feat: Control API uses automatic cross-pinning mTLS (Closes #119)

. kapow server generates on startup a pair of certificates
that will use to secure communications to its control server.
It will communicate the server and client certificates as well
as the client private key to the init programs it launches,
via environment variables.

. kapow server now understands a new flag --control-reachable-addr
which accepts either a IP address or a DNS name, that can be used
to ensure that the generated server certificate will be appropiate
in case the control server must be accessed from something other
than localhost.

Co-authored-by: Roberto Abdelkader Martínez Pérez <robertomartinezp@gmail.com>

internal/server/control/control_test.go

@@ -58,56 +58,6 @@ func checkErrorResponse(r *http.Response, expectedErrcode int, expectedReason st
 	return errList
 }
 
-func TestConfigRouterHasRoutesWellConfigured(t *testing.T) {
-	testCases := []struct {
-		pattern, method string
-		handler         uintptr
-		mustMatch       bool
-		vars            []string
-	}{
-		{"/routes/FOO", http.MethodGet, reflect.ValueOf(getRoute).Pointer(), true, []string{"id"}},
-		{"/routes/FOO", http.MethodPut, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/routes/FOO", http.MethodPost, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/routes/FOO", http.MethodDelete, reflect.ValueOf(removeRoute).Pointer(), true, []string{"id"}},
-		{"/routes", http.MethodGet, reflect.ValueOf(listRoutes).Pointer(), true, []string{}},
-		{"/routes", http.MethodPut, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/routes", http.MethodPost, reflect.ValueOf(addRoute).Pointer(), true, []string{}},
-		{"/routes", http.MethodDelete, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/", http.MethodGet, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/", http.MethodPut, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/", http.MethodPost, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/", http.MethodDelete, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodGet, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodPut, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodPost, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodDelete, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-	}
-	r := configRouter()
-
-	for _, tc := range testCases {
-		rm := mux.RouteMatch{}
-		rq, _ := http.NewRequest(tc.method, tc.pattern, nil)
-		if matched := r.Match(rq, &rm); tc.mustMatch == matched {
-			if tc.mustMatch {
-				// Check for Handler match.
-				realHandler := reflect.ValueOf(rm.Handler).Pointer()
-				if realHandler != tc.handler {
-					t.Errorf("Handler mismatch. Expected: %X, got: %X", tc.handler, realHandler)
-				}
-
-				// Check for variables
-				for _, vn := range tc.vars {
-					if _, exists := rm.Vars[vn]; !exists {
-						t.Errorf("Variable not present: %s", vn)
-					}
-				}
-			}
-		} else {
-			t.Errorf("Route mismatch: %+v", tc)
-		}
-	}
-}
-
 func TestPathValidatorNoErrorWhenCorrectPath(t *testing.T) {
 	err := pathValidator("/routes/{routeID}")
 

internal/server/control/server.go

@@ -17,24 +17,47 @@
 package control
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"net"
 	"net/http"
 	"sync"
 
+	"github.com/BBVA/kapow/internal/certs"
 	"github.com/BBVA/kapow/internal/logger"
 )
 
 // Run Starts the control server listening in bindAddr
-func Run(bindAddr string, wg *sync.WaitGroup) {
+func Run(bindAddr string, wg *sync.WaitGroup, serverCert, clientCert certs.Cert) {
 
-	listener, err := net.Listen("tcp", bindAddr)
+	caCertPool := x509.NewCertPool()
+	caCertPool.AppendCertsFromPEM(clientCert.SignedCertPEMBytes())
+
+	ln, err := net.Listen("tcp", bindAddr)
 	if err != nil {
 		logger.L.Fatal(err)
 	}
 
+	server := &http.Server{
+		Addr: bindAddr,
+		TLSConfig: &tls.Config{
+			Certificates: []tls.Certificate{
+				tls.Certificate{
+					Certificate: [][]byte{serverCert.SignedCert},
+					PrivateKey:  serverCert.PrivKey,
+					Leaf:        serverCert.X509Cert,
+				},
+			},
+			ClientAuth: tls.RequireAndVerifyClientCert,
+			ClientCAs:  caCertPool,
+		},
+		Handler: configRouter(),
+	}
+
 	// Signal startup
 	logger.L.Printf("ControlServer listening at %s\n", bindAddr)
 	wg.Done()
 
-	logger.L.Fatal(http.Serve(listener, configRouter()))
+	// Listen to HTTPS connections with the server certificate and wait
+	logger.L.Fatal(server.ServeTLS(ln, "", ""))
 }

internal/server/server.go

@@ -19,6 +19,7 @@ package server
 import (
 	"sync"
 
+	"github.com/BBVA/kapow/internal/certs"
 	"github.com/BBVA/kapow/internal/server/control"
 	"github.com/BBVA/kapow/internal/server/data"
 	"github.com/BBVA/kapow/internal/server/user"
@@ -34,13 +35,16 @@ type ServerConfig struct {
 
 	ClientAuth,
 	Debug bool
+
+	ControlServerCert certs.Cert
+	ControlClientCert certs.Cert
 }
 
 // StartServer Starts one instance of each server in a goroutine and remains listening on a channel for trace events generated by them
 func StartServer(config ServerConfig) {
 	var wg = sync.WaitGroup{}
 	wg.Add(3)
-	go control.Run(config.ControlBindAddr, &wg)
+	go control.Run(config.ControlBindAddr, &wg, config.ControlServerCert, config.ControlClientCert)
 	go data.Run(config.DataBindAddr, &wg)
 	go user.Run(config.UserBindAddr, &wg, config.CertFile, config.KeyFile, config.ClientCaFile, config.ClientAuth, config.Debug)