m/n/core/rpc: implement node verification in authenticated connections
The current API of NewAuthenticatedCredentials is not easily extensible,
so switch over to such an API now.
This then adds a WantRemoteNode option which verifies that the remote
connection is established to a node with a given ID.
Change-Id: Ie9f6b33d8b032729181bae5591eba9856ea2f523
Reviewed-on: https://review.monogon.dev/c/monogon/+/1427
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/test/e2e/main_test.go b/metropolis/test/e2e/main_test.go
index c3f6a3c..b57f3d3 100644
--- a/metropolis/test/e2e/main_test.go
+++ b/metropolis/test/e2e/main_test.go
@@ -101,7 +101,7 @@
launch.Log("E2E: Cluster running, starting tests...")
// Dial first node's curator.
- creds := rpc.NewAuthenticatedCredentials(cluster.Owner, nil)
+ creds := rpc.NewAuthenticatedCredentials(cluster.Owner, rpc.WantInsecure())
remote := net.JoinHostPort(cluster.NodeIDs[0], common.CuratorServicePort.PortString())
cl, err := grpc.Dial(remote, grpc.WithContextDialer(cluster.DialNode), grpc.WithTransportCredentials(creds))
if err != nil {
diff --git a/metropolis/test/launch/cluster/cluster.go b/metropolis/test/launch/cluster/cluster.go
index bfeb877..c433780 100644
--- a/metropolis/test/launch/cluster/cluster.go
+++ b/metropolis/test/launch/cluster/cluster.go
@@ -182,7 +182,7 @@
// instance within Cluster c, or nil together with an error.
func (c *Cluster) CuratorClient() (*grpc.ClientConn, error) {
if c.authClient == nil {
- authCreds := rpc.NewAuthenticatedCredentials(c.Owner, nil)
+ authCreds := rpc.NewAuthenticatedCredentials(c.Owner, rpc.WantInsecure())
r := resolver.New(c.ctxT, resolver.WithLogger(func(f string, args ...interface{}) {
launch.Log("Cluster: client resolver: %s", fmt.Sprintf(f, args...))
}))
@@ -589,7 +589,7 @@
launch.Log("Cluster: retrieved owner certificate.")
// Now connect authenticated and get the node ID.
- creds := rpc.NewAuthenticatedCredentials(*cert, nil)
+ creds := rpc.NewAuthenticatedCredentials(*cert, rpc.WantInsecure())
authClient, err := grpc.Dial(remote, grpc.WithContextDialer(initDialer), grpc.WithTransportCredentials(creds))
if err != nil {
return nil, nil, fmt.Errorf("dialing with owner credentials failed: %w", err)