Skip to content

Commit d991a1b

Browse files
amithkkamithkk-work
amithkk
and
amithkk-work
authored
Add support for X509 mutual authentication/authorization (#46)
* Add support, tests and documentation for x509 mutual authentication support. Clean up code Signed-off-by: KK, Amith <[email protected]> * Stub process.exit at prepare-time to wait for mongodb-memory-server download in CI Signed-off-by: KK, Amith <[email protected]> Co-authored-by: KK, Amith <[email protected]>
1 parent f6000d8 commit d991a1b

File tree

13 files changed

+510
-7000
lines changed

13 files changed

+510
-7000
lines changed

‎.gitignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
1+
# IDE Specific folders
12
.idea
3+
.vscode
4+
5+
# Key Storage
6+
.secrets

‎README.md

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -23,22 +23,30 @@ Latest OpenAPI Specification for this API is available on the [api-specs reposit
2323

2424
### Configuration
2525

26-
| Environment Variable | Default | Description |
27-
|------------------------------|------------------|---------------------------------------------------------------------------------|
28-
| LOG_LEVEL | `info` | The verbosity of the logging |
29-
| PORT | `3000` | Port on which the gateway listens |
30-
| MONGO_URI | - | A mongodb uri string. If this is specified, all other mongo args are overridden |
31-
| MONGO_HOST | `mongodb` | The host on which mongodb is available |
32-
| MONGO_PORT | `27017` | Port on which mongodb's native driver api is available |
33-
| MONGO_PASS | `pass` | Password for mongo host |
34-
| MONGO_REPLICA_SET_NAME | `` | Name of the mongo replicaset. Only required if connecting to an rs mongo |
35-
| CHANNEL_DB | `primary` | The database used as the channel collection |
36-
| AUDIT_POSTFIX | `_audit` | The postfix added to the audit channel for any given channel |
37-
| JAEGER_HOST | `` | The jaeger host to send traces to |
38-
| JAEGER_SAMPLER_PARAM | `1` | The parameter to pass to the jaeger sampler |
39-
| JAEGER_SAMPLER_TYPE | `const` | The jaeger sampler type to use |
40-
| JAEGER_SERVICE_NAME | `Database Agent` | The name of the service passed to jaeger |
41-
| JAEGER_AGENT_SIDECAR_ENABLED | `false` | Is jaeger agent sidecar injection enabled |
26+
| Environment Variable | Default | Description |
27+
|--------------------------------|------------------------------|----------------------------------------------------------------------------------------------------------------|
28+
| LOG_LEVEL | `info` | The verbosity of the logging |
29+
| PORT | `3000` | Port on which the gateway listens |
30+
| MONGO_URI | - | A mongodb uri string. If this is specified, all other mongo args are overridden |
31+
| MONGO_HOST | `mongodb` | The host on which mongodb is available |
32+
| MONGO_PORT | `27017` | Port on which mongodb's native driver api is available |
33+
| MONGO_PASS | `pass` | Password for mongo host |
34+
| MONGO_REPLICA_SET_NAME | `` | Name of the mongo replicaset. Only required if connecting to an rs mongo |
35+
| MONGO_TLS_MODE_ENABLED | `0` | If set to 1, enable TLS mongodb connections and present a client certificate for authorization |
36+
| MONGO_TLS_CLIENT_CERT_PATH | `` | Path to client certificate as .PEM encoded file. Relative to launch directory. Required if TLS mode is enabled |
37+
| MONGO_TLS_CA_CERT_PATH | `` | Path to CAs certificate as a .PEM encoded file. Relative to launch directory. Required if TLS mode is enabled |
38+
| MONGO_TLS_CLIENT_CERT_PASS_KEY | `MONGO_TLS_CLIENT_CERT_PASS` | Environment variable key for client certificate password. |
39+
| MONGO_TLS_CLIENT_CERT_PASS | `` | Key to decrypt client certificate. Required if client certificate is protected with a passphrase |
40+
| MONGO_TLS_ALLOW_INVALID_HOST | `0` | Allow use of server TLS certificates which do not have matching hostnames |
41+
| MONGO_SERVER_SELECTION_TIMEOUT | `3000` | Timeout for mongodb server selection. In milliseconds |
42+
| MONGO_CONNECTION_TIMEOUT | `3000` | Timeout for mongodb connection establishment. In milliseconds |
43+
| CHANNEL_DB | `primary` | The database used as the channel collection |
44+
| AUDIT_POSTFIX | `_audit` | The postfix added to the audit channel for any given channel |
45+
| JAEGER_HOST | `` | The jaeger host to send traces to |
46+
| JAEGER_SAMPLER_PARAM | `1` | The parameter to pass to the jaeger sampler |
47+
| JAEGER_SAMPLER_TYPE | `const` | The jaeger sampler type to use |
48+
| JAEGER_SERVICE_NAME | `Database Agent` | The name of the service passed to jaeger |
49+
| JAEGER_AGENT_SIDECAR_ENABLED | `false` | Is jaeger agent sidecar injection enabled |
4250

4351
## Helm Deployment
4452

‎src/app.js

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,18 +28,22 @@
2828
const express = require('express');
2929
const cookieParser = require('cookie-parser');
3030
const winston = require('winston');
31-
3231
const expressWinston = require('express-winston');
32+
const dbController = require('./controller/db');
3333
const jaegerHelper = require('./utils/tracer');
3434
const indexRouter = require('./routes/index');
3535
const agentRouter = require('./routes/agent');
3636

3737
/**
38-
* Express app providing pgp related functions.
38+
* Express app providing the agent interface
3939
* @type {object}
4040
* @const
4141
*/
4242
const app = express();
43+
dbController.setupClient()
44+
.catch(() => {
45+
process.exit(1);
46+
});
4347

4448
app.use(expressWinston.logger({
4549
level: process.env.LOG_LEVEL || 'info',
@@ -50,7 +54,6 @@ app.use(expressWinston.logger({
5054
winston.format.timestamp(),
5155
winston.format.align(),
5256
winston.format.printf((info) => `${info.timestamp} ${info.level} ${info.message}`),
53-
5457
),
5558
msg: 'HTTP {{req.method}} {{req.url}}',
5659
ignoredRoutes: ['/'],

‎src/bin/www

Lines changed: 58 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,93 @@
11
#!/usr/bin/env node
2+
/* file generated by express-generator */
3+
/* eslint-disable import/order,no-console */
24

35
/**
46
* Module dependencies.
57
*/
68
require('../utils/logging')
79
.setupLogs();
8-
var app = require('../app');
9-
var debug = require('debug')('database-agent:server');
10-
var http = require('http');
10+
const app = require('../app');
11+
const debug = require('debug')('database-agent:server');
12+
const http = require('http');
1113

1214
/**
13-
* Get port from environment and store in Express.
15+
* Normalize a port into a number, string, or false.
1416
*/
1517

16-
var port = normalizePort(process.env.PORT || '3500');
17-
app.set('port', port);
18+
function normalizePort(val) {
19+
const port = parseInt(val, 10);
1820

19-
/**
20-
* Create HTTP server.
21-
*/
21+
if (Number.isNaN(port)) {
22+
// named pipe
23+
return val;
24+
}
2225

23-
var server = http.createServer(app);
26+
if (port >= 0) {
27+
// port number
28+
return port;
29+
}
30+
31+
return false;
32+
}
2433

2534
/**
26-
* Listen on provided port, on all network interfaces.
35+
* Get port from environment and store in Express.
2736
*/
2837

29-
server.listen(port);
30-
server.on('error', onError);
31-
server.on('listening', onListening);
38+
const port = normalizePort(process.env.PORT || '3500');
39+
app.set('port', port);
3240

3341
/**
34-
* Normalize a port into a number, string, or false.
42+
* Create HTTP server.
3543
*/
3644

37-
function normalizePort(val) {
38-
var port = parseInt(val, 10);
39-
40-
if (isNaN(port)) {
41-
// named pipe
42-
return val
43-
}
44-
45-
if (port >= 0) {
46-
// port number
47-
return port
48-
}
49-
50-
return false
51-
}
45+
const server = http.createServer(app);
5246

5347
/**
5448
* Event listener for HTTP server "error" event.
5549
*/
5650

5751
function onError(error) {
58-
if (error.syscall !== 'listen') {
59-
throw error
60-
}
61-
62-
var bind = typeof port === 'string'
63-
? 'Pipe ' + port
64-
: 'Port ' + port;
65-
66-
// handle specific listen errors with friendly messages
67-
switch (error.code) {
68-
case 'EACCES':
69-
console.error(bind + ' requires elevated privileges');
70-
process.exit(1);
71-
break;
72-
case 'EADDRINUSE':
73-
console.error(bind + ' is already in use');
74-
process.exit(1);
75-
break;
76-
default:
77-
throw error;
78-
}
52+
if (error.syscall !== 'listen') {
53+
throw error;
54+
}
55+
56+
const bind = typeof port === 'string'
57+
? `Pipe ${port}`
58+
: `Port ${port}`;
59+
60+
// handle specific listen errors with friendly messages
61+
switch (error.code) {
62+
case 'EACCES':
63+
console.error(`${bind} requires elevated privileges`);
64+
process.exit(1);
65+
break;
66+
case 'EADDRINUSE':
67+
console.error(`${bind} is already in use`);
68+
process.exit(1);
69+
break;
70+
default:
71+
throw error;
72+
}
7973
}
8074

8175
/**
8276
* Event listener for HTTP server "listening" event.
8377
*/
8478

8579
function onListening() {
86-
var addr = server.address();
87-
var bind = typeof addr === 'string'
88-
? 'pipe ' + addr
89-
: 'port ' + addr.port;
90-
debug('Listening on ' + bind)
80+
const addr = server.address();
81+
const bind = typeof addr === 'string'
82+
? `pipe ${addr}`
83+
: `port ${addr.port}`;
84+
debug(`Listening on ${bind}`);
9185
}
86+
87+
/**
88+
* Listen on provided port, on all network interfaces.
89+
*/
90+
91+
server.listen(port);
92+
server.on('error', onError);
93+
server.on('listening', onListening);

0 commit comments

Comments
 (0)