Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) + FIPS Support based on BoringSSL #373

pavelnemirovsky · 2023-11-16T17:38:41Z

Scope of change;

Reopened pull request based on Session_timeout bug fix & Local Build Process fixup #119 and continuation of Sticky Sessions: Tolerate ClickHouse Session ID Mechanism #117.
Add make release-build-docker-fips to be able to build FIPS version of ClickHouse Proxy

…ue to Datadog lib)

# Conflicts: # Dockerfile # Makefile # main_test.go # proxy.go

pavelnemirovsky · 2023-11-17T09:29:31Z

Guys, I am going to add in this PR FIPS 140-2 support based on Borring SSL as well. (Don't review yet)

pavelnemirovsky · 2023-11-19T08:34:17Z

@sigua-cs PING

mga-chka · 2023-11-20T16:02:16Z

FYI, don't mind the ci error. Your PR is correct and pass the tests, it just that I broke the ci recently to improve our code coverage tracking.
All the maintainers are a bit busy so we might take time to review the PR.

pavelnemirovsky · 2023-11-21T15:11:50Z

@mga-chka understood, thx let's try to push forward since the originally provided functionally is not properly covered by tests now.

Blokje5 · 2023-11-24T10:42:36Z

@pavelnemirovsky if I understand correctly this is two PRs in one:

CH Sticky Sessions
Fips support

Would you be able to seperate the PRs? That leads to a cleaner commit history and will make it easier to review.

pavelnemirovsky · 2023-11-29T11:25:15Z

@Blokje5 Practically speaking, it is one PR PR since FIPS 140-2 is just a mode in Makefile that allows to compile ClickHouse Proxy with BorringSSL, so I suggest merging it that way.

pavelnemirovsky · 2023-11-29T11:26:38Z

Do you want me to add some documentation regarding the ability to build FIPS version of the app?

Blokje5 · 2023-11-29T13:12:31Z

@pavelnemirovsky If you would add some documentation regarding the new build that would be great 👍 .

pavelnemirovsky · 2023-12-17T17:52:27Z

@sigua-cs @Blokje5 @mga-chka documentation has been updated. Please check, and let's merge it.

pavelnemirovsky · 2023-12-18T21:32:50Z

@sigua-cs @Blokje5 @mga-chka PING

mga-chka · 2024-01-03T16:31:47Z

Sorry for the long delay but we were all off. We'll have a look this week. Can you fix the conflict while we review the PR?

mga-chka · 2024-01-03T23:17:19Z

Hi, I took a first look.
The go part regarding the sessionId looks ok.
I'm quite rusty regarding docker so I might be wrong (the last time I touched a docker file was 8 years ago). But, from what I get, there are some problems:

you're fixing the go version to 1.21 whereas we're setting another value in the release workflow for the moment the version is 1.19, so there is no issue, but the day we need a 1.22+, we'll likely produce failing docker images since there are no tests relating to docker image generation
the change in the Makefile makes the file Dockerfile not used anymore, why keeping it?
in the 2 new Dockerfiles, you rely on a golang:${GO_VER}-alpine image, which is experimental cf docker hub This variant is highly experimental, and not officially supported by the Go project (see [golang/go#19938](https://github.com/golang/go/issues/19938) for details). whereas the previous image we were using a rock solid debian image
the new images don't install the packages ca-certificates and curl, are they already included in the alpine image?

mga-chka · 2024-01-15T13:38:30Z

@pavelnemirovsky (I'm pinging you just in case you didn't see my previous msgs)

sconnole · 2024-10-17T21:17:06Z

I created a new PR for this issue here: #481

UPDATE

Pavel gave me write permission, so all changes will be here.

Added tests for dockerfile to ensure that GoVersions in dockerfiles stay in sync with Go.mod version. Updated dockerfile to use a more reliable base image. Install ca-certificates and curl

sconnole · 2024-10-23T20:37:37Z

@sigua-cs @Blokje5 @mga-chka Pinging this on behalf of Pavel

mga-chka · 2024-10-30T07:02:32Z

FYI we're in the middle of the holiday in France so most of the maintainer are off, which is why we're not very responsive.
Expect a review in 1-3 weeks (because we will have our yearly contentsquare hackathon once we're not off)

pavelnemirovsky · 2024-11-17T08:20:19Z

@mga-chka I hope your holiday went great; any update?

mga-chka · 2024-12-12T12:56:32Z

sorry for the long delay. I took a quick look at the full PR and you didn't take into account my comment from Jan 4

sconnole · 2024-12-12T16:22:11Z

@mga-chka

sorry for the long delay. I took a quick look at the full PR and you didn't take into account my comment from Jan 4

No stress on the delay. I have added the following changes in the PR that address these comments.

you're fixing the go version to 1.21 whereas we're setting another value in the release workflow for the moment the version is 1.19, so there is no issue, but the day we need a 1.22+, we'll likely produce failing docker images since there are no tests relating to docker image generation

I added the file dockerfile_version_test.go to for testing the dockerfile version is matching the version in go.mod.

the change in the Makefile makes the file Dockerfile not used anymore, why keeping it?

Updated the dockerfile so the default Dockerfile is used

in the 2 new Dockerfiles, you rely on a golang:${GO_VER}-alpine image, which is experimental cf docker hub This variant is highly experimental, and not officially supported by the Go project (see golang/go#19938 for details). whereas the previous image we were using a rock solid debian image

Changed to using FROM golang:${GO_VERSION} AS build instead of the alpine image. I believe the apline image was being used because it's a smaller image.

the new images don't install the packages ca-certificates and curl, are they already included in the alpine image?

Added these packages back in.

pavelnemirovsky added 19 commits May 12, 2021 22:23

Adjusted logic

51aabb9

Error handling

8d905da

tests

669e5a7

Adjust

881b17a

session_id

fc7db12

test adjustment

444a437

session_timeout logic

4f7a4e8

session_timeout tests

2ebaa88

header test

14fc89f

cleaning unused code

26ca1f5

handling session_id verification

dce7872

Ability to build version under Docker (Native go build doesn't work d…

456d694

…ue to Datadog lib)

Error handling in Makefile

eca0b6c

Merge https://github.com/Vertamedia/chproxy

eb5aa66

Bump to newer go + make sure static linking works correctly

4304395

Session_id typo fix

e5d9dca

Adjust tests for session-name and session-timeout

15a7609

Merge remote-tracking branch 'origin/master'

7ef6f48

# Conflicts: # Dockerfile # Makefile # main_test.go # proxy.go

Adjust tests for session-name and session-timeout

b3fb12b

pavelnemirovsky changed the title ~~Session_timeout bug fix & Local Build Process fixup~~ Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) Nov 17, 2023

Adjust tests for session-name and session-timeout

f1e4b68

pavelnemirovsky changed the title ~~Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage)~~ Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) + FIPS Support based on BoringSSL Nov 17, 2023

Adjust tests for session-name and session-timeout

028c67d

FIPS and Session_ID Documentation

4798d96

sconnole mentioned this pull request Oct 17, 2024

feat: sticky-sessions and fips support #481

Closed

13 tasks

chore: update dockerfile, add tests for dockerfile

d3f1dd8

Added tests for dockerfile to ensure that GoVersions in dockerfiles stay in sync with Go.mod version. Updated dockerfile to use a more reliable base image. Install ca-certificates and curl

chore: remove more vulnerabilities

7d7fc26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) + FIPS Support based on BoringSSL #373

Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) + FIPS Support based on BoringSSL #373

pavelnemirovsky commented Nov 16, 2023 •

edited

Loading

pavelnemirovsky commented Nov 17, 2023

pavelnemirovsky commented Nov 19, 2023

mga-chka commented Nov 20, 2023 •

edited

Loading

pavelnemirovsky commented Nov 21, 2023 •

edited

Loading

Blokje5 commented Nov 24, 2023

pavelnemirovsky commented Nov 29, 2023

pavelnemirovsky commented Nov 29, 2023

Blokje5 commented Nov 29, 2023

pavelnemirovsky commented Dec 17, 2023

pavelnemirovsky commented Dec 18, 2023

mga-chka commented Jan 3, 2024 •

edited

Loading

mga-chka commented Jan 3, 2024

mga-chka commented Jan 15, 2024

sconnole commented Oct 17, 2024 •

edited

Loading

sconnole commented Oct 23, 2024

mga-chka commented Oct 30, 2024

pavelnemirovsky commented Nov 17, 2024

mga-chka commented Dec 12, 2024

sconnole commented Dec 12, 2024

Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) + FIPS Support based on BoringSSL #373

Are you sure you want to change the base?

Sticky Sessions: Tolerate ClickHouse Session ID Mechanism (Better Tests Coverage) + FIPS Support based on BoringSSL #373

Conversation

pavelnemirovsky commented Nov 16, 2023 • edited Loading

pavelnemirovsky commented Nov 17, 2023

pavelnemirovsky commented Nov 19, 2023

mga-chka commented Nov 20, 2023 • edited Loading

pavelnemirovsky commented Nov 21, 2023 • edited Loading

Blokje5 commented Nov 24, 2023

pavelnemirovsky commented Nov 29, 2023

pavelnemirovsky commented Nov 29, 2023

Blokje5 commented Nov 29, 2023

pavelnemirovsky commented Dec 17, 2023

pavelnemirovsky commented Dec 18, 2023

mga-chka commented Jan 3, 2024 • edited Loading

mga-chka commented Jan 3, 2024

mga-chka commented Jan 15, 2024

sconnole commented Oct 17, 2024 • edited Loading

sconnole commented Oct 23, 2024

mga-chka commented Oct 30, 2024

pavelnemirovsky commented Nov 17, 2024

mga-chka commented Dec 12, 2024

sconnole commented Dec 12, 2024

pavelnemirovsky commented Nov 16, 2023 •

edited

Loading

mga-chka commented Nov 20, 2023 •

edited

Loading

pavelnemirovsky commented Nov 21, 2023 •

edited

Loading

mga-chka commented Jan 3, 2024 •

edited

Loading

sconnole commented Oct 17, 2024 •

edited

Loading