Skip to content

Commit 2745bd0

Browse files
jeremyhahnjeremyhahn
authored
Merge pull request #1 from jeremyhahn/develop
Overhaul storage layers, add PKCS8/PKCS11 abstraction layer
2 parents b3841e9 + 419a0c6 commit 2745bd0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+7939
-6005
lines changed

‎.vscode/launch.json‎

Lines changed: 33 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
"ca",
2323
"install-ca-certificates",
2424
"--debug",
25-
"--ca-password", "ca-intermediate-password",
25+
"--ca-password", "ca-password",
2626
"--server-password", "server-password",
2727
],
2828
},
@@ -62,7 +62,7 @@
6262
"args": [
6363
"tpm",
6464
"eventlog",
65-
"--ca-password", "ca-intermediate-password",
65+
"--ca-password", "ca-password",
6666
],
6767
},
6868
{
@@ -76,9 +76,8 @@
7676
"tpm",
7777
"import-ek",
7878
"--file", "ECcert.bin",
79-
"--root-password", "ca-root-password",
80-
"--intermediate-password", "ca-intermediate-password",
81-
"--ca-password", "ca-intermediate-password",
79+
"--ca-parent-password", "ca-parent-password",
80+
"--ca-password", "ca-password",
8281
],
8382
},
8483
{
@@ -90,17 +89,30 @@
9089
"program": "${workspaceRoot}/pkg",
9190
"args": ["webservice",
9291
"--debug",
92+
"--platform-dir", "trusted-data",
93+
"--config-dir", "trusted-data/etc",
94+
"--log-dir", "trusted-data/log",
95+
"--ca-dir", "trusted-data/ca",
96+
"--server-password", "server-password",
97+
"--ca-password", "ca-password",
9398
],
9499
},
95100
{
96101
"name": "trusted-platform webservice (clean)",
97102
"type": "go",
98103
"request": "launch",
99104
"mode": "debug",
100-
"preLaunchTask": "rm_trusted_data",
105+
"preLaunchTask": "debug_config_clean",
101106
"program": "${workspaceRoot}/pkg",
102107
"args": ["webservice",
103108
"--debug",
109+
"--platform-dir", "trusted-data",
110+
"--config-dir", "trusted-data/etc",
111+
"--log-dir", "trusted-data/log",
112+
"--ca-dir", "trusted-data/ca",
113+
"--ca-parent-password", "ca-parent-password",
114+
"--ca-password", "ca-password",
115+
"--server-password", "server-password",
104116
],
105117
},
106118
{
@@ -123,31 +135,31 @@
123135
"program": "${workspaceRoot}/pkg",
124136
"args": ["verifier",
125137
"--debug",
138+
"--platform-dir", "../attestation/verifier/trusted-data",
126139
"--config-dir", "../attestation/verifier/trusted-data/etc",
127-
"--platform-dir", "../attestation/attestor/trusted-data",
128-
"--log-dir", "../attestation/verifier/trusted-data/logs",
140+
"--log-dir", "../attestation/verifier/trusted-data/log",
129141
"--ca-dir", "../attestation/verifier/trusted-data/ca",
130-
"--ca-password", "ca-intermediate-password",
142+
"--ca-password", "ca-password",
131143
"--server-password", "server-password",
132-
"--attestor", "attestor.example.com",
144+
"--attestor", "www.attestor.example.com",
133145
"--ak-password", "ak-password",
134146
],
135147
}, {
136148
"name": "trusted-platform verifier",
137149
"type": "go",
138150
"request": "launch",
139151
"mode": "debug",
140-
"preLaunchTask": "debug_config",
152+
// "preLaunchTask": "debug_config",
141153
"program": "${workspaceRoot}/pkg",
142154
"args": ["verifier",
143155
"--debug",
156+
"--platform-dir", "../attestation/verifier/trusted-data",
144157
"--config-dir", "../attestation/verifier/trusted-data/etc",
145-
"--platform-dir", "../attestation/attestor/trusted-data",
146-
"--log-dir", "../attestation/verifier/trusted-data/logs",
158+
"--log-dir", "../attestation/verifier/trusted-data/log",
147159
"--ca-dir", "../attestation/verifier/trusted-data/ca",
148-
"--ca-password", "ca-intermediate-password",
160+
"--ca-password", "ca-password",
149161
"--server-password", "server-password",
150-
"--attestor", "attestor.example.com",
162+
"--attestor", "www.attestor.example.com",
151163
"--ak-password", "ak-password",
152164
],
153165
}, {
@@ -159,11 +171,11 @@
159171
"program": "${workspaceRoot}/pkg",
160172
"args": ["attestor",
161173
"--debug",
162-
"--config-dir", "../attestation/attestor/trusted-data/etc",
163174
"--platform-dir", "../attestation/attestor/trusted-data",
164-
"--log-dir", "../attestation/attestor/trusted-data/logs",
175+
"--config-dir", "../attestation/attestor/trusted-data/etc",
176+
"--log-dir", "../attestation/attestor/trusted-data/log",
165177
"--ca-dir", "../attestation/attestor/trusted-data/ca",
166-
"--ca-password", "ca-intermediate-password",
178+
"--ca-password", "ca-password",
167179
"--server-password", "server-password",
168180
],
169181
}, {
@@ -175,11 +187,11 @@
175187
"program": "${workspaceRoot}/pkg",
176188
"args": ["attestor",
177189
"--debug",
178-
"--config-dir", "../attestation/attestor/trusted-data/etc",
179190
"--platform-dir", "../attestation/attestor/trusted-data",
180-
"--log-dir", "../attestation/attestor/trusted-data/logs",
191+
"--config-dir", "../attestation/attestor/trusted-data/etc",
192+
"--log-dir", "../attestation/attestor/trusted-data/log",
181193
"--ca-dir", "../attestation/attestor/trusted-data/ca",
182-
"--ca-password", "ca-intermediate-password",
194+
"--ca-password", "ca-password",
183195
"--server-password", "server-password",
184196
],
185197
}

‎.vscode/tasks.json‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,44 @@
33
"tasks": [{
44
"type": "shell",
55
"label": "debug_config",
6+
"dependsOn": [
7+
"make_trusted_data",
8+
],
69
"command": "cp",
710
"args": [
811
"configs/platform/config.debug.yaml",
9-
"pkg/config.yaml",
12+
"pkg/trusted-data/etc/config.yaml",
1013
]
1114
},
1215
{
1316
"type": "shell",
14-
"label": "rm_trusted_data",
17+
"label": "debug_config_clean",
1518
"dependsOn": [
16-
"debug_config",
19+
"rm_trusted_data",
20+
"make_trusted_data",
1721
],
22+
"command": "cp",
23+
"args": [
24+
"configs/platform/config.debug.yaml",
25+
"pkg/trusted-data/etc/config.yaml",
26+
]
27+
},
28+
{
29+
"type": "shell",
30+
"label": "make_trusted_data",
31+
"command": "mkdir",
32+
"args": [
33+
"-p",
34+
"pkg/trusted-data/etc",
35+
]
36+
},
37+
{
38+
"type": "shell",
39+
"label": "rm_trusted_data",
1840
"command": "rm",
1941
"args": [
2042
"-rf",
21-
"trusted-data",
43+
"pkg/trusted-data",
2244
]
2345
},
2446
{
@@ -45,9 +67,6 @@
4567
},
4668
{
4769
"type": "shell",
48-
"dependsOn": [
49-
"debug_config",
50-
],
5170
"label": "attestor_init",
5271
"command": "make",
5372
"args": [
@@ -56,9 +75,9 @@
5675
},
5776
{
5877
"type": "shell",
59-
"dependsOn": [
60-
"debug_config",
61-
],
78+
// "dependsOn": [
79+
// "debug_config",
80+
// ],
6281
"label": "verifier_init",
6382
"command": "make",
6483
"args": [

‎Makefile‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,11 @@ ROOT_CA ?= root-ca
6868
INTERMEDIATE_CA ?= intermediate-ca
6969
DOMAIN ?= example.com
7070

71-
VERIFIER_HOSTNAME ?= verifier
72-
ATTESTOR_HOSTNAME ?= attestor
71+
VERIFIER_HOSTNAME ?= www
72+
VERIFIER_DOMAIN ?= verifier.example.com
73+
74+
ATTESTOR_HOSTNAME ?= www
75+
ATTESTOR_DOMAIN ?= attestor.example.com
7376

7477
CONFIG_YAML ?= config.dev.yaml
7578

@@ -138,12 +141,15 @@ deps:
138141

139142
swagger:
140143
swag init \
141-
--dir webservice,webservice/v1/router,webservice/v1/response,service,model,app,config \
144+
--dir pkg/webservice,pkg/webservice/v1/router,pkg/webservice/v1/response,pkg/app,pkg/config \
142145
--generalInfo webserver_v1.go \
143146
--parseDependency \
144147
--parseInternal \
145148
--parseDepth 1 \
146-
--output public_html/swagger
149+
--output pkg/public_html/swagger
150+
151+
swagger-ui:
152+
git clone --depth=1 https://github.com/swagger-api/swagger-ui.git public_html/swagger
147153

148154

149155
# x86_64
@@ -234,13 +240,18 @@ clean:
234240
/usr/local/bin/$(APPNAME) \
235241
$(PLATFORM_DIR) \
236242
$(ATTESTATION_DIR) \
237-
pkg/ca/certs \
238-
pkg/tpm2/certs \
243+
pkg/$(PLATFORM_DIR) \
244+
pkg/store/testdata \
245+
pkg/store/keystore/testdata \
246+
pkg/store/pkcs8/testdata \
247+
pkg/ca/testdata \
248+
pkg/tpm2/testdata \
239249
pkg/tpm2/$(EK_CERT_NAME) \
240-
pkg/$(EK_CERT_NAME)
250+
pkg/$(EK_CERT_NAME) \
251+
config.yaml
241252

242253

243-
test: test-ca test-tpm test-hash
254+
test: test-ca test-tpm test-crypto test-store
244255

245256
test-ca:
246257
cd pkg/ca && go test -v
@@ -252,8 +263,14 @@ test-tpm:
252263
test-pkcs11:
253264
cd pkg/pkcs11 && go test -v
254265

255-
test-hash:
256-
cd pkg/hash && go test -v
266+
test-crypto:
267+
cd pkg/crypto/aesgcm && go test -v
268+
cd pkg/crypto/argon2 && go test -v
269+
270+
test-store:
271+
cd pkg/store && go test -v
272+
cd pkg/store/keystore && go test -v
273+
cd pkg/store/keystore/pkcs8 && go test -v
257274

258275
proto:
259276
cd pkg/$(ATTESTATION_DIR) && $(PROTOC) \
@@ -268,15 +285,15 @@ uninstall: uninstall-ansible
268285

269286

270287
# Certificate Authority
271-
ca-verify-all: ca-root-verify ca-intermediate-verify ca-server-=verify
288+
ca-verify-all: ca-parent-verify ca-intermediate-verify ca-server-=verify
272289

273-
ca-show-all: ca-root-show ca-intermediate-show ca-server-show
290+
ca-show-all: ca-parent-show ca-intermediate-show ca-server-show
274291

275-
ca-root-verify:
292+
ca-parent-verify:
276293
cd $(CA_DIR) && \
277294
openssl verify -CAfile $(ROOT_CA)/$(ROOT_CA).crt $(ROOT_CA)/$(ROOT_CA).crt
278295

279-
ca-root-show:
296+
ca-parent-show:
280297
cd $(CA_DIR) && \
281298
openssl x509 -in $(ROOT_CA)/$(ROOT_CA).crt -text -noout
282299

@@ -312,8 +329,8 @@ ca-decrypt-intermediate-key:
312329
verifier-init:
313330
mkdir -p $(VERIFIER_DIR)/$(CONFIG_DIR)
314331
cp configs/platform/$(CONFIG_YAML) $(VERIFIER_CONF)
315-
sed -i 's/domain: $(DOMAIN)/domain: $(VERIFIER_HOSTNAME).$(DOMAIN)/' $(VERIFIER_CONF)
316-
sed -i 's/- $(DOMAIN)/- $(VERIFIER_HOSTNAME).$(DOMAIN)/' $(VERIFIER_CONF)
332+
sed -i 's/$(DOMAIN)/$(VERIFIER_DOMAIN)/' $(VERIFIER_CONF)
333+
sed -i 's/- $(VERIFIER_HOSTNAME).$(DOMAIN)/- $(VERIFIER_DOMAIN)/' $(VERIFIER_CONF)
317334

318335
verifier-no-clean: build verifier-init
319336
cd $(VERIFIER_DIR) && \
@@ -335,7 +352,7 @@ verifier: verifier-clean verifier-init build
335352
--server-password server-password \
336353
--ek-cert $(ATTESTATION_ECCERT) \
337354
--ak-password ak-password \
338-
--attestor $(ATTESTOR_HOSTNAME).$(DOMAIN)
355+
--attestor $(ATTESTOR_HOSTNAME).$(ATTESTOR_DOMAIN)
339356

340357
verifier-clean:
341358
rm -rf \
@@ -353,8 +370,9 @@ verifier-cert-chain:
353370
attestor-init:
354371
mkdir -p $(ATTESTOR_DIR)/$(CONFIG_DIR)
355372
cp configs/platform/$(CONFIG_YAML) $(ATTESTOR_CONF)
356-
sed -i 's/domain: $(DOMAIN)/domain: $(ATTESTOR_HOSTNAME).$(DOMAIN)/' $(ATTESTOR_CONF)
357-
sed -i 's/- $(DOMAIN)/- $(ATTESTOR_HOSTNAME).$(DOMAIN)/' $(ATTESTOR_CONF)
373+
sed -i 's/$(DOMAIN)/$(ATTESTOR_DOMAIN)/' $(ATTESTOR_CONF)
374+
sed -i 's/- __VERIFIER_CA__/- $(INTERMEDIATE_CA).$(VERIFIER_DOMAIN)/' $(ATTESTOR_CONF)
375+
cp $(EK_CERT_NAME) $(ATTESTOR_DIR)/$(EK_CERT_NAME)
358376

359377
attestor-clean:
360378
rm -rf \

0 commit comments

Comments
 (0)