Merge pull request #280 from depot/feat/registry-tls-server-name

feat: update local registry mTLS to do client-side server name verification
depot · May 3, 2024 · e72d69b · e72d69b
2 parents d31441a + e2d6e6b
commit e72d69b
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 14 deletions.
diff --git a/pkg/cmd/registry/registry.go b/pkg/cmd/registry/registry.go
@@ -13,7 +13,6 @@ import (
 	"log"
 	"net"
 	"net/http"
-	"net/url"
 	"os"
 	"os/signal"
 	"strconv"
@@ -64,6 +63,11 @@ func run() error {
 		return err
 	}
 
+	serverName, err := base64.StdEncoding.DecodeString(os.Getenv("SERVER_NAME"))
+	if err != nil {
+		return err
+	}
+
 	rawConfig, err := base64.StdEncoding.DecodeString(os.Getenv("CONFIG"))
 	if err != nil {
 		return err
@@ -103,7 +107,7 @@ func run() error {
 		cancel()
 	}()
 
-	contentClient, err := NewContentClient(ctx, caCert, certPEM, keyPEM, string(addr))
+	contentClient, err := NewContentClient(ctx, caCert, certPEM, keyPEM, string(serverName), string(addr))
 	if err != nil {
 		return err
 	}
@@ -120,18 +124,13 @@ func run() error {
 	return nil
 }
 
-func NewContentClient(ctx context.Context, caCert, certPEM, keyPEM []byte, buildkitdAddress string) (contentv1.ContentClient, error) {
-	uri, err := url.Parse(buildkitdAddress)
-	if err != nil {
-		return nil, err
-	}
-
+func NewContentClient(ctx context.Context, caCert, certPEM, keyPEM []byte, serverName, buildkitdAddress string) (contentv1.ContentClient, error) {
 	certPool := x509.NewCertPool()
 	if ok := certPool.AppendCertsFromPEM(caCert); !ok {
 		return nil, fmt.Errorf("failed to append ca certs")
 	}
 
-	cfg := &tls.Config{RootCAs: certPool}
+	cfg := &tls.Config{RootCAs: certPool, ServerName: serverName}
 	cert, err := tls.X509KeyPair(certPEM, keyPEM)
 	if err != nil {
 		return nil, fmt.Errorf("could not read certificate/key: %w", err)
@@ -142,7 +141,7 @@ func NewContentClient(ctx context.Context, caCert, certPEM, keyPEM []byte, build
 		grpc.WithBlock(),
 		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(defaults.DefaultMaxRecvMsgSize)),
 		grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize)),
-		grpc.WithAuthority(uri.Host),
+		grpc.WithAuthority(serverName),
 		grpc.WithTransportCredentials(credentials.NewTLS(cfg)),
 		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
 			addr := strings.TrimPrefix(buildkitdAddress, "tcp://")

diff --git a/pkg/load/load.go b/pkg/load/load.go
@@ -42,6 +42,7 @@ func DepotFastLoad(ctx context.Context, dockerapi docker.APIClient, resp []depot
 			RawManifest: manifest,
 			RawConfig:   config,
 			Addr:        nodeRes.Node.DriverOpts["addr"],
+			ServerName:  nodeRes.Node.DriverOpts["serverName"],
 			CACert:      []byte(nodeRes.Node.DriverOpts["caCert"]),
 			Key:         []byte(nodeRes.Node.DriverOpts["key"]),
 			Cert:        []byte(nodeRes.Node.DriverOpts["cert"]),

diff --git a/pkg/load/proxy.go b/pkg/load/proxy.go
@@ -25,10 +25,11 @@ type ProxyContainer struct {
 
 type ProxyConfig struct {
 	// Addr is the remote buildkit address (e.g. tcp://192.168.0.1)
-	Addr   string
-	CACert []byte
-	Key    []byte
-	Cert   []byte
+	Addr       string
+	ServerName string
+	CACert     []byte
+	Key        []byte
+	Cert       []byte
 
 	// RawManifest is the raw manifest bytes for the single image to serve.
 	RawManifest []byte
@@ -55,6 +56,7 @@ func RunProxyImage(ctx context.Context, dockerapi docker.APIClient, config *Prox
 				fmt.Sprintf("KEY=%s", base64.StdEncoding.EncodeToString(config.Key)),
 				fmt.Sprintf("CERT=%s", base64.StdEncoding.EncodeToString(config.Cert)),
 				fmt.Sprintf("ADDR=%s", base64.StdEncoding.EncodeToString([]byte(config.Addr))),
+				fmt.Sprintf("SERVER_NAME=%s", base64.StdEncoding.EncodeToString([]byte(config.ServerName))),
 				fmt.Sprintf("MANIFEST=%s", base64.StdEncoding.EncodeToString(config.RawManifest)),
 				fmt.Sprintf("CONFIG=%s", base64.StdEncoding.EncodeToString(config.RawConfig)),
 			},