Feat: Add mtls authentication for the API #87
Conversation
WalkthroughThe changes introduced in this pull request enhance the Changes
Assessment against linked issues
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (3)
op-defender/psp_executor/cli.go (2)
102-119: Improve usage descriptions for TLS flagsThe new TLS flags are added correctly. However, consider enhancing the
Usagedescriptions for clarity and consistency with existing flags.Suggested changes:
&cli.StringFlag{ Name: optls.TLSCaCertFlagName, - Usage: "tls ca cert path", + Usage: "TLS CA certificate file path", EnvVars: opservice.PrefixEnvVar(envPrefix, "TLS_CA"), }, &cli.StringFlag{ Name: optls.TLSCertFlagName, - Usage: "tls cert path", + Usage: "TLS certificate file path", EnvVars: opservice.PrefixEnvVar(envPrefix, "TLS_CERT"), }, &cli.StringFlag{ Name: optls.TLSKeyFlagName, - Usage: "tls key", + Usage: "TLS key file path", EnvVars: opservice.PrefixEnvVar(envPrefix, "TLS_KEY"), },This improves readability and maintains consistency with the capitalization and descriptive style used in other flags.
102-119: Explicitly specify theRequiredfield for TLS flagsCurrently, the new TLS flags do not have the
Requiredfield specified. To enhance clarity, explicitly setRequired: falsesince these flags are optional.Example:
&cli.StringFlag{ Name: optls.TLSCaCertFlagName, Usage: "TLS CA certificate file path", EnvVars: opservice.PrefixEnvVar(envPrefix, "TLS_CA"), + Required: false, },Apply the same addition to the
TLSCertFlagNameandTLSKeyFlagNameflags.op-defender/psp_executor/defender.go (1)
601-630: Consider allowing unauthenticated access to the health check endpointCurrently, the server is configured to require mutual TLS authentication for all endpoints, including
/api/healthcheck. This may prevent unauthenticated clients from accessing the health check endpoint, which is often needed for monitoring and health checks without authentication.Consider configuring the server or implementing middleware to allow certain endpoints, like
/api/healthcheck, to bypass mutual TLS authentication while keeping the rest of the API endpoints secured with mTLS.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (3)
- op-defender/cmd/defender/cli.go (1 hunks)
- op-defender/psp_executor/cli.go (4 hunks)
- op-defender/psp_executor/defender.go (4 hunks)
🔇 Additional comments (7)
op-defender/cmd/defender/cli.go (2)
Line range hint
1-78: Verify mTLS implementation in related filesWhile this file now includes a validation step for the configuration, which is a positive change, the mTLS implementation mentioned in the PR objectives is not directly visible here.
To ensure that mTLS is properly implemented, let's examine related files:
#!/bin/bash # Description: Search for mTLS-related code in the project # Test 1: Search for mTLS configuration in Config struct ast-grep --lang go --pattern 'type Config struct { $$$ // Look for fields related to mTLS $_ $_ $$$ }' # Test 2: Search for mTLS setup in server initialization rg --type go -A 10 'func New.*Server' # Test 3: Search for mTLS-related flags rg --type go 'cli\.StringFlag.*mTLS'These checks will help verify that mTLS is properly configured and implemented across the project.
59-61: Approve: Good addition of configuration validationThe addition of the
cfg.Check()call improves the robustness of the application by ensuring that only valid configurations are processed. This aligns well with the PR objectives of enhancing security and reliability.Consider enhancing the error handling to provide more context:
if err := cfg.Check(); err != nil { - return nil, err + return nil, fmt.Errorf("invalid configuration: %w", err) }This will make debugging easier by providing more information about the nature of the configuration error.
To ensure that the
cfg.Check()method includes all necessary validations, especially for mTLS, let's examine its implementation:op-defender/psp_executor/cli.go (5)
5-5: Import statement for TLS configuration added correctlyThe import of the
optlspackage is necessary for TLS configuration and is appropriately included.
30-30: Addition ofTLSConfigfield toCLIConfigstructThe
TLSConfigfield is added to theCLIConfigstruct to incorporate TLS settings, aligning with the objective of introducing mTLS authentication.
43-43: InitializeTLSConfiginReadCLIFlagsfunctionThe
TLSConfigfield is properly initialized usingoptls.ReadCLIConfig(ctx), ensuring that TLS configurations are read from the CLI context.
50-50: RefactorCLIFlagsfunction to use a localflagsvariableAssigning the initial flags to a local variable
flagsallows for appending additional flags later, which is necessary for incorporating the new TLS flags.
123-128: EnsureTLSConfig.Check()handles optional TLS configurationIf mTLS is optional, verify that the
Check()method ofTLSConfigdoes not return an error when TLS settings are not provided.Run the following script to confirm that the application initializes correctly without TLS configurations:
This ensures that the application remains functional when mTLS is not enabled, and
TLSConfig.Check()handles the absence of TLS settings gracefully.
|
Thanks a lot for the contribution @nodauf! I will try update the doc into the current branch if you can't? |
|
@nodauf are you able to push more about the documentation here, to make sure people can use and contrib easier would be perfect! |
|
Oh yeah, thanks for the reminder, I totally forgot. |
|
@Ethnical @raffaele-oplabs I was finally able to finish the documentation :). Hope that's good. Feel free to tell if you need me to change anything. |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
op-defender/psp_executor/README.md (3)
39-41: Add security context for TLS options.Consider adding a note about the security implications and requirements for these certificates:
- Explain that these are required for mTLS authentication
- Mention that certificates should be properly secured
- Add a reference to certificate generation instructions
81-81: Document certificate requirements for API requests.The curl command shows client certificate usage but should include:
- Required certificate format (PEM, etc.)
- How to obtain valid client certificates
- Error responses for invalid certificates
130-132: Clarify TLS configuration requirements.Please specify whether these TLS options are:
- Required or optional
- Their default values (if any)
- The behavior when partially configured
| @@ -23,7 +23,7 @@ Settings of the HTTP API service: | |||
| To run the psp_executor service, you can use the following command: | |||
|
|
|||
| ```shell | |||
| go run ../cmd/defender psp_executor --privatekey 2a[..]c6 --safe.address 0x837DE453AD5F21E89771e3c06239d8236c0EFd5E --path /tmp/psps.json --chainid 11155111 --superchainconfig.address 0xC2Be75506d5724086DEB7245bd260Cc9753911Be --rpc.url http://localhost:8545 --port.api 8080 | |||
| go run ../cmd/defender psp_executor --privatekey 2a[..]c6 --safe.address 0x837DE453AD5F21E89771e3c06239d8236c0EFd5E --path /tmp/psps.json --chainid 11155111 --superchainconfig.address 0xC2Be75506d5724086DEB7245bd260Cc9753911Be --rpc.url http://localhost:8545 --port.api 8080 --tls.ca certs/ca-cert.pem --tls.cert certs/server-cert.pem --tls.key certs/server-key.pem | |||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Enhance security and readability of the example command.
- Replace the private key with a placeholder to prevent accidental exposure.
- Add line breaks for better readability.
-go run ../cmd/defender psp_executor --privatekey 2a[..]c6 --safe.address 0x837DE453AD5F21E89771e3c06239d8236c0EFd5E --path /tmp/psps.json --chainid 11155111 --superchainconfig.address 0xC2Be75506d5724086DEB7245bd260Cc9753911Be --rpc.url http://localhost:8545 --port.api 8080 --tls.ca certs/ca-cert.pem --tls.cert certs/server-cert.pem --tls.key certs/server-key.pem
+go run ../cmd/defender psp_executor \
+ --privatekey <your-private-key> \
+ --safe.address 0x837DE453AD5F21E89771e3c06239d8236c0EFd5E \
+ --path /tmp/psps.json \
+ --chainid 11155111 \
+ --superchainconfig.address 0xC2Be75506d5724086DEB7245bd260Cc9753911Be \
+ --rpc.url http://localhost:8545 \
+ --port.api 8080 \
+ --tls.ca certs/ca-cert.pem \
+ --tls.cert certs/server-cert.pem \
+ --tls.key certs/server-key.pem📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go run ../cmd/defender psp_executor --privatekey 2a[..]c6 --safe.address 0x837DE453AD5F21E89771e3c06239d8236c0EFd5E --path /tmp/psps.json --chainid 11155111 --superchainconfig.address 0xC2Be75506d5724086DEB7245bd260Cc9753911Be --rpc.url http://localhost:8545 --port.api 8080 --tls.ca certs/ca-cert.pem --tls.cert certs/server-cert.pem --tls.key certs/server-key.pem | |
| go run ../cmd/defender psp_executor \ | |
| --privatekey <your-private-key> \ | |
| --safe.address 0x837DE453AD5F21E89771e3c06239d8236c0EFd5E \ | |
| --path /tmp/psps.json \ | |
| --chainid 11155111 \ | |
| --superchainconfig.address 0xC2Be75506d5724086DEB7245bd260Cc9753911Be \ | |
| --rpc.url http://localhost:8545 \ | |
| --port.api 8080 \ | |
| --tls.ca certs/ca-cert.pem \ | |
| --tls.cert certs/server-cert.pem \ | |
| --tls.key certs/server-key.pem |
Description
This PR add mTLS authentication for the API (#77). The
op-servicefrom the monorepo already implements the necessary requirements for this. I made a few adjustments since the default values are set for the TLS flags (default values). As a result, the checks (checks) always indicated that TLS was enabled, even when the user didn't provide the arguments.Regarding your infrastructure, I'm not sure if using middleware might be a better option than what I implemented. The middleware could allow some endpoints (like the healthcheck) to bypass the mTLS. What are you though on this?
Tests
The feature was tested using the following command line:
And then it was confirmed that only client that are authenticated using a certificate can access the API:
The files used in the previous command can be found below:
certs.zip
Metadata
psp_executorHTTP API intoop-defender#77