Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use gateway client attls status in eureka object to determine http vs… #583

Merged
merged 2 commits into from
Jan 14, 2025
Merged

Use gateway client attls status in eureka object to determine http vs… #583

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
45a8953
Use env vars to lookup state of client attls for gateway in order to …
1000TurquoisePogs Jan 13, 2025
84d57a3
Fix logic about client attls of gateway
1000TurquoisePogs Jan 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions lib/apiml.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,19 @@ function ApimlConnector({ hostName, port, discoveryUrls,
discoveryPort, tlsOptions, eurekaOverrides, isClientAttls }) {
Object.assign(this, { hostName, port, discoveryUrls,
discoveryPort, tlsOptions, eurekaOverrides, isClientAttls });
//TODO config should never be checked through env var, but is temporarily needed to temporarily read gateway's ATTLS state to provide it with Eureka info it can work with.
const clientGlobalAttls = process.env['ZWE_zowe_network_client_tls_attls'] == 'true';
const clientGatewayAttls = process.env['ZWE_components_gateway_zowe_network_client_tls_attls'] == 'true';
const clientAttls = clientGlobalAttls || clientGatewayAttls;
this.isGatewayClientAttls = false;
if ((clientGlobalAttls !== false) && (clientLocalAttls !== false) && (!clientAttls)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't see the clientLocalAttls definition is it a typo and should be clientGatewayAttls?
In that case i do not quite understand this condition, i believe it will never pass as clientGlobalAttls and clientGatewayAttls both are defined booleans. if both are true then clientAttls will always be true.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you're right, this was a mistake of me copying over from the util.js function.
it's not going to have the same logic.

// If client attls not explicitly false OR truthy, have client follow server attls variable. it simplifies common case in which users want both.
const serverGlobalAttls = process.env['ZWE_zowe_network_server_tls_attls'] == 'true';
const serverGatewayAttls = process.env['ZWE_components_gateway_zowe_network_server_tls_attls'] == 'true';
this.isGatewayClientAttls = serverGlobalAttls || serverGatewayAttls;
} else {
this.isGatewayClientAttls = clientAttls;
}
this.vipAddress = hostName;
}

Expand Down Expand Up @@ -168,8 +181,14 @@ ApimlConnector.prototype = {
// If the HTTP port is set to 0 then the API ML doesn't load zlux
httpPort: Number(this.port),
httpsPort: Number(this.port),
httpEnabled: false,
httpsEnabled: true
// TODO while the server should always be HTTPS for security,
// When AT-TLS is used, programs need to know when AT-TLS will add TLS to their traffic
// To align with the correct amount of TLS (Avoid no TLS and double TLS)
// It seems the gateway wants to be told app-server is 'http' when client TLS is set on it
// So this eureka object will be based upon that setting.
// This may change in the future, revisit.
httpEnabled: this.isGatewayClientAttls,
httpsEnabled: !this.isGatewayClientAttls
};

log.debug("ZWED0141I", 'https', this.port); //"Protocol:", proto, "Port", port);
Expand Down
Loading