Secure Communication Channels via TLS

NOTICE.md

@@ -26,5 +26,6 @@ these files remains with the original authors.
 ### Robert Bosch GmbH
 
 - Becker Sebastian <sebastian.becker@de.bosch.com>
+- Hettwer Benjamin <benjamin.hettwer@de.bosch.com>
 - Raskin Vadim <vadim.raskin@de.bosch.com>
 - Trieflinger Sven <sven.trieflinger@de.bosch.com>

charts/ephemeral/README.md

@@ -77,6 +77,8 @@ provided while installing the chart. For example,
 helm install --name my-release -f values.yaml ephemeral
 ```
 
+<!-- markdownlint-disable MD013 -->
+
 ### Global Parameters
 
 | Parameter     | Description       | Default |
@@ -94,19 +96,23 @@ helm install --name my-release -f values.yaml ephemeral
 | `discovery.service.annotations`  | Annotations that should be attached to the Discovery service                 | `[]`                               |
 | `discovery.frontendUrl`          | The external base URL of the VCP                                             | \`\`                               |
 | `discovery.master.port`          | The port of the master discovery service instance                            | \`\`                               |
+| `discovery.tls.enabled`          | Determines whether the service communicates over TLS or plaintext            | `false`                            |
+| `discovery.tls.secret`           | The name of the k8s secret that holds the TLS keys and certificates          | \`\`                               |
 | `discovery.isMaster`             | Determines whether the service acts as master or slave                       | `true`                             |
 | `discovery.slave.connectTimeout` | Timeout to establish the connection to the upstream master Discovery Service | `60s`                              |
 | `discovery.stateTimeout`         | Timeout in which the transition to the next state is expected                | `60s`                              |
 | `discovery.computationTimeout`   | Timeout in which the result of a game's mpc computation is expected          | `60s`                              |
 
 ### Network Controller
 
-| Parameter                            | Description                                                      | Default                                     |
-| ------------------------------------ | ---------------------------------------------------------------- | ------------------------------------------- |
-| `networkController.image.registry`   | Image registry used to pull the Network Controller Service image | `ghcr.io`                                   |
-| `networkController.image.repository` | Network Controller Image name                                    | `carbynestack/ephemeral/network-controller` |
-| `networkController.image.tag`        | Network Controller Image tag                                     | `latest`                                    |
-| `networkController.image.pullPolicy` | Network Controller Image pull policy                             | `IfNotPresent`                              |
+| Parameter                            | Description                                                         | Default                                     |
+| ------------------------------------ | ------------------------------------------------------------------- | ------------------------------------------- |
+| `networkController.image.registry`   | Image registry used to pull the Network Controller Service image    | `ghcr.io`                                   |
+| `networkController.image.repository` | Network Controller Image name                                       | `carbynestack/ephemeral/network-controller` |
+| `networkController.image.tag`        | Network Controller Image tag                                        | `latest`                                    |
+| `networkController.image.pullPolicy` | Network Controller Image pull policy                                | `IfNotPresent`                              |
+| `networkController.tls.enabled`      | Determines whether the service communicates over TLS or plaintext   | `false`                                     |
+| `networkController.tls.secret`       | The name of the k8s secret that holds the TLS keys and certificates | \`\`                                        |
 
 ### Ephemeral Service
 
@@ -133,6 +139,8 @@ helm install --name my-release -f values.yaml ephemeral
 | `ephemeral.discovery.port`                    | The port of the discovery service                                        | `8080`                                |
 | `ephemeral.discovery.connectTimout`           | Timeout to establish the connection to the discovery service             | `60s`                                 |
 | `ephemeral.frontendUrl`                       | The external base URL of the VCP                                         | \`\`                                  |
+| `ephemeral.tls.enabled`                       | Determines whether the service communicates over TLS or plaintext        | `false`                               |
+| `ephemeral.tls.secret`                        | The name of the k8s secret that holds the TLS keys and certificates      | \`\`                                  |
 | `ephemeral.spdz.prime`                        | The prime used by SPDZ                                                   | \`\`                                  |
 | `ephemeral.spdz.rInv`                         | The rInv used by SPDZ                                                    | \`\`                                  |
 | `ephemeral.spdz.gfpMacKey`                    | The macKey for the prime protocol used by SPDZ                           | \`\`                                  |
@@ -144,3 +152,5 @@ helm install --name my-release -f values.yaml ephemeral
 | `ephemeral.networkEstablishTimeout`           | Timeout to establish network connections                                 | `1m`                                  |
 | `ephemeral.player.stateTimeout`               | Timeout in which the transition to the next state is expected            | `60s`                                 |
 | `ephemeral.player.computationTimeout`         | Timeout in which the result of a game's mpc computation is expected      | `60s`                                 |
+
+<!-- markdownlint-enable MD013 -->

charts/ephemeral/templates/discovery.yaml

@@ -80,34 +80,3 @@ data:
       "computationTimeout": "{{ .Values.discovery.computationTimeout }}",
       "connectTimeout": "{{ .Values.discovery.slave.connectTimeout }}"
     }
----
-apiVersion: networking.istio.io/v1alpha3
-kind: Gateway
-metadata:
-  name: discovery-service
-spec:
-  selector:
-    istio: ingressgateway # use istio default controller
-  servers:
-    - port:
-        number: 31400
-        name: grpc-my
-        protocol: GRPC
-      hosts:
-        - "*"
----
-apiVersion: networking.istio.io/v1beta1
-kind: VirtualService
-metadata:
-  name: discovery-service
-spec:
-  hosts:
-    - "*"
-  gateways:
-    - discovery-service
-  http:
-    - route:
-        - destination:
-            host: {{ include "ephemeral.fullname" . }}-discovery.default.svc.cluster.local
-            port:
-              number: 8080

charts/ephemeral/templates/ephemeral.yaml

@@ -43,6 +43,9 @@ spec:
           volumeMounts:
             - name: config-volume
               mountPath: /etc/config
+            - name: tls-secret-volume
+              mountPath: /etc/tls
+              readOnly: true
           {{- if or .Values.ephemeral.resources.requests.memory .Values.ephemeral.resources.requests.cpu .Values.ephemeral.resources.limits.memory .Values.ephemeral.resources.limits.cpu }}
           resources:
             {{- if or .Values.ephemeral.resources.requests.memory .Values.ephemeral.resources.requests.cpu }}
@@ -68,6 +71,9 @@ spec:
         - name: config-volume
           configMap:
             name: {{ include "ephemeral.fullname" . }}-config1
+        - name: tls-secret-volume
+          secret:
+            secretName: {{ .Values.tls.secret }}
       serviceAccountName: knative-serving
 ---
 apiVersion: v1
@@ -102,6 +108,7 @@ data:
         "tupleStock": {{ .Values.ephemeral.castor.tupleStock }}
       },
       "frontendURL": "{{ .Values.ephemeral.frontendUrl }}",
+      "tlsEnabled": {{ .Values.tls.enabled }},
       "discoveryConfig": {
         "host": "{{ .Values.ephemeral.discovery.host }}",
         "port": "{{ .Values.ephemeral.discovery.port }}",

charts/ephemeral/templates/network-controller.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2021 - for information on the respective copyright owner
+# Copyright (c) 2021-2024 - for information on the respective copyright owner
 # see the NOTICE file and/or the repository https://github.com/carbynestack/ephemeral.
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -41,3 +41,23 @@ spec:
                 fieldPath: metadata.name
           - name: OPERATOR_NAME
             value: "network-controller"
+        volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config
+      volumes:
+        - name: config-volume
+          configMap:
+            name: {{ include "ephemeral.fullname" . }}-network-controller-config
+      serviceAccountName: network-controller
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "ephemeral.fullname" . }}-network-controller-config
+data:
+  config.json: |-
+    {
+      "tlsEnabled": {{ .Values.tls.enabled }},
+      "tlsSecret": "{{ .Values.tls.secret }}"
+    }

charts/ephemeral/values.yaml

@@ -8,6 +8,10 @@
 # This file defines the default values for all variables used in the Ephemeral Helm Chart.
 playerCount: 2
 
+tls:
+  enabled: false
+  secret:
+
 discovery:
   service:
     annotations: []

cmd/ephemeral/main.go

@@ -5,8 +5,10 @@
 package main
 
 import (
+	"crypto/tls"
 	"encoding/json"
 	"errors"
+
 	"github.com/carbynestack/ephemeral/pkg/amphora"
 	"github.com/carbynestack/ephemeral/pkg/castor"
 	. "github.com/carbynestack/ephemeral/pkg/ephemeral"
@@ -15,18 +17,20 @@ import (
 	"github.com/carbynestack/ephemeral/pkg/utils"
 	"os"
 
-	. "github.com/carbynestack/ephemeral/pkg/types"
 	"math/big"
 	"net/http"
 	"net/url"
 	"time"
 
+	. "github.com/carbynestack/ephemeral/pkg/types"
+
 	"go.uber.org/zap"
 )
 
 const (
-	defaultConfig = "/etc/config/config.json"
-	defaultPort   = "8080"
+	defaultConfig    = "/etc/config/config.json"
+	defaultTlsConfig = "/etc/tls"
+	defaultPort      = "8080"
 )
 
 func main() {
@@ -159,6 +163,15 @@ func InitTypedConfig(conf *SPDZEngineConfig, logger *zap.SugaredLogger) (*SPDZEn
 		return nil, err
 	}
 
+	var tlsConfig *tls.Config
+	if conf.TlsEnabled {
+		var err error
+		tlsConfig, err = utils.CreateTLSConfig(defaultTlsConfig)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	return &SPDZEngineTypedConfig{
 		ProgramIdentifier:       programIdentifier,
 		NetworkEstablishTimeout: networkEstablishTimeout,
@@ -185,5 +198,7 @@ func InitTypedConfig(conf *SPDZEngineConfig, logger *zap.SugaredLogger) (*SPDZEn
 		},
 		StateTimeout:       stateTimeout,
 		ComputationTimeout: computationTimeout,
+		TlsEnabled:         conf.TlsEnabled,
+		TlsConfig:          tlsConfig,
 	}, nil
 }

cmd/network-controller/main.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2021 - for information on the respective copyright owner
+// Copyright (c) 2021-2024 - for information on the respective copyright owner
 // see the NOTICE file and/or the repository https://github.com/carbynestack/ephemeral.
 //
 // SPDX-License-Identifier: Apache-2.0
@@ -9,13 +9,16 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"flag"
 	"fmt"
 	"os"
 	"runtime"
 
 	"github.com/carbynestack/ephemeral/pkg/network-controller/apis"
 	"github.com/carbynestack/ephemeral/pkg/network-controller/controller"
+	. "github.com/carbynestack/ephemeral/pkg/types"
+	"github.com/carbynestack/ephemeral/pkg/utils"
 
 	"github.com/operator-framework/operator-sdk/pkg/k8sutil"
 	"github.com/operator-framework/operator-sdk/pkg/leader"
@@ -37,6 +40,8 @@ var (
 )
 var log = logf.Log.WithName("cmd")
 
+const defaultConfigLocation = "/etc/config/config.json"
+
 func printVersion() {
 	log.Info(fmt.Sprintf("Go Version: %s", runtime.Version()))
 	log.Info(fmt.Sprintf("Go OS/Arch: %s/%s", runtime.GOOS, runtime.GOARCH))
@@ -66,6 +71,16 @@ func main() {
 
 	printVersion()
 
+	networkControllerConfig, err := ParseConfig(defaultConfigLocation)
+	if err != nil {
+		log.Error(err, "Failed to parse config")
+		os.Exit(1)
+	}
+	log.Info(fmt.Sprintf("Starting with the config:\n%+v", networkControllerConfig))
+	if err != nil {
+		panic(err)
+	}
+
 	namespace, err := k8sutil.GetWatchNamespace()
 	if err != nil {
 		log.Error(err, "Failed to get watch namespace")
@@ -107,7 +122,7 @@ func main() {
 	}
 
 	// Setup all Controllers
-	if err := controller.AddToManager(mgr); err != nil {
+	if err := controller.AddToManager(mgr, networkControllerConfig); err != nil {
 		log.Error(err, "")
 		os.Exit(1)
 	}
@@ -126,3 +141,21 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+// ParseConfig parses the configuration file of the discovery service.
+func ParseConfig(path string) (*NetworkControllerTypedConfig, error) {
+	bytes, err := utils.ReadFile(path)
+	if err != nil {
+		panic(err)
+	}
+	var conf NetworkControllerConfig
+	err = json.Unmarshal(bytes, &conf)
+	if err != nil {
+		return nil, err
+	}
+
+	return &NetworkControllerTypedConfig{
+		TlsEnabled: conf.TlsEnabled,
+		TlsSecret:  conf.TlsSecret,
+	}, nil
+}

pkg/ephemeral/network/proxy.go

@@ -6,6 +6,7 @@ package network
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
@@ -35,6 +36,8 @@ func NewProxy(lg *zap.SugaredLogger, conf *SPDZEngineTypedConfig, checker Networ
 		retrySleep:   conf.RetrySleep,
 		retryTimeout: conf.NetworkEstablishTimeout,
 		tcpChecker:   checker,
+		tlsEnabled:   conf.TlsEnabled,
+		tlsConfig:    conf.TlsConfig,
 	}
 }
 
@@ -50,6 +53,8 @@ type Proxy struct {
 	// activeProxyIndicatorCh indicates that proxy was successfully started (see [tcpproxy.Proxy.Start]) if the channel
 	// is closed.
 	activeProxyIndicatorCh chan struct{}
+	tlsEnabled             bool
+	tlsConfig              *tls.Config
 }
 
 // Run start the tcpproxy, makes sure it has started by means of a ping.
@@ -133,7 +138,31 @@ func (p *Proxy) addProxyEntry(config *ProxyConfig) *PingAwareTarget {
 	// Start the TCP proxy to forward the requests from the base partner address to the target one.
 	address := config.Host + ":" + config.Port
 	p.logger.Infow(fmt.Sprintf("Adding TCP Proxy Entry for 'localhost:%s' -> '%s'", config.LocalPort, address), GameID, p.ctx.Act.GameID)
-	dialProxy := tcpproxy.DialProxy{Addr: address, DialTimeout: timeout}
+
+	var dialProxy tcpproxy.DialProxy
+
+	if p.tlsEnabled {
+		// Load TLS configuration
+		tlsConfig := p.tlsConfig
+
+		dialProxy = tcpproxy.DialProxy{
+			Addr: address,
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				conn, err := tls.Dial(network, addr, tlsConfig)
+				if err != nil {
+					return nil, err
+				}
+				return conn, nil
+			},
+			DialTimeout: timeout,
+		}
+	} else {
+		dialProxy = tcpproxy.DialProxy{
+			Addr:        address,
+			DialTimeout: timeout,
+		}
+	}
+
 	pat := &PingAwareTarget{
 		Next:   &dialProxy,
 		Logger: p.logger,