cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.35k stars 128 forks source link

[T2418] Refactor http api (and bring TLS) #550

Closed G1gg1L3s closed 2 years ago

G1gg1L3s commented 2 years ago

This PR rewrites the existing acra's HTTP API to use gin, instead of using custom http server.

It also allows to use TLS with HTTP API, which was primary goal of this PR. Ideally, it should be two PR: one with refactoring and the other with TLS. But we have what we have ¯_(ツ)_/¯.

To maintain backward compatibility, by default the server doesn't use the TLS. To enable it, the user should provide certificates and keys, as well as --http_api_use_tls flag. Without it, the acra will produce a warning that the API is used without encryption. We can change this flag to true later and deprecate insecure usage of the API.

To move the server to the gin, I've studied the translator code, so many elements are familiar.

The only issue that is still present is the graceful shutdown. As it turns out, it is not that graceful, even in the translator, and I don't know whether it's something intended or wrong.

Checklist

G1gg1L3s commented 2 years ago

@Lagovas, please take a loot at the last commit and tell if it's correct or if it's not going to work in some cases. Before that, the restart with SIGHUP didn't work, because goroutines weren't able to stop during timeout. Right now it works and successfully serves the http api requests (though I haven't checked it with the TLS). However, the following log is still printed:

level=error msg="Handling HTTP API requests" connection_string="tcp://0.0.0.0:9090/" error="accept tcp [::]:9090: use of closed network connection" from_descriptor=false

Edit: checked, as expected, SIGHUP doesn't work with TLS: the server is restarted, but cannot serve TLS requests.