Skip to content
Snippets Groups Projects
Commit a2fbf6f8 authored by Malte Bauch's avatar Malte Bauch
Browse files

Wg3

parent 4d022e24
Branches
No related tags found
2 merge requests!9First working draft version,!7Wg3
Hide whitespace changes
Inline Side-by-side
go.mod
+ 1
− 1
View file @ a2fbf6f8
......@@ -4,7 +4,7 @@ go 1.20
require (
github.com/google/uuid v1.3.0
google.golang.org/grpc v1.56.1
google.golang.org/grpc v1.56.2
google.golang.org/protobuf v1.31.0
)
......
kms/kms-keystore.go
+ 5
− 7
View file @ a2fbf6f8
......@@ -22,7 +22,7 @@ type kmsKSElement struct {
type kmsKeyStore struct {
keyStoreMutex sync.Mutex
keyStore map[string]kmsKSElement
keyStore map[string]*kmsKSElement
}
func (ks *kmsKeyStore) addKey(bulkKeyId int64, keyToadd []byte) {
......@@ -40,7 +40,7 @@ func (ks *kmsKeyStore) addKey(bulkKeyId int64, keyToadd []byte) {
return
}
// ok to add
ks.keyStore[newKeyElement.keyID] = newKeyElement
ks.keyStore[newKeyElement.keyID] = &newKeyElement
}
......@@ -54,13 +54,11 @@ func (ks *kmsKeyStore) KeyChopper256Bit(bulkKey *quantumlayer.QuantumLayerBulkKe
// Let's chop!
key := *bulkKey.BulkKey
for len(key) > 8 {
tmpkey := key[:8]
for len(key) > 32 {
tmpkey := key[:32]
ks.addKey(bulkKey.BulkKeyId, tmpkey)
// shorten the key storage
key = key[8:]
key = key[32:]
}
return nil
}
kms/kms.go
+ 9
− 3
View file @ a2fbf6f8
......@@ -80,10 +80,10 @@ func (kms *EKMS) AddQuantumElement(kmsUDPAddrr string) *QuantumElement {
ql.PowerOn()
ksl := kmsKeyStore{
keyStore: make(map[string]kmsKSElement),
keyStore: make(map[string]*kmsKSElement),
}
ksr := kmsKeyStore{
keyStore: make(map[string]kmsKSElement),
keyStore: make(map[string]*kmsKSElement),
}
qle := QuantumElement{
......@@ -181,7 +181,13 @@ func (kms *EKMS) AddPeer(kmsPeerSocket string, servingQLE *QuantumElement) {
// TODO/XXX error handling
func (kms *EKMS) RemovePeer(kmsPeerSocket string) {
if _, there := kms.KmsPeers[kmsPeerSocket]; there {
//peer.quit <- true
delete(kms.KmsPeers, kmsPeerSocket)
return
}
log.Printf("Can not find a peer with socekt: %s", kmsPeerSocket)
return
}
func (kms *EKMS) AddExternalNotifierQLE(in chan uint32) {
......
kms/kmsetsi.go
+ 33
− 4
View file @ a2fbf6f8
......@@ -2,14 +2,18 @@ package kms
import (
"context"
"encoding/base64"
"errors"
"flag"
"fmt"
"log"
"net"
"os/exec"
pb "code.fbi.h-da.de/demoquandt/proto-kms/api/gen/proto/go/kmsetsi"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
)
var (
......@@ -19,6 +23,7 @@ var (
type etsiServer struct {
pb.UnimplementedKmsETSIServer
handlingEkms *EKMS
visitedKeys map[*kmsKSElement]bool
}
func (es *etsiServer) ETSICapabilities(ctx context.Context, in *pb.ETSICapabilitiesRequest) (capReply *pb.ETSICapabilitiesReply, err error) {
......@@ -92,15 +97,38 @@ func (es *etsiServer) ETSIGetPeerList(ctx context.Context, in *pb.ETSIKMSPeerLis
return r, nil
}
func (es *etsiServer) GetEncryptKeys256Bit(ctx context.Context, in *pb.ETSIGetEncryptKeys256BitRequest) (*pb.ETSIGetEncryptKeys256BitReply, error) {
func (es *etsiServer) ETSIGetEncryptKeys256Bit(ctx context.Context, in *pb.ETSIGetEncryptKeys256BitRequest) (*pb.ETSIGetEncryptKeys256BitReply, error) {
log.Printf("Received request for n=%d keys", in.GetAmount())
testBytes := []byte{120, 120, 120}
var randomKey *kmsKSElement
var err error
// NOTE: change change change!
for _, qe := range es.handlingEkms.QuantumElements {
quantumElementLocalKeyStore := qe.keyStoreLocal
randomKey, err = randomItemFromMap[string, *kmsKSElement](quantumElementLocalKeyStore.keyStore, es.visitedKeys)
if err != nil {
return nil, status.Errorf(codes.Internal, "%v", err)
}
es.visitedKeys[randomKey] = true
}
keyAsString := base64.StdEncoding.EncodeToString(randomKey.key)
// push the key to the encryptor via ssh
ssh := "ssh"
complexArg := fmt.Sprintf("(rc=$(sed \"12 c PresharedKey = %s\" /etc/wireguard/wg0.conf); echo \"$rc\" > /etc/wireguard/wg0.conf)", keyAsString)
args := []string{"root@172.20.0.5", "-oStrictHostKeyChecking=no", complexArg}
cmd := exec.Command(ssh, args...)
err = cmd.Run()
if err != nil {
log.Println("could not execute command")
return nil, status.Errorf(codes.Internal, "%v", err)
}
// Construct any response
return &pb.ETSIGetEncryptKeys256BitReply{
KeyID: "2",
Key: testBytes,
KeyID: randomKey.keyID,
Key: randomKey.key,
}, nil
}
......@@ -115,6 +143,7 @@ func StartETSI(listenAddr string, callingKMS *EKMS) {
s := grpc.NewServer()
pb.RegisterKmsETSIServer(s, &etsiServer{
handlingEkms: callingKMS,
visitedKeys: make(map[*kmsKSElement]bool),
})
log.Printf("server listening at %v", lis.Addr())
if err := s.Serve(lis); err != nil {
......
kms/kmspeers.go
+ 74
− 18
View file @ a2fbf6f8
......@@ -2,8 +2,11 @@ package kms
import (
"context"
"encoding/base64"
"fmt"
"log"
"net"
"os/exec"
"time"
pb "code.fbi.h-da.de/demoquandt/proto-kms/api/gen/proto/go/kmsetsi"
......@@ -35,6 +38,7 @@ type kmsPeer struct {
tcpSocketStr string // string rep. of tcpSocket
name string // the name of the kms peer
id uuid.UUID // uuid of the peer
quit chan bool // cancel the peer goroutine
}
func NewKmsPeer(servQLE *QuantumElement, in chan string) (peer kmsPeer) {
......@@ -43,12 +47,12 @@ func NewKmsPeer(servQLE *QuantumElement, in chan string) (peer kmsPeer) {
servingQLE: servQLE,
id: uuid.New(),
externalNotifierKMSPeer: in,
quit: make(chan bool),
}
}
// Handles everything with respect to a specific KMS peer
func (ph *kmsPeer) PeerHandler(kmsName string) {
log.Printf("%s started PeerHandler for %s:", kmsName, ph.tcpSocketStr)
// contact peer
......@@ -73,11 +77,58 @@ func (ph *kmsPeer) PeerHandler(kmsName string) {
if ph.externalNotifierKMSPeer != nil {
ph.externalNotifierKMSPeer <- ph.tcpSocketStr
}
return
}
// NOTE: If a session is created, we also request a encryption key for now
//quantumElementRequest, err := c.ETSIGetQuantumInterfaces(ctx, &pb.ETSIKMSQuantumInterfaceListRequest{})
//if err != nil {
// log.Println("Could not request quantum elements: ", err)
// ph.peerStatus = KmsPeerDown
// // Send notification about change
// if ph.externalNotifierKMSPeer != nil {
// ph.externalNotifierKMSPeer <- ph.tcpSocketStr
// }
// return
//}
//if quantumElementRequest.QlElementInfo != nil {
// peerQuantumElement := quantumElementRequest.QlElementInfo[0].QleID
//} else {
// // return error?!
//}
// Works and peer moves to kmsPeerUp
ph.peerStatus = KmsPeerUp
encryptKeyRequest, err := c.ETSIGetEncryptKeys256Bit(ctx, &pb.ETSIGetEncryptKeys256BitRequest{Amount: 1})
if err != nil {
log.Println("could not request a encryption key: ", err)
ph.peerStatus = KmsPeerDown
// Send notification about change
if ph.externalNotifierKMSPeer != nil {
ph.externalNotifierKMSPeer <- ph.tcpSocketStr
}
return
}
// check if key is in remoteKeyStore
if key, ok := ph.servingQLE.keyStoreRemote.keyStore[encryptKeyRequest.KeyID]; ok {
keyAsString := base64.StdEncoding.EncodeToString(key.key)
log.Printf("Agreed Key: %s", keyAsString)
// push the key to the encryptor via ssh
ssh := "ssh"
complexArg := fmt.Sprintf("(rc=$(sed \"12 c PresharedKey = %s\" /etc/wireguard/wg0.conf); echo \"$rc\" > /etc/wireguard/wg0.conf)", keyAsString)
args := []string{"root@172.20.0.4", "-oStrictHostKeyChecking=no", complexArg}
cmd := exec.Command(ssh, args...)
err := cmd.Run()
if err != nil {
log.Println("could not execute command")
return
}
}
// Send notification about change
if ph.externalNotifierKMSPeer != nil {
ph.externalNotifierKMSPeer <- ph.tcpSocketStr
......@@ -85,23 +136,28 @@ func (ph *kmsPeer) PeerHandler(kmsName string) {
log.Printf("Greeting: %s which is now in peerStatus %d", r.GetPeerKmsName(), ph.peerStatus)
// NOTE: should be possible to cancel!
// By now, do check only the liveliness of the peer, nothing else.
for {
time.Sleep(30 * time.Second)
// Contact the server and print out its response.
ctx, cancel := context.WithTimeout(context.Background(), time.Second)
defer cancel()
_, err := c.ETSICapabilities(ctx, &pb.ETSICapabilitiesRequest{MyKmsName: kmsName})
if err != nil {
log.Printf("could not greet: %v", err)
ph.peerStatus = KmsPeerDown
// Send notification about change
if ph.externalNotifierKMSPeer != nil {
ph.externalNotifierKMSPeer <- ph.tcpSocketStr
}
}
}
//for {
// select {
// case <-ph.quit:
// return
// default:
// // Contact the server and print out its response.
// ctx, cancel := context.WithTimeout(context.Background(), time.Second)
// defer cancel()
// _, err := c.ETSICapabilities(ctx, &pb.ETSICapabilitiesRequest{MyKmsName: kmsName})
// if err != nil {
// log.Printf("could not greet: %v", err)
// ph.peerStatus = KmsPeerDown
// // Send notification about change
// if ph.externalNotifierKMSPeer != nil {
// ph.externalNotifierKMSPeer <- ph.tcpSocketStr
// }
// }
// time.Sleep(30 * time.Second)
// }
//}
}
func (ph *kmsPeer) GetKmsPeerStatus() KmsPeerStatus {
......
kms/util.go 0 → 100644
+ 16
− 0
View file @ a2fbf6f8
package kms
import "fmt"
// Ewww... don't
func randomItemFromMap[T, M comparable](m map[T]M, v map[M]bool) (M, error) {
for _, item := range m {
if v[item] {
continue
}
return item, nil
}
var r M
return r, fmt.Errorf("Could not return a random item from map %v", m)
}
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment