zrok/controller/tunnel.go

268 lines
9.2 KiB
Go
Raw Normal View History

2022-07-26 22:21:49 +02:00
package controller
import (
"context"
2022-07-26 22:36:47 +02:00
"fmt"
2022-07-26 22:21:49 +02:00
"github.com/go-openapi/runtime/middleware"
2022-07-29 22:03:53 +02:00
"github.com/openziti-test-kitchen/zrok/controller/store"
2022-08-15 21:06:57 +02:00
"github.com/openziti-test-kitchen/zrok/model"
2022-07-26 22:21:49 +02:00
"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/tunnel"
2022-07-27 15:49:54 +02:00
"github.com/openziti/edge/rest_management_api_client"
2022-08-15 21:06:57 +02:00
"github.com/openziti/edge/rest_management_api_client/config"
2022-07-26 22:21:49 +02:00
"github.com/openziti/edge/rest_management_api_client/service"
2022-07-26 22:36:47 +02:00
"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
2022-07-26 23:17:37 +02:00
"github.com/openziti/edge/rest_management_api_client/service_policy"
2022-07-26 22:21:49 +02:00
"github.com/openziti/edge/rest_model"
"github.com/sirupsen/logrus"
"strings"
2022-07-26 22:21:49 +02:00
"time"
)
type tunnelHandler struct {
cfg *Config
}
func newTunnelHandler(cfg *Config) *tunnelHandler {
return &tunnelHandler{cfg: cfg}
}
func (self *tunnelHandler) Handle(params tunnel.TunnelParams, principal *rest_model_zrok.Principal) middleware.Responder {
2022-09-09 16:20:05 +02:00
logrus.Infof("tunneling for '%v' (%v)", principal.Email, principal.Token)
2022-07-29 22:03:53 +02:00
tx, err := str.Begin()
if err != nil {
logrus.Errorf("error starting transaction: %v", err)
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
defer func() { _ = tx.Rollback() }()
2022-07-29 22:03:53 +02:00
2022-08-03 20:25:27 +02:00
envId := params.Body.ZitiIdentityID
2022-08-03 19:43:54 +02:00
if envs, err := str.FindEnvironmentsForAccount(int(principal.ID), tx); err == nil {
2022-08-01 21:44:26 +02:00
found := false
2022-08-03 19:43:54 +02:00
for _, env := range envs {
if env.ZitiIdentityId == envId {
2022-09-09 16:20:05 +02:00
logrus.Infof("found identity '%v' for user '%v'", envId, principal.Email)
2022-08-01 21:44:26 +02:00
found = true
break
}
}
if !found {
2022-09-09 16:20:05 +02:00
logrus.Errorf("environment '%v' not found for user '%v'", envId, principal.Email)
2022-08-01 21:44:26 +02:00
return tunnel.NewTunnelUnauthorized().WithPayload("bad environment identity")
}
} else {
2022-09-09 16:20:05 +02:00
logrus.Errorf("error finding environments for account '%v'", principal.Email)
2022-08-01 21:44:26 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
2022-08-12 17:03:15 +02:00
edge, err := edgeClient(self.cfg.Ziti)
2022-07-26 22:21:49 +02:00
if err != nil {
logrus.Error(err)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
2022-07-26 22:21:49 +02:00
}
2022-09-14 20:16:37 +02:00
svcName, err := createServiceName()
2022-07-26 22:21:49 +02:00
if err != nil {
logrus.Error(err)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
2022-07-26 22:21:49 +02:00
}
cfgId, err := self.createConfig(svcName, params, edge)
2022-08-15 21:06:57 +02:00
if err != nil {
logrus.Error(err)
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
svcId, err := self.createService(svcName, cfgId, edge)
2022-07-27 15:49:54 +02:00
if err != nil {
logrus.Error(err)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
2022-07-27 15:49:54 +02:00
}
if err := self.createServicePolicyBind(svcName, svcId, envId, edge); err != nil {
2022-07-27 15:49:54 +02:00
logrus.Error(err)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
2022-07-27 15:49:54 +02:00
}
if err := self.createServicePolicyDial(svcName, svcId, edge); err != nil {
2022-07-27 15:49:54 +02:00
logrus.Error(err)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
2022-07-27 15:49:54 +02:00
}
if err := self.createServiceEdgeRouterPolicy(svcName, svcId, edge); err != nil {
2022-07-27 15:49:54 +02:00
logrus.Error(err)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
2022-07-27 15:49:54 +02:00
}
logrus.Infof("allocated service '%v'", svcName)
2022-08-03 20:25:27 +02:00
sid, err := str.CreateService(int(principal.ID), &store.Service{
ZitiServiceId: svcId,
Endpoint: params.Body.Endpoint,
}, tx)
2022-07-29 22:03:53 +02:00
if err != nil {
logrus.Errorf("error creating service record: %v", err)
_ = tx.Rollback()
return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
if err := tx.Commit(); err != nil {
logrus.Errorf("error committing service record: %v", err)
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
2022-09-09 16:20:05 +02:00
logrus.Infof("recorded service '%v' with id '%v' for '%v'", svcId, sid, principal.Email)
2022-07-29 22:03:53 +02:00
return tunnel.NewTunnelCreated().WithPayload(&rest_model_zrok.TunnelResponse{
ProxyEndpoint: self.proxyUrl(svcName),
Service: svcName,
2022-07-27 15:49:54 +02:00
})
}
func (self *tunnelHandler) createConfig(svcName string, params tunnel.TunnelParams, edge *rest_management_api_client.ZitiEdgeManagement) (cfgID string, err error) {
authScheme, err := model.ParseAuthScheme(params.Body.AuthScheme)
if err != nil {
return "", err
}
cfg := &model.ProxyConfig{
AuthScheme: authScheme,
}
if cfg.AuthScheme == model.Basic {
cfg.BasicAuth = &model.BasicAuth{}
for _, authUser := range params.Body.AuthUsers {
cfg.BasicAuth.Users = append(cfg.BasicAuth.Users, &model.AuthUser{Username: authUser.Username, Password: authUser.Password})
}
}
2022-08-15 21:06:57 +02:00
cfgCrt := &rest_model.ConfigCreate{
2022-08-15 23:29:31 +02:00
ConfigTypeID: &zrokProxyConfigId,
2022-08-15 21:06:57 +02:00
Data: cfg,
2022-08-15 21:08:58 +02:00
Name: &svcName,
2022-09-15 21:18:37 +02:00
Tags: self.zrokTags(svcName),
2022-08-15 21:06:57 +02:00
}
cfgReq := &config.CreateConfigParams{
Config: cfgCrt,
Context: context.Background(),
}
cfgReq.SetTimeout(30 * time.Second)
cfgResp, err := edge.Config.CreateConfig(cfgReq, nil)
if err != nil {
return "", err
}
logrus.Infof("created config '%v'", cfgResp.Payload.Data.ID)
return cfgResp.Payload.Data.ID, nil
}
2022-09-15 21:18:37 +02:00
func (self *tunnelHandler) createService(svcName, cfgId string, edge *rest_management_api_client.ZitiEdgeManagement) (serviceId string, err error) {
2022-08-15 21:06:57 +02:00
configs := []string{cfgId}
2022-07-27 15:49:54 +02:00
encryptionRequired := true
2022-07-26 22:21:49 +02:00
svc := &rest_model.ServiceCreate{
2022-07-27 15:49:54 +02:00
Configs: configs,
EncryptionRequired: &encryptionRequired,
2022-09-15 21:18:37 +02:00
Name: &svcName,
Tags: self.zrokTags(svcName),
2022-07-26 22:21:49 +02:00
}
2022-07-27 15:49:54 +02:00
req := &service.CreateServiceParams{
2022-07-26 22:21:49 +02:00
Service: svc,
Context: context.Background(),
}
2022-07-27 15:49:54 +02:00
req.SetTimeout(30 * time.Second)
resp, err := edge.Service.CreateService(req, nil)
2022-07-26 22:21:49 +02:00
if err != nil {
2022-07-27 15:49:54 +02:00
return "", err
2022-07-26 22:21:49 +02:00
}
2022-07-27 15:49:54 +02:00
logrus.Infof("created service '%v'", resp.Payload.Data.ID)
return resp.Payload.Data.ID, nil
}
2022-07-26 22:21:49 +02:00
func (self *tunnelHandler) createServicePolicyBind(svcName, svcId, envId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
2022-07-27 15:49:54 +02:00
semantic := rest_model.SemanticAllOf
identityRoles := []string{fmt.Sprintf("@%v", envId)}
2022-08-31 20:49:41 +02:00
name := fmt.Sprintf("%v-backend", svcName)
2022-07-27 15:49:54 +02:00
postureCheckRoles := []string{}
serviceRoles := []string{fmt.Sprintf("@%v", svcId)}
dialBind := rest_model.DialBindBind
2022-07-26 23:17:37 +02:00
svcp := &rest_model.ServicePolicyCreate{
2022-07-27 15:49:54 +02:00
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
2022-07-26 23:17:37 +02:00
Semantic: &semantic,
2022-07-27 15:49:54 +02:00
ServiceRoles: serviceRoles,
Type: &dialBind,
2022-09-15 21:18:37 +02:00
Tags: self.zrokTags(svcName),
2022-07-26 23:17:37 +02:00
}
2022-07-27 15:49:54 +02:00
req := &service_policy.CreateServicePolicyParams{
2022-07-26 23:17:37 +02:00
Policy: svcp,
Context: context.Background(),
}
2022-07-27 15:49:54 +02:00
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
2022-07-26 23:17:37 +02:00
if err != nil {
2022-07-27 15:49:54 +02:00
return err
2022-07-26 23:17:37 +02:00
}
logrus.Infof("created service policy '%v'", resp.Payload.Data.ID)
2022-07-27 15:49:54 +02:00
return nil
}
func (self *tunnelHandler) createServicePolicyDial(svcName, svcId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
var identityRoles []string
for _, proxyIdentity := range self.cfg.Proxy.Identities {
identityRoles = append(identityRoles, "@"+proxyIdentity)
logrus.Infof("added proxy identity role '%v'", proxyIdentity)
}
2022-07-27 15:49:54 +02:00
name := fmt.Sprintf("%v-dial", svcName)
postureCheckRoles := []string{}
semantic := rest_model.SemanticAllOf
serviceRoles := []string{fmt.Sprintf("@%v", svcId)}
dialBind := rest_model.DialBindDial
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
2022-07-27 15:49:54 +02:00
ServiceRoles: serviceRoles,
Type: &dialBind,
2022-09-15 21:18:37 +02:00
Tags: self.zrokTags(svcName),
}
2022-07-27 15:49:54 +02:00
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
2022-07-27 15:49:54 +02:00
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
2022-07-27 15:49:54 +02:00
return err
}
logrus.Infof("created service policy '%v'", resp.Payload.Data.ID)
2022-07-27 15:49:54 +02:00
return nil
}
2022-07-26 23:17:37 +02:00
func (self *tunnelHandler) createServiceEdgeRouterPolicy(svcName, svcId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
2022-08-01 19:46:18 +02:00
edgeRouterRoles := []string{"#all"}
2022-07-27 15:49:54 +02:00
semantic := rest_model.SemanticAllOf
serviceRoles := []string{fmt.Sprintf("@%v", svcId)}
2022-07-26 22:36:47 +02:00
serp := &rest_model.ServiceEdgeRouterPolicyCreate{
2022-07-27 15:49:54 +02:00
EdgeRouterRoles: edgeRouterRoles,
Name: &svcName,
2022-07-26 23:17:37 +02:00
Semantic: &semantic,
2022-07-27 15:49:54 +02:00
ServiceRoles: serviceRoles,
2022-09-15 21:18:37 +02:00
Tags: self.zrokTags(svcName),
2022-07-26 22:36:47 +02:00
}
serpParams := &service_edge_router_policy.CreateServiceEdgeRouterPolicyParams{
Policy: serp,
Context: context.Background(),
}
serpParams.SetTimeout(30 * time.Second)
resp, err := edge.ServiceEdgeRouterPolicy.CreateServiceEdgeRouterPolicy(serpParams, nil)
2022-07-26 22:36:47 +02:00
if err != nil {
2022-07-27 15:49:54 +02:00
return err
2022-07-26 22:36:47 +02:00
}
logrus.Infof("created service edge router policy '%v'", resp.Payload.Data.ID)
2022-07-27 15:49:54 +02:00
return nil
}
2022-07-26 22:36:47 +02:00
func (self *tunnelHandler) proxyUrl(svcName string) string {
return strings.Replace(self.cfg.Proxy.UrlTemplate, "{svcName}", svcName, -1)
}
2022-09-15 21:18:37 +02:00
func (self *tunnelHandler) zrokTags(svcName string) *rest_model.Tags {
return &rest_model.Tags{
SubTags: map[string]interface{}{
"zrok": version,
"zrok-service-name": svcName,
},
}
}