snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/pkg/corredor/conn.go

@@ -0,0 +1,99 @@
+package corredor
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/cortezaproject/corteza/server/pkg/options"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+)
+
+// Corredor standard connector to Corredor service via gRPC
+func NewConnection(ctx context.Context, opt options.CorredorOpt, logger *zap.Logger) (c *grpc.ClientConn, err error) {
+	log := logger.Named("conn")
+
+	if !opt.Enabled {
+		// Do not connect when script runner is not enabled
+		log.Info("corredor disabled (CORREDOR_ENABLED=false)")
+		return
+	}
+
+	var (
+		dialOpts = make([]grpc.DialOption, 0)
+
+		paths = map[string]string{
+			"corredor CA public key":      opt.TlsCertCA,
+			"corredor client public key":  opt.TlsCertPublic,
+			"corredor client private key": opt.TlsCertPrivate,
+		}
+
+		expl = "\n\n" +
+			"Check and change configured path to Corredor TLS certificates " +
+			"in env var CORREDOR_CLIENT_CERTIFICATES_PATH or disable " +
+			"this check with CORREDOR_CLIENT_CERTIFICATES_ENABLED=false" +
+			"\n\n"
+	)
+
+	// opt.PublicKey = ""
+	if opt.TlsCertEnabled {
+		// Check paths
+		log.Debug("connecting with TLS certificates enabled (CORREDOR_CLIENT_CERTIFICATES_ENABLED=true)")
+
+		for label, path := range paths {
+			if _, err = os.Stat(path); os.IsNotExist(err) {
+				return nil, fmt.Errorf("%s (%s) not found"+expl, label, path)
+			} else if err != nil {
+				return nil, fmt.Errorf("%s (%s) could not be loaded: %s"+expl, label, path, err)
+			}
+		}
+
+		// Load the certificates from disk
+		certificate, err := tls.LoadX509KeyPair(opt.TlsCertPublic, opt.TlsCertPrivate)
+		if err != nil {
+			return nil, fmt.Errorf("could not load client key pair: %s"+expl, err)
+		}
+
+		// Create a certificate pool from the certificate authority
+		certPool := x509.NewCertPool()
+		ca, err := ioutil.ReadFile(opt.TlsCertCA)
+		if err != nil {
+			return nil, fmt.Errorf("could not read ca certificate: %s"+expl, err)
+		}
+
+		// Append the client certificates from the CA
+		if ok := certPool.AppendCertsFromPEM(ca); !ok {
+			return nil, errors.New("failed to append ca certs" + expl)
+		}
+
+		crds := credentials.NewTLS(&tls.Config{
+			ServerName:   opt.TlsServerName,
+			Certificates: []tls.Certificate{certificate},
+			RootCAs:      certPool,
+		})
+
+		dialOpts = append(dialOpts, grpc.WithTransportCredentials(crds))
+	} else {
+		log.Debug("connecting without TLS certificates " +
+			"(this is OK if you are using private or internal docker network)")
+		dialOpts = append(dialOpts, grpc.WithInsecure())
+	}
+
+	if opt.MaxReceiveMessageSize > 0 {
+		dialOpts = append(dialOpts, grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(opt.MaxReceiveMessageSize)))
+	}
+
+	if opt.MaxBackoffDelay > 0 {
+		dialOpts = append(dialOpts, grpc.WithBackoffMaxDelay(opt.MaxBackoffDelay))
+	}
+
+	log.Info("connecting to corredor", zap.String("addr", opt.Addr))
+
+	return grpc.DialContext(ctx, opt.Addr, dialOpts...)
+}