cln-grpc-plugin: Secure access to your node over the network #5013

cdecker · 2022-01-18T14:01:34Z

This is the final PR in the cln-* series. It uses all the primitives we built in the previous 3 PRs and uses them to expose the JSON-RPC over grpc, with mTLS authentication builtin.

vincenzopalazzo

I was searching about the plugin architecture, to think about how to implement the grpc interface for my dart wrapper. In the meanwhile I left one comment (very very stupid).

Half of the code is the tls config, and I'm not the right person to review it

plugins/grpc-plugin/Cargo.toml

rustyrussell · 2022-03-19T22:47:39Z

I think experimental is too harsh: if it requires a config option to activate (grpc-port AFAICT), that's enough. IMHO.

Plugins generally don't have the same requirements as core functionality IMHO. I wonder if we should call it grpc or cln-grpc instead of grpc-plugin?

So please add a Changelog-Added: plugins: grpcXXX first class GRPC interface for controlling nodes (RUST)

Also nice to have:

Rust plugins should print Something Nice when you run them on cmdline, like Python ones do.
rust and rustfmt dependencies should be listed in INSTALL.md, at least as optional.

cdecker · 2022-03-25T10:01:28Z

@rustyrussell I have your branch merged in and it compiles. Will spend today adding more types since they can be difficult to add later, and add some tests to verify the generated conversions are working ok 👍

We are about to generate the python grpc bindings, but only when we have Rust enabled.

Currently still unencrypted, but will get its mTLS authentication in the next commits.

If we aren't using the correct certificates we should reject the connections during the mTLS connection setup. This test tries to connect with the wrong client cert to the node, and the server will reject it.

Changelog-Added: cln-grpc-plugin: The plugin can be configured to listen on a specific port using the `grpc-port` option

@rustyrussell

Suggested-by: Rusty Russell <@rustyrussell> Changelog-Added: plugins: `cln-grpc` first class GRPC interface for remotely controlling nodes over mTLS authentication

rustyrussell · 2022-03-27T23:21:28Z

plugins/grpc-plugin/src/main.rs

            "Which port should the grpc plugin listen for incoming connections?",
        ))
        .start()
        .await?;

    let bind_port = match plugin.option("grpc-port") {
+        Some(options::Value::Integer(-1)) => {
+            log::warn!("`grpc-port` option is not configured, exiting.");


This is probably just log::info? It's a great plugin, but every non-activated plugin should probably not shout to be activated :)

rustyrussell

Trivial change requested... I would merge anyway, but I know more is coming...

@rustyrussell

For now we don't want to autostart. Suggested-by: Rusty Russell <@rustyrussell>

cdecker · 2022-03-28T10:37:46Z

Fixed up. The remaining grpc methods are in a separate PR, so feel free to merge this one :-)

e.g. ``` lightningd-1: 2022-03-28T11:02:12.476Z DEBUG plugin-cln-grpc: add_pem_file processed 1 valid and 0 invalid certs lightningd-1: 2022-03-28T11:02:12.478Z DEBUG plugin-cln-grpc: Connecting to \"lightning-rpc\" and serving grpc on 0.0.0.0:36331 lightningd-1: 2022-03-28T11:02:12.478Z DEBUG connectd: REPLY WIRE_CONNECTD_ACTIVATE_REPLY with 0 fds lightningd-1: 2022-03-28T11:02:12.478Z INFO lightningd: -------------------------------------------------- lightningd-1: 2022-03-28T11:02:12.478Z INFO lightningd: Server started with public key ``` Which means we don't see it, since start() swallows it: ``` > raise TimeoutError('Unable to find "{}" in logs.'.format(exs)) E TimeoutError: Unable to find "[re.compile('serving grpc on 0.0.0.0:')]" in logs. ``` Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

rustyrussell · 2022-03-29T00:50:34Z

Pushed a simple test race fix.

Ack 343961d

vincenzopalazzo

ack 343961d

(with just some small comment!)

plugins/grpc-plugin/Cargo.toml

@vincenzopalazzo

Suggested-by: Vincenzo Palazzo <@vincenzopalazzo>

rustyrussell · 2022-03-30T01:45:49Z

Ack a47770d

cdecker added this to the v0.11 milestone Jan 18, 2022

cdecker force-pushed the cln-plugin branch from dff8708 to 918634c Compare January 18, 2022 14:37

cdecker force-pushed the cln-grpc-plugin branch 2 times, most recently from 1c3bfc5 to 0ef0fcb Compare January 18, 2022 14:52

cdecker force-pushed the cln-plugin branch 2 times, most recently from 3d6d0c0 to 4e6cd52 Compare January 19, 2022 09:33

cdecker force-pushed the cln-grpc-plugin branch from 0ef0fcb to b94b86d Compare January 19, 2022 09:33

cdecker force-pushed the cln-plugin branch from 4e6cd52 to 919121e Compare January 20, 2022 16:04

cdecker force-pushed the cln-grpc-plugin branch from b94b86d to 1949b06 Compare January 20, 2022 16:04

cdecker force-pushed the cln-plugin branch from 919121e to 687693d Compare January 21, 2022 10:55

cdecker force-pushed the cln-grpc-plugin branch 2 times, most recently from 7941e8e to f5a059e Compare January 21, 2022 17:16

cdecker force-pushed the cln-plugin branch from 687693d to c33bd1b Compare January 22, 2022 10:29

cdecker force-pushed the cln-grpc-plugin branch from f5a059e to 57c5c13 Compare January 22, 2022 10:29

cdecker force-pushed the cln-plugin branch 2 times, most recently from b23527e to b717005 Compare January 26, 2022 09:58

vincenzopalazzo reviewed Jan 29, 2022

View reviewed changes

plugins/grpc-plugin/Cargo.toml Show resolved Hide resolved

cdecker force-pushed the cln-plugin branch 4 times, most recently from 1723cb2 to 4703783 Compare February 7, 2022 11:17

cdecker force-pushed the cln-grpc-plugin branch from 57c5c13 to 8b8e9bd Compare February 7, 2022 12:14

cdecker force-pushed the cln-plugin branch 2 times, most recently from f0dc233 to c8a25b4 Compare February 7, 2022 19:30

cdecker force-pushed the cln-grpc-plugin branch from 8b8e9bd to ef84498 Compare February 7, 2022 19:36

cdecker force-pushed the cln-plugin branch from 1dbc930 to 797cac5 Compare February 9, 2022 17:06

cdecker force-pushed the cln-plugin branch 4 times, most recently from dba9dd0 to bccc8dc Compare February 25, 2022 13:59

cdecker force-pushed the cln-grpc-plugin branch 2 times, most recently from d0e0fa5 to a56eb26 Compare March 23, 2022 10:55

cdecker added 12 commits March 25, 2022 19:11

cln-grpc-plugin: Add scaffolding for the cln-grpc-plugin

8b391fb

make: Add a hook for us to depend on generated files for tests

eb067cf

We are about to generate the python grpc bindings, but only when we have Rust enabled.

make: Generate grpc bindings if we want to test with rust enabled

fffa0af

cln-grpc-plugin: Add basic grpc-plugin

14cd5e4

pytest: Add a test for the grpc plugin

acff48e

Currently still unencrypted, but will get its mTLS authentication in the next commits.

grpc-plugin: Generate mTLS certificates and use them in grpc

ca1aa3a

pytest: Add a test for incorrect credentials

3c42c0a

If we aren't using the correct certificates we should reject the connections during the mTLS connection setup. This test tries to connect with the wrong client cert to the node, and the server will reject it.

cln-grpc: Add the connect method

1bd6950

cln: Add grpc port as configurable option

d52bec3

grpc-plugin: Make the grpc port to listen on configurable

6e65cf0

Changelog-Added: cln-grpc-plugin: The plugin can be configured to listen on a specific port using the `grpc-port` option

py: Add grpcio-tools for the cln-grpc-plugin

bdfd01b

cln-grpc: Rename the grpc plugin and binary

b748e88

Suggested-by: Rusty Russell <@rustyrussell> Changelog-Added: plugins: `cln-grpc` first class GRPC interface for remotely controlling nodes over mTLS authentication

rustyrussell reviewed Mar 27, 2022

View reviewed changes

rustyrussell requested changes Mar 27, 2022

View reviewed changes

cln-grpc: Do not start unless a grpc-port is specified

21385e2

For now we don't want to autostart. Suggested-by: Rusty Russell <@rustyrussell>

cdecker force-pushed the cln-grpc-plugin branch from a56eb26 to 21385e2 Compare March 28, 2022 10:37

cdecker requested a review from rustyrussell March 28, 2022 10:37

rustyrussell approved these changes Mar 28, 2022

View reviewed changes

vincenzopalazzo approved these changes Mar 29, 2022

View reviewed changes

plugins/grpc-plugin/Cargo.toml Show resolved Hide resolved

cln-grpc: Set cln-grpc version to 0.0.1 until it's complete

a47770d

Suggested-by: Vincenzo Palazzo <@vincenzopalazzo>

rustyrussell merged commit 0cbf918 into master Mar 30, 2022

rustyrussell deleted the cln-grpc-plugin branch August 15, 2022 00:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cln-grpc-plugin: Secure access to your node over the network #5013

cln-grpc-plugin: Secure access to your node over the network #5013

cdecker commented Jan 18, 2022

vincenzopalazzo left a comment

rustyrussell commented Mar 19, 2022 •

edited

Loading

cdecker commented Mar 25, 2022

rustyrussell Mar 27, 2022

rustyrussell left a comment

cdecker commented Mar 28, 2022

rustyrussell commented Mar 29, 2022

vincenzopalazzo left a comment

rustyrussell commented Mar 30, 2022

cln-grpc-plugin: Secure access to your node over the network #5013

cln-grpc-plugin: Secure access to your node over the network #5013

Conversation

cdecker commented Jan 18, 2022

vincenzopalazzo left a comment

Choose a reason for hiding this comment

rustyrussell commented Mar 19, 2022 • edited Loading

cdecker commented Mar 25, 2022

rustyrussell Mar 27, 2022

Choose a reason for hiding this comment

rustyrussell left a comment

Choose a reason for hiding this comment

cdecker commented Mar 28, 2022

rustyrussell commented Mar 29, 2022

vincenzopalazzo left a comment

Choose a reason for hiding this comment

rustyrussell commented Mar 30, 2022

rustyrussell commented Mar 19, 2022 •

edited

Loading