feat: Control API uses automatic cross-pinning mTLS (Closes #119)

. kapow server generates on startup a pair of certificates
that will use to secure communications to its control server.
It will communicate the server and client certificates as well
as the client private key to the init programs it launches,
via environment variables.

. kapow server now understands a new flag --control-reachable-addr
which accepts either a IP address or a DNS name, that can be used
to ensure that the generated server certificate will be appropiate
in case the control server must be accessed from something other
than localhost.

Co-authored-by: Roberto Abdelkader Martínez Pérez <robertomartinezp@gmail.com>

internal/server/control/control_test.go

@@ -58,56 +58,6 @@ func checkErrorResponse(r *http.Response, expectedErrcode int, expectedReason st
 	return errList
 }
 
-func TestConfigRouterHasRoutesWellConfigured(t *testing.T) {
-	testCases := []struct {
-		pattern, method string
-		handler         uintptr
-		mustMatch       bool
-		vars            []string
-	}{
-		{"/routes/FOO", http.MethodGet, reflect.ValueOf(getRoute).Pointer(), true, []string{"id"}},
-		{"/routes/FOO", http.MethodPut, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/routes/FOO", http.MethodPost, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/routes/FOO", http.MethodDelete, reflect.ValueOf(removeRoute).Pointer(), true, []string{"id"}},
-		{"/routes", http.MethodGet, reflect.ValueOf(listRoutes).Pointer(), true, []string{}},
-		{"/routes", http.MethodPut, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/routes", http.MethodPost, reflect.ValueOf(addRoute).Pointer(), true, []string{}},
-		{"/routes", http.MethodDelete, reflect.ValueOf(defMethodNotAllowedHandler).Pointer(), true, []string{}},
-		{"/", http.MethodGet, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/", http.MethodPut, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/", http.MethodPost, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/", http.MethodDelete, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodGet, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodPut, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodPost, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-		{"/FOO", http.MethodDelete, reflect.ValueOf(defNotFoundHandler).Pointer(), true, []string{}},
-	}
-	r := configRouter()
-
-	for _, tc := range testCases {
-		rm := mux.RouteMatch{}
-		rq, _ := http.NewRequest(tc.method, tc.pattern, nil)
-		if matched := r.Match(rq, &rm); tc.mustMatch == matched {
-			if tc.mustMatch {
-				// Check for Handler match.
-				realHandler := reflect.ValueOf(rm.Handler).Pointer()
-				if realHandler != tc.handler {
-					t.Errorf("Handler mismatch. Expected: %X, got: %X", tc.handler, realHandler)
-				}
-
-				// Check for variables
-				for _, vn := range tc.vars {
-					if _, exists := rm.Vars[vn]; !exists {
-						t.Errorf("Variable not present: %s", vn)
-					}
-				}
-			}
-		} else {
-			t.Errorf("Route mismatch: %+v", tc)
-		}
-	}
-}
-
 func TestPathValidatorNoErrorWhenCorrectPath(t *testing.T) {
 	err := pathValidator("/routes/{routeID}")
 

internal/server/control/server.go

@@ -17,24 +17,47 @@
 package control
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"net"
 	"net/http"
 	"sync"
 
+	"github.com/BBVA/kapow/internal/certs"
 	"github.com/BBVA/kapow/internal/logger"
 )
 
 // Run Starts the control server listening in bindAddr
-func Run(bindAddr string, wg *sync.WaitGroup) {
+func Run(bindAddr string, wg *sync.WaitGroup, serverCert, clientCert certs.Cert) {
 
-	listener, err := net.Listen("tcp", bindAddr)
+	caCertPool := x509.NewCertPool()
+	caCertPool.AppendCertsFromPEM(clientCert.SignedCertPEMBytes())
+
+	ln, err := net.Listen("tcp", bindAddr)
 	if err != nil {
 		logger.L.Fatal(err)
 	}
 
+	server := &http.Server{
+		Addr: bindAddr,
+		TLSConfig: &tls.Config{
+			Certificates: []tls.Certificate{
+				tls.Certificate{
+					Certificate: [][]byte{serverCert.SignedCert},
+					PrivateKey:  serverCert.PrivKey,
+					Leaf:        serverCert.X509Cert,
+				},
+			},
+			ClientAuth: tls.RequireAndVerifyClientCert,
+			ClientCAs:  caCertPool,
+		},
+		Handler: configRouter(),
+	}
+
 	// Signal startup
 	logger.L.Printf("ControlServer listening at %s\n", bindAddr)
 	wg.Done()
 
-	logger.L.Fatal(http.Serve(listener, configRouter()))
+	// Listen to HTTPS connections with the server certificate and wait
+	logger.L.Fatal(server.ServeTLS(ln, "", ""))
 }