[feat]: support certificate authentication and add tests

crates/utils/src/config.rs

@@ -183,7 +183,7 @@ impl ClusterConfig {
         peer_advertise_urls: Vec<String>,
         client_listen_urls: Vec<String>,
         client_advertise_urls: Vec<String>,
-        members: HashMap<String, Vec<String>>,
+        peers: HashMap<String, Vec<String>>,
         is_leader: bool,
         curp: CurpConfig,
         client_config: ClientConfig,
@@ -196,7 +196,7 @@ impl ClusterConfig {
             peer_advertise_urls,
             client_listen_urls,
             client_advertise_urls,
-            peers: members,
+            peers,
             is_leader,
             curp_config: curp,
             client_config,
@@ -945,16 +945,16 @@ impl AuthConfig {
 #[non_exhaustive]
 #[derive(Clone, Debug, Deserialize, PartialEq, Eq, Getters, Default)]
 pub struct TlsConfig {
-    /// The CA certificate file used by server to verify client certificates
+    /// The CA certificate file used by peer to verify client certificates
     #[getset(get = "pub")]
-    pub server_ca_cert_path: Option<PathBuf>,
-    /// The public key file used by server
+    pub peer_ca_cert_path: Option<PathBuf>,
+    /// The public key file used by peer
     #[getset(get = "pub")]
-    pub server_cert_path: Option<PathBuf>,
-    /// The private key file used by server
+    pub peer_cert_path: Option<PathBuf>,
+    /// The private key file used by peer
     #[getset(get = "pub")]
-    pub server_key_path: Option<PathBuf>,
-    /// The CA certificate file used by client to verify server certificates
+    pub peer_key_path: Option<PathBuf>,
+    /// The CA certificate file used by client to verify peer certificates
     #[getset(get = "pub")]
     pub client_ca_cert_path: Option<PathBuf>,
     /// The public key file used by client
@@ -970,22 +970,29 @@ impl TlsConfig {
     #[must_use]
     #[inline]
     pub fn new(
-        server_ca_cert_path: Option<PathBuf>,
-        server_cert_path: Option<PathBuf>,
-        server_key_path: Option<PathBuf>,
+        peer_ca_cert_path: Option<PathBuf>,
+        peer_cert_path: Option<PathBuf>,
+        peer_key_path: Option<PathBuf>,
         client_ca_cert_path: Option<PathBuf>,
         client_cert_path: Option<PathBuf>,
         client_key_path: Option<PathBuf>,
     ) -> Self {
         Self {
-            server_ca_cert_path,
-            server_cert_path,
-            server_key_path,
+            peer_ca_cert_path,
+            peer_cert_path,
+            peer_key_path,
             client_ca_cert_path,
             client_cert_path,
             client_key_path,
         }
     }
+
+    /// Whether the server tls is enabled
+    #[must_use]
+    #[inline]
+    pub fn server_tls_enabled(&self) -> bool {
+        self.peer_cert_path.is_some() && self.peer_key_path.is_some()
+    }
 }
 
 /// Xline metrics push protocol
@@ -1230,8 +1237,8 @@ mod tests {
             auth_private_key = './private_key.pem'
 
             [tls]
-            server_cert_path = './cert.pem'
-            server_key_path = './key.pem'
+            peer_cert_path = './cert.pem'
+            peer_key_path = './key.pem'
             client_ca_cert_path = './ca.pem'
 
             [metrics]
@@ -1337,8 +1344,8 @@ mod tests {
         assert_eq!(
             config.tls,
             TlsConfig {
-                server_cert_path: Some(PathBuf::from("./cert.pem")),
-                server_key_path: Some(PathBuf::from("./key.pem")),
+                peer_cert_path: Some(PathBuf::from("./cert.pem")),
+                peer_key_path: Some(PathBuf::from("./key.pem")),
                 client_ca_cert_path: Some(PathBuf::from("./ca.pem")),
                 ..Default::default()
             }

crates/utils/src/lib.rs

@@ -198,6 +198,7 @@ pub mod tokio_lock;
 /// utils for pass span context
 pub mod tracing;
 
+use ::tracing::debug;
 pub use parser::*;
 
 /// Get current timestamp in seconds
@@ -210,30 +211,6 @@ pub fn timestamp() -> u64 {
         .as_secs()
 }
 
-/// Certs for tests
-pub mod certs {
-    /// Server certificate
-    #[inline]
-    #[must_use]
-    pub fn server_cert() -> &'static [u8] {
-        include_bytes!("../../../fixtures/server.crt")
-    }
-
-    /// Server private key
-    #[inline]
-    #[must_use]
-    pub fn server_key() -> &'static [u8] {
-        include_bytes!("../../../fixtures/server.key")
-    }
-
-    /// CA certificate
-    #[inline]
-    #[must_use]
-    pub fn ca_cert() -> &'static [u8] {
-        include_bytes!("../../../fixtures/ca.crt")
-    }
-}
-
 /// Create a new endpoint from addr
 /// # Errors
 /// Return error if addr or tls config is invalid
@@ -243,6 +220,14 @@ pub fn build_endpoint(
     addr: &str,
     tls_config: Option<&ClientTlsConfig>,
 ) -> Result<Endpoint, tonic::transport::Error> {
+    debug!(
+        "connect to {addr}{}",
+        if tls_config.is_some() {
+            " with tls_config"
+        } else {
+            ""
+        }
+    );
     let scheme_str = addr.split_once("://").map(|(scheme, _)| scheme);
     let endpoint = match scheme_str {
         Some(_scheme) => Endpoint::from_str(addr)?,

crates/xline-client/src/lib.rs

@@ -234,6 +234,7 @@ impl Client {
         let channel = Self::build_channel(addrs.clone(), options.tls_config.as_ref()).await?;
         let curp_client = Arc::new(
             CurpClientBuilder::new(options.client_config, false)
+                .tls_config(options.tls_config)
                 .discover_from(addrs)
                 .await?
                 .build::<Command>()

crates/xline-test-utils/Cargo.toml

@@ -13,6 +13,7 @@ readme = "README.md"
 [dependencies]
 anyhow = "1.0.75"
 clap = { version = "4.4.4", features = ["derive"] }
+futures = "0.3.30"
 rand = "0.8.5"
 tokio = { version = "0.2.23", package = "madsim-tokio", features = [
     "rt-multi-thread",
@@ -22,6 +23,7 @@ tokio = { version = "0.2.23", package = "madsim-tokio", features = [
     "net",
     "signal",
 ] }
+tonic = "0.10.2"
 utils = { path = "../utils", features = ["parking_lot"] }
 workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 xline = { path = "../xline" }