{"action":"created","issue":{"url":"https://api.github.com/repos/cf-tm-bot/diego/issues/163","repository_url":"https://api.github.com/repos/cf-tm-bot/diego","labels_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/163/labels{/name}","comments_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/163/comments","events_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/163/events","html_url":"https://github.com/cf-tm-bot/diego/issues/163","id":177362819,"number":163,"title":"Spike: the auctioneer can serve both HTTP and HTTPS on the same port - Story Id: 130322169","user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/delivered","name":"delivered","color":"f08000"},{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/feature","name":"feature","color":"ededed"},{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/secure-auctioneer-api","name":"secure-auctioneer-api","color":"ededed"},{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/security","name":"security","color":"ededed"},{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/timeboxed","name":"timeboxed","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2016-09-16T07:38:34Z","updated_at":"2016-09-23T23:14:44Z","closed_at":null,"body":"Seems like we might be able to inspect the initial bytes read from the server's `net.Conn` and opt into a TLS handshake if appropriate (maybe automatically by swapping in a `tls.Conn`?): https://stackoverflow.com/questions/13110713/upgrade-a-connection-to-tls-in-go  Can we also do mutual TLS?\n\nThe BBS is the only client, so we would want to verify that we can:\n- configure the auctioneer to operate in this dual-TLS mode, with the Diego CA and a cert and key signed by that CA\n- verify that the BBS client as configured can communicate with it\n- reconfigure the BBS client to communicate with the auctioneer via mutual TLS without reconfiguring the auctioneer\n- verify via curl that communication fails if the client does not present its own certificate\n\nWe should be sure not to disrupt automatic upgrades to HTTP/2 when clients connect with TLS, too.\n\nTimebox to 2 days before re-evaluation.\n\n---\n\nMirrors: [story 130322169](https://www.pivotaltracker.com/story/show/130322169) submitted on Sep 13, 2016 UTC\n- **Requester**: Eric Malm\n- **Owners**: Brandon Shroyer, Anoop Gopalakrishnan\n- **Estimate**: 0.0"},"comment":{"url":"https://api.github.com/repos/cf-tm-bot/diego/issues/comments/249323428","html_url":"https://github.com/cf-tm-bot/diego/issues/163#issuecomment-249323428","issue_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/163","id":249323428,"user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"created_at":"2016-09-23T23:14:44Z","updated_at":"2016-09-23T23:14:44Z","body":"Brandon Shroyer [commented](https://www.pivotaltracker.com/n/projects/1003146/stories/130322169/comments/150468887) on Sep 23, 2016, 9.42 PM UTC:\n\nThe code on `wip-upgradable-tls-conn` currently has the following properties:\n\n* If you curl the auctioneer using http, you will not be required to authenticate (you will receive a 404).\n* If you curl the auctioneer using https without supplying a key, cert and CA cert, you will receive an authentication failure.\n* If you curl the auctioneer using https with all credentials supplied, but the certificate is invalid, you will receive a bad handshake failure.\n\nThese properties were verified by curling a standalone instance of auctioneer with a consul process running in the background, using credentials in the `inigo/fixtures/certs` directory.\n\nIn addition, we've added HTTPS support to the BBS auctioneer client (not fully verified yet). It's worth noting that inigo is experiencing failures with this set up, even though it can be tested manually.\n\n<!--\nComment Id: 150468887\n-->"}}
{"actor":{"display_login":"cf-tm-bot"}}