Vihren Atlas

local_store_cert_provider.go ×51

Code frontier

unlabeled · c_d7dd98525376

3 tests · 2441 LOC · 90 files · introduces 0 tests · 202 LOC · 4 files

Introduces — evidence that enters the hierarchy at this concept

Code
74 ranges202 lines · 4 files
Tests
0 tests

Contains — complete concept membership

All code (extent)
439 ranges2441 lines · 90 files · Browse complete extent
All tests (intent)
3 testsBrowse complete intent

Neighbourhood graph

The orange circle is the focus. Violet and green circles are every ancestor and descendant, broader and narrower, at any distance; blue squares and pink diamonds are the introduced files and exact introduced tests of every visible concept, not only the focus's. Arrows point from broader to narrower concepts and bridge only concepts omitted from this view. Undirected links show source or test introduction. Concept and file size follows LOC; exact test nodes use test-count units.

Introduced files, introduced tests, and structurally relevant concept specialization

In the embedded map, ordinary wheel input scrolls the page; use the visible controls to zoom and drag to pan. Open the full-screen map for canvas navigation: wheel pans, Ctrl/Command plus wheel zooms, and arrow keys pan when this region is focused. On touch screens, open the full-screen map to pan or pinch. If JavaScript or WebGL is unavailable, use the native relationship evidence on this page.

Introduced files, introduced tests, and structurally relevant concept specializationlocal_store_cert_provider.go ×11 · 47 introduced LOClocal_store_cert_provide…tls_config_helper.go ×1 · 2 introduced LOCtls_config_helper.go ×1TestRingpopInvalidTLS · 0 introduced LOCTestRingpopInvalidTLSlocal_store_tls_provider.go ×4 · 17 introduced LOClocal_store_tls_provider…local_store_cert_provider.go ×5 · 12 introduced LOClocal_store_cert_provide…tls.go ×2 · 4 introduced LOCtls.go ×2local_store_tls_provider.go ×1 · 6 introduced LOClocal_store_tls_provider…factory.go ×1 · 5 introduced LOCfactory.go ×1factory.go ×6 · 20 introduced LOCfactory.go ×6tls.go ×20 · 133 introduced LOCtls.go ×20local_store_cert_provider.go ×2 · 22 introduced LOClocal_store_cert_provide…local_store_tls_provider.go ×3 · 21 introduced LOClocal_store_tls_provider…tls_factory.go ×1 · 1 introduced LOCtls_factory.go ×1tls_factory.go ×22 · 28 introduced LOCtls_factory.go ×22static_client.go ×1 · 1 introduced LOCstatic_client.go ×1static_client.go ×1 · 1 introduced LOCstatic_client.go ×1local_store_tls_provider.go ×5 · 36 introduced LOClocal_store_tls_provider…config.go ×1 · 3 introduced LOCconfig.go ×1convert.go ×1 · 3 introduced LOCconvert.go ×1monitor.go ×2 · 11 introduced LOCmonitor.go ×2tls_config_helper.go ×2 · 14 introduced LOCtls_config_helper.go ×2config.go ×1 · 4 introduced LOCconfig.go ×1local_store_tls_provider.go ×1 · 5 introduced LOClocal_store_tls_provider…noop_moving_window_average.go ×1 · 2 introduced LOCnoop_moving_window_avera…search_attribute.go ×12 · 121 introduced LOCsearch_attribute.go ×12key.go ×1 · 6 introduced LOCkey.go ×1collection.go ×1 · 1 introduced LOCcollection.go ×1collection.go ×1 · 2 introduced LOCcollection.go ×1setting_gen.go ×1 · 9 introduced LOCsetting_gen.go ×1static_client.go ×1 · 2 introduced LOCstatic_client.go ×1collection.go ×1 · 5 introduced LOCcollection.go ×1collection.go ×2 · 4 introduced LOCcollection.go ×2collection.go ×1 · 3 introduced LOCcollection.go ×1collection.go ×2 · 6 introduced LOCcollection.go ×2static_client.go ×2 · 6 introduced LOCstatic_client.go ×2setting_gen.go ×1 · 2 introduced LOCsetting_gen.go ×1collection.go ×1 · 23 introduced LOCcollection.go ×1collection.go ×1 · 9 introduced LOCcollection.go ×1convert.go ×1 · 3 introduced LOCconvert.go ×1collection.go ×1 · 2 introduced LOCcollection.go ×1collection.go ×2 · 3 introduced LOCcollection.go ×2collection.go ×1 · 2 introduced LOCcollection.go ×1priority.go ×1 · 3 introduced LOCpriority.go ×1setting_gen.go ×51 · 335 introduced LOCsetting_gen.go ×51grpc_resolver.go ×2 · 7 introduced LOCgrpc_resolver.go ×2noop_impl.go ×1 · 3 introduced LOCnoop_impl.go ×1predicates.pb.go ×21 · 54 introduced LOCpredicates.pb.go ×21service.pb.go ×2 · 342 introduced LOCservice.pb.go ×2message.pb.go ×2 · 20 introduced LOCmessage.pb.go ×2zap_logger.go ×3 · 17 introduced LOCzap_logger.go ×3constants.go ×1 · 6 introduced LOCconstants.go ×1task.pb.go ×1 · 3 introduced LOCtask.pb.go ×1message.pb.go ×2 · 442 introduced LOCmessage.pb.go ×2tags.go ×1 · 3 introduced LOCtags.go ×1defs.go ×5 · 91 introduced LOCdefs.go ×5zap_logger.go ×6 · 26 introduced LOCzap_logger.go ×6zap_logger.go ×1 · 2 introduced LOCzap_logger.go ×1noop_logger.go ×1 · 3 introduced LOCnoop_logger.go ×1zap_logger.go ×1 · 2 introduced LOCzap_logger.go ×1zap_logger.go ×1 · 7 introduced LOCzap_logger.go ×1tags.go ×9 · 37 introduced LOCtags.go ×9message.pb.go ×2 · 49 introduced LOCmessage.pb.go ×2cluster.pb.go ×2 · 200 introduced LOCcluster.pb.go ×2wildcard.go ×1 · 2 introduced LOCwildcard.go ×1wildcard.go ×4 · 14 introduced LOCwildcard.go ×4retrypolicy.go ×3 · 19 introduced LOCretrypolicy.go ×3message.pb.go ×2 · 20 introduced LOCmessage.pb.go ×2payload.go ×1 · 3 introduced LOCpayload.go ×1TestOperatorServiceMetadata, TestWorkflowServiceMetadata · 0 introduced LOCTestOperatorServiceMetad…go.temporal.io/server/api/adminservice/v1/request_response.pb.go · 6661 LOCv1/request_response.pb.g…go.temporal.io/server/api/adminservice/v1/service.pb.go · 297 LOCv1/service.pb.gogo.temporal.io/server/api/chasm/v1/message.pb.go · 230 LOCv1/message.pb.gogo.temporal.io/server/api/clock/v1/message.pb.go · 217 LOCv1/message.pb.gogo.temporal.io/server/api/cluster/v1/message.pb.go · 366 LOCv1/message.pb.gogo.temporal.io/server/api/common/v1/api_category.pb.go · 230 LOCv1/api_category.pb.gogo.temporal.io/server/api/common/v1/dlq.pb.go · 319 LOCv1/dlq.pb.gogo.temporal.io/server/api/deployment/v1/message.pb.go · 4650 LOCv1/message.pb.gogo.temporal.io/server/api/enums/v1/cluster.pb.go · 233 LOCv1/cluster.pb.gogo.temporal.io/server/api/enums/v1/common.pb.go · 288 LOCv1/common.pb.gogo.temporal.io/server/api/enums/v1/dlq.pb.go · 211 LOCv1/dlq.pb.gogo.temporal.io/server/api/enums/v1/fairness_state.pb.go · 147 LOCv1/fairness_state.pb.gogo.temporal.io/server/api/enums/v1/nexus.pb.go · 182 LOCv1/nexus.pb.gogo.temporal.io/server/api/enums/v1/predicate.pb.go · 194 LOCv1/predicate.pb.gogo.temporal.io/server/api/enums/v1/replication.pb.go · 338 LOCv1/replication.pb.gogo.temporal.io/server/api/enums/v1/task.pb.go · 480 LOCv1/task.pb.gogo.temporal.io/server/api/enums/v1/workflow.pb.go · 299 LOCv1/workflow.pb.gogo.temporal.io/server/api/enums/v1/workflow_task_type.pb.go · 148 LOCv1/workflow_task_type.pb…go.temporal.io/server/api/errordetails/v1/message.pb.go · 649 LOCv1/message.pb.gogo.temporal.io/server/api/health/v1/message.pb.go · 324 LOCv1/message.pb.gogo.temporal.io/server/api/history/v1/message.pb.go · 522 LOCv1/message.pb.gogo.temporal.io/server/api/historyservice/v1/request_response.pb.go · 12003 LOCv1/request_response.pb.g…go.temporal.io/server/api/historyservice/v1/service.pb.go · 452 LOCv1/service.pb.gogo.temporal.io/server/api/matchingservice/v1/request_response.pb.go · 6878 LOCv1/request_response.pb.g…go.temporal.io/server/api/matchingservice/v1/service.pb.go · 274 LOCv1/service.pb.gogo.temporal.io/server/api/metrics/v1/message.pb.go · 128 LOCv1/message.pb.gogo.temporal.io/server/api/namespace/v1/message.pb.go · 138 LOCv1/message.pb.gogo.temporal.io/server/api/persistence/v1/chasm.pb.go · 1215 LOCv1/chasm.pb.gogo.temporal.io/server/api/persistence/v1/chasm_visibility.pb.go · 170 LOCv1/chasm_visibility.pb.g…go.temporal.io/server/api/persistence/v1/cluster_metadata.pb.go · 313 LOCv1/cluster_metadata.pb.g…go.temporal.io/server/api/persistence/v1/executions.pb.go · 5768 LOCv1/executions.pb.gogo.temporal.io/server/api/persistence/v1/history_tree.pb.go · 298 LOCv1/history_tree.pb.gogo.temporal.io/server/api/persistence/v1/hsm.pb.go · 929 LOCv1/hsm.pb.gogo.temporal.io/server/api/persistence/v1/namespaces.pb.go · 560 LOCv1/namespaces.pb.gogo.temporal.io/server/api/persistence/v1/nexus.pb.go · 509 LOCv1/nexus.pb.gogo.temporal.io/server/api/persistence/v1/predicates.go-helpers.pb.go · 413 LOCv1/predicates.go-helpers…go.temporal.io/server/api/persistence/v1/predicates.pb.go · 864 LOCv1/predicates.pb.gogo.temporal.io/server/api/persistence/v1/queue_metadata.pb.go · 129 LOCv1/queue_metadata.pb.gogo.temporal.io/server/api/persistence/v1/queues.pb.go · 641 LOCv1/queues.pb.gogo.temporal.io/server/api/persistence/v1/task_queues.pb.go · 924 LOCv1/task_queues.pb.gogo.temporal.io/server/api/persistence/v1/tasks.pb.go · 870 LOCv1/tasks.pb.gogo.temporal.io/server/api/persistence/v1/update.pb.go · 455 LOCv1/update.pb.gogo.temporal.io/server/api/persistence/v1/workflow_mutable_state.pb.go · 560 LOCv1/workflow_mutable_stat…go.temporal.io/server/api/replication/v1/message.pb.go · 2481 LOCv1/message.pb.gogo.temporal.io/server/api/taskqueue/v1/message.pb.go · 1363 LOCv1/message.pb.gogo.temporal.io/server/api/token/v1/message.pb.go · 809 LOCv1/message.pb.gogo.temporal.io/server/api/visibilityservice/v1/request_response.pb.go · 426 LOCv1/request_response.pb.g…go.temporal.io/server/api/workflow/v1/message.pb.go · 302 LOCv1/message.pb.gogo.temporal.io/server/chasm/library.go · 60 LOCchasm/library.gogo.temporal.io/server/chasm/registrable_component.go · 233 LOCchasm/registrable_compon…go.temporal.io/server/chasm/search_attribute.go · 525 LOCchasm/search_attribute.g…go.temporal.io/server/common/aggregate/noop_moving_window_average.go · 13 LOCaggregate/noop_moving_wi…go.temporal.io/server/common/auth/tls_config_helper.go · 225 LOCauth/tls_config_helper.g…go.temporal.io/server/common/backoff/retrypolicy.go · 347 LOCbackoff/retrypolicy.gogo.temporal.io/server/common/build/build.go · 56 LOCbuild/build.gogo.temporal.io/server/common/config/config.go · 879 LOCconfig/config.gogo.temporal.io/server/common/convert/convert.go · 79 LOCconvert/convert.gogo.temporal.io/server/common/dynamicconfig/collection.go · 779 LOCdynamicconfig/collection…go.temporal.io/server/common/dynamicconfig/deepcopy.go · 78 LOCdynamicconfig/deepcopy.g…go.temporal.io/server/common/dynamicconfig/gradual_change.go · 196 LOCdynamicconfig/gradual_ch…go.temporal.io/server/common/dynamicconfig/key.go · 21 LOCdynamicconfig/key.gogo.temporal.io/server/common/dynamicconfig/registry.go · 44 LOCdynamicconfig/registry.g…go.temporal.io/server/common/dynamicconfig/setting_gen.go · 1972 LOCdynamicconfig/setting_ge…go.temporal.io/server/common/dynamicconfig/shared_structure.go · 69 LOCdynamicconfig/shared_str…go.temporal.io/server/common/dynamicconfig/static_client.go · 31 LOCdynamicconfig/static_cli…go.temporal.io/server/common/log/noop_logger.go · 25 LOClog/noop_logger.gogo.temporal.io/server/common/log/tag/tags.go · 1039 LOCtag/tags.gogo.temporal.io/server/common/log/tag/zap_tag.go · 242 LOCtag/zap_tag.gogo.temporal.io/server/common/log/zap_logger.go · 318 LOClog/zap_logger.gogo.temporal.io/server/common/membership/grpc_resolver.go · 169 LOCmembership/grpc_resolver…go.temporal.io/server/common/membership/ringpop/factory.go · 270 LOCringpop/factory.gogo.temporal.io/server/common/membership/ringpop/monitor.go · 484 LOCringpop/monitor.gogo.temporal.io/server/common/metrics/defs.go · 76 LOCmetrics/defs.gogo.temporal.io/server/common/metrics/defs_base.go · 30 LOCmetrics/defs_base.gogo.temporal.io/server/common/metrics/noop_impl.go · 58 LOCmetrics/noop_impl.gogo.temporal.io/server/common/metrics/option.go · 21 LOCmetrics/option.gogo.temporal.io/server/common/metrics/registry.go · 75 LOCmetrics/registry.gogo.temporal.io/server/common/metrics/tags.go · 619 LOCmetrics/tags.gogo.temporal.io/server/common/payload/payload.go · 127 LOCpayload/payload.gogo.temporal.io/server/common/persistence/noop_health_signal_aggregator.go · 31 LOCpersistence/noop_health_…go.temporal.io/server/common/rpc/encryption/local_store_cert_provider.go · 586 LOCencryption/local_store_c…go.temporal.io/server/common/rpc/encryption/local_store_per_host_cert_provider_map.go · 85 LOCencryption/local_store_p…go.temporal.io/server/common/rpc/encryption/local_store_tls_provider.go · 506 LOCencryption/local_store_t…go.temporal.io/server/common/rpc/encryption/tls_factory.go · 156 LOCencryption/tls_factory.g…go.temporal.io/server/common/searchattribute/sadefs/constants.go · 396 LOCsadefs/constants.gogo.temporal.io/server/common/tasks/priority.go · 81 LOCtasks/priority.gogo.temporal.io/server/common/util/wildcard.go · 50 LOCutil/wildcard.gogo.temporal.io/server/service/history/tasks/key.go · 144 LOCtasks/key.gogo.temporal.io/server/tests/testutils/certificate.go · 126 LOCtestutils/certificate.gogo.temporal.io/server/tests/testutils/tls.go · 186 LOCtestutils/tls.goTestOperatorServiceMetadata · introduced test · go.temporal.io/server/common/api/TestOperatorServiceMetadataTestOperatorServiceMetad…TestWorkflowServiceMetadata · introduced test · go.temporal.io/server/common/api/TestWorkflowServiceMetadataTestWorkflowServiceMetad…TestTSCBWithDynamicSettings · introduced test · go.temporal.io/server/common/circuitbreaker/TestTSCBWithDynamicSettingsTestTSCBWithDynamicSetti…TestDeepCopy_OtherReferenceTypes_Nil · introduced test · go.temporal.io/server/common/dynamicconfig/TestDeepCopy_OtherReferenceTypes_NilTestDeepCopy_OtherRefere…TestRingpopInvalidTLS · introduced test · go.temporal.io/server/common/membership/ringpop/TestRingpopSuite/TestRingpopInvalidTLSTestRingpopInvalidTLSTestRingpopMutualTLS · introduced test · go.temporal.io/server/common/membership/ringpop/TestRingpopSuite/TestRingpopMutualTLSTestRingpopMutualTLSTestRingpopServerTLS · introduced test · go.temporal.io/server/common/membership/ringpop/TestRingpopSuite/TestRingpopServerTLSTestRingpopServerTLSTestMutexMapBaggage · introduced test · go.temporal.io/server/common/metrics/TestBaggageBenchSuite/TestMutexMapBaggageTestMutexMapBaggageTestSyncMapBaggage · introduced test · go.temporal.io/server/common/metrics/TestBaggageBenchSuite/TestSyncMapBaggageTestSyncMapBaggageTestIsEnabled · introduced test · go.temporal.io/server/common/rpc/encryption/TestTLSConfigSuite/TestIsEnabledTestIsEnabledTestIsSystemWorker · introduced test · go.temporal.io/server/common/rpc/encryption/TestTLSConfigSuite/TestIsSystemWorkerTestIsSystemWorkerTestAPIPrioritiesOrdered · introduced test · go.temporal.io/server/service/matching/configs/TestQuotasSuite/TestAPIPrioritiesOrderedTestAPIPrioritiesOrderedTestAPIToPriorityMapping · introduced test · go.temporal.io/server/service/matching/configs/TestQuotasSuite/TestAPIToPriorityMappingTestAPIToPriorityMappingFocused concept · local_store_cert_provider.go ×51 · 202 introduced LOClocal_store_cert_provide…

Graph controls are ready.

Interactive rendering requires JavaScript and WebGL. Use the native relationship evidence on this page while the interactive map is unavailable.

Native relationship evidence

Every exact file and test below is linked only from the concept that introduces it.

Introduced tests

Every collected test enters the hierarchy at exactly one concept.

No tests are introduced at this concept. Its intent tests are introduced by other concepts.

Introduced code

Every collected source range enters the hierarchy at exactly one concept.

4 files ranked by introduced lines: 202 introduced LOC across 74 ranges. Expand a file to inspect source; the > gutter marks introduced lines.

go.temporal.io/server/common/rpc/encryption/local_store_cert_provider.go 141 introduced LOC · 51 ranges

Open complete file

116 }
117
118 > func (s *localStoreCertProvider) FetchServerRootCAsForClient(isWorker bool) (*x509.CertPool, error) { local_store_cert_provider.go
119 >
120 > clientSettings := s.getClientTLSSettings(isWorker)
121 > if clientSettings == nil {
122 return nil, nil
123 }
124 > certs, err := s.getCerts() local_store_cert_provider.go
125 > if err != nil {
126 return nil, err
127 }
128
129 > if isWorker { local_store_cert_provider.go
130 return certs.serverCAsWorkerPool, nil
131 }
132
133 > return certs.serverCAPool, nil local_store_cert_provider.go
134 }
135
173 }
174
175 > func (s *localStoreCertProvider) getCerts() (*certCache, error) { local_store_cert_provider.go
176 >
177 > s.RLock()
178 > if s.certs != nil {
179 > defer s.RUnlock()
180 > return s.certs, nil
181 > }
182 > s.RUnlock()
183 > s.Lock()
184 > defer s.Unlock()
185 >
186 > if s.certs != nil {
187 return s.certs, nil
188 }
189
190 > newCerts, err := s.loadCerts() local_store_cert_provider.go
191 > if err != nil {
192 return nil, err
193 }
194
195 > if newCerts == nil { local_store_cert_provider.go
196 s.certs = &certCache{}
197 > } else { local_store_cert_provider.go
198 > s.certs = newCerts
199 > }
200 > return s.certs, nil
201 }
202
203 > func (s *localStoreCertProvider) loadCerts() (*certCache, error) { local_store_cert_provider.go
204 >
205 > if !s.isTLSEnabled() {
206 return nil, nil
207 }
208
209 > newCerts := certCache{} local_store_cert_provider.go
210 > var err error
211 >
212 > if s.tlsSettings != nil {
213 > newCerts.serverCert, err = s.fetchCertificate(s.tlsSettings.Server.CertFile, s.tlsSettings.Server.CertData,
214 > s.tlsSettings.Server.KeyFile, s.tlsSettings.Server.KeyData)
215 > if err != nil {
216 return nil, err
217 }
218
219 > certPool, certs, err := s.fetchCAs(s.tlsSettings.Server.ClientCAFiles, s.tlsSettings.Server.ClientCAData, local_store_cert_provider.go
220 > "cannot specify both clientCAFiles and clientCAData properties")
221 > if err != nil {
222 return nil, err
223 }
224 > newCerts.clientCAPool = certPool local_store_cert_provider.go
225 > newCerts.clientCACerts = certs
226 }
227
228 > if s.isLegacyWorkerConfig { local_store_cert_provider.go
229 newCerts.workerCert = newCerts.serverCert
230 > } else { local_store_cert_provider.go
231 > if s.workerTLSSettings != nil {
232 newCerts.workerCert, err = s.fetchCertificate(s.workerTLSSettings.CertFile, s.workerTLSSettings.CertData,
233 s.workerTLSSettings.KeyFile, s.workerTLSSettings.KeyData)
238 }
239
240 > nonWorkerPool, nonWorkerCerts, err := s.loadServerCACerts(false) local_store_cert_provider.go
241 > if err != nil {
242 return nil, err
243 }
244 > newCerts.serverCAPool = nonWorkerPool local_store_cert_provider.go
245 > newCerts.serverCACerts = nonWorkerCerts
246 >
247 > workerPool, workerCerts, err := s.loadServerCACerts(true)
248 > if err != nil {
249 return nil, err
250 }
251 > newCerts.serverCAsWorkerPool = workerPool local_store_cert_provider.go
252 > newCerts.serverCACertsWorker = workerCerts
253 >
254 > return &newCerts, nil
255 }
256
257 func (s *localStoreCertProvider) fetchCertificate(
258 certFile string, certData string,
259 > keyFile string, keyData string) (*tls.Certificate, error) { local_store_cert_provider.go
260 > if certFile == "" && certData == "" {
261 return nil, nil
262 }
263
264 > if certFile != "" && certData != "" { local_store_cert_provider.go
265 return nil, errors.New("only one of certFile or certData properties should be spcified")
266 }
267
268 > var certBytes []byte local_store_cert_provider.go
269 > var keyBytes []byte
270 > var err error
271 >
272 > if certFile != "" {
273 s.logger.Info("loading certificate from file", tag.TLSCertFile(certFile))
274 certBytes, err = os.ReadFile(certFile)
283 }
284
285 > if keyFile != "" { local_store_cert_provider.go
286 s.logger.Info("loading private key from file", tag.TLSKeyFile(keyFile))
287 keyBytes, err = os.ReadFile(keyFile)
296 }
297
298 > cert, err := tls.X509KeyPair(certBytes, keyBytes) local_store_cert_provider.go
299 > if err != nil {
300 return nil, fmt.Errorf("loading tls certificate failed: %v", err)
301 }
302
303 > return &cert, nil local_store_cert_provider.go
304 }
305
306 > func (s *localStoreCertProvider) getClientTLSSettings(isWorker bool) *config.ClientTLS { local_store_cert_provider.go
307 > if isWorker && s.workerTLSSettings != nil {
308 return &s.workerTLSSettings.Client // explicit system worker case
309 > } else if isWorker { local_store_cert_provider.go
310 > return s.legacyWorkerSettings // legacy config case when we use Frontend.Client settings
311 > } else {
312 > if s.tlsSettings == nil {
313 return nil
314 }
315 > return &s.tlsSettings.Client // internode client case local_store_cert_provider.go
316 }
317 }
318
319 > func (s *localStoreCertProvider) loadServerCACerts(isWorker bool) (*x509.CertPool, []*x509.Certificate, error) { local_store_cert_provider.go
320 >
321 > clientSettings := s.getClientTLSSettings(isWorker)
322 > if clientSettings == nil {
323 > return nil, nil, nil
324 > }
325
326 > return s.fetchCAs(clientSettings.RootCAFiles, clientSettings.RootCAData, local_store_cert_provider.go
327 > "cannot specify both rootCAFiles and rootCAData properties")
328 }
329
331 files []string,
332 data []string,
333 > duplicateErrorMessage string) (*x509.CertPool, []*x509.Certificate, error) { local_store_cert_provider.go
334 > if len(files) == 0 && len(data) == 0 {
335 return nil, nil, nil
336 }
337
338 > caPoolFromFiles, caCertsFromFiles, err := s.buildCAPoolFromFiles(files) local_store_cert_provider.go
339 > if err != nil {
340 return nil, nil, err
341 }
342
343 > caPoolFromData, caCertsFromData, err := buildCAPoolFromData(data) local_store_cert_provider.go
344 > if err != nil {
345 return nil, nil, err
346 }
347
348 > if caPoolFromFiles != nil && caPoolFromData != nil { local_store_cert_provider.go
349 return nil, nil, errors.New(duplicateErrorMessage)
350 }
351
352 > var certPool *x509.CertPool local_store_cert_provider.go
353 > var certs []*x509.Certificate
354 >
355 > if caPoolFromData != nil {
356 certPool = caPoolFromData
357 certs = caCertsFromData
358 > } else { local_store_cert_provider.go
359 certPool = caPoolFromFiles
360 certs = caCertsFromFiles
361 }
362
363 > return certPool, certs, nil local_store_cert_provider.go
364 }
365
421 }
422
423 > func buildCAPoolFromData(caData []string) (*x509.CertPool, []*x509.Certificate, error) { local_store_cert_provider.go
424 >
425 > return buildCAPool(caData, base64.StdEncoding.DecodeString)
426 > }
427
428 > func (s *localStoreCertProvider) buildCAPoolFromFiles(caFiles []string) (*x509.CertPool, []*x509.Certificate, error) { local_store_cert_provider.go
429 > if len(caFiles) == 0 {
430 return nil, nil, nil
431 }
435 }
436
437 > func buildCAPool(cas []string, getBytes loadOrDecodeDataFunc) (*x509.CertPool, []*x509.Certificate, error) { local_store_cert_provider.go
438 >
439 > var caPool *x509.CertPool
440 > var certs []*x509.Certificate
441 >
442 > for _, ca := range cas {
443 > if ca == "" {
444 continue
445 }
446
447 > caBytes, err := getBytes(ca) local_store_cert_provider.go
448 > if err != nil {
449 return nil, nil, fmt.Errorf("failed to decode ca cert: %w", err)
450 }
451
452 > if caPool == nil { local_store_cert_provider.go
453 > caPool = x509.NewCertPool()
454 > }
455 > if !caPool.AppendCertsFromPEM(caBytes) {
456 return nil, nil, errors.New("unknown failure constructing cert pool for ca")
457 }
458
459 > cert, err := parseCert(caBytes) local_store_cert_provider.go
460 > if err != nil {
461 return nil, nil, fmt.Errorf("failed to parse x509 certificate: %w", err)
462 }
463 > certs = append(certs, cert) local_store_cert_provider.go
464 }
465 > return caPool, certs, nil local_store_cert_provider.go
466 }
467
468 // logic borrowed from tls.X509KeyPair()
469 > func parseCert(bytes []byte) (*x509.Certificate, error) { local_store_cert_provider.go
470 >
471 > var certBytes [][]byte
472 > for {
473 > var certDERBlock *pem.Block
474 > certDERBlock, bytes = pem.Decode(bytes)
475 > if certDERBlock == nil {
476 > break
477 }
478 > if certDERBlock.Type == "CERTIFICATE" { local_store_cert_provider.go
479 > certBytes = append(certBytes, certDERBlock.Bytes)
480 > }
481 }
482
483 > if len(certBytes) == 0 || len(certBytes[0]) == 0 { local_store_cert_provider.go
484 return nil, fmt.Errorf("failed to decode PEM certificate data")
485 }
486 > return x509.ParseCertificate(certBytes[0]) local_store_cert_provider.go
487 }
488
526 }
527
528 > func (s *localStoreCertProvider) isTLSEnabled() bool { local_store_cert_provider.go
529 > return s.tlsSettings != nil || s.workerTLSSettings != nil
530 > }
531
532 func (c *certCache) isEqual(other *certCache) bool {
go.temporal.io/server/common/rpc/encryption/local_store_tls_provider.go 41 introduced LOC · 14 ranges

Open complete file

115 &s.cachedInternodeClientConfig,
116 func() (*tls.Config, error) {
117 > return newClientTLSConfig(s.internodeClientCertProvider, client.ServerName, local_store_tls_provider.go
118 > s.settings.Internode.Server.RequireClientAuth, false, !client.DisableHostVerification)
119 > },
120 s.settings.Internode.IsClientEnabled(),
121 )
176 &s.cachedInternodeServerConfig,
177 func() (*tls.Config, error) {
178 > return newServerTLSConfig(s.internodeCertProvider, nil, &s.settings.Internode, s.logger) local_store_tls_provider.go
179 > },
180 s.settings.Internode.IsServerEnabled())
181 }
222
223 // Check if exists under a read lock first
224 > s.RLock() local_store_tls_provider.go
225 > if *cachedConfig != nil {
226 defer s.RUnlock()
227 return *cachedConfig, nil
228 }
229 // Not found, promote to write lock to initialize
230 > s.RUnlock() local_store_tls_provider.go
231 > s.Lock()
232 > defer s.Unlock()
233 > // Check if someone got here first while waiting for write lock
234 > if *cachedConfig != nil {
235 return *cachedConfig, nil
236 }
237
238 // Load configuration
239 > localConfig, err := configConstructor() local_store_tls_provider.go
240 >
241 > if err != nil {
242 return nil, err
243 }
244
245 > *cachedConfig = localConfig local_store_tls_provider.go
246 > return *cachedConfig, nil
247 }
248
287 config *config.GroupTLS,
288 logger log.Logger,
289 > ) (*tls.Config, error) { local_store_tls_provider.go
290 >
291 > clientAuthRequired := config.Server.RequireClientAuth
292 > tlsConfig, err := getServerTLSConfigFromCertProvider(certProvider, clientAuthRequired, "", "", logger)
293 > if err != nil {
294 return nil, err
295 }
296
297 > tlsConfig.GetConfigForClient = func(c *tls.ClientHelloInfo) (*tls.Config, error) { local_store_tls_provider.go
298
299 remoteAddress := c.Conn.RemoteAddr().String()
326 remoteAddress string,
327 serverName string,
328 > logger log.Logger) (*tls.Config, error) { local_store_tls_provider.go
329 >
330 > // Get serverCert from disk
331 > serverCert, err := certProvider.FetchServerCertificate()
332 > if err != nil {
333 return nil, fmt.Errorf("loading server tls certificate failed: %v", err)
334 }
335
336 // tls disabled, responsibility of cert provider above to error otherwise
337 > if serverCert == nil { local_store_tls_provider.go
338 return nil, nil
339 }
340
341 // Default to NoClientAuth
342 > clientAuthType := tls.NoClientCert local_store_tls_provider.go
343 > var clientCaPool *x509.CertPool
344 >
345 > // If mTLS enabled
346 > if requireClientAuth {
347 clientAuthType = tls.RequireAndVerifyClientCert
348
354 clientCaPool = ca
355 }
356 > if remoteAddress != "" { // remoteAddress=="" when we return initial tls.Config object when configuring server local_store_tls_provider.go
357 logger.Debug("returning TLS config for connection", tag.Address(remoteAddress), tag.ServerName(serverName))
358 }
359 > return auth.NewTLSConfigWithCertsAndCAs( local_store_tls_provider.go
360 > clientAuthType,
361 > []tls.Certificate{*serverCert},
362 > clientCaPool,
363 > logger), nil
364 }
365
go.temporal.io/server/common/membership/ringpop/factory.go 13 introduced LOC · 7 ranges

Open complete file

156 var tChannel *tchannel.Channel
157 if enableTLS {
158 > tChannel = factory.getTLSChannel(ringpopHostAddress, ringpopServiceName) factory.go
159 } else {
160 tChannel = factory.getTCPChannel(ringpopHostAddress, ringpopServiceName)
183 }
184
185 > func (factory *factory) getTLSChannel(ringpopHostAddress string, ringpopServiceName string) *tchannel.Channel { factory.go
186 > clientTLSConfig, err := factory.TLSFactory.GetInternodeClientConfig()
187 > if err != nil {
188 factory.Logger.Fatal("Failed to get internode TLS client config", tag.Error(err))
189 }
190
191 > serverTLSConfig, err := factory.TLSFactory.GetInternodeServerConfig() factory.go
192 > if err != nil {
193 factory.Logger.Fatal("Failed to get internode TLS server config", tag.Error(err))
194 }
195
196 > listener, err := tls.Listen("tcp", ringpopHostAddress, serverTLSConfig) factory.go
197 > if err != nil {
198 factory.Logger.Fatal("Failed to start ringpop TLS listener", tag.Error(err), tag.Address(ringpopHostAddress))
199 }
200
201 > dialer := tls.Dialer{Config: clientTLSConfig} factory.go
202 > tChannel, err := tchannel.NewChannel(ringpopServiceName, &tchannel.ChannelOptions{Dialer: dialer.DialContext})
203 > if err != nil {
204 factory.Logger.Fatal("Failed to create ringpop TChannel", tag.Error(err))
205 }
206
207 > if err := tChannel.Serve(listener); err != nil { factory.go
208 factory.Logger.Fatal("Failed to serve ringpop listener", tag.Error(err), tag.Address(ringpopHostAddress))
209 }
210 > return tChannel factory.go
211 }
212
go.temporal.io/server/common/auth/tls_config_helper.go 7 introduced LOC · 2 ranges

Open complete file

60 clientCAs *x509.CertPool,
61 logger log.Logger,
62 > ) *tls.Config { tls_config_helper.go
63 > c := NewEmptyTLSConfig()
64 > c.ClientAuth = clientAuth
65 > c.Certificates = certificates
66 > c.ClientCAs = clientCAs
67 > c.VerifyConnection = func(state tls.ConnectionState) error {
68 logger.Debug("successfully established incoming TLS connection", tag.ServerName(state.ServerName), tag.Name(tlsCN(state)))
69 return nil
70 }
71 > return c tls_config_helper.go
72 }
73

Direct hierarchy

Parents

Children