COCOS-160: Enable mTLS when using aTLS (#434)

* added maTLS feature to agent and cli

* added maTLS feature to agent and cli

* added tests and fixed one bug

* fixed according to comment

* fixed test

* fixed

internal/server/grpc/grpc.go

@@ -108,6 +108,7 @@ func (s *Server) Start() error {
 	creds := grpc.Creds(insecure.NewCredentials())
 	var listener net.Listener
 
+	c := s.Config.GetBaseConfig()
 	if agCfg, ok := s.Config.(server.AgentConfig); ok && agCfg.AttestedTLS {
 		certificateBytes, privateKeyBytes, err := generateCertificatesForATLS(s.caUrl, s.cvmId)
 		if err != nil {
@@ -124,6 +125,41 @@ func (s *Server) Start() error {
 			Certificates: []tls.Certificate{certificate},
 		}
 
+		var mtls bool
+		mtls = false
+
+		// Loading Server CA file
+		rootCA, err := loadCertFile(c.ServerCAFile)
+		if err != nil {
+			return fmt.Errorf("failed to load server ca file: %w", err)
+		}
+		if len(rootCA) > 0 {
+			if tlsConfig.RootCAs == nil {
+				tlsConfig.RootCAs = x509.NewCertPool()
+			}
+			if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCA) {
+				return fmt.Errorf("failed to append server ca to tls.Config")
+			}
+			mtls = true
+		}
+
+		// Loading Client CA File
+		clientCA, err := loadCertFile(c.ClientCAFile)
+		if err != nil {
+			return fmt.Errorf("failed to load client ca file: %w", err)
+		}
+		if len(clientCA) > 0 {
+			if tlsConfig.ClientCAs == nil {
+				tlsConfig.ClientCAs = x509.NewCertPool()
+			}
+			if !tlsConfig.ClientCAs.AppendCertsFromPEM(clientCA) {
+				return fmt.Errorf("failed to append client ca to tls.Config")
+			}
+
+			tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
+			mtls = true
+		}
+
 		creds = grpc.Creds(credentials.NewTLS(tlsConfig))
 
 		listener, err = atls.Listen(
@@ -131,12 +167,15 @@ func (s *Server) Start() error {
 			certificateBytes,
 			privateKeyBytes,
 		)
+
 		if err != nil {
 			return fmt.Errorf("failed to create Listener for aTLS: %w", err)
+		} else if mtls {
+			s.Logger.Info(fmt.Sprintf("%s service gRPC server listening at %s with Attested mTLS", s.Name, s.Address))
+		} else {
+			s.Logger.Info(fmt.Sprintf("%s service gRPC server listening at %s with Attested TLS", s.Name, s.Address))
 		}
-		s.Logger.Info(fmt.Sprintf("%s service gRPC server listening at %s with Attested TLS", s.Name, s.Address))
 	} else {
-		c := s.Config.GetBaseConfig()
 		switch {
 		case c.CertFile != "" || c.KeyFile != "":
 			certificate, err := loadX509KeyPair(c.CertFile, c.KeyFile)
@@ -253,6 +292,8 @@ func readFileOrData(input string) ([]byte, error) {
 		data, err := os.ReadFile(input)
 		if err == nil {
 			return data, nil
+		} else {
+			return nil, err
 		}
 	}
 	return []byte(input), nil

internal/server/grpc/grpc_test.go

@@ -327,60 +327,53 @@ func TestServerInitializationAndStartup(t *testing.T) {
 			expectedLog: "failed to load auth certificates",
 		},
 		{
-			name: "mTLS Server Startup",
-			config: server.AgentConfig{
-				ServerConfig: server.ServerConfig{
-					BaseConfig: server.BaseConfig{
-						Host: "localhost",
-						Port: "0",
-					},
-				},
-			},
-			setupCallback: setupMTLSConfig,
-			expectedLog:   "TestServer service gRPC server listening at localhost:0 with TLS",
-		},
-		{
-			name: "mTLS Server Startup with Invalid Root CA",
+			name: "maTLS Server Startup",
 			config: server.AgentConfig{
 				ServerConfig: server.ServerConfig{
 					BaseConfig: server.BaseConfig{
 						Host:         "localhost",
 						Port:         "0",
-						ServerCAFile: "invalid",
-					},
-				},
-			},
-			setupCallback: setupInvalidRootCAConfig,
-			expectError:   true,
-			expectedLog:   "failed to append root ca to tls.Config",
-		},
-		{
-			name: "mTLS Server Startup with Invalid Client CA",
-			config: server.AgentConfig{
-				ServerConfig: server.ServerConfig{
-					BaseConfig: server.BaseConfig{
-						Host:         "localhost",
-						Port:         "0",
-						ServerCAFile: "invalid",
-					},
-				},
-			},
-			setupCallback: setupInvalidClientCAConfig,
-			expectError:   true,
-			expectedLog:   "failed to append client ca to tls.Config",
-		},
-		{
-			name: "Attested TLS Server Startup",
-			config: server.AgentConfig{
-				ServerConfig: server.ServerConfig{
-					BaseConfig: server.BaseConfig{
-						Host: "localhost",
-						Port: "0",
+						ServerCAFile: "",
+						ClientCAFile: "",
 					},
 				},
 				AttestedTLS: true,
 			},
-			expectedLog: "TestServer service gRPC server listening at localhost:0 with Attested TLS",
+			setupCallback: setupMTLSConfig,
+			expectError:   false,
+			expectedLog:   "with Attested mTLS",
+		},
+		{
+			name: "maTLS Server Startup with Invalid Server CA file",
+			config: server.AgentConfig{
+				ServerConfig: server.ServerConfig{
+					BaseConfig: server.BaseConfig{
+						Host:         "localhost",
+						Port:         "0",
+						ServerCAFile: "invalid",
+					},
+				},
+				AttestedTLS: true,
+			},
+			setupCallback: setupInvalidRootCAConfig,
+			expectError:   true,
+			expectedLog:   "failed to load server ca file",
+		},
+		{
+			name: "maTLS Server Startup with Invalid Clinet CA file",
+			config: server.AgentConfig{
+				ServerConfig: server.ServerConfig{
+					BaseConfig: server.BaseConfig{
+						Host:         "localhost",
+						Port:         "0",
+						ServerCAFile: "invalid",
+					},
+				},
+				AttestedTLS: true,
+			},
+			setupCallback: setupInvalidClientCAConfig,
+			expectError:   true,
+			expectedLog:   "failed to load client ca file",
 		},
 	}