil {
115123
// If TLS certificates are provided enforce the HTTPS schema, meaning console will redirect
116124
// plain HTTP connections to HTTPS server
117125
server.EnabledListeners = []string{"http", "https"}

go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ require (
2020
github.com/minio/minio v0.0.0-20200927172404-27d9bd04e544
2121
github.com/minio/minio-go/v7 v7.0.6-0.20200923173112-bc846cb9b089
2222
github.com/minio/operator v0.0.0-20200930213302-ab2bbdfae96c
23+
github.com/mitchellh/go-homedir v1.1.0
2324
github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
2425
github.com/secure-io/sio-go v0.3.1
2526
github.com/stretchr/testify v1.6.1

pkg/certs/certs.go

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
// This file is part of MinIO Console Server
2+
// Copyright (c) 2020 MinIO, Inc.
3+
//
4+
// This program is free software: you can redistribute it and/or modify
5+
// it under the terms of the GNU Affero General Public License as published by
6+
// the Free Software Foundation, either version 3 of the License, or
7+
// (at your option) any later version.
8+
//
9+
// This program is distributed in the hope that it will be useful,
10+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
// GNU Affero General Public License for more details.
13+
//
14+
// You should have received a copy of the GNU Affero General Public License
15+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
16+
17+
package certs
18+
19+
import (
20+
"context"
21+
"crypto/x509"
22+
"errors"
23+
"fmt"
24+
"os"
25+
"path/filepath"
26+
"strings"
27+
28+
"github.com/minio/cli"
29+
"github.com/minio/minio/cmd/config"
30+
"github.com/minio/minio/cmd/logger"
31+
"github.com/minio/minio/pkg/certs"
32+
"github.com/mitchellh/go-homedir"
33+
)
34+
35+
type GetCertificateFunc = certs.GetCertificateFunc
36+
37+
// ConfigDir - points to a user set directory.
38+
type ConfigDir struct {
39+
Path string
40+
}
41+
42+
// Get - returns current directory.
43+
func (dir *ConfigDir) Get() string {
44+
return dir.Path
45+
}
46+
47+
func getDefaultConfigDir() string {
48+
homeDir, err := homedir.Dir()
49+
if err != nil {
50+
return ""
51+
}
52+
return filepath.Join(homeDir, DefaultConsoleConfigDir)
53+
}
54+
55+
func getDefaultCertsDir() string {
56+
return filepath.Join(getDefaultConfigDir(), CertsDir)
57+
}
58+
59+
func getDefaultCertsCADir() string {
60+
return filepath.Join(getDefaultCertsDir(), CertsCADir)
61+
}
62+
63+
// isFile - returns whether given Path is a file or not.
64+
func isFile(path string) bool {
65+
if fi, err := os.Stat(path); err == nil {
66+
return fi.Mode().IsRegular()
67+
}
68+
69+
return false
70+
}
71+
72+
var (
73+
// DefaultCertsDir certs directory.
74+
DefaultCertsDir = &ConfigDir{Path: getDefaultCertsDir()}
75+
// DefaultCertsCADir CA directory.
76+
DefaultCertsCADir = &ConfigDir{Path: getDefaultCertsCADir()}
77+
// GlobalCertsDir points to current certs directory set by user with --certs-dir
78+
GlobalCertsDir = DefaultCertsDir
79+
// GlobalCertsCADir points to relative Path to certs directory and is <value-of-certs-dir>/CAs
80+
GlobalCertsCADir = DefaultCertsCADir
81+
)
82+
83+
// MkdirAllIgnorePerm attempts to create all directories, ignores any permission denied errors.
84+
func MkdirAllIgnorePerm(path string) error {
85+
err := os.MkdirAll(path, 0700)
86+
if err != nil {
87+
// It is possible in kubernetes like deployments this directory
88+
// is already mounted and is not writable, ignore any write errors.
89+
if os.IsPermission(err) {
90+
err = nil
91+
}
92+
}
93+
return err
94+
}
95+
96+
func NewConfigDirFromCtx(ctx *cli.Context, option string, getDefaultDir func() string) (*ConfigDir, bool) {
97+
var dir string
98+
var dirSet bool
99+
100+
switch {
101+
case ctx.IsSet(option):
102+
dir = ctx.String(option)
103+
dirSet = true
104+
case ctx.GlobalIsSet(option):
105+
dir = ctx.GlobalString(option)
106+
dirSet = true
107+
// cli package does not expose parent's option option. Below code is workaround.
108+
if dir == "" || dir == getDefaultDir() {
109+
dirSet = false // Unset to false since GlobalIsSet() true is a false positive.
110+
if ctx.Parent().GlobalIsSet(option) {
111+
dir = ctx.Parent().GlobalString(option)
112+
dirSet = true
113+
}
114+
}
115+
default:
116+
// Neither local nor global option is provided. In this case, try to use
117+
// default directory.
118+
dir = getDefaultDir()
119+
if dir == "" {
120+
logger.FatalIf(errors.New("invalid arguments specified"), "%s option must be provided", option)
121+
}
122+
}
123+
124+
if dir == "" {
125+
logger.FatalIf(errors.New("empty directory"), "%s directory cannot be empty", option)
126+
}
127+
128+
// Disallow relative paths, figure out absolute paths.
129+
dirAbs, err := filepath.Abs(dir)
130+
logger.FatalIf(err, "Unable to fetch absolute path for %s=%s", option, dir)
131+
logger.FatalIf(MkdirAllIgnorePerm(dirAbs), "Unable to create directory specified %s=%s", option, dir)
132+
133+
return &ConfigDir{Path: dirAbs}, dirSet
134+
}
135+
136+
func getPublicCertFile() string {
137+
return filepath.Join(GlobalCertsDir.Get(), PublicCertFile)
138+
}
139+
140+
func getPrivateKeyFile() string {
141+
return filepath.Join(GlobalCertsDir.Get(), PrivateKeyFile)
142+
}
143+
144+
func GetTLSConfig() (x509Certs []*x509.Certificate, manager *certs.Manager, err error) {
145+
146+
ctx := context.Background()
147+
148+
if !(isFile(getPublicCertFile()) && isFile(getPrivateKeyFile())) {
149+
return nil, nil, nil
150+
}
151+
152+
if x509Certs, err = config.ParsePublicCertFile(getPublicCertFile()); err != nil {
153+
return nil, nil, err
154+
}
155+
156+
manager, err = certs.NewManager(ctx, getPublicCertFile(), getPrivateKeyFile(), config.LoadX509KeyPair)
157+
if err != nil {
158+
return nil, nil, err
159+
}
160+
161+
//Console has support for multiple certificates. It expects the following structure:
162+
// certs/
163+
// │
164+
// ├─ public.crt
165+
// ├─ private.key
166+
// │
167+
// ├─ example.com/
168+
// │ │
169+
// │ ├─ public.crt
170+
// │ └─ private.key
171+
// └─ foobar.org/
172+
// │
173+
// ├─ public.crt
174+
// └─ private.key
175+
// ...
176+
//
177+
//Therefore, we read all filenames in the cert directory and check
178+
//for each directory whether it contains a public.crt and private.key.
179+
// If so, we try to add it to certificate manager.
180+
root, err := os.Open(GlobalCertsDir.Get())
181+
if err != nil {
182+
return nil, nil, err
183+
}
184+
defer root.Close()
185+
186+
files, err := root.Readdir(-1)
187+
if err != nil {
188+
return nil, nil, err
189+
}
190+
for _, file := range files {
191+
// Ignore all
192+
// - regular files
193+
// - "CAs" directory
194+
// - any directory which starts with ".."
195+
if file.Mode().IsRegular() || file.Name() == "CAs" || strings.HasPrefix(file.Name(), "..") {
196+
continue
197+
}
198+
if file.Mode()&os.ModeSymlink == os.ModeSymlink {
199+
file, err = os.Stat(filepath.Join(root.Name(), file.Name()))
200+
if err != nil {
201+
// not accessible ignore
202+
continue
203+
}
204+
if !file.IsDir() {
205+
continue
206+
}
207+
}
208+
209+
var (
210+
certFile = filepath.Join(root.Name(), file.Name(), PublicCertFile)
211+
keyFile = filepath.Join(root.Name(), file.Name(), PrivateKeyFile)
212+
)
213+
if !isFile(certFile) || !isFile(keyFile) {
214+
continue
215+
}
216+
if err = manager.AddCertificate(certFile, keyFile); err != nil {
217+
err = fmt.Errorf("unable to load TLS certificate '%s,%s': %w", certFile, keyFile, err)
218+
logger.LogIf(ctx, err, logger.Application)
219+
}
220+
}
221+
return x509Certs, manager, nil
222+
}

pkg/certs/const.go

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// This file is part of MinIO Console Server
2+
// Copyright (c) 2020 MinIO, Inc.
3+
//
4+
// This program is free software: you can redistribute it and/or modify
5+
// it under the terms of the GNU Affero General Public License as published by
6+
// the Free Software Foundation, either version 3 of the License, or
7+
// (at your option) any later version.
8+
//
9+
// This program is distributed in the hope that it will be useful,
10+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
// GNU Affero General Public License for more details.
13+
//
14+
// You should have received a copy of the GNU Affero General Public License
15+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
16+
17+
package certs
18+
19+
const (
20+
// Default minio configuration directory where below configuration files/directories are stored.
21+
DefaultConsoleConfigDir = ".console"
22+
23+
// Directory contains below files/directories for HTTPS configuration.
24+
CertsDir = "certs"
25+
26+
// Directory contains all CA certificates other than system defaults for HTTPS.
27+
CertsCADir = "CAs"
28+
29+
// Public certificate file for HTTPS.
30+
PublicCertFile = "public.crt"
31+
32+
// Private key file for HTTPS.
33+
PrivateKeyFile = "private.key"
34+
)

0 commit comments

Comments
 (0)