Move TLS setup to listener

google · Jan 17, 2020 · 2c8e035 · 2c8e035
1 parent 447bea1
commit 2c8e035
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 16 deletions.
diff --git a/cmd/keytransparency-monitor/main.go b/cmd/keytransparency-monitor/main.go
@@ -123,7 +123,7 @@ func main() {
 	grpc_prometheus.Register(grpcServer)
 	grpc_prometheus.EnableHandlingTimeHistogram()
 
-	lis, conn, done, err := serverutil.Listen(ctx, *addr, *certFile)
+	lis, conn, done, err := serverutil.ListenTLS(ctx, *addr, *certFile, *keyFile)
 	if err != nil {
 		glog.Fatalf("Listen(%v): %v", *addr, err)
 	}
@@ -132,8 +132,7 @@ func main() {
 	g, gctx := errgroup.WithContext(ctx)
 	g.Go(func() error { return serverutil.ServeHTTPMetrics(*metricsAddr, serverutil.Healthz()) })
 	g.Go(func() error {
-		return serverutil.ServeHTTPAPIAndGRPC(gctx, lis, *keyFile, *certFile,
-			grpcServer, conn, mopb.RegisterMonitorHandler)
+		return serverutil.ServeHTTPAPIAndGRPC(gctx, lis, grpcServer, conn, mopb.RegisterMonitorHandler)
 	})
 	glog.Errorf("Monitor exiting: %v", g.Wait())
 }

diff --git a/cmd/keytransparency-sequencer/main.go b/cmd/keytransparency-sequencer/main.go
@@ -139,7 +139,7 @@ func main() {
 	)
 
 	// Listen and create empty grpc client connection.
-	lis, conn, done, err := serverutil.Listen(ctx, *addr, *certFile)
+	lis, conn, done, err := serverutil.ListenTLS(ctx, *listenAddr, *certFile, *keyFile)
 	if err != nil {
 		glog.Fatalf("Listen(%v): %v", *addr, err)
 	}
@@ -174,8 +174,8 @@ func main() {
 	g, gctx := errgroup.WithContext(ctx)
 	g.Go(func() error { return serverutil.ServeHTTPMetrics(*metricsAddr, serverutil.Readyz(sqldb)) })
 	g.Go(func() error {
-		return serverutil.ServeHTTPAPIAndGRPC(gctx, lis, *keyFile, *certFile,
-			grpcServer, conn, pb.RegisterKeyTransparencyAdminHandler)
+		return serverutil.ServeHTTPAPIAndGRPC(gctx, lis, grpcServer, conn,
+			pb.RegisterKeyTransparencyAdminHandler)
 	})
 	g.Go(func() error { return runSequencer(gctx, conn, directoryStorage) })
 

diff --git a/cmd/keytransparency-server/main.go b/cmd/keytransparency-server/main.go
@@ -137,7 +137,7 @@ func main() {
 	grpc_prometheus.Register(grpcServer)
 	grpc_prometheus.EnableHandlingTimeHistogram()
 
-	lis, conn, done, err := serverutil.Listen(ctx, *addr, *certFile)
+	lis, conn, done, err := serverutil.ListenTLS(ctx, *addr, *certFile, *keyFile)
 	if err != nil {
 		glog.Fatalf("Listen(%v): %v", *addr, err)
 	}
@@ -146,8 +146,7 @@ func main() {
 	g, gctx := errgroup.WithContext(ctx)
 	g.Go(func() error { return serverutil.ServeHTTPMetrics(*metricsAddr, serverutil.Readyz(sqldb)) })
 	g.Go(func() error {
-		return serverutil.ServeHTTPAPIAndGRPC(gctx, lis, *keyFile, *certFile,
-			grpcServer, conn, pb.RegisterKeyTransparencyHandler)
+		return serverutil.ServeHTTPAPIAndGRPC(gctx, lis, grpcServer, conn, pb.RegisterKeyTransparencyHandler)
 	})
 
 	glog.Errorf("Key Transparency Server exiting: %v", g.Wait())

diff --git a/cmd/serverutil/listen.go b/cmd/serverutil/listen.go
@@ -16,19 +16,28 @@ package serverutil
 
 import (
 	"context"
+	"crypto/tls"
 	"net"
 
 	"github.com/golang/glog"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 )
 
-// Listen binds to listenAddr and returns a gRPC connection to it.
-func Listen(ctx context.Context, listenAddr, certFile string) (net.Listener, *grpc.ClientConn, func(), error) {
-	lis, err := net.Listen("tcp", listenAddr)
+// ListenTLS binds to listenAddr and returns a gRPC connection to it.
+func ListenTLS(ctx context.Context, listenAddr, certFile, keyFile string) (net.Listener, *grpc.ClientConn, func(), error) {
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		glog.Exitf("error reading keypair: %v", err)
+	}
+	config := &tls.Config{
+		Certificates: []tls.Certificate{cert},
+	}
+	lis, err := tls.Listen("tcp", listenAddr, config)
 	if err != nil {
 		return nil, nil, nil, err
 	}
+
 	addr := lis.Addr().String()
 	glog.Infof("Listening on %v", addr)
 

diff --git a/cmd/serverutil/serverutil.go b/cmd/serverutil/serverutil.go
@@ -46,8 +46,7 @@ func GrpcHandlerFunc(grpcServer http.Handler, otherHandler http.Handler) http.Ha
 type RegisterServiceFromConn func(context.Context, *runtime.ServeMux, *grpc.ClientConn) error
 
 // ServeAPIGatewayAndGRPC serves the given services over HTTP / JSON and gRPC.
-func ServeHTTPAPIAndGRPC(ctx context.Context,
-	lis net.Listener, keyFile, certFile string,
+func ServeHTTPAPIAndGRPC(ctx context.Context, lis net.Listener,
 	grpcServer *grpc.Server, conn *grpc.ClientConn,
 	services ...RegisterServiceFromConn) error {
 	// Wire up gRPC and HTTP servers.
@@ -62,8 +61,7 @@ func ServeHTTPAPIAndGRPC(ctx context.Context,
 	mux := http.NewServeMux()
 	mux.Handle("/", RootHealthHandler(gwmux))
 
-	server := &http.Server{Handler: GrpcHandlerFunc(grpcServer, mux)}
-	return server.ServeTLS(lis, certFile, keyFile)
+	return http.Serve(lis, GrpcHandlerFunc(grpcServer, mux))
 }
 
 // ServeHTTPMetrics serves monitoring APIs