Aryeh/rpc-auth #36

harryttd · 2020-10-29T20:04:32Z

Install devspace
mkchain generate-constants....
devspace use namespace tqtezos
cd ./docker/rpc-auth
devspace dev --var=CHAIN_NAME="$CHAIN_NAME"
(If you want to pass more mkchain args, you can do --var=CHAIN_ARGS="--docker-image=tezos/tezos:v8-release ...")

The above will build (if not already built) the python and zerotier docker images, and apply the yaml for mkchain and rpc auth server. It also enables the minikube nginx addon so that the rpc-auth ingress can work.

Thoughts/Comments on first iteration of this auth mechanism:

If this will turn into a separate repo, we need to especially keep in mind that the namespaces are consistent across them so that all the services/pods can talk to each other (easily).
Clients can request as many new url's as they want.
Need to understand more what potential attack vectors there are and how to prevent. (I believe a replay attack with regards to signing the server-sent-nonce is avoided, by running the getting and deleting of the nonce (that we are verifying for) in a redis transaction.)
Probably need to configure redis in more detail. For example, how often it persists data.

Run `k create cm rpc-auth-config -n tqtezos1 --from-file rpc-auth/server/ --dry-run -o yaml | k apply -f -` to update the config map which will then contain the python script. Sometimes if you make updates locally to the file and run the above command, the pod will restart the server bec it's in debug mode. Most of the times it doesn't and it is unclear why.

harryttd · 2020-10-29T20:06:06Z

rpc-auth/server/backend.yaml

+                - "redis-cli -h $(hostname) ping"
+            initialDelaySeconds: 5
+            periodSeconds: 3
+          # resources:


k8s noob question: at what point in time do we configure resources for all of our different infrastructure objects? How do we determine what the resources should be?

It's important to set resources once we are in production and have metrics collection in place. The main benefit is to have sensible autoscaling behaviour. In a minikube context it matters less since there is only one node anyway.

harryttd · 2020-10-29T20:44:21Z

rpc-auth/server/index.py

+    return False
+
+
+## Need a proper server for production


Need to configure a proper server for production

itkach · 2020-10-30T17:08:21Z

rpc-auth/server/index.py

+import requests
+
+TEZOS_CHAIN_ID = os.getenv("TEST_CHAIN_ID")
+TEZOS_RPC = f"{os.getenv('TEZOS_RPC')}:{os.getenv('TEZOS_RPC_PORT')}"


TEZOS_RPC should be full endpoint, including scheme; as would be accepted by tezos-client's --endpoint paramemter in tezos 8.0; code below has `http hardcoded, which is problematic

TEZOS_RPC is meant for the server to communicate with the tezos rpc k8s service to do its own logic. Not for the client to send their RPC requests. I can rename the variable to be more clear as well as add the scheme to it so that it does not need to be written elsewhere in the code here and here

Ah, I see generate_secret_url actually uses request.url_root... I'm not sure how Flask application would know it's public url (must be explicit configuration?), but this assumes that this service would be doing the proxying of actual requests, which it shouldn't

I don't think at this point the Flask app needs to know its public url. Whatever host the client requests from in order to get a secret url in the first place is the host of the Flask app. They couldn't talk to our app without knowing the host's address. Then we can just use that host as the host of the secret url returned to the client.

itkach · 2020-10-30T17:13:03Z

rpc-auth/server/index.py

+
+@app.route("/tezos-node-rpc/<access_token>/<path:rpc_endpoint>",
+           methods=["GET", "POST", "PATCH", "DELETE", "PUT"])
+def rpc_passthrough(access_token, rpc_endpoint):


this web service should NOT take on proxying requests; correctly proxying all requests is not that simple; this naive implementation is already not correct even for simplest GETs (it doesn't pass along any headers); instead this service should be used together with nginx's auth_request (https://nginx.org/en/docs/http/ngx_http_auth_request_module.html)

now using nginx auth-url annotations to handle the auth subrequest

itkach · 2020-10-30T17:15:14Z

rpc-auth/server/index.py

+
+
+def verify_chain_id(chain_id):
+    global TEZOS_CHAIN_ID


no need for global here; would be even better if getting chain id were a function

My intent here is that the server should not have to fetch the chain id on every request that a client makes. I set the CHAIN_ID var as a global variable at the top of the file so that it is kept in memory the whole time the server is alive. Only on the first request to the server will we go and fetch the chain id. I do have a get chain id function that is called a few lines below and is defined under this function.

Without setting global TEZOS_CHAIN_ID i get a local var referenced before assignment error.

Without setting global TEZOS_CHAIN_ID i get a local var referenced before assignment error.

only because you try to assign it; caching function (e.g. using https://docs.python.org/3/library/functools.html#functools.cache) would provide a cleaner implementation (less global mutable state)

itkach · 2020-10-30T17:17:38Z

rpc-auth/server/index.py

+
+
+def create_nonce():
+    return str(uuid4().hex)


no need to wrap in str()

itkach · 2020-10-30T17:18:20Z

rpc-auth/server/index.py

+
+
+def generate_secret_url(public_key):
+    access_token = str(uuid4())


this gives the same format as create_nonce() but spelled differently, would be nice to be consistent

I will remove the create_nonce() func as I don't think it is necessary. create_nonce() right now returns a uuid in hex format as that is required for the tezos-client while here it is plain uuid (cd470ace-264f-418b-95a2-4202bd8956dc). Not sure what you mean by "spelled differently". Would like this function to generate an access token in hex format as well?

the result is exactly the same as far as I can tell - hex string without dashes

❯ python Python 3.8.6 (default, Oct 8 2020, 14:07:53) [Clang 11.0.0 (clang-1100.0.33.17)] on darwin Type "help", "copyright", "credits" or "license" for more information. >>> import uuid >>> uuid.uuid4() UUID('b7e0552e-6de4-4d5b-965e-48b9970f52db') >>> uuid.uuid4().hex '4f5359ef73f74663897ee9e903be51bc' >>> str(uuid.uuid4().hex) 'a4d43e241bd640d08098f46fa8dcdab8' >>> uuid.uuid4().hex '7259e167589946659a5f0288f32c2d53' >>>

itkach · 2020-10-30T17:20:14Z

rpc-auth/server/index.py

+
+
+@app.route("/vending-machine")
+def get_tezos_rpc_url():


this should only accept POST method and be called "generate" rather than "get" since it is meant to have side-effects (generating new secret url every time)

itkach · 2020-10-30T17:24:00Z

rpc-auth/server/index.py

+
+def generate_secret_url(public_key):
+    access_token = str(uuid4())
+    redis.set(create_redis_access_token_key(access_token), public_key)


this should probably be associated with tz address (pkh) rather than full public key since tz address is the common way of identifying tezos accounts
should probably also add access token to list associated with tz address (along with timestamp) so that we can inspect and, if need be, revoke or expire access codes for a given tz addres

itkach · 2020-10-30T17:24:09Z

rpc-auth/server/index.py

+    return False
+
+
+## Need a proper server for production


itkach · 2020-10-30T17:30:22Z

rpc-auth/server/index.py

+
+def get_chain_id():
+    response = requests.get(
+        urljoin(f"http://{TEZOS_RPC}", "chains/main/chain_id"))


This web service in all likelihood may be able to access a Tezos RPC service by it's internal IP, while secret URL generated for the client will use public host/port - so not the same.

Pass auth token as header

Node was listening also on ipv6 loopback when using "localhost". Not sure if this matters but for backwards consistency I changed it.

harryttd · 2020-11-18T16:36:41Z

Taquito and Pytezos both work.

const { TezosToolkit } = require("@taquito/taquito")
const tezos = new TezosToolkit(
  "http://192.168.64.52/tezos-node-rpc/300c4ae403f343d49595076ce7bd97da"
)
tezos.rpc.getChainId().then(console.log)
// NetXvmLTRGRTusY

from pytezos import rpc
rpcNode = rpc.node.RpcNode("http://192.168.64.52/tezos-node-rpc/300c4ae403f343d49595076ce7bd97da")
print(rpcNode.get("chains/main/chain_id"))
# NetXvmLTRGRTusY

itkach · 2020-11-18T18:55:46Z

docker/rpc-auth/Dockerfile

+
+COPY --chown=appuser:appuser ./server/index.py .
+
+ARG FLASK_ENV=development


prod is probably a better default

nicolasochem · 2020-11-20T06:04:33Z

tqchain/mkchain.py

@@ -319,6 +324,7 @@ def main():
            "bootstrap_timestamp": datetime.utcnow()
            .replace(tzinfo=timezone.utc)
            .isoformat(),
+            "rpc_auth": False,


I don't think it is needed here. argparse will set it to false unless the user passes the arg.

nicolasochem · 2020-11-20T06:16:06Z

docker/rpc-auth/Dockerfile

+  --processes 1 \
+  --wsgi-file index.py \
+  --worker-reload-mercy 0 \
+  $(if [ "${FLASK_ENV}" = "development" ] ; then echo "--touch-reload index.py" ; else : ; fi)


Is that useful considering that devspace will rebuild and restart the container when something changes?

@nicolasochem looks like devspace is set up to sync files for rpc-auth rather than rebuild image, so this makes sense

this is true

nicolasochem · 2020-11-20T06:27:22Z

MULTICLUSTER.md

+- Client can then make RPC requests:
+  - `curl http://192.168.64.51/tezos-node-rpc/ffff3eb3d7dd4f6bbff3f2fd096722ae/chains/main/chain_id`
+  - Bug in tezos client v8, so as of version `tezos/tezos:master_08d3405e_20201113152010`:
+    - `tezos-client --endpoint http://192.168.64.51/tezos-node-rpc/ffff3eb3d7dd4f6bbff3f2fd096722ae/ rpc get chains/main/chain_id`


Please also add a paragraph in DEVELOPMENT.md explaining how to spin up rpc-auth on minikube with devspace.

nicolasochem · 2020-11-20T06:30:04Z

devspace.yaml

+      docker:
+        options:
+          buildArgs:
+            FLASK_ENV: ${FLASK_ENV}


this variable also needs to be declared in vars: section below with source: env and a default value otherwise devspace build prompts for the value.

@nicolasochem I just tried with no prompt:

❯ echo $FLASK_ENV ❯ devspace build --skip-push -b [done] √ Done building image tezos-rpc-auth:qchX3Uf (rpc-auth) [done] √ Done building image tezos-zerotier:KkAWwY3 (zerotier) [done] √ Successfully built 2 images

How can I reproduce?

@nicolasochem yes, removing .devspace prompted me. thanks

nicolasochem · 2020-11-20T07:03:39Z

tqchain/deployment/rpc-auth.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  name: rpc-auth-service


Let's just call it rpc-auth?

itkach · 2020-11-20T14:58:09Z

docker/rpc-auth/server/index.py

@@ -0,0 +1,167 @@
+import os


putting rpc-auth under docker directory makes no sense to me; rpc-auth is a distinct component, just like mkchain. If we are not moving it out to a separate repo then rpc-auth and mkchain need to be sibling subdirs in the project, each with its own setup.py. Right now mkchain is "dominant" with its setup.py sitting in project root and rpc-auth is shoved under the rug in a weird place.

It's a container centric view of the environment. mkchain does not belong here because it's not part of the cluster. It's a helper script to generate helm chart values.

See also: https://github.com/midl-dev/tezos-on-gke/tree/master/docker

One of the things I am planning is to migrate generateTezosConfig.py and import_keys.sh into init containers in the docker folder.

Perhaps mkchain could move to the scripts folder that has been added in this PR?

mkchain is a software component, so is rpc-auth. They have their own packaging, dependencies, documentation, possible usage and deployment scenarios. I would really like to see component based structure here, perhaps even force it via putting them in separate repos (monorepo can work too, but not like this). Containers flow from that, not the other way around.

closes #51

nicolasochem · 2020-11-20T18:01:01Z

Maybe remove .devspace folder completely?

…

On Fri, Nov 20, 2020, 9:41 AM Aryeh Harris ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In devspace.yaml <#36 (comment)>: > images: zerotier: image: tezos-zerotier dockerfile: ./docker/zerotier/Dockerfile context: ./docker/zerotier + rpc-auth: + image: rpc-auth + dockerfile: ./docker/rpc-auth/Dockerfile + context: ./docker/rpc-auth + build: + docker: + options: + buildArgs: + FLASK_ENV: ${FLASK_ENV} @nicolasochem <https://github.com/nicolasochem> I just tried with no prompt: ❯ echo $FLASK_ENV ❯ devspace build --skip-push -b [done] √ Done building image tezos-rpc-auth:qchX3Uf (rpc-auth) [done] √ Done building image tezos-zerotier:KkAWwY3 (zerotier) [done] √ Successfully built 2 images How can I reproduce? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#36 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAWXCY3U7DU6QARVFAZ4CTSQ2S53ANCNFSM4TEGEQNA> .

Closes #52

harryttd added 10 commits October 27, 2020 16:24

RPC Auth WIP

6fee28f

WIP

dec7345

Delete nonce from redis after use

20bc5ea

Use (experimenting) devspace for hot reloading the python server

e438a41

Validate url access token and passthrough to RPC endpoint

f65b18f

Inject env vars into python server

fb83b1b

Clean up client logs

8d2632c

Merge branch 'master' into aryeh/rpc-auth

f0d2f3b

tweaks

e8687d3

harryttd commented Oct 29, 2020

View reviewed changes

harryttd added 2 commits October 29, 2020 16:40

Have devspace enable minikube nginx addon

f1da427

Use host address that the client initiated with in the returned url

8a604b2

harryttd commented Oct 29, 2020

View reviewed changes

harryttd requested review from agtilden and nicolasochem October 29, 2020 21:01

harryttd linked an issue Oct 29, 2020 that may be closed by this pull request

Implement Tezos node RPC access via secret link #30

Closed

Formatting using black and isort

14b7034

harryttd force-pushed the aryeh/rpc-auth branch from 2e92b44 to 14b7034 Compare October 30, 2020 17:25

itkach requested changes Oct 30, 2020

View reviewed changes

harryttd added 3 commits October 30, 2020 13:51

Better naming for tezos rpc service url

c31ff23

Make /vending-machine http POST only

8c3b8e1

Remove create_nonce function

806870a

harryttd removed the request for review from agtilden November 2, 2020 16:49

harryttd and others added 6 commits November 2, 2020 11:49

Use namespace fields in devspace.yaml

95ca56e

Update injected value for tezos rpc endpoint

f7279aa

tweak dockerfile to build smaller image

8fe6e8c

Working nginx auth proxy

f9ce69f

Pass auth token as header

Better nginx auth configuration

853cbd7

Use uuid hex format for access token

f4ed012

Use ip instead of localhost alias for rpc listening address

5357394

Node was listening also on ipv6 loopback when using "localhost". Not sure if this matters but for backwards consistency I changed it.

harryttd marked this pull request as ready for review November 18, 2020 02:14

harryttd requested a review from s-zeng November 18, 2020 02:14

Only run uwsgi touchreload in development

32c098f

harryttd requested a review from itkach November 18, 2020 17:26

itkach reviewed Nov 18, 2020

View reviewed changes

harryttd added 3 commits November 18, 2020 14:57

Run rpc-auth by default in prod

635b952

Merge branch 'master' into aryeh/rpc-auth

64e2de2

Configure redis persistance

7fca9ae

nicolasochem reviewed Nov 20, 2020

View reviewed changes

itkach reviewed Nov 20, 2020

View reviewed changes

harryttd added 3 commits November 20, 2020 11:12

WIP

eec82f1

Configure redis persistance

22c25d6

closes #51

fix for devspace

3a0a70f

harryttd linked an issue Nov 20, 2020 that may be closed by this pull request

Configure redis persistance for RPC authentication #51

Closed

harryttd added 3 commits November 20, 2020 13:02

Rename rpc-auth-service to just rpc-auth

e1361e8

Add FLASK_ENV var to devspace

c9a2ef8

Properly handle falsey chain args

38dde33

s-zeng approved these changes Nov 23, 2020

View reviewed changes

harryttd added 2 commits November 23, 2020 18:56

Merge branch 'aryeh/rpc-auth' into devspace

97d618a

Devspace hook to increase fs.inotify.max_user_watches

3ca2c86

Closes #52

harryttd force-pushed the aryeh/rpc-auth branch from 3c23443 to 3ca2c86 Compare November 24, 2020 00:55

Merge branch 'master' into aryeh/rpc-auth

bf55629

harryttd requested review from nicolasochem, s-zeng and itkach November 24, 2020 00:59

harryttd merged commit ecd7efa into master Nov 25, 2020

harryttd deleted the aryeh/rpc-auth branch November 25, 2020 19:51



		def generate_secret_url(public_key):
		access_token = str(uuid4())


		COPY --chown=appuser:appuser ./server/index.py .

		ARG FLASK_ENV=development

Aryeh/rpc-auth #36

Aryeh/rpc-auth #36

Conversation

harryttd commented Oct 29, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

itkach Oct 30, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

harryttd commented Nov 18, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

itkach Nov 20, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

itkach Nov 20, 2020 • edited Loading

Choose a reason for hiding this comment

nicolasochem commented Nov 20, 2020 via email

harryttd commented Oct 29, 2020 •

edited

Loading

itkach Oct 30, 2020 •

edited

Loading

itkach Nov 20, 2020 •

edited

Loading

itkach Nov 20, 2020 •

edited

Loading