wbtiger
/
foundationdb
mirror of https://github.com/apple/foundationdb.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refactor TLS config for backup

This commit is contained in:
Jingyu Zhou 2021-04-05 11:47:23 -07:00
parent 86482606bb
commit 0ce3ed93ec
4 changed files with 143 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

90
fdbbackup/BackupTLSConfig.cpp Normal file
View File

@ -0,0 +1,90 @@
/*
* BackupTLSConfig.cpp
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2021 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <iostream>
#include "fdbclient/NativeAPI.actor.h"
#include "flow/Arena.h"
#include "flow/Error.h"
#include "flow/network.h"
#include "fdbbackup/BackupTLSConfig.h"
void BackupTLSConfig::setupBlobCredentials() {
// Add blob credentials files from the environment to the list collected from the command line.
const char* blobCredsFromENV = getenv("FDB_BLOB_CREDENTIALS");
if (blobCredsFromENV != nullptr) {
StringRef t((uint8_t*)blobCredsFromENV, strlen(blobCredsFromENV));
do {
StringRef file = t.eat(":");
if (file.size() != 0)
blobCredentials.push_back(file.toString());
} while (t.size() != 0);
}
// Update the global blob credential files list
std::vector<std::string>* pFiles = (std::vector<std::string>*)g_network->global(INetwork::enBlobCredentialFiles);
if (pFiles != nullptr) {
for (auto& f : blobCredentials) {
pFiles->push_back(f);
}
}
}
bool BackupTLSConfig::setupTLS() {
if (tlsCertPath.size()) {
try {
setNetworkOption(FDBNetworkOptions::TLS_CERT_PATH, tlsCertPath);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS certificate path to " << tlsCertPath << " (" << e.what() << ")\n";
return false;
}
}
if (tlsCAPath.size()) {
try {
setNetworkOption(FDBNetworkOptions::TLS_CA_PATH, tlsCAPath);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS CA path to " << tlsCAPath << " (" << e.what() << ")\n";
return false;
}
}
if (tlsKeyPath.size()) {
try {
if (tlsPassword.size())
setNetworkOption(FDBNetworkOptions::TLS_PASSWORD, tlsPassword);
setNetworkOption(FDBNetworkOptions::TLS_KEY_PATH, tlsKeyPath);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS key path to " << tlsKeyPath << " (" << e.what() << ")\n";
return false;
}
}
if (tlsVerifyPeers.size()) {
try {
setNetworkOption(FDBNetworkOptions::TLS_VERIFY_PEERS, tlsVerifyPeers);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS peer verification to " << tlsVerifyPeers << " (" << e.what()
<< ")\n";
return false;
}
}
return true;
}

41
fdbbackup/BackupTLSConfig.h Normal file
View File

@ -0,0 +1,41 @@
/*
* BackupTLSConfig.h
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2021 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FDBBACKUP_BACKUPTLSCONFIG_H
#define FDBBACKUP_BACKUPTLSCONFIG_H
#pragma once
#include <string>
#include <vector>
// TLS and blob credentials for backups and setup for these credentials.
struct BackupTLSConfig {
std::string tlsCertPath, tlsKeyPath, tlsCAPath, tlsPassword, tlsVerifyPeers;
std::vector<std::string> blobCredentials;
// Returns if TLS setup is successful
bool setupTLS();
// Sets up blob crentials. Add the file specified by FDB_BLOB_CREDENTIALS as well.
// Note this must be called after g_network is set up.
void setupBlobCredentials();
};
#endif // FDBBACKUP_BACKUPTLSCONFIG_H

2
fdbbackup/CMakeLists.txt
View File

@ -11,6 +11,8 @@ add_flow_target(EXECUTABLE NAME fdbconvert SRCS ${FDBCONVERT_SRCS})
target_link_libraries(fdbconvert PRIVATE fdbclient)
set(FDBDECODE_SRCS
BackupTLSConfig.h
BackupTLSConfig.cpp
FileDecoder.actor.cpp
FileConverter.h)
add_flow_target(EXECUTABLE NAME fdbdecode SRCS ${FDBDECODE_SRCS})

83
fdbbackup/FileDecoder.actor.cpp
View File

@ -22,6 +22,7 @@
#include <iostream>
#include <vector>
#include "fdbbackup/BackupTLSConfig.h"
#include "fdbclient/BackupAgent.actor.h"
#include "fdbclient/BackupContainer.h"
#include "fdbbackup/FileConverter.h"
@ -77,8 +78,7 @@ struct DecodeParams {
std::string fileFilter; // only files match the filter will be decoded
bool log_enabled = false;
std::string log_dir, trace_format, trace_log_group;
std::string tlsCertPath, tlsKeyPath, tlsCAPath, tlsPassword, tlsVerifyPeers;
std::vector<std::string> blobCredentials;
BackupTLSConfig tlsConfig;
std::string toString() {
std::string s;
@ -100,70 +100,7 @@ struct DecodeParams {
return s;
}
// Sets up blob crentials. Add the file specified by FDB_BLOB_CREDENTIALS as well.
void setupBlobCredentials() {
// Add blob credentials files from the environment to the list collected from the command line.
const char* blobCredsFromENV = getenv("FDB_BLOB_CREDENTIALS");
if (blobCredsFromENV != nullptr) {
StringRef t((uint8_t*)blobCredsFromENV, strlen(blobCredsFromENV));
do {
StringRef file = t.eat(":");
if (file.size() != 0)
blobCredentials.push_back(file.toString());
} while (t.size() != 0);
}
// Update the global blob credential files list
std::vector<std::string>* pFiles =
(std::vector<std::string>*)g_network->global(INetwork::enBlobCredentialFiles);
if (pFiles != nullptr) {
for (auto& f : blobCredentials) {
pFiles->push_back(f);
}
}
}
// Returns if TLS setup is successful
bool setupTLS() {
if (tlsCertPath.size()) {
try {
setNetworkOption(FDBNetworkOptions::TLS_CERT_PATH, tlsCertPath);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS certificate path to " << tlsCertPath << " (" << e.what() << ")\n";
return false;
}
}
if (tlsCAPath.size()) {
try {
setNetworkOption(FDBNetworkOptions::TLS_CA_PATH, tlsCAPath);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS CA path to " << tlsCAPath << " (" << e.what() << ")\n";
return false;
}
}
if (tlsKeyPath.size()) {
try {
if (tlsPassword.size())
setNetworkOption(FDBNetworkOptions::TLS_PASSWORD, tlsPassword);
setNetworkOption(FDBNetworkOptions::TLS_KEY_PATH, tlsKeyPath);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS key path to " << tlsKeyPath << " (" << e.what() << ")\n";
return false;
}
}
if (tlsVerifyPeers.size()) {
try {
setNetworkOption(FDBNetworkOptions::TLS_VERIFY_PEERS, tlsVerifyPeers);
} catch (Error& e) {
std::cerr << "ERROR: cannot set TLS peer verification to " << tlsVerifyPeers << " (" << e.what()
<< ")\n";
return false;
}
}
return true;
}
};
int parseDecodeCommandLine(DecodeParams* param, CSimpleOpt* args) {
@ -216,7 +153,7 @@ int parseDecodeCommandLine(DecodeParams* param, CSimpleOpt* args) {
break;
case OPT_BLOB_CREDENTIALS:
param->blobCredentials.push_back(args->OptionArg());
param->tlsConfig.blobCredentials.push_back(args->OptionArg());
break;
#ifndef TLS_DISABLED
@ -225,23 +162,23 @@ int parseDecodeCommandLine(DecodeParams* param, CSimpleOpt* args) {
break;
case TLSConfig::OPT_TLS_CERTIFICATES:
param->tlsCertPath = args->OptionArg();
param->tlsConfig.tlsCertPath = args->OptionArg();
break;
case TLSConfig::OPT_TLS_PASSWORD:
param->tlsPassword = args->OptionArg();
param->tlsConfig.tlsPassword = args->OptionArg();
break;
case TLSConfig::OPT_TLS_CA_FILE:
param->tlsCAPath = args->OptionArg();
param->tlsConfig.tlsCAPath = args->OptionArg();
break;
case TLSConfig::OPT_TLS_KEY:
param->tlsKeyPath = args->OptionArg();
param->tlsConfig.tlsKeyPath = args->OptionArg();
break;
case TLSConfig::OPT_TLS_VERIFY_PEERS:
param->tlsVerifyPeers = args->OptionArg();
param->tlsConfig.tlsVerifyPeers = args->OptionArg();
break;
#endif
@ -633,7 +570,7 @@ int main(int argc, char** argv) {
}
}
if (!param.setupTLS()) {
if (!param.tlsConfig.setupTLS()) {
TraceEvent(SevError, "TLSError");
throw tls_error();
}
@ -646,7 +583,7 @@ int main(int argc, char** argv) {
TraceEvent::setNetworkThread();
openTraceFile(NetworkAddress(), 10 << 20, 10 << 20, param.log_dir, "decode", param.trace_log_group);
param.setupBlobCredentials();
param.tlsConfig.setupBlobCredentials();
auto f = stopAfter(decode_logs(param));