passthru sage requests. better cert name.

bubble-server/src/main/java/bubble/resources/account/AuthResource.java

@@ -535,7 +535,7 @@ public class AuthResource {
         if (type == null) type = CertType.pem;
         final BubbleNetwork thisNet = configuration.getThisNetwork();
         if (thisNet == null) return die("getCaCert: thisNetwork was null");
-        final File certFile = new File(CACERTS_DIR, thisNet.getNetworkDomain()+"-ca-cert."+type.name());
+        final File certFile = new File(CACERTS_DIR, "bubble-"+thisNet.getShortId()+"-ca-cert."+type.name());
         if (!certFile.exists()) return notFound(type.name());
         return send(new FileSendableResource(certFile).setForceDownload(true));
     }

bubble-server/src/main/java/bubble/service/cloud/AnsiblePrepService.java

@@ -113,10 +113,10 @@ public class AnsiblePrepService {
 
         // if this is a fork, and current server is local, then sage will be self
         if (fork && configuration.getThisNode().localIp4()) {
-            ctx.put("sageNode", node.getUuid());
+            ctx.put("sageNode", node);
         } else {
             // otherwise, sage will be us, the node that is launching the new node
-            ctx.put("sageNode", configuration.getThisNode().getUuid());
+            ctx.put("sageNode", configuration.getThisNode());
         }
 
         final File rolesDir = new File(automation, "roles");

bubble-server/src/main/resources/ansible/roles/bubble/files/bubble_role.json

@@ -6,7 +6,7 @@
     {"name": "admin_port", "value": "[[node.adminPort]]"},
     {"name": "ssl_port", "value": "[[node.sslPort]]"},
     {"name": "public_base_uri", "value": "[[publicBaseUri]]"},
-    {"name": "sage_node", "value": "[[sageNode]]"},
+    {"name": "sage_node", "value": "[[sageNode.uuid]]"},
     {"name": "install_type", "value": "[[installType]]"},
     {"name": "promo_code_policy", "value": "[[#compare fork '==' true]][[configuration.promoCodePolicy]][[else]]disabled[[/compare]]"},
     {"name": "default_locale", "value": "[[network.locale]]"},

bubble-server/src/main/resources/ansible/roles/mitmproxy/files/bubble_role.json

@@ -5,6 +5,10 @@
     {"name": "bubble_network", "value": "[[node.network]]"},
     {"name": "server_name", "value": "[[node.fqdn]]"},
     {"name": "server_alias", "value": "[[network.networkDomain]]"},
-    {"name": "ssl_port", "value": "[[node.sslPort]]"}
+    {"name": "ssl_port", "value": "[[node.sslPort]]"},
+    {"name": "sage_host", "value": "[[sageNode.fqdn]]"},
+    {"name": "sage_ip4", "value": "[[sageNode.ip4]]"},
+    {"name": "sage_ip6", "value": "[[sageNode.ip6]]"},
+    {"name": "cert_name", "value": "bubble-[[network.shortId]]"}
   ]
 }

bubble-server/src/main/resources/ansible/roles/mitmproxy/tasks/main.yml

@@ -2,7 +2,7 @@
 # Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
 #
 - name: Set the cert name
-  shell: set_cert_name.sh /home/mitmproxy/mitmproxy {{ server_alias }}
+  shell: set_cert_name.sh /home/mitmproxy/mitmproxy {{ cert_name }}
 
 - name: Reuse bubble mitm certs if available
   shell: reuse_bubble_mitm_certs.sh

bubble-server/src/main/resources/ansible/roles/mitmproxy/templates/bubble_config.py.j2

@@ -3,3 +3,6 @@ bubble_port = '{{ admin_port }}';
 bubble_host = '{{ server_name }}'
 bubble_host_alias = '{{ server_alias }}'
 bubble_ssl_port = '{{ ssl_port }}'
+bubble_sage_host = '{{ sage_host }}'
+bubble_sage_ip4 = '{{ sage_ip4 }}'
+bubble_sage_ip6 = '{{ sage_ip6 }}'

bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_config.py

@@ -1,8 +0,0 @@
-#
-# Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
-#
-bubble_network = '{{ bubble_network }}'
-bubble_port = '{{ admin_port }}';
-bubble_host = '{{ server_name }}'
-bubble_host_alias = '{{ server_alias }}'
-bubble_ssl_port = '{{ ssl_port }}'

bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_passthru.py

@@ -27,6 +27,7 @@ from mitmproxy.proxy.protocol import TlsLayer, RawTCPLayer
 from mitmproxy.exceptions import TlsProtocolException
 
 from bubble_api import bubble_log, bubble_passthru, bubble_activity_log, redis_set
+from bubble_config import bubble_sage_host, bubble_sage_ip4, bubble_sage_ip6
 import redis
 import json
 import subprocess
@@ -60,6 +61,10 @@ def get_local_ips():
     return local_ips
 
 
+def is_sage_request(ip, fqdns):
+    return ip == bubble_sage_ip4 or ip == bubble_sage_ip6 or bubble_sage_host in fqdns
+
+
 def passthru_cache_prefix(client_addr, server_addr):
     return REDIS_PASSTHRU_PREFIX + client_addr + '_' + server_addr
 
@@ -106,11 +111,6 @@ def check_bubble_passthru(client_addr, addr, fqdns):
 
 
 def should_passthru(client_addr, addr, fqdns):
-    # always passthru for local ips
-    if addr in get_local_ips():
-        # bubble_log('should_passthru: local ip is always passthru: '+addr)
-        return {'fqdns': fqdns, 'addr': addr, 'passthru': True}
-
     cache_key = passthru_cache_prefix(client_addr, addr)
     prefix = 'should_passthru: ip='+repr(addr)+' (fqdns='+repr(fqdns)+') cache_key='+cache_key+': '
 
@@ -141,6 +141,10 @@ def next_layer(next_layer):
             bubble_log('next_layer: enabling passthru for LOCAL server='+server_addr+' regardless of security_level='+security_level+' for client='+client_addr)
             passthru = FORCE_PASSTHRU
 
+        elif is_sage_request(server_addr, fqdns):
+            bubble_log('next_layer: enabling passthru for SAGE server='+server_addr+' regardless of security_level='+security_level+' for client='+client_addr)
+            passthru = FORCE_PASSTHRU
+
         elif security_level == 'disabled' or security_level == 'basic':
             bubble_log('next_layer: enabling passthru for server='+server_addr+' because security_level='+security_level+' for client='+client_addr)
             passthru = FORCE_PASSTHRU