Skip to content

Commit 1569148

Browse files
author
Razvan Becheriu
committed
[#3694] addressed review comments
1 parent aa5ccbc commit 1569148

16 files changed

+116
-49
lines changed

‎ChangeLog

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
2324. [func] razvan
22
It is not necessary to restart the server to apply changes in the
33
TLS configuration. Running the "config-reload" command is
4-
sufficient.
4+
sufficient. A different address or port must be specified when
5+
switching from HTTP to HTTPS or from HTTPS to HTTP.
56
(Gitlab #3694)
67

78
Kea 2.7.6 (development) released on January 29, 2025

‎doc/sphinx/arm/agent.rst

+6-1
Original file line numberDiff line numberDiff line change
@@ -259,8 +259,13 @@ Configuring only one or two string parameters results in an error.
259259
mutually authenticated, but there is no proof they are the same as
260260
for the HTTP authentication.
261261

262+
The server will issue an error when changing the socket type from HTTP to HTTPS
263+
or from HTTPS to HTTP using the same address and port. This action is not
264+
allowed as it might introduce a security issue accidentally caused by a user
265+
mistake.
262266
A different address or port must be specified when using the "config-set"
263-
command to switch from HTTP to HTTPS or from HTTPS to HTTP.
267+
command to switch from HTTP to HTTPS or from HTTPS to HTTP. The same applies
268+
when modyfying the configuration file and then running "config-reload" command.
264269

265270
The :iscman:`kea-shell` tool also supports TLS.
266271

‎doc/sphinx/arm/ddns.rst

+6-1
Original file line numberDiff line numberDiff line change
@@ -428,8 +428,13 @@ password, these values can be read from files. The syntax is extended by:
428428

429429
Since Kea-2.7.6 Kea supports multiple HTTP/HTTPS connections.
430430
Both IPv4 and IPv6 addresses can be used.
431+
The server will issue an error when changing the socket type from HTTP to HTTPS
432+
or from HTTPS to HTTP using the same address and port. This action is not
433+
allowed as it might introduce a security issue accidentally caused by a user
434+
mistake.
431435
A different address or port must be specified when using the "config-set"
432-
command to switch from HTTP to HTTPS or from HTTPS to HTTP.
436+
command to switch from HTTP to HTTPS or from HTTPS to HTTP. The same applies
437+
when modyfying the configuration file and then running "config-reload" command.
433438

434439
When files are used, they are read when the configuration is loaded,
435440
to detect configuration errors as soon as possible.

‎doc/sphinx/arm/dhcp4-srv.rst

+6-1
Original file line numberDiff line numberDiff line change
@@ -7922,8 +7922,13 @@ password, these values can be read from files. The syntax is extended by:
79227922

79237923
Since Kea-2.7.6 Kea supports multiple HTTP/HTTPS connections.
79247924
Both IPv4 and IPv6 addresses can be used.
7925+
The server will issue an error when changing the socket type from HTTP to HTTPS
7926+
or from HTTPS to HTTP using the same address and port. This action is not
7927+
allowed as it might introduce a security issue accidentally caused by a user
7928+
mistake.
79257929
A different address or port must be specified when using the "config-set"
7926-
command to switch from HTTP to HTTPS or from HTTPS to HTTP.
7930+
command to switch from HTTP to HTTPS or from HTTPS to HTTP. The same applies
7931+
when modyfying the configuration file and then running "config-reload" command.
79277932

79287933
When files are used, they are read when the configuration is loaded,
79297934
to detect configuration errors as soon as possible.

‎doc/sphinx/arm/dhcp6-srv.rst

+6-1
Original file line numberDiff line numberDiff line change
@@ -7723,8 +7723,13 @@ password, these values can be read from files. The syntax is extended by:
77237723

77247724
Since Kea-2.7.6 Kea supports multiple HTTP/HTTPS connections.
77257725
Both IPv4 and IPv6 addresses can be used.
7726+
The server will issue an error when changing the socket type from HTTP to HTTPS
7727+
or from HTTPS to HTTP using the same address and port. This action is not
7728+
allowed as it might introduce a security issue accidentally caused by a user
7729+
mistake.
77267730
A different address or port must be specified when using the "config-set"
7727-
command to switch from HTTP to HTTPS or from HTTPS to HTTP.
7731+
command to switch from HTTP to HTTPS or from HTTPS to HTTP. The same applies
7732+
when modyfying the configuration file and then running "config-reload" command.
77287733

77297734
When files are used, they are read when the configuration is loaded,
77307735
to detect configuration errors as soon as possible.

‎src/bin/agent/ca_messages.cc

+7-5
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ extern const isc::log::MessageID CTRL_AGENT_HTTPS_SERVICE_STARTED = "CTRL_AGENT_
2020
extern const isc::log::MessageID CTRL_AGENT_HTTPS_SERVICE_UPDATED = "CTRL_AGENT_HTTPS_SERVICE_UPDATED";
2121
extern const isc::log::MessageID CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED = "CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED";
2222
extern const isc::log::MessageID CTRL_AGENT_HTTP_SERVICE_STARTED = "CTRL_AGENT_HTTP_SERVICE_STARTED";
23+
extern const isc::log::MessageID CTRL_AGENT_HTTP_SERVICE_UPDATED = "CTRL_AGENT_HTTP_SERVICE_UPDATED";
2324
extern const isc::log::MessageID CTRL_AGENT_RUN_EXIT = "CTRL_AGENT_RUN_EXIT";
2425
extern const isc::log::MessageID CTRL_AGENT_STARTED = "CTRL_AGENT_STARTED";
2526

@@ -37,11 +38,12 @@ const char* values[] = {
3738
"CTRL_AGENT_CONFIG_FAIL", "Control Agent configuration failed: %1",
3839
"CTRL_AGENT_CONFIG_SYNTAX_WARNING", "Control Agent configuration syntax warning: %1",
3940
"CTRL_AGENT_FAILED", "application experienced a fatal error: %1",
40-
"CTRL_AGENT_HTTPS_SERVICE_REUSE_FAILED", "failed to reuse HTTPS service bound to address %1:%2",
41-
"CTRL_AGENT_HTTPS_SERVICE_STARTED", "HTTPS service bound to address %1:%2",
42-
"CTRL_AGENT_HTTPS_SERVICE_UPDATED", "reused HTTPS service bound to address %1:%2 and updated TLS settings",
43-
"CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED", "failed to reused HTTP service bound to address %1:%2",
44-
"CTRL_AGENT_HTTP_SERVICE_STARTED", "HTTP service bound to address %1:%2",
41+
"CTRL_AGENT_HTTPS_SERVICE_REUSE_FAILED", "failed to reuse HTTPS service bound to address: %1 port: %2",
42+
"CTRL_AGENT_HTTPS_SERVICE_STARTED", "HTTPS service bound to address: %1 port: %2",
43+
"CTRL_AGENT_HTTPS_SERVICE_UPDATED", "reused HTTPS service bound to address: %1 port: %2 and updated TLS settings",
44+
"CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED", "failed to reused HTTP service bound to address: %1 port: %2",
45+
"CTRL_AGENT_HTTP_SERVICE_STARTED", "HTTP service bound to address: %1 port: %2",
46+
"CTRL_AGENT_HTTP_SERVICE_UPDATED", "reused HTTP service bound to address: %1 port: %2",
4547
"CTRL_AGENT_RUN_EXIT", "application is exiting the event loop",
4648
"CTRL_AGENT_STARTED", "Kea Control Agent version %1 started",
4749
NULL

‎src/bin/agent/ca_messages.h

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ extern const isc::log::MessageID CTRL_AGENT_HTTPS_SERVICE_STARTED;
2121
extern const isc::log::MessageID CTRL_AGENT_HTTPS_SERVICE_UPDATED;
2222
extern const isc::log::MessageID CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED;
2323
extern const isc::log::MessageID CTRL_AGENT_HTTP_SERVICE_STARTED;
24+
extern const isc::log::MessageID CTRL_AGENT_HTTP_SERVICE_UPDATED;
2425
extern const isc::log::MessageID CTRL_AGENT_RUN_EXIT;
2526
extern const isc::log::MessageID CTRL_AGENT_STARTED;
2627

‎src/bin/agent/ca_messages.mes

+9-5
Original file line numberDiff line numberDiff line change
@@ -43,31 +43,35 @@ error. The error was displayed and the configuration parsing resumed.
4343
This is a fatal error message issued when the Control Agent application
4444
encounters an unrecoverable error from within the event loop.
4545

46-
% CTRL_AGENT_HTTPS_SERVICE_REUSE_FAILED failed to reuse HTTPS service bound to address %1:%2
46+
% CTRL_AGENT_HTTPS_SERVICE_REUSE_FAILED failed to reuse HTTPS service bound to address: %1 port: %2
4747
This error message indicates that the server has failed reusing existing
4848
HTTPS service on the specified address and port. The server can not swith from
4949
HTTPS to HTTP sockets using the same address and port.
5050

51-
% CTRL_AGENT_HTTPS_SERVICE_STARTED HTTPS service bound to address %1:%2
51+
% CTRL_AGENT_HTTPS_SERVICE_STARTED HTTPS service bound to address: %1 port: %2
5252
This informational message indicates that the server has started HTTPS service
5353
on the specified address and port. All control commands should be sent to this
5454
address and port over a TLS channel.
5555

56-
% CTRL_AGENT_HTTPS_SERVICE_UPDATED reused HTTPS service bound to address %1:%2 and updated TLS settings
56+
% CTRL_AGENT_HTTPS_SERVICE_UPDATED reused HTTPS service bound to address: %1 port: %2 and updated TLS settings
5757
This informational message indicates that the server has reused existing
5858
HTTPS service on the specified address and port. Note that any change in
5959
the TLS setup has been applied.
6060

61-
% CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED failed to reused HTTP service bound to address %1:%2
61+
% CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED failed to reused HTTP service bound to address: %1 port: %2
6262
This error message indicates that the server has failed reusing existing
6363
HTTP service on the specified address and port. The server can not swith from
6464
HTTP to HTTPS sockets using the same address and port.
6565

66-
% CTRL_AGENT_HTTP_SERVICE_STARTED HTTP service bound to address %1:%2
66+
% CTRL_AGENT_HTTP_SERVICE_STARTED HTTP service bound to address: %1 port: %2
6767
This informational message indicates that the server has started HTTP service
6868
on the specified address and port. All control commands should be sent to this
6969
address and port.
7070

71+
% CTRL_AGENT_HTTP_SERVICE_UPDATED reused HTTP service bound to address: %1 port: %2
72+
This informational message indicates that the server has reused existing
73+
HTTP service on the specified address and port.
74+
7175
% CTRL_AGENT_RUN_EXIT application is exiting the event loop
7276
Logged at debug log level 0.
7377
This is a debug message issued when the Control Agent exits its

‎src/bin/agent/ca_process.cc

+17-8
Original file line numberDiff line numberDiff line change
@@ -162,18 +162,27 @@ CtrlAgentProcess::configure(isc::data::ConstElementPtr config_set,
162162
// Overwrite the authentication setup and the http headers in the response creator config.
163163
it->second->config_->setAuthConfig(ctx->getAuthConfig());
164164
it->second->config_->setHttpHeaders(ctx->getHttpHeaders());
165-
getIOService()->post([listener, tls_context]() { listener->setTlsContext(tls_context); });
165+
listener->setTlsContext(tls_context);
166166
LOG_INFO(agent_logger, CTRL_AGENT_HTTPS_SERVICE_UPDATED)
167167
.arg(server_address.toText())
168168
.arg(server_port);
169169
}
170-
} else if (!ctx->getTrustAnchor().empty()) {
171-
// Can not switch from HTTP to HTTPS
172-
LOG_ERROR(agent_logger, CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED)
173-
.arg(server_address.toText())
174-
.arg(server_port);
175-
isc_throw(BadValue,
176-
"Can not switch from HTTP to HTTPS sockets using the same address and port.");
170+
} else {
171+
if (!ctx->getTrustAnchor().empty()) {
172+
// Can not switch from HTTP to HTTPS
173+
LOG_ERROR(agent_logger, CTRL_AGENT_HTTP_SERVICE_REUSE_FAILED)
174+
.arg(server_address.toText())
175+
.arg(server_port);
176+
isc_throw(BadValue,
177+
"Can not switch from HTTP to HTTPS sockets using the same address and port.");
178+
} else {
179+
// Overwrite the authentication setup and the http headers in the response creator config.
180+
it->second->config_->setAuthConfig(ctx->getAuthConfig());
181+
it->second->config_->setHttpHeaders(ctx->getHttpHeaders());
182+
LOG_INFO(agent_logger, CTRL_AGENT_HTTP_SERVICE_UPDATED)
183+
.arg(server_address.toText())
184+
.arg(server_port);
185+
}
177186
}
178187
}
179188
// If the connection can be reused, mark it as usable.

‎src/bin/agent/tests/ca_controller_unittests.cc

+12
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,9 @@ TEST_F(CtrlAgentControllerTest, noListenerChangeHttp) {
421421
" }"
422422
"}";
423423

424+
// Pointer used to store the listener instance. It is set after 50 ms the
425+
// process has started (using a timer) and it's value is checked on server
426+
// shutdown using the callback.
424427
const HttpListener* listener_ptr = 0;
425428

426429
// This check callback is called before the shutdown.
@@ -522,6 +525,9 @@ TEST_F(CtrlAgentControllerTest, noListenerChangeHttps) {
522525
<< " }"
523526
<< "}";
524527

528+
// Pointer used to store the listener instance. It is set after 50 ms the
529+
// process has started (using a timer) and it's value is checked on server
530+
// shutdown using the callback.
525531
const HttpListener* listener_ptr = 0;
526532
TlsContext* context = 0;
527533

@@ -607,6 +613,9 @@ TEST_F(CtrlAgentControllerTest, handleHttpToHttpsSwitch) {
607613
<< " }"
608614
<< "}";
609615

616+
// Pointer used to store the listener instance. It is set after 50 ms the
617+
// process has started (using a timer) and it's value is checked on server
618+
// shutdown using the callback.
610619
const HttpListener* listener_ptr = 0;
611620

612621
// This check callback is called before the shutdown.
@@ -703,6 +712,9 @@ TEST_F(CtrlAgentControllerTest, handleHttpsToHttpSwitch) {
703712
<< " }"
704713
<< "}";
705714

715+
// Pointer used to store the listener instance. It is set after 50 ms the
716+
// process has started (using a timer) and it's value is checked on server
717+
// shutdown using the callback.
706718
const HttpListener* listener_ptr = 0;
707719
TlsContext* context = 0;
708720

‎src/lib/config/config_messages.cc

+9-7
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ extern const isc::log::MessageID COMMAND_WATCH_SOCKET_MARK_READY_ERROR = "COMMAN
3737
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED = "HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED";
3838
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED = "HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED";
3939
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED = "HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED";
40+
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTP_SERVICE_UPDATED = "HTTP_COMMAND_MGR_HTTP_SERVICE_UPDATED";
4041
extern const isc::log::MessageID HTTP_COMMAND_MGR_SERVICE_STARTED = "HTTP_COMMAND_MGR_SERVICE_STARTED";
4142
extern const isc::log::MessageID HTTP_COMMAND_MGR_SERVICE_STOPPING = "HTTP_COMMAND_MGR_SERVICE_STOPPING";
4243

@@ -50,9 +51,9 @@ const char* values[] = {
5051
"COMMAND_DEREGISTERED", "Command %1 deregistered",
5152
"COMMAND_EXTENDED_REGISTERED", "Command %1 registered",
5253
"COMMAND_HTTP_LISTENER_COMMAND_REJECTED", "Command HTTP listener rejected command '%1' from '%2'",
53-
"COMMAND_HTTP_LISTENER_STARTED", "Command HTTP listener started with %1 threads, listening on %2:%3, use TLS: %4",
54-
"COMMAND_HTTP_LISTENER_STOPPED", "Command HTTP listener for %1:%2 stopped.",
55-
"COMMAND_HTTP_LISTENER_STOPPING", "Stopping Command HTTP listener for %1:%2",
54+
"COMMAND_HTTP_LISTENER_STARTED", "Command HTTP listener started with %1 threads, listening on address: %2 port: %3, use TLS: %4",
55+
"COMMAND_HTTP_LISTENER_STOPPED", "Command HTTP listener for address: %1 port: %2 stopped.",
56+
"COMMAND_HTTP_LISTENER_STOPPING", "Stopping Command HTTP listener for address: %1 port: %2",
5657
"COMMAND_PROCESS_ERROR1", "Error while processing command: %1",
5758
"COMMAND_PROCESS_ERROR2", "Error while processing command: %1",
5859
"COMMAND_RECEIVED", "Received command '%1'",
@@ -73,10 +74,11 @@ const char* values[] = {
7374
"COMMAND_WATCH_SOCKET_CLEAR_ERROR", "watch socket failed to clear: %1",
7475
"COMMAND_WATCH_SOCKET_CLOSE_ERROR", "watch socket failed to close: %1",
7576
"COMMAND_WATCH_SOCKET_MARK_READY_ERROR", "watch socket failed to mark ready: %1",
76-
"HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED", "failed to reused HTTPS service bound to address %1:%2",
77-
"HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED", "reused HTTPS service bound to address %1:%2 and updated TLS settings",
78-
"HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED", "failed to reused HTTP service bound to address %1:%2",
79-
"HTTP_COMMAND_MGR_SERVICE_STARTED", "started %1 service bound to address %2 port %3",
77+
"HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED", "failed to reused HTTPS service bound to address: %1 port: %2",
78+
"HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED", "reused HTTPS service bound to address: %1 port: %2 and updated TLS settings",
79+
"HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED", "failed to reused HTTP service bound to address: %1 port: %2",
80+
"HTTP_COMMAND_MGR_HTTP_SERVICE_UPDATED", "reused HTTP service bound to address: %1 port: %2",
81+
"HTTP_COMMAND_MGR_SERVICE_STARTED", "started %1 service bound to address: %2 port: %3",
8082
"HTTP_COMMAND_MGR_SERVICE_STOPPING", "Server is stopping %1 service %2",
8183
NULL
8284
};

‎src/lib/config/config_messages.h

+1
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ extern const isc::log::MessageID COMMAND_WATCH_SOCKET_MARK_READY_ERROR;
3838
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED;
3939
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED;
4040
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED;
41+
extern const isc::log::MessageID HTTP_COMMAND_MGR_HTTP_SERVICE_UPDATED;
4142
extern const isc::log::MessageID HTTP_COMMAND_MGR_SERVICE_STARTED;
4243
extern const isc::log::MessageID HTTP_COMMAND_MGR_SERVICE_STOPPING;
4344

‎src/lib/config/config_messages.mes

+11-7
Original file line numberDiff line numberDiff line change
@@ -30,20 +30,20 @@ Logged at debug log level 10.
3030
This debug messages is issued when a command is rejected. Arguments detail
3131
the command and the address the request was received from.
3232

33-
% COMMAND_HTTP_LISTENER_STARTED Command HTTP listener started with %1 threads, listening on %2:%3, use TLS: %4
33+
% COMMAND_HTTP_LISTENER_STARTED Command HTTP listener started with %1 threads, listening on address: %2 port: %3, use TLS: %4
3434
Logged at debug log level 10.
3535
This debug messages is issued when an HTTP listener has been started to
3636
accept connections from Command API clients through which commands can be
3737
received and responses sent. Arguments detail the number of threads
3838
that the listener is using, the address and port at which it is listening,
3939
and if HTTPS/TLS is used or not.
4040

41-
% COMMAND_HTTP_LISTENER_STOPPED Command HTTP listener for %1:%2 stopped.
41+
% COMMAND_HTTP_LISTENER_STOPPED Command HTTP listener for address: %1 port: %2 stopped.
4242
Logged at debug log level 10.
4343
This debug messages is issued when the Command HTTP listener, listening
4444
at the given address and port, has completed shutdown.
4545

46-
% COMMAND_HTTP_LISTENER_STOPPING Stopping Command HTTP listener for %1:%2
46+
% COMMAND_HTTP_LISTENER_STOPPING Stopping Command HTTP listener for address: %1 port: %2
4747
Logged at debug log level 10.
4848
This debug messages is issued when the Command HTTP listener, listening
4949
at the given address and port, has begun to shutdown.
@@ -153,22 +153,26 @@ ready status after scheduling asynchronous send. This is programmatic error
153153
that should be reported. The command manager may or may not continue
154154
to operate correctly.
155155

156-
% HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED failed to reused HTTPS service bound to address %1:%2
156+
% HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED failed to reused HTTPS service bound to address: %1 port: %2
157157
This error message indicates that the server has failed reusing existing
158158
HTTPS service on the specified address and port. The server can not swith from
159159
HTTPS to HTTP sockets using the same address and port.
160160

161-
% HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED reused HTTPS service bound to address %1:%2 and updated TLS settings
161+
% HTTP_COMMAND_MGR_HTTPS_SERVICE_UPDATED reused HTTPS service bound to address: %1 port: %2 and updated TLS settings
162162
This informational message indicates that the server has reused existing
163163
HTTPS service on the specified address and port. Note that any change in
164164
the TLS setup has been applied.
165165

166-
% HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED failed to reused HTTP service bound to address %1:%2
166+
% HTTP_COMMAND_MGR_HTTP_SERVICE_UPDATED reused HTTP service bound to address: %1 port: %2
167+
This informational message indicates that the server has reused existing
168+
HTTP service on the specified address and port.
169+
170+
% HTTP_COMMAND_MGR_HTTP_SERVICE_REUSE_FAILED failed to reused HTTP service bound to address: %1 port: %2
167171
This error message indicates that the server has failed reusing existing
168172
HTTP service on the specified address and port. The server can not swith from
169173
HTTP to HTTPS sockets using the same address and port.
170174

171-
% HTTP_COMMAND_MGR_SERVICE_STARTED started %1 service bound to address %2 port %3
175+
% HTTP_COMMAND_MGR_SERVICE_STARTED started %1 service bound to address: %2 port: %3
172176
This informational message indicates that the server has started
173177
HTTP/HTTPS service on the specified address and port for receiving
174178
control commands.

0 commit comments

Comments
 (0)