Merge pull request #6252 from oasisprotocol/peternose/trivial/tls-provider

go/consensus/cometbft/stateless/provider: Support TLS connection

Author: peternose

.changelog/6252.trivial.md

@@ -45,7 +45,7 @@ func New(
 		}
 		return node, nil
 	case config.ModeStatelessClient:
-		node, err := createStatelessNode(ctx, genesis, doc, genesisDoc, p2p)
+		node, err := createStatelessNode(ctx, identity, genesis, doc, genesisDoc, p2p)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create stateless node: %w", err)
 		}
@@ -97,12 +97,13 @@ func createFullNode(
 
 func createStatelessNode(
 	ctx context.Context,
+	identity *identity.Identity,
 	genesis genesisAPI.Provider,
 	doc *genesisAPI.Document,
 	genesisDoc *cmttypes.GenesisDoc,
 	p2p p2pAPI.Service,
 ) (consensusAPI.Service, error) {
-	provider, err := createProvider()
+	provider, err := createProvider(identity)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create provider: %w", err)
 	}
@@ -145,13 +146,13 @@ func createStatelessServices(
 	return stateless.NewServices(provider, lightClient, cfg)
 }
 
-func createProvider() (*consensusAPI.Client, error) {
+func createProvider(identity *identity.Identity) (*consensusAPI.Client, error) {
 	addresses := config.GlobalConfig.Consensus.Providers
 	if len(addresses) == 0 {
 		return nil, fmt.Errorf("no providers configured")
 	}
 
-	return stateless.NewProvider(addresses[0])
+	return stateless.NewProvider(addresses[0], identity.TLSCertificate)
 }
 
 func createLightClient(

go/consensus/cometbft/cometbft.go

@@ -1,23 +1,77 @@
 package stateless
 
 import (
+	"crypto/tls"
+	"fmt"
+	"strings"
+
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/oasisprotocol/oasis-core/go/common/crypto/signature"
 	cmnGrpc "github.com/oasisprotocol/oasis-core/go/common/grpc"
+	"github.com/oasisprotocol/oasis-core/go/common/identity"
 	consensusAPI "github.com/oasisprotocol/oasis-core/go/consensus/api"
 )
 
 // NewProvider creates a new consensus provider for the stateless client.
-func NewProvider(address string) (*consensusAPI.Client, error) {
-	conn, err := cmnGrpc.Dial(
-		address,
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
+func NewProvider(address string, cert *tls.Certificate) (*consensusAPI.Client, error) {
+	target, creds, err := createCredentials(address, cert)
+	if err != nil {
+		return nil, err
+	}
+
+	opts := []grpc.DialOption{
+		grpc.WithTransportCredentials(creds),
 		grpc.WithDefaultCallOptions(grpc.WaitForReady(true)),
-	)
+	}
+
+	conn, err := cmnGrpc.Dial(target, opts...)
 	if err != nil {
 		return nil, err
 	}
 
 	return consensusAPI.NewClient(conn), nil
 }
+
+func createCredentials(address string, cert *tls.Certificate) (string, credentials.TransportCredentials, error) {
+	switch {
+	case cmnGrpc.IsSocketAddress(address):
+		return address, insecure.NewCredentials(), nil
+	case !containsPublicKey(address):
+		return address, credentials.NewTLS(&tls.Config{}), nil
+	default:
+		return createClientCredentials(address, cert)
+	}
+}
+
+func createClientCredentials(address string, cert *tls.Certificate) (string, credentials.TransportCredentials, error) {
+	key, target, _ := strings.Cut(address, "@")
+
+	var pk signature.PublicKey
+	if err := pk.UnmarshalText([]byte(key)); err != nil {
+		return "", nil, fmt.Errorf("malformed address: %s", address)
+	}
+
+	opts := &cmnGrpc.ClientOptions{
+		CommonName: identity.CommonName,
+		ServerPubKeys: map[signature.PublicKey]bool{
+			pk: true,
+		},
+		Certificates: []tls.Certificate{
+			*cert,
+		},
+	}
+
+	creds, err := cmnGrpc.NewClientCreds(opts)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return target, creds, nil
+}
+
+func containsPublicKey(address string) bool {
+	return strings.Contains(address, "@")
+}

go/consensus/cometbft/stateless/provider.go

@@ -72,7 +72,7 @@ func getConfiguredRuntimeIDs() ([]common.Namespace, error) {
 		if len(runtimes) > 0 && !cmdFlags.DebugDontBlameOasis() {
 			return nil, fmt.Errorf("no runtimes should be configured when in validator or seed modes")
 		}
-	case config.ModeCompute, config.ModeKeyManager, config.ModeStatelessClient:
+	case config.ModeCompute, config.ModeKeyManager:
 		// At least one runtime should be configured.
 		if len(runtimes) == 0 && !cmdFlags.DebugDontBlameOasis() {
 			return nil, fmt.Errorf("at least one runtime must be configured when in compute, keymanager, or client-stateless modes")