From 57e5571816dadd0e1347c22637db4fc9ef7a234e Mon Sep 17 00:00:00 2001 From: Eugene K Date: Wed, 13 Sep 2023 10:30:19 -0400 Subject: [PATCH] process CA bundle event - re-write config file or external CA bundle file --- .../include/ziti/ziti_tunnel_cbs.h | 3 +- lib/ziti-tunnel-cbs/ziti_tunnel_ctrl.c | 76 +++++++++++++++---- 2 files changed, 63 insertions(+), 16 deletions(-) diff --git a/lib/ziti-tunnel-cbs/include/ziti/ziti_tunnel_cbs.h b/lib/ziti-tunnel-cbs/include/ziti/ziti_tunnel_cbs.h index d537d9ac..7a412ce6 100644 --- a/lib/ziti-tunnel-cbs/include/ziti/ziti_tunnel_cbs.h +++ b/lib/ziti-tunnel-cbs/include/ziti/ziti_tunnel_cbs.h @@ -252,7 +252,8 @@ XX(code, int, none, code, __VA_ARGS__) #define ZTX_API_EVENT_MODEL(XX, ...) \ BASE_EVENT_MODEL(XX, __VA_ARGS__) \ -XX(new_ctrl_address, string, none, new_ctrl_address, __VA_ARGS__) +XX(new_ctrl_address, string, none, new_ctrl_address, __VA_ARGS__) \ +XX(new_ca_bundle, string, none, new_ca_bundle, __VA_ARGS__) DECLARE_MODEL(base_event, BASE_EVENT_MODEL) DECLARE_MODEL(ziti_ctx_event, ZTX_EVENT_MODEL) diff --git a/lib/ziti-tunnel-cbs/ziti_tunnel_ctrl.c b/lib/ziti-tunnel-cbs/ziti_tunnel_ctrl.c index 5c44f3f3..1ced8d7d 100644 --- a/lib/ziti-tunnel-cbs/ziti_tunnel_ctrl.c +++ b/lib/ziti-tunnel-cbs/ziti_tunnel_ctrl.c @@ -74,6 +74,7 @@ typedef struct api_update_req_s { uv_work_t wr; ziti_context ztx; char *new_url; + char *new_ca; int err; const char *errmsg; } api_update_req; @@ -830,12 +831,13 @@ static void on_ziti_event(ziti_context ztx, const ziti_event_t *event) { } case ZitiAPIEvent: { - if (event->event.api.new_ctrl_address) { + if (event->event.api.new_ctrl_address || event->event.api.new_ca_bundle) { if (instance->opts.config) { api_update_req *req = calloc(1, sizeof(api_update_req)); req->wr.data = req; req->ztx = ztx; - req->new_url = strdup(event->event.api.new_ctrl_address); + req->new_url = event->event.api.new_ctrl_address ? strdup(event->event.api.new_ctrl_address) : NULL; + req->new_ca = event->event.api.new_ca_bundle ? strdup(event->event.api.new_ca_bundle) : NULL; uv_queue_work(CMD_CTX.loop, &req->wr, update_config, update_config_done); } @@ -843,6 +845,7 @@ static void on_ziti_event(ziti_context ztx, const ziti_event_t *event) { ev.event_type = TunnelEvents.APIEvent; ev.identifier = instance->identifier; ev.new_ctrl_address = event->event.api.new_ctrl_address; + ev.new_ca_bundle = event->event.api.new_ca_bundle; CMD_CTX.on_event((const base_event *) &ev); } else { ZITI_LOG(WARN, "unexpected API event: new_ctrl_address is missing"); @@ -1178,6 +1181,36 @@ static void on_sigdump(uv_signal_t *sig, int signum) { fclose(dumpfile); } + +static int update_file(const char *path, char *content, size_t content_len) { +#define CHECK_UV(desc, op) do{ \ + uv_fs_req_cleanup(&fs_req); \ + rc = op; \ + if (rc < 0) { \ + ZITI_LOG(ERROR, "op[" desc "] failed: %d(%s)", rc, uv_strerror(rc)); \ + goto DONE; \ + }} while(0) + + int rc = 0; + uv_fs_t fs_req = {0}; + CHECK_UV("check exiting config", uv_fs_stat(NULL, &fs_req, path, NULL)); + uint64_t mode = fs_req.statbuf.st_mode; + + char backup[FILENAME_MAX]; + snprintf(backup, sizeof(backup), "%s.bak", path); + CHECK_UV("create backup", uv_fs_rename(NULL, &fs_req, path, backup, NULL)); + + uv_os_fd_t f; + CHECK_UV("open new config", f = uv_fs_open(NULL, &fs_req, path, UV_FS_O_WRONLY | UV_FS_O_CREAT, (int) mode, NULL)); + uv_buf_t buf = uv_buf_init(content, content_len); + CHECK_UV("write new config", uv_fs_write(NULL, &fs_req, f, &buf, 1, 0, NULL)); + CHECK_UV("close new config", uv_fs_close(NULL, &fs_req, f, NULL)); + + DONE: + return rc; +#undef CHECK_UV +} + #define CHECK_UV(desc, op) do{ \ int rc = op; \ if (rc < 0) { \ @@ -1200,7 +1233,6 @@ static void update_config(uv_work_t *wr) { cfg_len = fs_req.statbuf.st_size; cfg_buf = malloc(cfg_len); - uint64_t cfg_mode = fs_req.statbuf.st_mode; CHECK_UV("open existing config", f = uv_fs_open(wr->loop, &fs_req, config_file, UV_FS_O_RDONLY, 0, NULL)); uv_buf_t buf = uv_buf_init(cfg_buf, cfg_len); CHECK_UV("read existing config", uv_fs_read(wr->loop, &fs_req, f, &buf, 1, 0, NULL)); @@ -1215,21 +1247,35 @@ static void update_config(uv_work_t *wr) { } FREE(cfg_buf); - free(cfg.controller_url); - cfg.controller_url = req->new_url; - req->new_url = NULL; - - char backup[FILENAME_MAX]; + // attempt to update CA bundle external to config file + if (req->new_ca && strncmp(cfg.id.ca, "file://", strlen("file://")) == 0) { + struct tlsuv_url_s path_uri; + char path[FILENAME_MAX]; + CHECK_UV("parse CA bundle path", tlsuv_parse_url(&path_uri, cfg.id.ca)); + strncpy(path, path_uri.path, path_uri.path_len); + CHECK_UV("update CA bundle file", update_file(path, req->new_ca, strlen(req->new_ca))); + FREE(req->new_ca); + } - snprintf(backup, sizeof(backup), "%s.bak", config_file); - CHECK_UV("create backup", uv_fs_rename(wr->loop, &fs_req, config_file, backup, NULL)); + bool write_new_cfg = false; + if (req->new_url) { + free(cfg.controller_url); + cfg.controller_url = req->new_url; + req->new_url = NULL; + write_new_cfg = true; + } - CHECK_UV("open new config", f = uv_fs_open(wr->loop, &fs_req, config_file, UV_FS_O_WRONLY | UV_FS_O_CREAT, (int)cfg_mode, NULL)); - cfg_buf = ziti_config_to_json(&cfg, 0, &cfg_len); - buf = uv_buf_init(cfg_buf, cfg_len); - CHECK_UV("write new config", uv_fs_write(wr->loop, &fs_req, f, &buf, 1, 0, NULL)); - CHECK_UV("close new config", uv_fs_close(wr->loop, &fs_req, f, NULL)); + if (req->new_ca) { + free(cfg.id.ca); + cfg.id.ca = req->new_ca; + req->new_ca = NULL; + write_new_cfg = true; + } + if (write_new_cfg) { + cfg_buf = ziti_config_to_json(&cfg, 0, &cfg_len); + CHECK_UV("update config", update_file(config_file, cfg_buf, cfg_len)); + } DONE: free_ziti_config(&cfg); FREE(cfg_buf);