Add Redis TLS for acra tokens tool

.circleci/check_configs.sh

@@ -3,7 +3,7 @@
 function compare_configs() {
     folder_a=$1
     folder_b=$2
-    binaries=(server translator rollback keymaker poisonrecordmaker rotate)
+    binaries=(server translator rollback keymaker poisonrecordmaker rotate tokens backup keys)
     for cmd in "${binaries[@]}"; do
      cmp ${folder_a}/acra-${cmd}.yaml ${folder_b}/acra-${cmd}.yaml
      cmp_status="$?"

cmd/acra-tokens/tokens/token-storage.go

@@ -17,8 +17,10 @@
 package tokens
 
 import (
+	"crypto/tls"
 	"errors"
 	"flag"
+	"github.com/cossacklabs/acra/network"
 	"os"
 
 	"github.com/cossacklabs/acra/cmd"
@@ -77,11 +79,23 @@ func (p *CommonTokenStorageParameters) Open(flagSet *flag.FlagSet) (tokenCommon.
 		return tokenStorage.NewBoltDBTokenStorage(db), nil
 	}
 	if redisOptions := cmd.ParseRedisCLIParametersFromFlags(flagSet, ""); redisOptions.KeysConfigured() {
-		redisClient, err := tokenStorage.NewRedisClient(redisOptions.HostPort, redisOptions.Password, redisOptions.DBTokens, nil)
+		var redisTLSConfig *tls.Config
+		var err error
+
+		if redisOptions.TLSEnable {
+			redisTLSConfig, err = network.NewTLSConfigByName(flagSet, "redis", redisOptions.HostPort, network.ClientNameConstructorFunc())
+			if err != nil {
+				log.WithError(err).Errorln("Can't initialize tls config for redis client")
+				return nil, err
+			}
+		}
+
+		redisClient, err := tokenStorage.NewRedisClient(redisOptions.HostPort, redisOptions.Password, redisOptions.DBTokens, redisTLSConfig)
 		if err != nil {
 			log.WithError(err).Warn("Cannot initialize Redis client")
 			return nil, err
 		}
+
 		storage, err := tokenStorage.NewRedisStorage(redisClient)
 		if err != nil {
 			log.WithError(err).Warn("Cannot initialize Redis token storage")

cmd/acra-tokens/tokens/token_storage_redis_tls_test.go

@@ -0,0 +1,64 @@
+//go:build integration && redis && tls
+// +build integration,redis,tls
+
+package tokens
+
+import (
+	"flag"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/cossacklabs/acra/cmd"
+	"github.com/cossacklabs/acra/utils/tests"
+)
+
+func TestTokensStatusWithTLSRedis(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("Expected no panics in command")
+		}
+	}()
+
+	hostport := os.Getenv("TEST_REDIS_HOSTPORT")
+	if hostport == "" {
+		hostport = "localhost:6380"
+	}
+	password := os.Getenv("TEST_REDIS_PASSWORD")
+	if password == "" {
+		password = ""
+	}
+
+	dbNum := os.Getenv("TEST_REDIS_DB")
+	if dbNum == "" {
+		dbNum = "0"
+	}
+
+	flagSet := flag.NewFlagSet("status", flag.ContinueOnError)
+	cmd.RegisterRedisTokenStoreParametersWithPrefix(flagSet, "", "")
+
+	workingDirectory := tests.GetSourceRootDirectory(t)
+	flagsToSet := map[string]string{
+		"redis_host_port":                 hostport,
+		"redis_password":                  password,
+		"redis_db_tokens":                 dbNum,
+		"redis_tls_enable":                "true",
+		"redis_tls_client_ca":             filepath.Join(workingDirectory, "tests/ssl/ca/ca.crt"),
+		"redis_tls_client_key":            filepath.Join(workingDirectory, "tests/ssl/acra-writer/acra-writer.key"),
+		"redis_tls_client_cert":           filepath.Join(workingDirectory, "tests/ssl/acra-writer/acra-writer.crt"),
+		"redis_tls_crl_client_from_cert":  "ignore",
+		"redis_tls_ocsp_client_from_cert": "ignore",
+	}
+
+	for flag, value := range flagsToSet {
+		if err := flagSet.Set(flag, value); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	statusSubCommand := &StatusSubcommand{
+		flagSet: flagSet,
+	}
+
+	statusSubCommand.Execute()
+}

cmd/redis.go

@@ -93,9 +93,10 @@ func RegisterRedisTokenStoreParametersWithPrefix(flags *flag.FlagSet, prefix str
 	if flags.Lookup(prefix+"redis_host_port") == nil {
 		flags.String(prefix+"redis_host_port", "", "<host>:<port> used to connect to Redis"+description)
 		flags.String(prefix+"redis_password", "", "Password to Redis database"+description)
+		flags.Bool(prefix+"redis_tls_enable", false, "Use TLS to connect to Redis"+description)
 	}
 	if flags.Lookup(prefix+network.ClientNameConstructorFunc()("redis", "cert", "")) == nil {
-		network.RegisterTLSArgsForService(flags, true, "redis", network.ClientNameConstructorFunc())
+		network.RegisterTLSArgsForService(flags, true, prefix+"redis", network.ClientNameConstructorFunc())
 	}
 	flags.Int(prefix+"redis_db_tokens", redisDefaultDB, "Number of Redis database for tokens"+description)
 	checkBothKeyAndToken(flags, prefix)

configs/acra-tokens.yaml

@@ -59,6 +59,9 @@ redis_tls_crl_client_from_cert: prefer
 # URL of the Certificate Revocation List (CRL) to use
 redis_tls_crl_client_url: 
 
+# Use TLS to connect to Redis
+redis_tls_enable: false
+
 # Put 'true' to check only final/last certificate, or 'false' to check the whole certificate chain using OCSP
 redis_tls_ocsp_client_check_only_leaf_certificate: false