From 346ee5630559c1910defb5e3d6af5f748b99af3d Mon Sep 17 00:00:00 2001 From: Mitali Rawat Date: Wed, 26 Jun 2024 09:20:59 -0700 Subject: [PATCH 1/2] update snapshot command skip option --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index f0e285ab..15d05f94 100644 --- a/Makefile +++ b/Makefile @@ -127,5 +127,5 @@ snapshot: docker run --rm --privileged -v $(PWD):/go/tmp \ -v /var/run/docker.sock:/var/run/docker.sock \ -w /go/tmp \ - ghcr.io/goreleaser/goreleaser-cross:latest --clean --snapshot --skip-publish + ghcr.io/goreleaser/goreleaser-cross:latest --clean --snapshot --skip publish From 19e29ea08f85e3f0f9174c3fc3328bf4acb01d62 Mon Sep 17 00:00:00 2001 From: Mitali Rawat Date: Wed, 26 Jun 2024 07:00:55 -0700 Subject: [PATCH 2/2] print client information from connection and add ForwardingSvc field to Operation --- protocol/protocol.go | 4 +- server/server.go | 107 ++++++++++++++++++++++++++++++------------- tracing/tracing.go | 1 + 3 files changed, 80 insertions(+), 32 deletions(-) diff --git a/protocol/protocol.go b/protocol/protocol.go index c489e931..9fbe6dbe 100644 --- a/protocol/protocol.go +++ b/protocol/protocol.go @@ -414,19 +414,21 @@ type Operation struct { ServerIP net.IP SNI string CertID string + ForwardingSvc int64 CustomFuncName string JaegerSpan []byte ReqContext []byte } func (o *Operation) String() string { - return fmt.Sprintf("[Opcode: %v, SKI: %v, Digest: %02x, Client IP: %s, Server IP: %s, SNI: %s]", + return fmt.Sprintf("[Opcode: %v, SKI: %v, Digest: %02x, Client IP: %s, Server IP: %s, SNI: %s, Forwarding Service: %v]", o.Opcode, o.SKI, o.Digest, o.ClientIP, o.ServerIP, o.SNI, + o.ForwardingSvc, ) } diff --git a/server/server.go b/server/server.go index 6286bb59..3506cbd3 100644 --- a/server/server.go +++ b/server/server.go @@ -16,6 +16,7 @@ import ( "net" "net/rpc" "os" + "strings" "sync" "time" @@ -152,6 +153,12 @@ type Sealer interface { Unseal(*protocol.Operation) ([]byte, error) } +// ClientInfo has information on the client of the connection +type ClientInfo struct { + Name string + CertSerial string +} + // handler is associated with a connection and contains bookkeeping // information used across goroutines. The channel tokens limits the // concurrency: before reading a request a token is extracted, when @@ -166,6 +173,7 @@ type handler struct { conn net.Conn timeout time.Duration closed bool + c *ClientInfo } func (h *handler) close(err error) { @@ -197,6 +205,12 @@ func (h *handler) handle(pkt *protocol.Packet, reqTime time.Time) { } else { resp = h.s.unlimitedDo(pkt, h.name) } + + if resp.op.ErrorVal() != protocol.ErrNone { + // log the client certificate information on the connection if the request failed so the caller is apparent + reqID, _ := getOperationRequestID(&pkt.Operation) + log.Errorf("operation from client %s client cert serial: %s errored. sni %s ski %s cert %s request-id %s", h.c.Name, h.c.CertSerial, resp.op.SNI, resp.op.SKI.String(), resp.op.CertID, reqID) + } logRequestExecDuration(pkt.Operation.Opcode, start, resp.op.ErrorVal()) respPkt := protocol.Packet{ Header: protocol.Header{ @@ -289,32 +303,61 @@ func makeErrResponse(pkt *protocol.Packet, err protocol.Error) response { func addOperationRequestID(op *protocol.Operation) string { reqContext := make(map[string]interface{}) var reqID string - var gen bool if len(op.ReqContext) > 0 { - if err := json.Unmarshal(op.ReqContext, &reqContext); err == nil { - if v, ok := reqContext["request_id"]; ok { - return v.(string) - } else { - gen = true - } - } else { - log.Errorf("malformed operation.ReqContext %v, ignoring error", op.ReqContext) + if decodeErr := json.Unmarshal(op.ReqContext, &reqContext); decodeErr != nil { + log.Error(fmt.Errorf("malformed operation.ReqContext %v, ignoring error", op.ReqContext)) + return reqID + } + } + + if v, ok := reqContext["request_id"]; ok { + return v.(string) + } + + reqID = uuid.New().String() + reqContext["request_id"] = reqID + b, err := json.Marshal(reqContext) + if err == nil { + op.ReqContext = b + } else { + log.Errorf("error marshaling operation.ReqContext %v, ignoring error", reqContext) + reqID = "" + } + return reqID +} + +func getOperationRequestID(op *protocol.Operation) (reqID string, err error) { + reqContext := make(map[string]interface{}) + if len(op.ReqContext) == 0 { + return + } + if decodeErr := json.Unmarshal(op.ReqContext, &reqContext); decodeErr == nil { + if v, ok := reqContext["request_id"]; ok { + return v.(string), nil } + } else { + err = fmt.Errorf("malformed operation.ReqContext %v, ignoring error", op.ReqContext) + log.Error(err) + return } + return +} - if len(op.ReqContext) == 0 || gen { - reqID = uuid.New().String() - reqContext["request_id"] = reqID - b, err := json.Marshal(reqContext) - if err == nil { - op.ReqContext = b +func getClientInfoFromCerts(certs []*x509.Certificate) *ClientInfo { + cln := []string(nil) + srls := []string(nil) + for _, cert := range certs { + if cert.Subject.CommonName != "" { + cln = append(cln, cert.Subject.CommonName) } else { - log.Errorf("error marshaling operation.ReqContext %v, ignoring error", reqContext) - reqID = "" + cln = append(cln, cert.DNSNames...) } + srls = append(srls, cert.SerialNumber.String()) } - return reqID + name := strings.Join(cln, " , ") + serial := strings.Join(srls, " , ") + return &ClientInfo{Name: name, CertSerial: serial} } func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { @@ -328,7 +371,7 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { reqID := addOperationRequestID(&pkt.Operation) span.SetTag("request_id", reqID) - log.Debugf("connection %s: limited=false opcode=%s id=%d sni=%s ip=%s ski=%v request-id=%s", + log.Debugf("connection %s: limited=false opcode= %s id=%d sni= %s ip= %s ski= %v request-id= %s", connName, pkt.Operation.Opcode, pkt.Header.ID, @@ -412,14 +455,14 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { sig, err := key.Sign(rand.Reader, pkt.Operation.Payload, crypto.Hash(0)) if err != nil { - log.Errorf("Connection: %s: sni=%s ski=%v request-id=%s: Signing error: %v: request-id:%s:", connName, pkt.Operation.SNI, pkt.Operation.SKI, reqID, protocol.ErrCrypto, err, reqID) + log.Errorf("Connection: %s: sni= %s ski= %v request-id= %s: Signing error: %v", connName, pkt.Operation.SNI, pkt.Operation.SKI, reqID, protocol.ErrCrypto, err) // This indicates that a remote keyserver is being used var remoteConfigurationErr RemoteConfigurationErr if errors.As(err, &remoteConfigurationErr) { - log.Errorf("Connection %v: sni=%s ski=%v request-id=%s: %s: Signing error: %v request-id:%s\n", connName, pkt.Operation.SNI, pkt.Operation.SKI, reqID, protocol.ErrRemoteConfiguration, err, reqID) + log.Errorf("Connection %v: sni= %s ski= %v request-id= %s: %s: Signing error: %v\n", connName, pkt.Operation.SNI, pkt.Operation.SKI, reqID, protocol.ErrRemoteConfiguration, err) return makeErrResponse(pkt, protocol.ErrRemoteConfiguration) } else { - log.Errorf("Connection %v: sni=%s ski=%v request-id=%s: %s: Signing error: %v request-id:%s\n", connName, pkt.Operation.SNI, pkt.Operation.SKI, reqID, protocol.ErrCrypto, err, reqID) + log.Errorf("Connection %v: sni= %s ski= %v request-id= %s: %s: Signing error: %v\n", connName, pkt.Operation.SNI, pkt.Operation.SKI, reqID, protocol.ErrCrypto, err) return makeErrResponse(pkt, protocol.ErrCrypto) } } @@ -430,15 +473,15 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { key, err := s.keys.Get(ctx, &pkt.Operation) logKeyLoadDuration(loadStart) if err != nil { - log.Errorf("failed to load key with sni=%s ip=%s ski=%v request-id=%s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err) + log.Errorf("failed to load key with sni= %s ip= %s ski=%v request-id= %s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err) return makeErrResponse(pkt, protocol.ErrInternal) } else if key == nil { - log.Errorf("failed to load key with sni=%s ip=%s ski=%v request-id=%s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrKeyNotFound) + log.Errorf("failed to load key with sni= %s ip= %s ski= %v request-id= %s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrKeyNotFound) return makeErrResponse(pkt, protocol.ErrKeyNotFound) } if _, ok := key.Public().(*rsa.PublicKey); !ok { - log.Errorf("Connection %v: sni=%s request-id=%s: %s: Key is not RSA", connName, pkt.Operation.SNI, reqID, protocol.ErrCrypto) + log.Errorf("Connection %v: sni= %s request-id= %s: %s: Key is not RSA", connName, pkt.Operation.SNI, reqID, protocol.ErrCrypto) return makeErrResponse(pkt, protocol.ErrCrypto) } @@ -446,7 +489,7 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { // Decrypt without removing padding; that's the client's responsibility. ptxt, err := textbook_rsa.Decrypt(rsaKey, pkt.Operation.Payload) if err != nil { - log.Errorf("connection %v: sni=%s ip=%s ski=%v request-id=%s: %v", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err) + log.Errorf("connection %v: sni= %s ip= %s ski= %v request-id= %s: %v", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err) return makeErrResponse(pkt, protocol.ErrCrypto) } return makeRespondResponse(pkt, ptxt) @@ -493,10 +536,10 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { key, err := s.keys.Get(ctx, &pkt.Operation) logKeyLoadDuration(loadStart) if err != nil { - log.Errorf("failed to load key with sni=%s ip=%s ski=%v request-id=%s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err) + log.Errorf("failed to load key with sni= %s ip= %s ski= %v request-id= %s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err) return makeErrResponse(pkt, protocol.ErrInternal) } else if key == nil { - log.Errorf("failed to load key with sni=%s ip=%s ski=%v request-id=%s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrKeyNotFound) + log.Errorf("failed to load key with sni= %s ip= %s ski= %v request-id= %s: %v", pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrKeyNotFound) return makeErrResponse(pkt, protocol.ErrKeyNotFound) } @@ -526,17 +569,17 @@ func (s *Server) unlimitedDo(pkt *protocol.Packet, connName string) response { } if err != nil { if attempts > 1 { - log.Debugf("Connection %v sni=%s ip=%s ski=%v request-id=%s : failed sign attempt: %s, %d attempt(s) left", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err, attempts-1) + log.Debugf("Connection %v sni= %s ip= %s ski= %v request-id= %s : failed sign attempt: %s, %d attempt(s) left", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, err, attempts-1) continue } else { tracing.LogError(span, err) // This indicates that a remote keyserver is being used var remoteConfigurationErr RemoteConfigurationErr if errors.As(err, &remoteConfigurationErr) { - log.Errorf("Connection %v sni=%s ip=%s ski=%v request-id=%s : %s: Signing error: %v\n", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrRemoteConfiguration, err) + log.Errorf("Connection %v sni= %s ip= %s ski= %v request-id= %s : %s: Signing error: %v\n", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrRemoteConfiguration, err) return makeErrResponse(pkt, protocol.ErrRemoteConfiguration) } else { - log.Errorf("Connection %v sni=%s ip=%s ski=%v request-id=%s : %s: Signing error: %v\n", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrCrypto, err) + log.Errorf("Connection %v sni= %s ip= %s ski= %v request-id= %s : %s: Signing error: %v\n", connName, pkt.Operation.SNI, pkt.Operation.ServerIP, pkt.Operation.SKI, reqID, protocol.ErrCrypto, err) return makeErrResponse(pkt, protocol.ErrCrypto) } } @@ -656,6 +699,7 @@ func (s *Server) spawn(l net.Listener, c net.Conn) { } connState := tconn.ConnectionState() certmetrics.Observe(certmetrics.CertSourceFromCerts(fmt.Sprintf("listener: %s", l.Addr().String()), connState.PeerCertificates)...) + cl := getClientInfoFromCerts(connState.PeerCertificates) limited, err := s.config.isLimited(connState) if err != nil { log.Errorf("connection %v: could not determine if limited: %v", c.RemoteAddr(), err) @@ -692,6 +736,7 @@ func (s *Server) spawn(l net.Listener, c net.Conn) { conn: tconn, listener: l, timeout: timeout, + c: cl, } err = handler.loop() diff --git a/tracing/tracing.go b/tracing/tracing.go index c5c4007c..15d76c94 100644 --- a/tracing/tracing.go +++ b/tracing/tracing.go @@ -47,6 +47,7 @@ func SetOperationSpanTags(span opentracing.Span, op *protocol.Operation) { "operation.sni": op.SNI, "operation.certid": op.CertID, "operation.customfuncname": op.CustomFuncName, + "operation.forwardingsvc": fmt.Sprintf("%d", op.ForwardingSvc), } for k, v := range tags { span.SetTag(k, v)