feat: [stable-8.2][OCISDEV-1115] harden nats communication

pkg/auth/manager/publicshares/publicshares.go

@@ -61,6 +61,9 @@ type config struct {
 	StoreTable            string        `mapstructure:"store_table"`
 	StoreUsername         string        `mapstructure:"store_username"`
 	StorePassword         string        `mapstructure:"store_password"`
+	StoreEnableTLS        bool          `mapstructure:"store_enable_tls"`
+	StoreTLSInsecure      bool          `mapstructure:"store_tls_insecure"`
+	StoreTLSRootCACert    string        `mapstructure:"store_tls_root_ca_certificate"`
 }
 
 func parseConfig(m map[string]interface{}) (*config, error) {
@@ -86,6 +89,7 @@ func New(m map[string]interface{}) (auth.Manager, error) {
 		microstore.Database(mgr.c.StoreDatabase),
 		microstore.Table(mgr.c.StoreTable),
 		store.Authentication(mgr.c.StoreUsername, mgr.c.StorePassword),
+		store.TLS(mgr.c.StoreEnableTLS, mgr.c.StoreTLSInsecure, mgr.c.StoreTLSRootCACert),
 	)
 	mgr.bfp = NewBruteForceProtection(revaStore, mgr.c.BruteForceTimeGap, mgr.c.BruteForceMaxAttempts)
 	return mgr, nil

pkg/storage/cache/cache.go

@@ -21,6 +21,7 @@ package cache
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -51,6 +52,9 @@ type Config struct {
 	DisablePersistence bool          `mapstructure:"cache_disable_persistence"`
 	AuthUsername       string        `mapstructure:"cache_auth_username"`
 	AuthPassword       string        `mapstructure:"cache_auth_password"`
+	EnableTLS          bool          `mapstructure:"cache_enable_tls"`
+	TLSInsecure        bool          `mapstructure:"cache_tls_insecure"`
+	TLSRootCACert      string        `mapstructure:"cache_tls_root_ca_certificate"`
 }
 
 // Cache handles key value operations on caches
@@ -86,13 +90,19 @@ type FileMetadataCache interface {
 	RemoveMetadata(path string) error
 }
 
+func cacheKey(cfg Config) string {
+	return strings.Join(append(append([]string{cfg.Store}, cfg.Nodes...),
+		cfg.Database, cfg.Table,
+		strconv.FormatBool(cfg.EnableTLS)+":"+strconv.FormatBool(cfg.TLSInsecure)+":"+cfg.TLSRootCACert), ":")
+}
+
 // GetStatCache will return an existing StatCache for the given store, nodes, database and table
 // If it does not exist yet it will be created, different TTLs are ignored
 func GetStatCache(cfg Config) StatCache {
 	mutex.Lock()
 	defer mutex.Unlock()
 
-	key := strings.Join(append(append([]string{cfg.Store}, cfg.Nodes...), cfg.Database, cfg.Table), ":")
+	key := cacheKey(cfg)
 	if statCaches[key] == nil {
 		statCaches[key] = NewStatCache(cfg)
 	}
@@ -105,7 +115,7 @@ func GetProviderCache(cfg Config) ProviderCache {
 	mutex.Lock()
 	defer mutex.Unlock()
 
-	key := strings.Join(append(append([]string{cfg.Store}, cfg.Nodes...), cfg.Database, cfg.Table), ":")
+	key := cacheKey(cfg)
 	if providerCaches[key] == nil {
 		providerCaches[key] = NewProviderCache(cfg)
 	}
@@ -118,7 +128,7 @@ func GetFileMetadataCache(cfg Config) FileMetadataCache {
 	mutex.Lock()
 	defer mutex.Unlock()
 
-	key := strings.Join(append(append([]string{cfg.Store}, cfg.Nodes...), cfg.Database, cfg.Table), ":")
+	key := cacheKey(cfg)
 	if fileMetadataCaches[key] == nil {
 		fileMetadataCaches[key] = NewFileMetadataCache(cfg)
 	}
@@ -202,5 +212,6 @@ func getStore(cfg Config) microstore.Store {
 		store.Size(cfg.Size),
 		store.DisablePersistence(cfg.DisablePersistence),
 		store.Authentication(cfg.AuthUsername, cfg.AuthPassword),
+		store.TLS(cfg.EnableTLS, cfg.TLSInsecure, cfg.TLSRootCACert),
 	)
 }

pkg/storage/fs/posix/lookup/store_idcache.go

@@ -44,6 +44,7 @@ func NewStoreIDCache(o *options.Options) *StoreIDCache {
 			microstore.Table(o.IDCache.Table),
 			store.DisablePersistence(o.IDCache.DisablePersistence),
 			store.Authentication(o.IDCache.AuthUsername, o.IDCache.AuthPassword),
+			store.TLS(o.IDCache.EnableTLS, o.IDCache.TLSInsecure, o.IDCache.TLSRootCACert),
 		),
 	}
 }

pkg/storage/fs/posix/posix.go

@@ -112,6 +112,7 @@ func New(m map[string]interface{}, stream events.Stream, log *zerolog.Logger) (s
 		microstore.Table(o.IDCache.Table),
 		store.DisablePersistence(o.IDCache.DisablePersistence),
 		store.Authentication(o.IDCache.AuthUsername, o.IDCache.AuthPassword),
+		store.TLS(o.IDCache.EnableTLS, o.IDCache.TLSInsecure, o.IDCache.TLSRootCACert),
 	), log)
 	if err != nil {
 		return nil, err

pkg/storage/utils/decomposedfs/decomposedfs.go

@@ -163,6 +163,7 @@ func NewDefault(m map[string]interface{}, bs tree.Blobstore, es events.Stream, l
 		microstore.Table(o.IDCache.Table),
 		store.DisablePersistence(o.IDCache.DisablePersistence),
 		store.Authentication(o.IDCache.AuthUsername, o.IDCache.AuthPassword),
+		store.TLS(o.IDCache.EnableTLS, o.IDCache.TLSInsecure, o.IDCache.TLSRootCACert),
 	), log)
 
 	permissionsSelector, err := pool.PermissionsSelector(o.PermissionsSVC, pool.WithTLSMode(o.PermTLSMode))

pkg/store/options.go

@@ -25,6 +25,8 @@ import (
 	"go-micro.dev/v4/store"
 )
 
+type tlsContextKey struct{}
+
 type typeContextKey struct{}
 
 // Store determines the implementation:
@@ -103,3 +105,21 @@ func Authentication(username, password string) store.Option {
 		o.Context = context.WithValue(o.Context, authenticationContextKey{}, []string{username, password})
 	}
 }
+
+type tlsOptions struct {
+	enable     bool
+	insecure   bool
+	rootCACert string
+}
+
+// TLS configures TLS for the nats-js and nats-js-kv store backends.
+// enable activates TLS; insecure skips certificate verification (for self-signed certs);
+// rootCACert is an optional path to a PEM file used to validate the server certificate.
+func TLS(enable bool, insecure bool, rootCACert string) store.Option {
+	return func(o *store.Options) {
+		if o.Context == nil {
+			o.Context = context.Background()
+		}
+		o.Context = context.WithValue(o.Context, tlsContextKey{}, tlsOptions{enable, insecure, rootCACert})
+	}
+}

pkg/store/store.go

@@ -20,6 +20,9 @@ package store
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"os"
 	"strings"
 	"time"
 
@@ -66,6 +69,12 @@ func Create(opts ...microstore.Option) microstore.Store {
 
 	storeType, _ := options.Context.Value(typeContextKey{}).(string)
 
+	if tlsOpts, ok := options.Context.Value(tlsContextKey{}).(tlsOptions); ok && tlsOpts.enable &&
+		storeType != TypeNatsJS && storeType != TypeNatsJSKV {
+		logger.Logf(logger.WarnLevel,
+			"reva-store: TLS requested but store type %q does not support TLS — settings ignored", storeType)
+	}
+
 	switch storeType {
 	case TypeNoop:
 		return microstore.NewNoopStore(opts...)
@@ -174,6 +183,10 @@ func defaultNatsOptions(options *microstore.Options) nats.Options {
 		natsOptions.User = auth[0]
 		natsOptions.Password = auth[1]
 	}
+	if tlsOpts, ok := options.Context.Value(tlsContextKey{}).(tlsOptions); ok && tlsOpts.enable {
+		natsOptions.TLSConfig = BuildNatsTLSConfig(tlsOpts.insecure, tlsOpts.rootCACert)
+		natsOptions.Secure = true
+	}
 	natsOptions.DisconnectedErrCB = func(_ *nats.Conn, err error) {
 		logger.Logf(logger.WarnLevel, "reva-store: nats connection disconnected: %v", err)
 	}
@@ -185,3 +198,25 @@ func defaultNatsOptions(options *microstore.Options) nats.Options {
 	}
 	return natsOptions
 }
+
+// BuildNatsTLSConfig constructs a tls.Config for NATS client connections.
+// insecure skips certificate verification; rootCACert is an optional path to a
+// PEM file whose CA is used to validate the server certificate.
+func BuildNatsTLSConfig(insecure bool, rootCACert string) *tls.Config {
+	tlsConf := &tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: insecure} //nolint:gosec
+	if rootCACert != "" {
+		b, err := os.ReadFile(rootCACert)
+		if err != nil {
+			logger.Logf(logger.WarnLevel, "reva-store: failed to read TLS root CA cert %q: %v", rootCACert, err)
+		} else {
+			pool := x509.NewCertPool()
+			if pool.AppendCertsFromPEM(b) {
+				tlsConf.RootCAs = pool
+				tlsConf.InsecureSkipVerify = false
+			} else {
+				logger.Logf(logger.WarnLevel, "reva-store: no valid PEM certificates found in %q", rootCACert)
+			}
+		}
+	}
+	return tlsConf
+}