Support HTTPS certs, keys and CAs #261

sjug · 2017-11-14T19:05:17Z

As subject says, allows users to pass -cert -key and -CA so that pprof can be used against authenticated TLS endpoints.

Closes golang/go#20939 and #244

vbatts · 2017-11-14T21:07:29Z

seems fine to me

aalexand

Thanks for doing this! Can you please add tests that verify the new functionality end-to-end?

aalexand · 2017-11-14T21:07:04Z

internal/driver/cli.go

+	// HTTPS options
+	flagCertFile := flag.String("cert", "", "TLS client certificate file")
+	flagKeyFile := flag.String("key", "", "TLS private key file")
+	flagCAFile := flag.String("CA", "", "TLS CA certs file")


It's a bit strange to have command line flag in capital letters. Is there a precedent for this?

Agreed, my mistake.

aalexand · 2017-11-14T21:08:38Z

internal/driver/fetch.go

+		tlsConfig.RootCAs = caCertPool
+	}
+
+	if url.Scheme == "https+insecure" {


Should internal/symbolizer/symbolizer.go be updated as well?

Do you mean the postURL() in symbolizer.go?

The problem is the source struct which contains the flag values is in driver pkg. That's why Symbolizer() takes mode string rather than s *source. In order to keep it clean I would need to create a new package for the source struct, do you have any preference where it should go?

I don't think we should pass all of source struct to the symbolizer, it doesn't need most of that. Maybe something like this in internal/plugin/plugin.go:

type TLSParams struct { HTTPSCert, HTTPSKey, HTTPSCA string }

and then pass it as to the symbolizer and to the fetcher as a new param.

Changed the implementation to use TLSParams, thoughts?

aalexand · 2017-11-15T01:20:59Z

@sjug Did you also see my

Can you please add tests that verify the new functionality end-to-end?

request? Just want to make sure it's not missed since it was a whole-PR comment rather than on a specific line and so looks subtle in the GH UI.

sjug · 2017-11-15T01:24:34Z

@aalexand Yep, didn't miss it. Will do.

aalexand · 2017-11-15T17:32:39Z

internal/driver/cli.go

@@ -34,6 +34,9 @@ type source struct {
 	Timeout      int
 	Symbolize    string
 	HTTPHostport string
+	HTTPSCert    string


Perhaps move these up to follow Sources field to emphasize that this is about setting up the TLS for fetching the profiles not for the HTTP server mode of pprof itself.

aalexand · 2017-11-15T17:33:16Z

internal/driver/cli.go

@@ -61,6 +64,10 @@ func parseFlags(o *plugin.Options) (*source, []string, error) {
 	flagContentions := flag.Bool("contentions", false, "Display number of delays at each region")
 	flagMeanDelay := flag.Bool("mean_delay", false, "Display mean delay at each region")
 	flagTools := flag.String("tools", os.Getenv("PPROF_TOOLS"), "Path for object tool pathnames")
+	// HTTPS options
+	flagCertFile := flag.String("cert", "", "TLS client certificate file")


I like the brevity of the docs but we should here also clarify that this about the TLS params for profile and symbol fetch.

aalexand · 2017-11-15T17:33:25Z

internal/driver/cli.go

@@ -280,6 +290,9 @@ var usageMsgSrc = "\n\n" +
 	"  Source options:\n" +
 	"    -seconds              Duration for time-based profile collection\n" +
 	"    -timeout              Timeout in seconds for profile collection\n" +
+	"    -key                  Specify TLS private key\n" +


Ditto (I like the brevity of the docs but we should here also clarify that this about the TLS params for profile and symbol fetch).

aalexand · 2017-11-15T17:34:31Z

internal/driver/fetch.go

@@ -580,17 +581,35 @@ func adjustURL(source string, duration, timeout time.Duration) (string, time.Dur

 // httpGet is a wrapper around http.Get; it is defined as a variable
 // so it can be redefined during for testing.
-var httpGet = func(source string, timeout time.Duration) (*http.Response, error) {
+var httpGet = func(s *source, source string, timeout time.Duration) (*http.Response, error) {


We shouldn't need to pass all of "s *source" here, we only need the TLS params?

Just seemed cleaner to not create anything extra, just reuse the existing struct. If we make the TLSParams in plugin.go that should work for Symbolizer() as well. Isn't having the same HTTPS* fields in the source struct redundant?

I would use TLSParams in the source structure as well to avoid the duplicated fields, but (as I said) would pass the source / URL string and the TLS params alone instead of passing the whole input structure. Passing only what's needed is better than being able to avoid another little struct imo.

aalexand · 2017-11-15T17:36:03Z

internal/driver/fetch.go

+		tlsConfig.RootCAs = caCertPool
+	}
+
+	if url.Scheme == "https+insecure" {


I don't think we should pass all of source struct to the symbolizer, it doesn't need most of that. Maybe something like this in internal/plugin/plugin.go:

type TLSParams struct { HTTPSCert, HTTPSKey, HTTPSCA string }

and then pass it as to the symbolizer and to the fetcher as a new param.

aalexand · 2017-11-15T20:54:38Z

The only thing that concerns me is that the TLS parameters are visible in the help and are exposed in the method signatures now regardless of whether the underlying symbolizer and fetcher need them. For example, at Google internally we use a custom fetch implementation which wouldn't need these options. I wonder if there is a better way to abstract these into the implementation of the fetcher and symbolizer. @rauls5382 do you have some ideas?

sjug · 2017-11-30T14:43:59Z

@aalexand Has a decision been made as to how this should be implemented so I can move forward with writing tests for this?

aalexand · 2017-11-30T15:37:02Z

Not yet. I was curious to hear @rauls5382's thoughts. Raul, any thoughts here?

dgryski · 2018-02-15T18:43:00Z

Ping @rauls5382.

nolanmar511 · 2019-01-07T19:30:23Z

This functionality was added with #423, so I'm closing this PR.

Thanks for all the work here!

googlebot added the cla: yes label Nov 14, 2017

sjug force-pushed the pprof_https_auth branch 2 times, most recently from 641e2a8 to d9b5131 Compare November 14, 2017 19:30

sjug mentioned this pull request Nov 14, 2017

cmd/pprof: add HTTPS support with client certificates golang/go#20939

Closed

aalexand reviewed Nov 14, 2017

View reviewed changes

sjug force-pushed the pprof_https_auth branch from d9b5131 to eb91825 Compare November 15, 2017 01:16

aalexand reviewed Nov 15, 2017

View reviewed changes

sjug force-pushed the pprof_https_auth branch 3 times, most recently from cecace9 to 302e336 Compare November 15, 2017 20:17

Support HTTPS certs, keys and CAs

efef5de

sjug force-pushed the pprof_https_auth branch from 302e336 to efef5de Compare November 15, 2017 20:20

ravisantoshgudimetla mentioned this pull request May 8, 2018

Add openshift profiling to kubelet openshift/origin#19567

Closed

nolanmar511 closed this Jan 7, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support HTTPS certs, keys and CAs #261

Support HTTPS certs, keys and CAs #261

sjug commented Nov 14, 2017 •

edited

Loading

vbatts commented Nov 14, 2017

aalexand left a comment

aalexand Nov 14, 2017

sjug Nov 15, 2017 •

edited

Loading

aalexand Nov 14, 2017

sjug Nov 15, 2017 •

edited

Loading

aalexand Nov 15, 2017

sjug Nov 15, 2017 •

edited

Loading

aalexand Nov 15, 2017 •

edited

Loading

sjug Nov 15, 2017

aalexand commented Nov 15, 2017

sjug commented Nov 15, 2017

aalexand Nov 15, 2017

aalexand Nov 15, 2017

aalexand Nov 15, 2017

aalexand Nov 15, 2017

sjug Nov 15, 2017

aalexand Nov 15, 2017 •

edited

Loading

aalexand Nov 15, 2017 •

edited

Loading

aalexand commented Nov 15, 2017

sjug commented Nov 30, 2017

aalexand commented Nov 30, 2017

dgryski commented Feb 15, 2018

nolanmar511 commented Jan 7, 2019

Support HTTPS certs, keys and CAs #261

Support HTTPS certs, keys and CAs #261

Conversation

sjug commented Nov 14, 2017 • edited Loading

vbatts commented Nov 14, 2017

aalexand left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sjug Nov 15, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sjug Nov 15, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sjug Nov 15, 2017 • edited Loading

Choose a reason for hiding this comment

aalexand Nov 15, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aalexand commented Nov 15, 2017

sjug commented Nov 15, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aalexand Nov 15, 2017 • edited Loading

Choose a reason for hiding this comment

aalexand Nov 15, 2017 • edited Loading

Choose a reason for hiding this comment

aalexand commented Nov 15, 2017

sjug commented Nov 30, 2017

aalexand commented Nov 30, 2017

dgryski commented Feb 15, 2018

nolanmar511 commented Jan 7, 2019

sjug commented Nov 14, 2017 •

edited

Loading

sjug Nov 15, 2017 •

edited

Loading

sjug Nov 15, 2017 •

edited

Loading

sjug Nov 15, 2017 •

edited

Loading

aalexand Nov 15, 2017 •

edited

Loading

aalexand Nov 15, 2017 •

edited

Loading

aalexand Nov 15, 2017 •

edited

Loading