Documentation
¶
Overview ¶
Package atunnel carries actor ingress and egress through an ateom worker pod.
Index ¶
- Constants
- Variables
- func EgressPort(listenAddress string) (uint16, error)
- func ParsePort(s string) (port int, ok bool)
- func ResolvConfNameservers(path string) ([]string, error)
- func TCPOriginalDestination(conn net.Conn) (string, error)
- type BrokerCertificateSource
- type BrokerConfig
- type Client
- type ClientConfig
- type ClientOption
- type Config
- type ConnectRejectedError
- type DNSRelay
- type DialFunc
- type Egress
- type OriginalDestination
- type Server
- func (s *Server) Activate(atespace, actorName, actorUID string, dial DialFunc) error
- func (s *Server) Deactivate(ctx context.Context, atespace, actorName, actorUID string) error
- func (s *Server) Serve(ctx context.Context, lis net.Listener) error
- func (s *Server) ServeConnect(ctx context.Context, lis net.Listener) error
- func (s *Server) ServeConnectHTTP(w http.ResponseWriter, r *http.Request)
- func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)
Constants ¶
const ( // DefaultConnectPort is the worker port on which atunnel accepts inbound // mTLS CONNECT tunnels from the ingress router. DefaultConnectPort = 8443 // StaleAssignmentHeader distinguishes an atunnel routing rejection from a // 421 returned by the actor application itself. StaleAssignmentHeader = "X-Ate-Assignment-Stale" // TargetPortHeader carries the port to reach on the actor: the CONNECT // :authority's port for arbitrary-port ingress, or the default 80 // otherwise (see atenet-router's HandleRequestHeaders). cfg.Upstream is // fixed for the Server's lifetime, so this lets the port vary per // request; stripped before the request reaches the actor. TargetPortHeader = "X-Ate-Target-Port" )
const (
// DNSPort is the relay port on the sandbox's gateway.
DNSPort = 53
)
Variables ¶
var ErrGatewayHandshake = errors.New("atunnel: egress gateway TLS handshake")
ErrGatewayHandshake reports that the gateway's front door refused the connection at TLS: it rejected the client certificate, or its own certificate did not verify.
Functions ¶
func EgressPort ¶ added in v0.2.0
EgressPort is the port from a listen address, which each sandbox's redirect aims at. The address itself is never bound: egress is served from inside the sandbox namespaces.
func ParsePort ¶
ParsePort parses s as a TCP port number, returning ok=false for anything outside the valid 1-65535 range (including non-numeric input).
func ResolvConfNameservers ¶ added in v0.2.0
ResolvConfNameservers reads nameservers from resolv.conf as "host:53".
Types ¶
type BrokerCertificateSource ¶
type BrokerCertificateSource struct {
// contains filtered or unexported fields
}
BrokerCertificateSource owns atunnel's actor private key and obtains the matching short-lived certificate from the node-local atelet.
func NewBrokerCertificateSource ¶
func NewBrokerCertificateSource(cfg BrokerConfig) (*BrokerCertificateSource, error)
NewBrokerCertificateSource creates one actor key for this activation. The key is reused across renewals and never leaves atunnel; only its CSR crosses the credential broker socket.
func (*BrokerCertificateSource) GetClientCertificate ¶
func (s *BrokerCertificateSource) GetClientCertificate(*tls.CertificateRequestInfo) (*tls.Certificate, error)
GetClientCertificate supplies the current actor certificate to the egress gateway TLS handshake and refuses to use it after expiry.
func (*BrokerCertificateSource) MintAteomCertificate ¶ added in v0.2.0
MintAteomCertificate requests and installs a fresh certificate for the source's existing actor key. It returns the new expiry for renewal scheduling.
type BrokerConfig ¶
type BrokerConfig struct {
// SocketPath is the atelet-owned Unix socket shared with this worker.
SocketPath string
// CredentialBundlePath is the worker Pod certificate and private key used
// only to authenticate atunnel to atelet.
CredentialBundlePath string
// TrustBundlePath verifies atelet's Pod certificate.
TrustBundlePath string
// Which actor are we currently running?
ActorAtespace string
ActorName string
ActorUID string
// AteletSPIFFEID is the identity the node-local atelet must present on the
// credential broker connection. It names atelet's namespace, not this
// worker's, so it is configured rather than derived from the downward API.
AteletSPIFFEID string
}
BrokerConfig configures the node-local atelet credential broker client.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client opens actor egress streams through an mTLS-authenticated gateway.
func NewClient ¶
func NewClient(cfg ClientConfig, opts ...ClientOption) (*Client, error)
NewClient creates an egress CONNECT client and validates its TLS material.
type ClientConfig ¶
type ClientConfig struct {
GatewayAddress string
ServerName string
GetClientCertificate func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
TrustBundlePath string
}
TODO(liorlieberman): support/use CONNECT on Ingress as well. ClientConfig configures an egress CONNECT client.
type ClientOption ¶
type ClientOption func(*Client)
ClientOption customizes a Client beyond its configuration. Production callers need none of these.
func WithDialer ¶
func WithDialer(dial DialFunc) ClientOption
WithDialer overrides how the client reaches the egress gateway. It exists so tests can substitute a transport; by default a net.Dialer is used.
type Config ¶
type Config struct {
CredentialBundlePath string
TrustBundlePath string
AllowedClientID string
Upstream *url.URL
}
Config configures an ingress Server.
type ConnectRejectedError ¶
type ConnectRejectedError struct {
StatusCode int
// Status is the full status line, e.g. "403 Forbidden".
Status string
// Message is the response body, or the status text when the body is empty.
Message string
}
ConnectRejectedError reports a CONNECT the gateway answered with a non-2xx status. The caller authenticated successfully and the request was declined anyway, which is what an authorization denial looks like from here. The status code is carried separately from the message because it is the part a caller can act on.
func (*ConnectRejectedError) Error ¶
func (e *ConnectRejectedError) Error() string
type DNSRelay ¶ added in v0.2.0
type DNSRelay struct {
// contains filtered or unexported fields
}
DNSRelay forwards UDP and TCP DNS unchanged to the worker pod's resolvers. It listens in the sandbox's gateway namespace and dials from the worker's. DNS bypasses the egress tunnel and is not checked against egress policy.
func NewDNSRelay ¶ added in v0.2.0
NewDNSRelay forwards to upstreams, each "host:port".
func (*DNSRelay) Serve ¶ added in v0.2.0
Serve relays TCP DNS connections until ctx is canceled or the listener closes.
func (*DNSRelay) ServePacket ¶ added in v0.2.0
ServePacket answers UDP queries until ctx is canceled or the socket fails.
type Egress ¶
type Egress struct {
// contains filtered or unexported fields
}
Egress proxies actor TCP connections through an egress CONNECT dialer. It is long-lived across actor activations, but only carries traffic while an actor is assigned to its worker.
func NewEgress ¶
func NewEgress(originalDestination OriginalDestination) (*Egress, error)
NewEgress creates an activation-aware egress proxy.
func (*Egress) Activate ¶
func (e *Egress) Activate(actorUID string, dialer egressDialer, certificateSource actorCertificateSource, expiresAt time.Time) error
Activate enables the actor's egress and certificate renewal until deactivation.
type OriginalDestination ¶
OriginalDestination returns the address that a transparently intercepted connection originally targeted.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is an HTTPS reverse proxy for the worker's active actors.
func (*Server) Activate ¶
Activate routes requests for the actor through its namespace-specific dialer. Requests are routed by name, so an older incarnation still active under the same name is replaced.
func (*Server) Deactivate ¶
Deactivate rejects new requests for the actor and cancels and drains its handlers. It leaves a newer incarnation under the same name alone.
func (*Server) ServeConnect ¶
ServeConnect serves the mTLS CONNECT endpoint. CONNECT is deliberately on a separate listener so ordinary actor ingress remains a request proxy, while the router can use this listener for a bidirectional tunnel.
func (*Server) ServeConnectHTTP ¶
func (s *Server) ServeConnectHTTP(w http.ResponseWriter, r *http.Request)
ServeConnectHTTP accepts a router-authenticated CONNECT request and relays its tunnel to the named port on the currently active actor.
Source Files