Skip to content

Commit af87dc9

Browse files
gautamg795gautamg795
authored
Merge branch 'stripe:master' into master
2 parents 50b3e18 + 48d1053 commit af87dc9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+6001
-1453
lines changed

‎.github/workflows/test.yml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,16 @@ name: Test
44
# See https://github.com/lemurheavy/coveralls-public/issues/1716
55
env:
66
COVERALLS_SERVICE_NUMBER: ${{ github.run_id }}-${{ github.run_attempt }}
7+
COVERALLS_PARALLEL: true
78
jobs:
89
test:
910
strategy:
1011
matrix:
11-
go-version: ['1.20', '1.21']
12+
go-version: ['1.21', '1.22', '1.23']
1213
runs-on: ubuntu-latest
1314
steps:
14-
- uses: actions/checkout@v3
15-
- uses: actions/setup-go@v3
15+
- uses: actions/checkout@v4
16+
- uses: actions/setup-go@v5
1617
with:
1718
go-version: ${{ matrix.go-version }}
1819
- name: Setup env
@@ -31,10 +32,20 @@ jobs:
3132
go test -race -v -timeout 2m -failfast ./cmd/... -run TestInvalidUpstreamProxyConfiguration
3233
go test -race -v -timeout 2m -failfast ./cmd/... -run TestClientHalfCloseConnection
3334
- name: Install goveralls
34-
env:
35-
GO111MODULE: off
36-
run: go get github.com/mattn/goveralls
35+
run: go install github.com/mattn/goveralls@latest
3736
- name: Send coverage
3837
env:
3938
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4039
run: goveralls -coverprofile=.covprofile -service=github
40+
finish:
41+
needs: test
42+
runs-on: ubuntu-latest
43+
steps:
44+
- uses: actions/checkout@v4
45+
- uses: actions/setup-go@v5
46+
- name: Install goveralls
47+
run: go install github.com/mattn/goveralls@latest
48+
- name: Close goveralls parallel build
49+
env:
50+
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
51+
run: goveralls -coverprofile=.covprofile -service=github -parallel-finish=true

‎.vscode/launch.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
// Use IntelliSense to learn about possible attributes.
3+
// Hover to view descriptions of existing attributes.
4+
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
5+
"version": "0.2.0",
6+
"configurations": [
7+
{
8+
"name": "smokescreen",
9+
"type": "go",
10+
"request": "launch",
11+
"mode": "auto",
12+
"program": "./",
13+
"args": ["--config-file", "config.yaml", "--egress-acl-file", "acl.yaml"]
14+
}
15+
]
16+
}

‎Development.md‎

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,308 @@
1+
2+
# Development and Testing
3+
4+
## Testing
5+
```bash
6+
go test ./...
7+
```
8+
9+
## Running locally
10+
11+
This section describes how to run Smokescreen locally with different scenarios and using `curl` as a client.
12+
13+
- [HTTP Proxy](#http-proxy)
14+
- [HTTP CONNECT Proxy](#http-connect-proxy)
15+
- [Monitor metrics Smokescreen emits](#monitor-metrics-smokescreen-emits)
16+
- [HTTP CONNECT Proxy over TLS](#http-connect-proxy-over-tls)
17+
- [MITM (Man in the middle) Proxy](#mitm-man-in-the-middle-proxy)
18+
- [MITM (Man in the middle) Proxy over TLS](#mitm-man-in-the-middle-proxy-over-tls)
19+
20+
### HTTP Proxy
21+
22+
#### Configurations
23+
24+
```yaml
25+
# config.yaml
26+
---
27+
allow_missing_role: true # skip mTLS client validation (use default ACL)
28+
```
29+
30+
```yaml
31+
# acl.yaml
32+
---
33+
version: v1
34+
services: []
35+
default:
36+
name: default
37+
project: security
38+
action: enforce
39+
allowed_domains:
40+
- example.com
41+
```
42+
43+
#### Run
44+
45+
```bash
46+
# Run smokescreen (in a different shell)
47+
go run . --config-file config.yaml --egress-acl-file acl.yaml
48+
49+
# Curl
50+
curl -x localhost:4750 http://example.com
51+
# Curl with ALL_PROXY
52+
ALL_PROXY=localhost:4750 curl -v http://example.com
53+
```
54+
55+
### HTTP CONNECT Proxy
56+
57+
#### Configurations
58+
59+
```yaml
60+
# config.yaml
61+
---
62+
allow_missing_role: true # skip mTLS client validation (use default ACL)
63+
```
64+
65+
```yaml
66+
# acl.yaml
67+
---
68+
version: v1
69+
services: []
70+
default:
71+
name: default
72+
project: security
73+
action: enforce
74+
allowed_domains:
75+
- api.github.com
76+
```
77+
78+
#### Run
79+
80+
```bash
81+
# Run smokescreen (in a different shell)
82+
go run . --config-file config.yaml --egress-acl-file acl.yaml
83+
84+
# Curl
85+
curl --proxytunnel -x localhost:4750 https://api.github.com/zen
86+
# Curl with HTTPS_PROXY
87+
HTTPS_PROXY=localhost:4750 curl https://api.github.com/zen
88+
```
89+
90+
### Monitor metrics Smokescreen emits
91+
92+
#### Configurations
93+
94+
```yaml
95+
# config.yaml
96+
---
97+
allow_missing_role: true # skip mTLS client validation (use default ACL)
98+
statsd_address: 127.0.0.1:8200
99+
```
100+
101+
```yaml
102+
# acl.yaml
103+
---
104+
version: v1
105+
services: []
106+
default:
107+
name: default
108+
project: security
109+
action: enforce
110+
allowed_domains:
111+
- api.github.com
112+
```
113+
114+
#### Run
115+
116+
```bash
117+
# Listen to a local port with nc (in a different shell)
118+
nc -uklv 127.0.0.1 8200
119+
120+
# Run smokescreen (in a different shell)
121+
go run . --config-file config.yaml --egress-acl-file acl.yaml
122+
123+
# Curl
124+
curl --proxytunnel -x localhost:4750 https://api.github.com/zen
125+
# Curl with HTTPS_PROXY
126+
HTTPS_PROXY=localhost:4750 curl https://api.github.com/zen
127+
```
128+
129+
### HTTP CONNECT Proxy over TLS
130+
131+
#### Set-up
132+
133+
##### Generate certificates
134+
```bash
135+
mkdir -p mtls_setup
136+
# Private keys for CAs
137+
openssl genrsa -out mtls_setup/server-ca.key 2048
138+
openssl genrsa -out mtls_setup/client-ca.key 2048
139+
140+
# Generate client and server CA certificates
141+
openssl req -new -x509 -nodes -days 1000 -key mtls_setup/server-ca.key -out mtls_setup/server-ca.crt \
142+
-subj "/C=AQ/ST=Petrel Island/L=Dumont-d'Urville
143+
/O=Penguin/OU=Publishing house/CN=server CA"
144+
145+
openssl req -new -x509 -nodes -days 1000 -key mtls_setup/client-ca.key -out mtls_setup/client-ca.crt \
146+
-subj "/C=MA/ST=Tarfaya/L=Tarfaya/O=Fennec/OU=Aviator/CN=Client CA"
147+
148+
# Generate a certificate signing request (client CN is localhost which is used by smokescreen as the service name by default)
149+
openssl req -newkey rsa:2048 -nodes -keyout mtls_setup/server.key -out mtls_setup/server.req \
150+
-subj "/C=AQ/ST=Petrel Island/L=Dumont-d'Urville/O=Chionis/OU=Publishing house/CN=server req"
151+
openssl req -newkey rsa:2048 -nodes -keyout mtls_setup/client.key -out mtls_setup/client.req \
152+
-subj "/C=MA/ST=Tarfaya/L=Tarfaya/O=Addax/OU=Writer/CN=localhost"
153+
154+
# Have the CA sign the certificate requests and output the certificates.
155+
echo "authorityKeyIdentifier=keyid,issuer
156+
basicConstraints=CA:FALSE
157+
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
158+
subjectAltName = @alt_names
159+
160+
[alt_names]
161+
DNS.1 = localhost
162+
" > mtls_setup/localhost.ext
163+
164+
openssl x509 -req -in mtls_setup/server.req -days 1000 -CA mtls_setup/server-ca.crt -CAkey mtls_setup/server-ca.key -set_serial 01 -out mtls_setup/server.crt -extfile mtls_setup/localhost.ext
165+
166+
openssl x509 -req -in mtls_setup/client.req -days 1000 -CA mtls_setup/client-ca.crt -CAkey mtls_setup/client-ca.key -set_serial 01 -out mtls_setup/client.crt
167+
```
168+
169+
##### Configurations
170+
171+
```yaml
172+
# config.yaml
173+
---
174+
tls:
175+
cert_file: "mtls_setup/server.crt"
176+
key_file: "mtls_setup/server.key"
177+
client_ca_files:
178+
- "mtls_setup/client-ca.crt"
179+
```
180+
181+
```yaml
182+
# acl.yaml
183+
---
184+
version: v1
185+
services:
186+
- name: localhost
187+
project: github
188+
action: enforce
189+
allowed_domains:
190+
- api.github.com
191+
default:
192+
name: default
193+
project: security
194+
action: enforce
195+
allowed_domains: []
196+
```
197+
198+
#### Run
199+
200+
```bash
201+
# Run smokescreen (in a different shell)
202+
go run . --config-file config.yaml --egress-acl-file acl.yaml
203+
204+
# Curl
205+
curl --proxytunnel -x https://localhost:4750 --proxy-cacert mtls_setup/server-ca.crt --proxy-cert mtls_setup/client.crt --proxy-key mtls_setup/client.key https://api.github.com/zen
206+
# Curl with HTTPS_PROXY
207+
HTTPS_PROXY=https://localhost:4750 curl --proxy-cacert mtls_setup/server-ca.crt --proxy-cert mtls_setup/client.crt --proxy-key mtls_setup/client.key https://api.github.com/zen
208+
```
209+
210+
### MITM (Man in the middle) Proxy
211+
212+
#### Set-up
213+
214+
```yaml
215+
# config.yaml
216+
---
217+
allow_missing_role: true # skip mTLS client validation (use default ACL)
218+
# Re-using goproxy library CA and key
219+
mitm_ca_cert_file: "vendor/github.com/stripe/goproxy/ca.pem"
220+
mitm_ca_key_file: "vendor/github.com/stripe/goproxy/key.pem"
221+
```
222+
223+
```yaml
224+
# acl.yaml
225+
---
226+
version: v1
227+
services: []
228+
default:
229+
name: default
230+
project: security
231+
action: enforce
232+
allowed_domains:
233+
- wttr.in
234+
mitm_domains:
235+
- domain: wttr.in
236+
add_headers:
237+
Accept-Language: el
238+
detailed_http_logs: true
239+
detailed_http_logs_full_headers:
240+
- User-Agent
241+
```
242+
243+
#### Run
244+
245+
```bash
246+
# Run smokescreen (in a different shell)
247+
go run . --config-file config.yaml --egress-acl-file acl.yaml
248+
249+
# Curl (weather should be in Greek since we set the Accept-Language header)
250+
curl --proxytunnel -x localhost:4750 --cacert vendor/github.com/stripe/goproxy/ca.pem https://wttr.in
251+
# Curl with HTTPS_PROXY
252+
HTTPS_PROXY=localhost:4750 curl --cacert vendor/github.com/stripe/goproxy/ca.pem https://wttr.in
253+
```
254+
255+
### MITM (Man in the middle) Proxy over TLS
256+
257+
#### Set-up
258+
259+
Please generate the certificates from the TLS Generate certificates section.
260+
261+
```yaml
262+
# config.yaml
263+
---
264+
tls:
265+
cert_file: "mtls_setup/server.crt"
266+
key_file: "mtls_setup/server.key"
267+
client_ca_files:
268+
- "mtls_setup/client-ca.crt"
269+
# Re-using goproxy library CA and key
270+
mitm_ca_cert_file: "vendor/github.com/stripe/goproxy/ca.pem"
271+
mitm_ca_key_file: "vendor/github.com/stripe/goproxy/key.pem"
272+
```
273+
274+
```yaml
275+
# acl.yaml
276+
---
277+
version: v1
278+
services:
279+
- name: localhost
280+
project: github
281+
action: enforce
282+
allowed_domains:
283+
- wttr.in
284+
mitm_domains:
285+
- domain: wttr.in
286+
add_headers:
287+
Accept-Language: el
288+
detailed_http_logs: true
289+
detailed_http_logs_full_headers:
290+
- User-Agent
291+
default:
292+
name: default
293+
project: security
294+
action: enforce
295+
allowed_domains: []
296+
```
297+
298+
#### Run
299+
300+
```bash
301+
# Run smokescreen (in a different shell)
302+
go run . --config-file config.yaml --egress-acl-file acl.yaml
303+
304+
# Curl (weather should be in Greek since we set the Accept-Language header)
305+
curl --proxytunnel -x https://localhost:4750 --cacert vendor/github.com/stripe/goproxy/ca.pem --proxy-cacert mtls_setup/server-ca.crt --proxy-cert mtls_setup/client.crt --proxy-key mtls_setup/client.key https://wttr.in
306+
# Curl with HTTPS_PROXY
307+
HTTPS_PROXY=https://localhost:4750 curl --cacert vendor/github.com/stripe/goproxy/ca.pem --proxy-cacert mtls_setup/server-ca.crt --proxy-cert mtls_setup/client.crt --proxy-key mtls_setup/client.key https://wttr.in
308+
```

0 commit comments

Comments
 (0)