Merge pull request #575 from weaveworks/559-probe-ssl-support

Add ssl support for the probe

.gitignore

@@ -43,6 +43,7 @@ docker/scope-probe
 docker/docker*
 docker/weave
 docker/runsvinit
+docker/ca-certificates.crt
 experimental/bridge/bridge
 experimental/demoprobe/demoprobe
 experimental/fixprobe/fixprobe

Makefile

@@ -29,19 +29,22 @@ docker/weave:
 	curl -L git.io/weave -o docker/weave
 	chmod u+x docker/weave
 
-$(SCOPE_EXPORT): $(APP_EXE) $(PROBE_EXE) $(DOCKER_DISTRIB) docker/weave $(RUNSVINIT) docker/Dockerfile docker/run-app docker/run-probe docker/entrypoint.sh
+$(SCOPE_EXPORT): $(APP_EXE) $(PROBE_EXE) $(DOCKER_DISTRIB) docker/weave $(RUNSVINIT) docker/Dockerfile docker/run-app docker/run-probe docker/entrypoint.sh docker/ca-certificates.crt
 	@if [ -z '$(DOCKER_SQUASH)' ] ; then echo "Please install docker-squash by running 'make deps' (and make sure GOPATH/bin is in your PATH)." && exit 1 ; fi
 	cp $(APP_EXE) $(PROBE_EXE) docker/
 	cp $(DOCKER_DISTRIB) docker/docker.tgz
 	$(SUDO) docker build -t $(SCOPE_IMAGE) docker/
 	$(SUDO) docker save $(SCOPE_IMAGE):latest | sudo $(DOCKER_SQUASH) -t $(SCOPE_IMAGE) | tee $@ | $(SUDO) docker load
 
+docker/ca-certificates.crt: /etc/ssl/certs/ca-certificates.crt
+		cp $? $@
+
 $(RUNSVINIT): vendor/runsvinit/*.go
 	go build -o $@ github.com/weaveworks/scope/vendor/runsvinit
 
-$(APP_EXE): app/*.go render/*.go report/*.go xfer/*.go
+$(APP_EXE): app/*.go render/*.go report/*.go xfer/*.go common/sanitize/*.go
 
-$(PROBE_EXE): probe/*.go probe/docker/*.go probe/kubernetes/*.go probe/endpoint/*.go probe/host/*.go probe/process/*.go probe/overlay/*.go report/*.go xfer/*.go
+$(PROBE_EXE): probe/*.go probe/docker/*.go probe/kubernetes/*.go probe/endpoint/*.go probe/host/*.go probe/process/*.go probe/overlay/*.go report/*.go xfer/*.go common/sanitize/*.go common/exec/*.go
 
 $(APP_EXE) $(PROBE_EXE):
 	go get -d -tags netgo ./$(@D)

common/sanitize/sanitize.go

@@ -10,29 +10,29 @@ import (
 
 // URL returns a function that sanitizes a URL string. It lets underspecified
 // strings to be converted to usable URLs via some default arguments.
-func URL(scheme string, port int, path string) func(string) string {
-	if scheme == "" {
-		scheme = "http://"
+func URL(defaultScheme string, defaultPort int, defaultPath string) func(string) string {
+	if defaultScheme == "" {
+		defaultScheme = "http://"
 	}
 	return func(s string) string {
 		if s == "" {
 			return s // can't do much here
 		}
-		if !strings.HasPrefix(s, "http") {
-			s = scheme + s
+		if !strings.Contains(s, "://") {
+			s = defaultScheme + s
 		}
 		u, err := url.Parse(s)
 		if err != nil {
 			log.Printf("%q: %v", s, err)
 			return s // oh well
 		}
-		if port > 0 {
-			if _, _, err = net.SplitHostPort(u.Host); err != nil {
-				u.Host += fmt.Sprintf(":%d", port)
-			}
+		if _, port, err := net.SplitHostPort(u.Host); err != nil && defaultPort > 0 {
+			u.Host += fmt.Sprintf(":%d", defaultPort)
+		} else if port == "443" {
+			u.Scheme = "https"
 		}
-		if path != "" && u.Path != path {
-			u.Path = path
+		if defaultPath != "" && u.Path != defaultPath {
+			u.Path = defaultPath
 		}
 		return u.String()
 	}

common/sanitize/sanitize_test.go

@@ -22,9 +22,12 @@ func TestSanitizeURL(t *testing.T) {
 		{"https://", 0, "", "foo", "https://foo"},
 		{"https://", 80, "", "foo", "https://foo:80"},
 		{"https://", 0, "some/path", "foo", "https://foo/some/path"},
-		{"https://", 0, "", "http://foo", "http://foo"}, // specified scheme beats default...
-		{"", 9999, "", "foo:80", "http://foo:80"},       // specified port beats default...
-		{"", 0, "/bar", "foo/baz", "http://foo/bar"},    // ...but default path beats specified!
+		{"https://", 0, "", "http://foo", "http://foo"},  // specified scheme beats default...
+		{"", 0, "", "https://foo", "https://foo"},        // https can be a specified scheme without default...
+		{"http://", 0, "", "https://foo", "https://foo"}, // https can be a specified scheme with default...
+		{"", 9999, "", "foo:80", "http://foo:80"},        // specified port beats default...
+		{"", 0, "/bar", "foo/baz", "http://foo/bar"},     // ...but default path beats specified!
+		{"", 0, "", "foo:443", "https://foo:443"},        // port 443 addrs default to https scheme
 	} {
 		if want, have := input.want, sanitize.URL(input.scheme, input.port, input.path)(input.input); want != have {
 			t.Errorf("sanitize.URL(%q, %d, %q)(%q): want %q, have %q", input.scheme, input.port, input.path, input.input, want, have)

docker/Dockerfile

@@ -10,5 +10,6 @@ ADD ./weave /usr/bin/
 COPY ./scope-app ./scope-probe ./runsvinit ./entrypoint.sh /home/weave/
 COPY ./run-app /etc/service/app/run
 COPY ./run-probe /etc/service/probe/run
+COPY ./ca-certificates.crt /etc/ssl/certs/
 EXPOSE 4040
 ENTRYPOINT ["/home/weave/entrypoint.sh"]

docker/entrypoint.sh

@@ -103,7 +103,7 @@ while true; do
                 shift
             fi
             PROBE_ARGS="$PROBE_ARGS -token=$ARG_VALUE"
-            echo "scope.weave.works:80" >/etc/weave/apps
+            echo "scope.weave.works:443" >/etc/weave/apps
             touch /etc/service/app/down
             ;;
         --no-app)

experimental/demoprobe/main.go

@@ -23,7 +23,7 @@ func main() {
 	)
 	flag.Parse()
 
-	_, publisher, err := xfer.NewHTTPPublisher(*publish, "demoprobe", "demoprobe")
+	_, publisher, err := xfer.NewHTTPPublisher(*publish, "demoprobe", "demoprobe", false)
 	if err != nil {
 		log.Fatal(err)
 	}

experimental/fixprobe/main.go

@@ -34,7 +34,7 @@ func main() {
 	}
 	f.Close()
 
-	_, publisher, err := xfer.NewHTTPPublisher(*publish, "fixprobe", "fixprobe")
+	_, publisher, err := xfer.NewHTTPPublisher(*publish, "fixprobe", "fixprobe", false)
 	if err != nil {
 		log.Fatal(err)
 	}

probe/main.go

@@ -45,6 +45,7 @@ func main() {
 		procRoot           = flag.String("proc.root", "/proc", "location of the proc filesystem")
 		printVersion       = flag.Bool("version", false, "print version number and exit")
 		useConntrack       = flag.Bool("conntrack", true, "also use conntrack to track connections")
+		insecure           = flag.Bool("insecure", false, "(SSL) explicitly allow \"insecure\" SSL connections and transfers")
 		logPrefix          = flag.String("log.prefix", "<probe>", "prefix for each log line")
 	)
 	flag.Parse()
@@ -90,7 +91,7 @@ func main() {
 	log.Printf("publishing to: %s", strings.Join(targets, ", "))
 
 	factory := func(endpoint string) (string, xfer.Publisher, error) {
-		id, publisher, err := xfer.NewHTTPPublisher(endpoint, *token, probeID)
+		id, publisher, err := xfer.NewHTTPPublisher(endpoint, *token, probeID, *insecure)
 		if err != nil {
 			return "", nil, err
 		}

xfer/http_publisher.go

@@ -1,6 +1,7 @@
 package xfer
 
 import (
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -15,24 +16,31 @@ type HTTPPublisher struct {
 	url     string
 	token   string
 	probeID string
+	client  *http.Client
 }
 
-var fastClient = http.Client{
+var fastClient = &http.Client{
 	Timeout: 5 * time.Second,
 }
 
 // NewHTTPPublisher returns an HTTPPublisher ready for use.
-func NewHTTPPublisher(target, token, probeID string) (string, *HTTPPublisher, error) {
+func NewHTTPPublisher(target, token, probeID string, insecure bool) (string, *HTTPPublisher, error) {
 	p := &HTTPPublisher{
-		url:     sanitize.URL("http://", 0, "/api/report")(target),
+		url:     sanitize.URL("", 0, "/api/report")(target),
 		token:   token,
 		probeID: probeID,
+		client:  http.DefaultClient,
 	}
-	req, err := p.authorizedRequest("GET", sanitize.URL("http://", 0, "/api")(target), nil)
+	client := fastClient
+	if insecure {
+		allowInsecure(fastClient)
+		allowInsecure(p.client)
+	}
+	req, err := p.authorizedRequest("GET", sanitize.URL("", 0, "/api")(target), nil)
 	if err != nil {
 		return "", nil, err
 	}
-	resp, err := fastClient.Do(req)
+	resp, err := client.Do(req)
 	if err != nil {
 		return "", nil, err
 	}
@@ -68,7 +76,7 @@ func (p HTTPPublisher) Publish(r io.Reader) error {
 	req.Header.Set("Content-Encoding", "gzip")
 	// req.Header.Set("Content-Type", "application/binary") // TODO: we should use http.DetectContentType(..) on the gob'ed
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := p.client.Do(req)
 	if err != nil {
 		return err
 	}
@@ -89,6 +97,12 @@ func AuthorizationHeader(token string) string {
 	return fmt.Sprintf("Scope-Probe token=%s", token)
 }
 
+func allowInsecure(c *http.Client) {
+	c.Transport = &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+}
+
 // ScopeProbeIDHeader is the header we use to carry the probe's unique ID. The
 // ID is currently set to the probe's hostname. It's designed to deduplicate
 // reports from the same probe to the same receiver, in case the probe is

xfer/http_publisher_test.go

@@ -67,7 +67,7 @@ func TestHTTPPublisher(t *testing.T) {
 	s := httptest.NewServer(handlers.CompressHandler(handler))
 	defer s.Close()
 
-	_, p, err := xfer.NewHTTPPublisher(s.URL, token, id)
+	_, p, err := xfer.NewHTTPPublisher(s.URL, token, id, false)
 	if err != nil {
 		t.Fatal(err)
 	}