spire for cert, no client validation fails about ghostunnel

[csstaub]

@kfox1111 Try this to see if it fixes your issue?

#418

[csstaub]

Released in v1.7.3

[csstaub]

Need more information to know what's happening. Did the client provide a certificate but Ghostunnel didn't see it? Or do you want clients w/o certs to be able to connect?

[kfox1111]

Trying to get clients without certs to be able to successfully use the service but use spire to issue/refresh the server side certificate.

[kfox1111]

Amongst other clients, I was doing testing mostly with curl against ghostunel in server mode.

[amartinezfayo]

I've looked into this and if the Workload API is being used in the server, the disable-authentication flag is ignored. I've reproduced this running ./ghostunnel server --use-workload-api-addr unix:/tmp/spire-agent/public/api.sock --listen :9000 --target localhost:9001 --disable-authentication.

I think that the problem may be here: https://github.com/ghostunnel/ghostunnel/blob/master/main.go#L837.
The TLSConfigSourceFromWorkloadAPI function is being called using the *clientDisableAuth value, while this is being executed by a server command. Shouldn't it be called with *serverDisableAuth?

[csstaub]

Good catch! That function is used both in server and in client mode, so it should probably take a flag for disableAuth, and the client/server mode main function needs to pass either *clientDisableAuth or *serverDisableAuth.