[OGUI-1755] Encrypt connections with certificates

Tokenization/backend/wrapper/models/config.model.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2019-2020 CERN and copyright holders of ALICE O2.
+ * See http://alice-o2.web.cern.ch/copyright for details of the copyright holders.
+ * All rights not expressly granted are reserved.
+ *
+ * This software is distributed under the terms of the GNU General Public
+ * License v3 (GPL Version 3), copied verbatim in the file "COPYING".
+ *
+ * In applying this license CERN does not waive the privileges and immunities
+ * granted to it by virtue of its status as an Intergovernmental Organization
+ * or submit itself to any jurisdiction.
+ */
+
+export interface CentralSystemConfig {
+  /** Path to the proto file defining the services. */
+  protoPath: string;
+  /** Host/IP to bind the gRPC server on. Defaults to "0.0.0.0" which is docker-friendly. */
+  host?: string;
+  /** Port to bind. Defaults to 50051. */
+  port?: number;
+}
+
+export interface gRPCWrapperConfig {
+  /** Path to the proto file defining the services. */
+  protoPath: string;
+  /** Address of the CentralSystem server. */
+  centralAddress: string;
+}

Tokenization/backend/wrapper/src/central/CentralSystemWrapper.ts

@@ -15,6 +15,8 @@
 import * as grpc from '@grpc/grpc-js';
 import * as protoLoader from '@grpc/proto-loader';
 import { LogManager } from '@aliceo2/web-ui';
+import * as fs from 'fs';
+import type { CentralSystemConfig } from '../models/config.model';
 import type { DuplexMessageModel } from '../models/message.model';
 
 /**
@@ -24,11 +26,15 @@ export class CentralSystemWrapper {
   // Config
   private _protoPath: string;
 
-  // Utilities
-  private _logger = LogManager.getLogger('CentralSystemWrapper');
-
   // Class properties
   private _server: grpc.Server;
+  private _port: number;
+
+  // Certificates paths
+  private _serverCerts: CentralSystemConfig['serverCerts'];
+
+  // Utilities
+  private _logger = LogManager.getLogger('CentralSystemWrapper');
 
   // Clients management
   private _clients = new Map<string, grpc.ServerDuplexStream<any, any>>();
@@ -38,8 +44,15 @@ export class CentralSystemWrapper {
    * Initializes the Wrapper for CentralSystem.
    * @param port The port number to bind the gRPC server to.
    */
-  constructor(protoPath: string, private port: number) {
-    this._protoPath = protoPath;
+  constructor(config: CentralSystemConfig) {
+    if (!config.protoPath || !config.serverCerts?.caCertPath || !config.serverCerts?.certPath || !config.serverCerts?.keyPath) {
+      throw new Error('Invalid CentralSystemConfig provided');
+    }
+
+    this._protoPath = config.protoPath;
+    this._serverCerts = config.serverCerts;
+    this._port = config.port ?? 50051;
+
     this._server = new grpc.Server();
     this.setupService();
   }
@@ -115,7 +128,7 @@ export class CentralSystemWrapper {
 
     // Handle stream error event
     call.on('error', (err) => {
-      this._logger.infoMessage(`Stream error from client ${clientIp}:`, err);
+      this._logger.errorMessage(`Stream error from client ${clientIp}:`, err);
       this.cleanupClient(peer);
     });
   }
@@ -168,10 +181,27 @@ export class CentralSystemWrapper {
    * Starts the gRPC server and binds it to the specified in class port.
    */
   public listen() {
-    const addr = `localhost:${this.port}`;
-    this._server.bindAsync(addr, grpc.ServerCredentials.createInsecure(), (err, _port) => {
+    const addr = `localhost:${this._port}`;
+
+    // Create mTLS secure gRPC server
+    const caCert = fs.readFileSync(this._serverCerts.caCertPath);
+    const centralKey = fs.readFileSync(this._serverCerts.keyPath);
+    const centralCert = fs.readFileSync(this._serverCerts.certPath);
+
+    const sslCreds = grpc.ServerCredentials.createSsl(
+      caCert,
+      [
+        {
+          private_key: centralKey,
+          cert_chain: centralCert,
+        },
+      ],
+      true
+    );
+
+    this._server.bindAsync(addr, sslCreds, (err, _port) => {
       if (err) {
-        this._logger.infoMessage('Server bind error:', err);
+        this._logger.errorMessage('Server bind error:', err);
         return;
       }
       this._logger.infoMessage(`CentralSytem started listening on ${addr}`);

Tokenization/backend/wrapper/src/client/connection/Connection.ts

@@ -33,13 +33,35 @@ export class Connection {
    * @param token - The authentication token for the connection.
    * @param targetAddress - The unique address of the target client.
    * @param direction - The direction of the connection (e.g., sending or receiving).
+   * @param peerCtor - The constructor for the gRPC client to be used for communication.
+   * @param caCertPath - Path to the CA certificate file.
+   * @param clientCertPath - Path to the client certificate file.
+   * @param clientKeyPath - Path to the client key file.
    */
-  constructor(token: string, targetAddress: string, direction: ConnectionDirection, peerCtor: any) {
+  constructor(
+    token: string,
+    targetAddress: string,
+    direction: ConnectionDirection,
+    peerCtor: any,
+    private readonly connectionCerts: {
+      caCert: NonSharedBuffer;
+      clientCert: NonSharedBuffer;
+      clientKey: NonSharedBuffer;
+    }
+  ) {
     this._token = token;
     this._targetAddress = targetAddress;
-    this._peerClient = new peerCtor(targetAddress, grpc.credentials.createInsecure());
     this.direction = direction;
 
+    if (!connectionCerts.caCert || !connectionCerts.clientCert || !connectionCerts.clientKey) {
+      throw new Error('Connection certificates are required to create a Connection.');
+    }
+
+    // Create grpc credentials
+    const sslCreds = grpc.credentials.createSsl(this.connectionCerts.caCert, this.connectionCerts.clientKey, this.connectionCerts.clientCert);
+
+    this._peerClient = new peerCtor(targetAddress, sslCreds);
+
     this._status = ConnectionStatus.CONNECTED;
   }
 

Tokenization/backend/wrapper/src/client/connectionManager/ConnectionManager.ts

@@ -14,15 +14,16 @@
 
 import * as grpc from '@grpc/grpc-js';
 import * as protoLoader from '@grpc/proto-loader';
+import * as fs from 'fs';
 import { CentralConnection } from './CentralConnection';
 import { CentralCommandDispatcher } from './eventManagement/CentralCommandDispatcher';
 import { Connection } from '../connection/Connection';
 import { LogManager } from '@aliceo2/web-ui';
-import type { Command, CommandHandler } from 'models/commands.model';
-import type { DuplexMessageEvent } from '../../models/message.model';
 import { ConnectionDirection } from '../../models/message.model';
 import { ConnectionStatus } from '../../models/connection.model';
 import { peerListener } from '../../utils/connection/peerListener';
+import type { Command, CommandHandler } from 'models/commands.model';
+import type { DuplexMessageEvent } from '../../models/message.model';
 
 /**
  * Manages the lifecycle and connection logic for a gRPC client communicating with the central system.
@@ -49,15 +50,23 @@ export class ConnectionManager {
   private _peerServer: grpc.Server | undefined;
   private _baseAPIPath: string = '';
 
+  // Client certificates
+  private _caCert: NonSharedBuffer;
+  private _clientCert: NonSharedBuffer;
+  private _clientKey: NonSharedBuffer;
+
   /**
    * Initializes a new instance of the ConnectionManager class.
    *
    * This constructor sets up the gRPC client for communication with the central system.
    *
    * @param protoPath - The file path to the gRPC proto definition.
    * @param centralAddress - The address of the central gRPC server (default: "localhost:50051").
+   * @param caCertPath - Path to the CA certificate file.
+   * @param clientCertPath - Path to the client certificate file.
+   * @param clientKeyPath - Path to the client key file.
    */
-  constructor(protoPath: string, centralAddress: string = 'localhost:50051') {
+  constructor(protoPath: string, centralAddress: string = 'localhost:50051', caCertPath: string, clientCertPath: string, clientKeyPath: string) {
     const packageDef = protoLoader.loadSync(protoPath, {
       keepCase: true,
       longs: String,
@@ -70,11 +79,18 @@ export class ConnectionManager {
     this._wrapper = proto.webui.tokenization;
     this._peerCtor = this._wrapper.Peer2Peer;
 
-    const client = new this._wrapper.CentralSystem(centralAddress, grpc.credentials.createInsecure());
+    // Read certs
+    this._caCert = fs.readFileSync(caCertPath);
+    this._clientCert = fs.readFileSync(clientCertPath);
+    this._clientKey = fs.readFileSync(clientKeyPath);
+
+    // Create grpc credentials
+    const sslCreds = grpc.credentials.createSsl(this._caCert, this._clientKey, this._clientCert);
+    const centralClient = new this._wrapper.CentralSystem(centralAddress, sslCreds);
 
     // Event dispatcher for central system events
     this._centralDispatcher = new CentralCommandDispatcher();
-    this._centralConnection = new CentralConnection(client, this._centralDispatcher, centralAddress);
+    this._centralConnection = new CentralConnection(centralClient, this._centralDispatcher, centralAddress);
   }
 
   /**
@@ -112,8 +128,28 @@ export class ConnectionManager {
    * @param direction Direction of connection
    * @param token Optional token for connection
    */
-  createNewConnection(address: string, direction: ConnectionDirection, token?: string) {
-    const conn = new Connection(token ?? '', address, direction, this._peerCtor);
+  public async createNewConnection(address: string, direction: ConnectionDirection, token?: string) {
+    let conn: Connection | undefined;
+
+    // Checks if connection already exists
+    conn = direction === ConnectionDirection.RECEIVING ? this._receivingConnections.get(address) : this._sendingConnections.get(address);
+
+    // Return existing connection if found
+    if (conn) {
+      if (token) {
+        conn.token = token;
+      }
+      return conn;
+    }
+
+    // Create new connection
+    conn = new Connection(token ?? '', address, direction, this._peerCtor, {
+      caCert: this._caCert,
+      clientCert: this._clientCert,
+      clientKey: this._clientKey,
+    });
+
+    conn.status = ConnectionStatus.CONNECTING;
 
     if (direction === ConnectionDirection.RECEIVING) {
       this._receivingConnections.set(address, conn);
@@ -158,7 +194,7 @@ export class ConnectionManager {
   }
 
   /** Starts a listener server for p2p connections */
-  public async listenForPeers(port: number, baseAPIPath?: string): Promise<void> {
+  public async listenForPeers(port: number, listenerKey: NonSharedBuffer, listenerCert: NonSharedBuffer, baseAPIPath?: string): Promise<void> {
     if (baseAPIPath) this._baseAPIPath = baseAPIPath;
 
     if (this._peerServer) {
@@ -169,11 +205,22 @@ export class ConnectionManager {
     this._peerServer = new grpc.Server();
     this._peerServer.addService(this._wrapper.Peer2Peer.service, {
       Fetch: async (call: grpc.ServerUnaryCall<any, any>, callback: grpc.sendUnaryData<any>) =>
-        peerListener(call, callback, this._logger, this._receivingConnections, this._peerCtor, this._baseAPIPath),
+        peerListener(call, callback, this._logger, this._receivingConnections, this.createNewConnection.bind(this), this._baseAPIPath),
     });
 
+    const sslCreds = grpc.ServerCredentials.createSsl(
+      this._caCert,
+      [
+        {
+          private_key: listenerKey,
+          cert_chain: listenerCert,
+        },
+      ],
+      true
+    );
+
     await new Promise<void>((resolve, reject) => {
-      this._peerServer?.bindAsync(`localhost:${port}`, grpc.ServerCredentials.createInsecure(), (err) => (err ? reject(err) : resolve()));
+      this._peerServer?.bindAsync(`localhost:${port}`, sslCreds, (err) => (err ? reject(err) : resolve()));
     });
 
     this._logger.infoMessage(`Peer server listening on localhost:${port}`);

Tokenization/backend/wrapper/src/client/gRPCWrapper.ts

@@ -12,14 +12,17 @@
  * or submit itself to any jurisdiction.
  */
 
+import * as fs from 'fs';
 import { ConnectionManager } from './connectionManager/ConnectionManager';
 import { RevokeTokenHandler } from './commands/revokeToken/revokeToken.handler';
 import { ConnectionDirection, DuplexMessageEvent } from '../models/message.model';
 import { NewTokenHandler } from './commands/newToken/newToken.handler';
+import { LogManager } from '@aliceo2/web-ui';
+import type { gRPCWrapperConfig } from '../models/config.model';
 import type { Connection } from './connection/Connection';
 
 /**
- * @description Wrapper class for managing secure gRPC wrapper.
+ * Wrapper class for managing secure gRPC wrapper.
  *
  * @remarks
  * This class serves as a high-level abstraction over the underlying
@@ -34,15 +37,39 @@ import type { Connection } from './connection/Connection';
  */
 export class gRPCWrapper {
   private _connectionManager: ConnectionManager;
+  private _listenerKey?: NonSharedBuffer;
+  private _listenerCert?: NonSharedBuffer;
+  private _logger = LogManager.getLogger('gRPCWrapper');
 
   /**
    * Initializes an instance of gRPCWrapper class.
    *
    * @param protoPath - The file path to the gRPC proto definition.
    * @param centralAddress - The address of the central gRPC server (default: "localhost:4100").
    */
-  constructor(protoPath: string, centralAddress: string = 'localhost:4100') {
-    this._connectionManager = new ConnectionManager(protoPath, centralAddress);
+  constructor(config: gRPCWrapperConfig) {
+    if (
+      !config.protoPath ||
+      !config.centralAddress ||
+      !config.clientCerts?.caCertPath ||
+      !config.clientCerts?.certPath ||
+      !config.clientCerts?.keyPath
+    ) {
+      throw new Error('Invalid gRPCWrapper configuration provided.');
+    }
+
+    if (config.listenerCertPaths?.keyPath && config.listenerCertPaths?.certPath) {
+      this._listenerKey = fs.readFileSync(config.listenerCertPaths.keyPath);
+      this._listenerCert = fs.readFileSync(config.listenerCertPaths.certPath);
+    }
+
+    this._connectionManager = new ConnectionManager(
+      config.protoPath,
+      config.centralAddress,
+      config.clientCerts.caCertPath,
+      config.clientCerts.certPath,
+      config.clientCerts.keyPath
+    );
     this._connectionManager.registerCommandHandlers([
       {
         event: DuplexMessageEvent.MESSAGE_EVENT_REVOKE_TOKEN,
@@ -83,8 +110,18 @@ export class gRPCWrapper {
    * @param baseAPIPath Optional base API path to forward requests to e.g. '/api'.
    * @returns A promise that resolves when the p2p listener server is started.
    */
-  public async listenForPeers(port: number, baseAPIPath?: string): Promise<void> {
-    return this._connectionManager.listenForPeers(port, baseAPIPath);
+  public async listenForPeers(port: number, baseAPIPath?: string, listenerCertPaths?: { keyPath: string; certPath: string }): Promise<void> {
+    if (listenerCertPaths?.keyPath && listenerCertPaths?.certPath) {
+      this._listenerKey = fs.readFileSync(listenerCertPaths.keyPath);
+      this._listenerCert = fs.readFileSync(listenerCertPaths.certPath);
+    }
+
+    if (!this._listenerKey || !this._listenerCert) {
+      this._logger.errorMessage('Listener certificates are required to start P2P listener. Please provide valid paths.');
+      return;
+    }
+
+    return this._connectionManager.listenForPeers(port, this._listenerKey, this._listenerCert, baseAPIPath);
   }
 
   /**