Skip to content

Commit b6ca27b

Browse files
stroebitzerstroebitzer
committed
add adaptions for mtls verification for servisemesh training, move dockerfiles in seperate folder
1 parent 082e42a commit b6ca27b

12 files changed

Lines changed: 156 additions & 127 deletions

File tree

‎Makefile‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -25,37 +25,37 @@ run: build
2525

2626
.PHONY: docker-lint
2727
docker-lint:
28-
hadolint Dockerfile
28+
hadolint docker/Dockerfile
2929

3030
.PHONY: docker-lint-all
3131
docker-lint-all:
32-
hadolint Dockerfile
33-
hadolint Dockerfile-A
34-
hadolint Dockerfile-B --ignore DL3025
35-
hadolint Dockerfile-distroless --ignore DL3006
32+
hadolint docker/Dockerfile
33+
hadolint docker/Dockerfile-A
34+
hadolint docker/Dockerfile-B --ignore DL3025
35+
hadolint docker/Dockerfile-distroless --ignore DL3006
3636

3737
.PHONY: docker-build
38-
docker-build: build
39-
docker build -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
38+
docker-build: build docker-lint
39+
docker build -f docker/Dockerfile -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
4040

4141
.PHONY: docker-run
4242
docker-run: docker-build
4343
docker run -it --rm -p 8080:8080 -m=10m --cpus=".5" --name ${APPLICATION_NAME} ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION}
4444

4545
.PHONY: docker-build-all
4646
docker-build-all: lint docker-lint
47-
docker build -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
48-
docker build -f Dockerfile-A -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_A} .
49-
docker build -f Dockerfile-B -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_B} .
50-
docker build -f Dockerfile-distroless -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_DISTROLESS} .
47+
docker build -f docker/Dockerfile -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
48+
docker build -f docker/Dockerfile-A -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_A} .
49+
docker build -f docker/Dockerfile-B -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_B} .
50+
docker build -f docker/Dockerfile-distroless -t ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_DISTROLESS} .
5151

5252
.PHONY: docker-push
5353
docker-push:
54-
docker buildx build --push --platform linux/arm64,linux/amd64 --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
54+
docker buildx build --push --platform linux/arm64,linux/amd64 -f docker/Dockerfile --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
5555

5656
.PHONY: docker-push-all
5757
docker-push-all:
58-
docker buildx build --push --platform linux/arm64,linux/amd64 --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
59-
docker buildx build --push --platform linux/arm64,linux/amd64 -f Dockerfile-A --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_A} .
60-
docker buildx build --push --platform linux/arm64,linux/amd64 -f Dockerfile-B --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_B} .
61-
docker buildx build --push --platform linux/arm64,linux/amd64 -f Dockerfile-distroless --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_DISTROLESS} .
58+
docker buildx build --push --platform linux/arm64,linux/amd64 -f docker/Dockerfile --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION} .
59+
docker buildx build --push --platform linux/arm64,linux/amd64 -f docker/Dockerfile-A --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_A} .
60+
docker buildx build --push --platform linux/arm64,linux/amd64 -f docker/Dockerfile-B --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_B} .
61+
docker buildx build --push --platform linux/arm64,linux/amd64 -f docker/Dockerfile-distroless --tag ${IMAGE_REPOSITORY}/${APPLICATION_NAME}:${BUILD_VERSION_DISTROLESS} .

Dockerfile renamed to docker/Dockerfile

File renamed without changes.

Dockerfile-A renamed to docker/Dockerfile-A

File renamed without changes.

Dockerfile-B renamed to docker/Dockerfile-B

File renamed without changes.

Dockerfile-distroless renamed to docker/Dockerfile-distroless

File renamed without changes.

‎pod.yaml‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎src/cli.go‎

Lines changed: 2 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@ package main
22

33
import (
44
"bufio"
5-
"crypto/x509"
6-
"encoding/base64"
75
"fmt"
86
"io"
97
"net/http"
@@ -133,31 +131,7 @@ func request(url string) error {
133131
}
134132
}()
135133

136-
log.Infof("StatusCode of response %d", resp.StatusCode)
137-
138-
if resp.TLS == nil {
139-
log.Info("Response is not encrypted")
140-
clientCertHeader := resp.Header.Get("X-Client-Cert")
141-
if clientCertHeader != "" {
142-
certData, err := base64.StdEncoding.DecodeString(clientCertHeader)
143-
if err != nil {
144-
log.Errorf("error decoding proxied certificate: %s", err)
145-
}
146-
cert, err := x509.ParseCertificate(certData)
147-
if err != nil {
148-
log.Errorf("error parsing proxied certificate: %s", err)
149-
}
150-
log.Info(getCertString("Proxied certificate", cert))
151-
} else {
152-
log.Infof("No proxied certificate found")
153-
}
154-
} else {
155-
log.Info("Response is encrypted")
156-
log.Infof("TLS Version: %d", resp.TLS.Version)
157-
for i, cert := range resp.TLS.PeerCertificates {
158-
log.Info(getCertString(fmt.Sprintf("Certificate %d", i+1), cert))
159-
}
160-
}
134+
log.Info(newResponseInfo(resp))
161135

162136
bodyBytes, err := io.ReadAll(resp.Body)
163137
if err != nil {
@@ -167,24 +141,10 @@ func request(url string) error {
167141
if len(bodyString) >= 100 {
168142
bodyString = bodyString[:100]
169143
}
170-
log.Infof("Response Body: %s", bodyString)
144+
log.Infof("Response Body: \n%s", bodyString)
171145
return nil
172146
}
173147

174-
func getCertString(header string, cert *x509.Certificate) string {
175-
var sb strings.Builder
176-
sb.WriteString(fmt.Sprintf("%s: \n", header))
177-
sb.WriteString(fmt.Sprintf("\tCertificate Subject: %s\n", cert.Subject.String()))
178-
sb.WriteString(fmt.Sprintf("\tCertificate Issuer: %s\n", cert.Issuer.String()))
179-
sb.WriteString(fmt.Sprintf("\tCertificate Serial Number: %s\n", cert.SerialNumber.String()))
180-
sb.WriteString(fmt.Sprintf("\tCertificate Not Before: %s\n", cert.NotBefore.String()))
181-
sb.WriteString(fmt.Sprintf("\tCertificate Not After: %s\n", cert.NotAfter.String()))
182-
sb.WriteString(fmt.Sprintf("\tCertificate DNS Names: %v\n", cert.DNSNames))
183-
sb.WriteString(fmt.Sprintf("\tCertificate Email Addresses: %v\n", cert.EmailAddresses))
184-
sb.WriteString(fmt.Sprintf("\tCertificate IP Addresses: %v\n", cert.IPAddresses))
185-
return sb.String()
186-
}
187-
188148
func leakMem() {
189149
memLeak := make([]string, 0)
190150
count := 0

‎src/request_info.go‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
package main
2+
3+
import (
4+
_ "embed"
5+
"fmt"
6+
"net/http"
7+
"strings"
8+
)
9+
10+
type requestInfo struct {
11+
Method string
12+
Url string
13+
Proto string
14+
Host string
15+
RemoteAddr string
16+
RequestUri string
17+
TLS bool
18+
Header map[string][]string
19+
}
20+
21+
func newRequestInfo(r *http.Request) *requestInfo {
22+
return &requestInfo{
23+
Method: r.Method,
24+
Url: r.URL.String(),
25+
Proto: r.Proto,
26+
Host: r.Host,
27+
RemoteAddr: r.RemoteAddr,
28+
RequestUri: r.RequestURI,
29+
TLS: r.TLS != nil,
30+
Header: r.Header,
31+
}
32+
}
33+
34+
func (ri *requestInfo) String() string {
35+
var sb strings.Builder
36+
sb.WriteString("Request Info:\n")
37+
sb.WriteString(fmt.Sprintf("\tMethod: %v\n", ri.Method))
38+
sb.WriteString(fmt.Sprintf("\tUrl: %v\n", ri.Url))
39+
sb.WriteString(fmt.Sprintf("\tProto: %v\n", ri.Proto))
40+
sb.WriteString(fmt.Sprintf("\tHost: %v\n", ri.Host))
41+
sb.WriteString(fmt.Sprintf("\tRemoteAddr: %v\n", ri.RemoteAddr))
42+
sb.WriteString(fmt.Sprintf("\tRequestUri: %v\n", ri.RequestUri))
43+
sb.WriteString(fmt.Sprintf("\tTLS: %v\n", ri.TLS))
44+
sb.WriteString("\tHeader:\n")
45+
for key, value := range ri.Header {
46+
sb.WriteString(fmt.Sprintf("\t\t%v: %v\n", key,value))
47+
}
48+
return sb.String()
49+
}

‎src/response_info.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package main
2+
3+
import (
4+
"crypto/tls"
5+
"crypto/x509"
6+
_ "embed"
7+
"fmt"
8+
"net/http"
9+
"strings"
10+
)
11+
12+
type certInfo struct {
13+
Subject string
14+
Issuer string
15+
}
16+
17+
type tlsInfo struct {
18+
ServerName string
19+
CertInfos []*certInfo
20+
}
21+
22+
type responseInfo struct {
23+
Status string
24+
Proto string
25+
TlsInfo *tlsInfo
26+
Header map[string][]string
27+
}
28+
29+
func newCertInfos(certs []*x509.Certificate) []*certInfo {
30+
certInfos := make([]*certInfo, len(certs))
31+
for i, cert := range certs {
32+
certInfos[i] = &certInfo{
33+
Subject: strings.TrimSpace(cert.Subject.CommonName),
34+
Issuer: strings.TrimSpace(cert.Issuer.CommonName),
35+
}
36+
}
37+
return certInfos
38+
}
39+
40+
func newTLSInfo(s *tls.ConnectionState) *tlsInfo {
41+
if s == nil {
42+
return nil
43+
} else {
44+
return &tlsInfo{
45+
ServerName: s.ServerName,
46+
CertInfos: newCertInfos(s.PeerCertificates),
47+
}
48+
}
49+
}
50+
51+
func newResponseInfo(r *http.Response) *responseInfo {
52+
return &responseInfo{
53+
Status: r.Status,
54+
Proto: r.Proto,
55+
TlsInfo: newTLSInfo(r.TLS),
56+
Header: r.Header,
57+
}
58+
}
59+
60+
func (ri *responseInfo) String() string {
61+
var sb strings.Builder
62+
sb.WriteString("Response Info:\n")
63+
sb.WriteString(fmt.Sprintf("\tStatus: %v\n", ri.Status))
64+
sb.WriteString(fmt.Sprintf("\tProto: %v\n", ri.Proto))
65+
if ri.TlsInfo == nil {
66+
sb.WriteString("\tTLS: false\n")
67+
} else {
68+
sb.WriteString("\tTLS:\n")
69+
sb.WriteString(fmt.Sprintf("\t\tServer Name: %s\n", ri.TlsInfo.ServerName))
70+
sb.WriteString("\t\tCertificates:\n")
71+
for _, ci := range ri.TlsInfo.CertInfos {
72+
sb.WriteString(fmt.Sprintf("\t\t\tCertificate Subject: %s - Certificate Issuer: %s\n", ci.Subject, ci.Issuer))
73+
}
74+
}
75+
sb.WriteString("\tHeader:\n")
76+
for key, value := range ri.Header {
77+
sb.WriteString(fmt.Sprintf("\t\t%v: %v\n", key, value))
78+
}
79+
return sb.String()
80+
}

‎src/root.html‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,10 @@ <h3>About the Request</h3>
3434
RemoteAddr: {{.RequestInfo.RemoteAddr}}<br>
3535
RequestUri: {{.RequestInfo.RequestUri}}<br>
3636
TLS: {{.RequestInfo.TLS}}<br>
37-
HeaderXForwardedProto: {{.RequestInfo.HeaderXForwardedProto}}<br>
38-
HeaderXForwardedFor: {{.RequestInfo.HeaderXForwardedFor}}<br>
39-
HeaderXForwardedPort: {{.RequestInfo.HeaderXForwardedPort}}<br>
37+
Header:<br>
38+
{{ range $key, $value := .RequestInfo.Header }}
39+
{{$key}}: {{$value}}<br>
40+
{{ end}}
4041

4142
{{if .CatImageURL}}
4243
<h2>The cute cat</h2>

0 commit comments

Comments
 (0)