diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 10fe3c3dce65c722d537d38e446f5614540411c9..7f1b4632f925bfe9bb18386af7abd29ddfb5d6f3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -51,7 +51,7 @@ lint:
script:
- apk add --update make
- echo "machine code.fbi.h-da.de login ${GITLAB_LOGIN} password ${GITLAB_TOKEN}" > ~/.netrc
- - make lint
+ - make ci-lint
needs: []
diff --git a/.vscode/launch.json b/.vscode/launch.json
index 5fa834f302c8483d43793333565f883ef7afecc2..ebcf0f5a2e68389cd9b10f127a953c7e075fed1c 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -12,7 +12,18 @@
"program": "${file}"
},
{
- "name": "ekms",
+ "name": "kms",
+ "type": "go",
+ "request": "launch",
+ "mode": "auto",
+ "program": "${workspaceFolder}/ekms/main.go",
+ "env": {},
+ "args": [
+ "start", "--log", "debug", "--kms_config", "${workspaceFolder}/debug_configs/config/kms/kms_1.yaml", "--insecure"
+ ]
+ },
+ {
+ "name": "kms-debug",
"type": "go",
"request": "launch",
"mode": "auto",
@@ -21,5 +32,6 @@
"args": [
"start", "--log", "debug", "--kms_config", "${workspaceFolder}/config/ekms/example_debug.yaml", "--insecure"
]
- },]
+ },
+ ]
}
diff --git a/Makefile b/Makefile
index a2ec3e7af598282882ea7837f19c436fd317c734..d70d5dd9395faf24b4f2176a75fec2858448925c 100644
--- a/Makefile
+++ b/Makefile
@@ -32,6 +32,9 @@ install-tools:
go install github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
@echo Finished installing development tooling
+ci-lint: install-tools
+ ./$(TOOLS_DIR)/golangci-lint run --config .golangci.yml
+
lint: install-tools
./$(TOOLS_DIR)/golangci-lint run --config .golangci.yml
@@ -78,12 +81,19 @@ akms-simulator-container:
build-images: ekms-container quantumlayer-container akms-simulator-container
-compose-up: build-images
+compose-up: build-images generate-certs
docker-compose up -d
compose-down:
docker-compose down
+debug-kms-up: build-images generate-debug-certs
+ docker-compose -f docker-compose_debug_kms.yml down
+ docker-compose -f docker-compose_debug_kms.yml up
+
+debug-kms-down:
+ docker-compose -f docker-compose_debug_kms.yml down
+
integration-test-debug-up: build-images
docker-compose -f docker-compose_integration_test.yml down
docker-compose -f docker-compose_integration_test.yml up -d
@@ -107,10 +117,21 @@ playground-stop:
playground-graph:
sudo containerlab graph --topo playground.clab.yaml
-self-certs:
- mkdir -p ./artifacts/ssl/private
- mkdir -p ./artifacts/ssl/certs
- openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout ./artifacts/ssl/private/gnmi-target-selfsigned.key -out ./artifacts/ssl/certs/gnmi-target-selfsigned.crt
+generate-certs: generate-root-ca generate-ekms-certs
+
+generate-root-ca: pre
+ if [ ! -d "$(BUILD_ARTIFACTS_PATH)/ssl" ]; then \
+ mkdir -p $(BUILD_ARTIFACTS_PATH)/ssl; \
+ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -new -subj '/C=DE/O=H_DA/CN=ROOT_CA' \
+ -keyout $(BUILD_ARTIFACTS_PATH)/ssl/ca.key -out $(BUILD_ARTIFACTS_PATH)/ssl/ca.crt; \
+ openssl x509 -in $(BUILD_ARTIFACTS_PATH)/ssl/ca.crt -noout -text; \
+ fi
+
+generate-ekms-certs:
+ ./config/ekms/generate-ekms-certs.sh
+
+generate-debug-certs: generate-root-ca
+ ./debug_configs/config/kms/generate-debug-certs.sh
# other targets
cross:
diff --git a/config/ekms/example01.yaml b/config/ekms/example01.yaml
index 829a4eb296ac6c2b1e7269a24cc9b1017cd98e5e..002344b618b30710fe8a76a12ade07cb06fdde3c 100644
--- a/config/ekms/example01.yaml
+++ b/config/ekms/example01.yaml
@@ -1,9 +1,14 @@
Id: "0ff33c82-7fe1-482b-a0ca-67565806ee4b"
Name: ekms01
InterComAddr: 172.100.20.10:50910
+QuantumAddr: 172.100.20.10:50911
GRPCAddr: 172.100.20.10:50900
AkmsURL: "http://172.100.20.22:4444/api/v1/keys/push_ksa_key"
AkmsCkmsServerPort: "9696"
+TLS: true
+CAFile: "ssl/ca.crt"
+CertFile: "ssl/ekms/ekms1-selfsigned.crt"
+KeyFile: "ssl/ekms/ekms1-selfsigned.key"
Peers:
# peer to ekms02
- PeerId: "5e41c291-6121-4335-84f6-41e04b8bdaa2"
diff --git a/config/ekms/example02.yaml b/config/ekms/example02.yaml
index c6d8c7616b0c56f8d4fcf561a8e8589f3fbbee1b..c8388dafae927980cc55a75afd0cae02982e078a 100644
--- a/config/ekms/example02.yaml
+++ b/config/ekms/example02.yaml
@@ -1,7 +1,12 @@
Id: "5e41c291-6121-4335-84f6-41e04b8bdaa2"
Name: ekms02
InterComAddr: 172.100.20.11:50910
+QuantumAddr: 172.100.20.11:50911
GRPCAddr: 172.100.20.11:50900
+TLS: true
+CAFile: "ssl/ca.crt"
+CertFile: "ssl/ekms/ekms2-selfsigned.crt"
+KeyFile: "ssl/ekms/ekms2-selfsigned.key"
Peers:
# peer to ekms01
- PeerId: "0ff33c82-7fe1-482b-a0ca-67565806ee4b"
diff --git a/config/ekms/example03.yaml b/config/ekms/example03.yaml
index d211db6e540b08d5449b606f1b60c901736098c6..cd5201839f3e0a248890778c911c2cb81fecbe16 100644
--- a/config/ekms/example03.yaml
+++ b/config/ekms/example03.yaml
@@ -1,7 +1,12 @@
Id: "f80db2c0-2480-46b9-b7d1-b63f954e8227"
Name: ekms03
InterComAddr: 172.100.20.12:50910
+QuantumAddr: 172.100.20.12:50911
GRPCAddr: 172.100.20.12:50900
+TLS: true
+CAFile: "ssl/ca.crt"
+CertFile: "ssl/ekms/ekms3-selfsigned.crt"
+KeyFile: "ssl/ekms/ekms3-selfsigned.key"
Peers:
# peer to ekms01
- PeerId: "0ff33c82-7fe1-482b-a0ca-67565806ee4b"
diff --git a/config/ekms/example04.yaml b/config/ekms/example04.yaml
index 4d72dfa8790566247d5bf6d709f185dab10fa4f1..339c1da321b5e7bdfcd83f9b469f91bc5b6b7f4f 100644
--- a/config/ekms/example04.yaml
+++ b/config/ekms/example04.yaml
@@ -1,9 +1,14 @@
Id: "968fd594-b0e7-41f0-ba4b-de259047a933"
Name: ekms04
InterComAddr: 172.100.20.13:50910
+QuantumAddr: 172.100.20.13:50911
GRPCAddr: 172.100.20.13:50900
AkmsURL: "http://172.100.20.23:4444/api/v1/keys/push_ksa_key"
AkmsCkmsServerPort: "9696"
+TLS: true
+CAFile: "ssl/ca.crt"
+CertFile: "ssl/ekms/ekms4-selfsigned.crt"
+KeyFile: "ssl/ekms/ekms4-selfsigned.key"
Peers:
# peer to ekms02
- PeerId: "5e41c291-6121-4335-84f6-41e04b8bdaa2"
diff --git a/config/ekms/generate-ekms-certs.sh b/config/ekms/generate-ekms-certs.sh
new file mode 100755
index 0000000000000000000000000000000000000000..dcb2b0b29c0b05864a6378140c424789f3263785
--- /dev/null
+++ b/config/ekms/generate-ekms-certs.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+dirPath="artifacts/ssl"
+
+if [ ! -d "${dirPath}/ekms" ]; then
+ mkdir $dirPath/ekms
+ counter=1
+ for FILE in ./config/ekms/tlsConfigs/*.txt;
+ do openssl req -x509 -nodes -days 365 -newkey rsa:4096 -config $FILE \
+ -CA $dirPath/ca.crt -CAkey $dirPath/ca.key \
+ -keyout "$dirPath/ekms/ekms$counter-selfsigned.key" -out "$dirPath/ekms/ekms$counter-selfsigned.crt"; \
+ openssl x509 -in "$dirPath/ekms/ekms$counter-selfsigned.crt" -noout -text
+ counter=$((counter+1));
+ done
+ fi
+
diff --git a/config/ekms/tlsConfigs/ekms01ReqConfig.txt b/config/ekms/tlsConfigs/ekms01ReqConfig.txt
new file mode 100644
index 0000000000000000000000000000000000000000..5a622e8be20a08ba47c5367416b6a38ca81a4477
--- /dev/null
+++ b/config/ekms/tlsConfigs/ekms01ReqConfig.txt
@@ -0,0 +1,16 @@
+[req]
+default_bits = 4096
+default_md = sha256
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = DE
+O = H_DA
+CN = ekms01
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+[alt_names]
+IP.1 = 172.100.20.10
diff --git a/config/ekms/tlsConfigs/ekms02ReqConfig.txt b/config/ekms/tlsConfigs/ekms02ReqConfig.txt
new file mode 100644
index 0000000000000000000000000000000000000000..00486caebb5105e87ed8f1b0e754135dc6cff350
--- /dev/null
+++ b/config/ekms/tlsConfigs/ekms02ReqConfig.txt
@@ -0,0 +1,16 @@
+[req]
+default_bits = 4096
+default_md = sha256
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = DE
+O = H_DA
+CN = ekms02
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+[alt_names]
+IP.1 = 172.100.20.11
diff --git a/config/ekms/tlsConfigs/ekms03ReqConfig.txt b/config/ekms/tlsConfigs/ekms03ReqConfig.txt
new file mode 100644
index 0000000000000000000000000000000000000000..185fb5d28063a696d87c0623ec0fa6530e5e8837
--- /dev/null
+++ b/config/ekms/tlsConfigs/ekms03ReqConfig.txt
@@ -0,0 +1,16 @@
+[req]
+default_bits = 4096
+default_md = sha256
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = DE
+O = H_DA
+CN = ekms03
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+[alt_names]
+IP.1 = 172.100.20.12
diff --git a/config/ekms/tlsConfigs/ekms04ReqConfig.txt b/config/ekms/tlsConfigs/ekms04ReqConfig.txt
new file mode 100644
index 0000000000000000000000000000000000000000..51036ff5af0963900c290d719abbeac9c0ba0e93
--- /dev/null
+++ b/config/ekms/tlsConfigs/ekms04ReqConfig.txt
@@ -0,0 +1,16 @@
+[req]
+default_bits = 4096
+default_md = sha256
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = DE
+O = H_DA
+CN = ekms04
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+[alt_names]
+IP.1 = 172.100.20.13
diff --git a/config/quantumlayer/example01.yaml b/config/quantumlayer/example01.yaml
index 187eb48ae368e192c22afb64dac48999f33ea31a..1736d402143060d2d3250301f955c91959e1bd42 100644
--- a/config/quantumlayer/example01.yaml
+++ b/config/quantumlayer/example01.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.10:50910'
+KMSAddr: '172.100.20.10:50911'
UDPAddr: '172.100.20.14:50901'
PeerUDPAddr: '172.100.20.15:50901'
GenerateKeys: true
diff --git a/config/quantumlayer/example02.yaml b/config/quantumlayer/example02.yaml
index 727e11855ef2887975c0b0d8c2a43c578521eb7e..2073a95cab0c3ae060045b9d34468bbf4a5dafaa 100644
--- a/config/quantumlayer/example02.yaml
+++ b/config/quantumlayer/example02.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.11:50910'
+KMSAddr: '172.100.20.11:50911'
UDPAddr: '172.100.20.15:50901'
PeerUDPAddr: '172.100.20.14:50901'
GenerateKeys: false
diff --git a/config/quantumlayer/example03.yaml b/config/quantumlayer/example03.yaml
index abf7588bf2ba62433770e926169b9ab10ba95124..23e801076b122e53aee09ba1ee8c907b16da5e43 100644
--- a/config/quantumlayer/example03.yaml
+++ b/config/quantumlayer/example03.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.11:50910'
+KMSAddr: '172.100.20.11:50911'
UDPAddr: '172.100.20.16:50901'
PeerUDPAddr: '172.100.20.17:50901'
GenerateKeys: true
diff --git a/config/quantumlayer/example04.yaml b/config/quantumlayer/example04.yaml
index bd66a90d9e267f0555c4171d01f39b044c7df6e6..05d7609f59c8a59ec8c8de4559e0cd531baeb597 100644
--- a/config/quantumlayer/example04.yaml
+++ b/config/quantumlayer/example04.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.13:50910'
+KMSAddr: '172.100.20.13:50911'
UDPAddr: '172.100.20.17:50901'
PeerUDPAddr: '172.100.20.16:50901'
GenerateKeys: false
diff --git a/config/quantumlayer/example05.yaml b/config/quantumlayer/example05.yaml
index b14495d8cf0fb9da74911955371fa6c388af3cf2..5c693db0559d8929a4a7920d28681b0241db4525 100644
--- a/config/quantumlayer/example05.yaml
+++ b/config/quantumlayer/example05.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.10:50910'
+KMSAddr: '172.100.20.10:50911'
UDPAddr: '172.100.20.18:50901'
PeerUDPAddr: '172.100.20.19:50901'
GenerateKeys: true
diff --git a/config/quantumlayer/example06.yaml b/config/quantumlayer/example06.yaml
index 5e6b0f64e1943931b9360ec8d97985472dd014dc..3dfff95bb70f1f7671f90a35ae18789ecee69915 100644
--- a/config/quantumlayer/example06.yaml
+++ b/config/quantumlayer/example06.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.12:50910'
+KMSAddr: '172.100.20.12:50911'
UDPAddr: '172.100.20.19:50901'
PeerUDPAddr: '172.100.20.18:50901'
GenerateKeys: false
diff --git a/config/quantumlayer/example07.yaml b/config/quantumlayer/example07.yaml
index 83af816c6ef95f838f4b9c345ee698d5112ffcf9..ce547970996be648bd1e5cd987500dc7006fe4d1 100644
--- a/config/quantumlayer/example07.yaml
+++ b/config/quantumlayer/example07.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.12:50910'
+KMSAddr: '172.100.20.12:50911'
UDPAddr: '172.100.20.20:50901'
PeerUDPAddr: '172.100.20.21:50901'
GenerateKeys: true
diff --git a/config/quantumlayer/example08.yaml b/config/quantumlayer/example08.yaml
index fd92862417d28894a440158b744f85342cca6e32..7f07547acd7372aec0207f26bdd06fab826796e8 100644
--- a/config/quantumlayer/example08.yaml
+++ b/config/quantumlayer/example08.yaml
@@ -1,4 +1,4 @@
-KMSAddr: '172.100.20.13:50910'
+KMSAddr: '172.100.20.13:50911'
UDPAddr: '172.100.20.21:50901'
PeerUDPAddr: '172.100.20.20:50901'
GenerateKeys: false
diff --git a/debug_configs/config/kms/generate-debug-certs.sh b/debug_configs/config/kms/generate-debug-certs.sh
new file mode 100755
index 0000000000000000000000000000000000000000..8db4b5fd8d6714850d0e8e07caef8d1885d72c16
--- /dev/null
+++ b/debug_configs/config/kms/generate-debug-certs.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+dirPath="artifacts/ssl"
+
+if [ ! -d "${dirPath}/debug-ekms" ]; then
+ mkdir $dirPath/debug-ekms
+ counter=1
+ for FILE in ./debug_configs/config/kms/tlsConfigs/*.txt;
+ do openssl req -x509 -nodes -days 365 -newkey rsa:4096 -config $FILE \
+ -CA $dirPath/ca.crt -CAkey $dirPath/ca.key \
+ -keyout "$dirPath/debug-ekms/ekms$counter-selfsigned.key" -out "$dirPath/debug-ekms/ekms$counter-selfsigned.crt"; \
+ openssl x509 -in "$dirPath/debug-ekms/ekms$counter-selfsigned.crt" -noout -text
+ counter=$((counter+1));
+ done
+ fi
+
diff --git a/debug_configs/config/kms/kms_1.json b/debug_configs/config/kms/kms_1.json
new file mode 100644
index 0000000000000000000000000000000000000000..65c46e12e6f7734817a494001ca9c5fcc45dd46a
--- /dev/null
+++ b/debug_configs/config/kms/kms_1.json
@@ -0,0 +1,12 @@
+{
+ "path-id": "38e0588b-6a2d-42c9-85a0-887cc877c299",
+ "next-hop": {
+ "node-id": "5e41c291-6121-4335-84f6-41e04b8bdaa2",
+ "ip-address": "kms_2",
+ "port": 50910
+ },
+ "initiating-kms-address": {
+ "initiating-kms-ip": "kms_2",
+ "initiating-kms-port": 50910
+ }
+}
diff --git a/debug_configs/config/kms/kms_1.yaml b/debug_configs/config/kms/kms_1.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..fbd96212feef6ceca1fcf94c73b67a2900e41e69
--- /dev/null
+++ b/debug_configs/config/kms/kms_1.yaml
@@ -0,0 +1,21 @@
+Id: '0ff33c82-7fe1-482b-a0ca-67565806ee4b'
+Name: kms_1
+InterComAddr: 0.0.0.0:50910
+GRPCAddr: 127.0.0.1:50900
+QuantumAddr: 0.0.0.0:50911
+AkmsURL: "http://127.0.0.1:4444/api/v1/keys/push_ksa_key"
+AkmsCkmsServerPort: "9696"
+TLS: true
+CAFile: "../artifacts/ssl/ca.crt"
+CertFile: "../artifacts/ssl/debug-ekms/ekms1-selfsigned.crt"
+KeyFile: "../artifacts/ssl/debug-ekms/ekms1-selfsigned.key"
+Peers:
+ # peer to kms_2
+ - PeerId: '5e41c291-6121-4335-84f6-41e04b8bdaa2'
+ PeerInterComAddr: 127.0.0.1:51910
+ Sync: true
+ Type: danet
+ # quantum module of type emulated at the given address
+ QuantumModule:
+ Type: emulated
+ Address: 172.200.20.20
diff --git a/debug_configs/config/kms/kms_2.json b/debug_configs/config/kms/kms_2.json
new file mode 100644
index 0000000000000000000000000000000000000000..d8d510d3188933a02e035b0697336f2f1290e744
--- /dev/null
+++ b/debug_configs/config/kms/kms_2.json
@@ -0,0 +1,12 @@
+{
+ "path-id": "38e0588b-6a2d-42c9-85a0-887cc877c299",
+ "prev-hop": {
+ "node-id": "0ff33c82-7fe1-482b-a0ca-67565806ee4b",
+ "ip-address": "kms_1",
+ "port": 50910
+ },
+ "initiating-kms-address": {
+ "initiating-kms-ip": "kms_1",
+ "initiating-kms-port": 50910
+ }
+}
diff --git a/debug_configs/config/kms/kms_2.yaml b/debug_configs/config/kms/kms_2.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..98a4e7263d468e9d346a6ecc9346ae00ca70c1ff
--- /dev/null
+++ b/debug_configs/config/kms/kms_2.yaml
@@ -0,0 +1,21 @@
+Id: '5e41c291-6121-4335-84f6-41e04b8bdaa2'
+Name: kms_2
+InterComAddr: 0.0.0.0:50910
+GRPCAddr: 0.0.0.0:50900
+QuantumAddr: 0.0.0.0:50911
+AkmsURL: "http://akms-simulator_2:4444/api/v1/keys/push_ksa_key"
+AkmsCkmsServerPort: "9696"
+TLS: true
+CAFile: "ssl/ca.crt"
+CertFile: "ssl/debug-ekms/ekms2-selfsigned.crt"
+KeyFile: "ssl/debug-ekms/ekms2-selfsigned.key"
+Peers:
+ # peer to kms_1
+ - PeerId: '0ff33c82-7fe1-482b-a0ca-67565806ee4b'
+ PeerInterComAddr: 172.18.0.1:50910
+ Sync: false
+ Type: danet
+ # quantum module of type emulated at the given address
+ QuantumModule:
+ Type: emulated
+ Hostname: quantumlayer_2
diff --git a/debug_configs/config/kms/tlsConfigs/ekms01ReqConfig.txt b/debug_configs/config/kms/tlsConfigs/ekms01ReqConfig.txt
new file mode 100644
index 0000000000000000000000000000000000000000..2aee4a01faaffa3d9f9530ded5d6b7cf14e99bb3
--- /dev/null
+++ b/debug_configs/config/kms/tlsConfigs/ekms01ReqConfig.txt
@@ -0,0 +1,17 @@
+[req]
+default_bits = 4096
+default_md = sha256
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = DE
+O = H_DA
+CN = kms_1
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+[alt_names]
+IP.1 = 172.18.0.1
+IP.2 = 172.200.20.1
diff --git a/debug_configs/config/kms/tlsConfigs/ekms02ReqConfig.txt b/debug_configs/config/kms/tlsConfigs/ekms02ReqConfig.txt
new file mode 100644
index 0000000000000000000000000000000000000000..e3628496f3704e6fa9ad4d979ddd5f2e5f3c010e
--- /dev/null
+++ b/debug_configs/config/kms/tlsConfigs/ekms02ReqConfig.txt
@@ -0,0 +1,17 @@
+[req]
+default_bits = 4096
+default_md = sha256
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = DE
+O = H_DA
+CN = kms_2
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+[alt_names]
+IP.1 = 127.0.0.1
+IP.2 = 172.200.20.12
diff --git a/debug_configs/config/quantumlayer/quantumlayer_1.yaml b/debug_configs/config/quantumlayer/quantumlayer_1.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..21fb247f4990d997a6c7d670b3d4ae951fc30bb8
--- /dev/null
+++ b/debug_configs/config/quantumlayer/quantumlayer_1.yaml
@@ -0,0 +1,4 @@
+KMSAddr: 'host.docker.internal:50911'
+UDPAddr: '0.0.0.0:50901'
+PeerUDPAddr: 'quantumlayer_2:50901'
+GenerateKeys: true
diff --git a/debug_configs/config/quantumlayer/quantumlayer_2.yaml b/debug_configs/config/quantumlayer/quantumlayer_2.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..d0e21821093a5582359c9ec464b2f6f436d24431
--- /dev/null
+++ b/debug_configs/config/quantumlayer/quantumlayer_2.yaml
@@ -0,0 +1,4 @@
+KMSAddr: 'kms_2:50911'
+UDPAddr: '0.0.0.0:50901'
+PeerUDPAddr: 'quantumlayer_1:50901'
+GenerateKeys: false
diff --git a/docker-compose.yml b/docker-compose.yml
index 5eaa84e6e7d09783219b207815df20b67c0eff3e..363d275fa2133ccaed58771050e067242b91a5e8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,36 +1,40 @@
services:
ekms01:
image: ekms
- command: ["start", "--log", "info", "--kms_config", "/tmp/kms/config/ekms01.yaml", "--insecure"]
+ command: ["start", "--log", "debug", "--kms_config", "/tmp/kms/config/ekms01.yaml", "--insecure"]
volumes:
- ./config/ekms/example01.yaml:/tmp/kms/config/ekms01.yaml
+ - ./artifacts/ssl:/ssl
networks:
ekms-net:
ipv4_address: 172.100.20.10
ekms02:
image: ekms
- command: ["start", "--log", "info", "--kms_config", "/tmp/kms/config/ekms02.yaml", "--insecure"]
+ command: ["start", "--log", "debug", "--kms_config", "/tmp/kms/config/ekms02.yaml", "--insecure"]
volumes:
- ./config/ekms/example02.yaml:/tmp/kms/config/ekms02.yaml
+ - ./artifacts/ssl:/ssl
networks:
ekms-net:
ipv4_address: 172.100.20.11
ekms03:
image: ekms
- command: ["start", "--log", "info", "--kms_config", "/tmp/kms/config/ekms03.yaml", "--insecure"]
+ command: ["start", "--log", "debug", "--kms_config", "/tmp/kms/config/ekms03.yaml", "--insecure"]
volumes:
- ./config/ekms/example03.yaml:/tmp/kms/config/ekms03.yaml
+ - ./artifacts/ssl:/ssl
networks:
ekms-net:
ipv4_address: 172.100.20.12
ekms04:
image: ekms
- command: ["start", "--log", "info", "--kms_config", "/tmp/kms/config/ekms04.yaml", "--insecure"]
+ command: ["start", "--log", "debug", "--kms_config", "/tmp/kms/config/ekms04.yaml", "--insecure"]
volumes:
- ./config/ekms/example04.yaml:/tmp/kms/config/ekms04.yaml
+ - ./artifacts/ssl:/ssl
networks:
ekms-net:
ipv4_address: 172.100.20.13
diff --git a/docker-compose_debug_kms.yml b/docker-compose_debug_kms.yml
new file mode 100644
index 0000000000000000000000000000000000000000..03314cc28cd3c56ab9b51c60de7c6e014271db8c
--- /dev/null
+++ b/docker-compose_debug_kms.yml
@@ -0,0 +1,66 @@
+services:
+ #kms_1:
+ #image: ekms
+ #command: ["start", "--log", "debug", "--kms_config", "/tmp/kms/config/kms_1.yaml", "--insecure"]
+ #volumes:
+ # - ./debug_configs/config/kms/kms_1.yaml:/tmp/kms/config/kms_1.yaml
+ #ports:
+ # - "127.0.0.1:7030:7030"
+ # - "127.0.0.1:9696:9696"
+
+ kms_2:
+ image: ekms
+ command: ["start", "--log", "debug", "--kms_config", "/tmp/kms/config/kms_2.yaml", "--insecure"]
+ volumes:
+ - ./debug_configs/config/kms/kms_2.yaml:/tmp/kms/config/kms_2.yaml
+ - ./artifacts/ssl:/ssl
+ ports:
+ - "127.0.0.1:7031:7030"
+ - "127.0.0.1:51910:50910"
+ extra_hosts:
+ - "host.docker.internal:host-gateway"
+ networks:
+ ekms-debug-net:
+ ipv4_address: 172.200.20.12
+
+ quantumlayer_1:
+ image: quantumlayer
+ command: ["--log", "debug", "--config", "/tmp/quantumlayer/config/quantumlayer_1.yaml"]
+ volumes:
+ - ./debug_configs/config/quantumlayer/quantumlayer_1.yaml:/tmp/quantumlayer/config/quantumlayer_1.yaml
+ extra_hosts:
+ - "host.docker.internal:host-gateway"
+ networks:
+ ekms-debug-net:
+ ipv4_address: 172.200.20.20
+
+ quantumlayer_2:
+ image: quantumlayer
+ command: ["--log", "debug", "--config", "/tmp/quantumlayer/config/quantumlayer_2.yaml"]
+ volumes:
+ - ./debug_configs/config/quantumlayer/quantumlayer_2.yaml:/tmp/quantumlayer/config/quantumlayer_2.yaml
+ networks:
+ ekms-debug-net:
+
+ akms-simulator_1:
+ image: akms-simulator
+ ports:
+ - "127.0.0.1:4444:4444"
+ networks:
+ ekms-debug-net:
+
+ akms-simulator_2:
+ image: akms-simulator
+ ports:
+ - "127.0.0.1:4445:4444"
+ networks:
+ ekms-debug-net:
+
+
+networks:
+ ekms-debug-net:
+ ipam:
+ driver: default
+ config:
+ - subnet: "172.200.20.0/24"
+ name: ekms-debug-net
diff --git a/ekms/etsiqkdnclient/etsi-qkdn-client.go b/ekms/etsiqkdnclient/etsi-qkdn-client.go
index 9c9e5c191eca9f22ca8b6fc828e6a45fd3553008..17536ba69ae56e8bf27cab4bb8d594f7c1d8a455 100644
--- a/ekms/etsiqkdnclient/etsi-qkdn-client.go
+++ b/ekms/etsiqkdnclient/etsi-qkdn-client.go
@@ -1,13 +1,16 @@
package etsiqkdnclient
import (
+ "crypto/tls"
+ "crypto/x509"
+ "fmt"
"net"
"os"
"time"
- "github.com/sirupsen/logrus"
log "github.com/sirupsen/logrus"
"google.golang.org/grpc"
+ "google.golang.org/grpc/credentials"
"google.golang.org/grpc/credentials/insecure"
"code.fbi.h-da.de/danet/quant/ekms/internal/akmsCkmsServer"
@@ -48,6 +51,7 @@ type Config struct {
Id string `yaml:"Id"`
Name string `yaml:"Name"`
InterComAddr string `yaml:"InterComAddr"`
+ QuantumAddr string `yaml:"QuantumAddr"`
GRPCAddr string `yaml:"GRPCAddr"`
AkmsURL string `yaml:"AkmsURL"`
AkmsCkmsServerPort string `yaml:"AkmsCkmsServerPort"`
@@ -58,6 +62,10 @@ type Config struct {
Type string `yaml:"Type"`
QuantumModule QuantumModule `yaml:"QuantumModule"`
} `yaml:"Peers"`
+ TLS bool `yaml:"TLS"`
+ CAFile string `yaml:"CAFile"`
+ CertFile string `yaml:"CertFile"`
+ KeyFile string `yaml:"KeyFile"`
}
type QuantumModule struct {
@@ -119,13 +127,13 @@ func NewEkmsClient(config *Config) (myInfo *ekmsInfo) {
for i, peer := range config.Peers {
// If the address is not set, try to resolve the hostname.
if peer.QuantumModule.Address == "" && peer.QuantumModule.Hostname != "" {
- logrus.Info("Trying to get IP from hostname for quantum module: ", peer.QuantumModule.Hostname)
+ log.Info("Trying to get IP from hostname for quantum module: ", peer.QuantumModule.Hostname)
for j := 0; j < connectionRetries; j++ {
ipAddr, err = net.LookupIP(peer.QuantumModule.Hostname)
if err == nil {
break
}
- logrus.Errorf("Failed to get IP from hostname %s, retrying in 2 seconds (attempt %d/%d)", peer.QuantumModule.Hostname, j+1, connectionRetries)
+ log.Errorf("Failed to get IP from hostname %s, retrying in 2 seconds (attempt %d/%d)", peer.QuantumModule.Hostname, j+1, connectionRetries)
time.Sleep(2 * time.Second)
}
if err != nil {
@@ -162,7 +170,14 @@ func NewEkmsClient(config *Config) (myInfo *ekmsInfo) {
// TODO: return an error.
func emulatedKMS(config *Config, id uuid.UUID) *kms.EKMS {
// Attach to eKMS
- emuKMS := kms.NewEKMS(config.Name, id, os.Stdout, log.GetLevel(), false, config.InterComAddr, config.AkmsURL)
+ tlsData := kms.TlsData{
+ TLS: config.TLS,
+ CaFile: config.CAFile,
+ CertFile: config.CertFile,
+ KeyFile: config.KeyFile,
+ }
+
+ emuKMS := kms.NewEKMS(config.Name, id, os.Stdout, log.GetLevel(), false, config.InterComAddr, config.QuantumAddr, config.AkmsURL, tlsData)
var qm kms.QuantumModule
var err error
@@ -188,7 +203,18 @@ func emulatedKMS(config *Config, id uuid.UUID) *kms.EKMS {
return nil
}
- newPeerConn, err := grpc.Dial(peer.PeerInterComAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ var gRPCTransportCreds credentials.TransportCredentials
+ if config.TLS {
+ gRPCTransportCreds, err = generateGRPCClientTransportCredsWithTLS(config.CAFile, config.CertFile, config.KeyFile)
+ if err != nil {
+ log.Error(err)
+ return nil
+ }
+ } else {
+ gRPCTransportCreds = insecure.NewCredentials()
+ }
+
+ newPeerConn, err := grpc.Dial(peer.PeerInterComAddr, grpc.WithTransportCredentials(gRPCTransportCreds))
if err != nil {
return nil
}
@@ -211,7 +237,9 @@ func emulatedKMS(config *Config, id uuid.UUID) *kms.EKMS {
go func() {
time.Sleep(time.Second * 32)
if err := p.SyncBulkKeys(); err != nil {
- log.Println("SYNC ERROR: ", err)
+ log.Info("SYNC ERROR: ", err)
+ } else {
+ log.Info("SYNCED successfully!")
}
}()
}
@@ -220,7 +248,7 @@ func emulatedKMS(config *Config, id uuid.UUID) *kms.EKMS {
// Start the akmsCkmsReceiverServer
if config.AkmsCkmsServerPort != "" {
akmsCkmsReceiverServer := akmsCkmsServer.NewAKMSReceiver(config.AkmsCkmsServerPort, emuKMS)
- logrus.Infof("Starting AKMS receiver server on port: %s", config.AkmsCkmsServerPort)
+ log.Infof("Starting AKMS receiver server on port: %s", config.AkmsCkmsServerPort)
go akmsCkmsReceiverServer.Serve()
}
@@ -238,3 +266,28 @@ func (qkdnInfo *ekmsInfo) ID() uuid.UUID {
func (qkdnInfo *ekmsInfo) Ekms() *kms.EKMS {
return qkdnInfo.kms
}
+
+func generateGRPCClientTransportCredsWithTLS(caFilePath, certFile, keyFile string) (credentials.TransportCredentials, error) {
+ cp := x509.NewCertPool()
+
+ b, err := os.ReadFile(caFilePath)
+ if err != nil {
+ return nil, err
+ }
+ if !cp.AppendCertsFromPEM(b) {
+ return nil, fmt.Errorf("credentials: failed to append certificates")
+ }
+
+ cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+ if err != nil {
+ return nil, err
+ }
+
+ tlsConfig := &tls.Config{
+ MinVersion: tls.VersionTLS13,
+ RootCAs: cp,
+ Certificates: []tls.Certificate{cert},
+ }
+
+ return credentials.NewTLS(tlsConfig), nil
+}
diff --git a/ekms/internal/kms/kms.go b/ekms/internal/kms/kms.go
index 8c7157e63aad28fdc8384be7cbc9c560611e1518..be0babf2c8823790405a1207636c6e0a9c9d8d48 100644
--- a/ekms/internal/kms/kms.go
+++ b/ekms/internal/kms/kms.go
@@ -6,15 +6,19 @@ package kms
import (
"context"
+ "crypto/tls"
+ "crypto/x509"
"encoding/base64"
"fmt"
"io"
"net"
+ "os"
"sync"
"time"
log "github.com/sirupsen/logrus"
"google.golang.org/grpc"
+ "google.golang.org/grpc/credentials"
"google.golang.org/grpc/credentials/insecure"
"google.golang.org/grpc/health"
healthpb "google.golang.org/grpc/health/grpc_health_v1"
@@ -57,9 +61,11 @@ type PlatformKey struct {
// The general emulated KMS.
type EKMS struct {
- kmsName string
- kmsUUID uuid.UUID
- interComAddr string
+ kmsName string
+ kmsUUID uuid.UUID
+ interComAddr string
+ quantumAddress string
+ tlsData TlsData
// TODO create a mapping between ids and address
remoteKMSMapping map[string]*RemoteKMS
remoteKMSMappingMutex sync.RWMutex
@@ -80,6 +86,13 @@ type EKMS struct {
Receiver *Receiver
}
+type TlsData struct {
+ TLS bool
+ CaFile string
+ CertFile string
+ KeyFile string
+}
+
// Will keep information about the quantum elements that this EKMS is talking to
// This actually constitutes a quantum element with only a single link
@@ -88,7 +101,7 @@ type QuantumElementInterface interface {
GetQlID() qlElementId
}*/
-func NewEKMS(kmsName string, kmsUUID uuid.UUID, logOutput io.Writer, logLevel log.Level, logInJson bool, interComAddr string, akmsURL string) (newEKMS *EKMS) {
+func NewEKMS(kmsName string, kmsUUID uuid.UUID, logOutput io.Writer, logLevel log.Level, logInJson bool, interComAddr, quantumAddress string, akmsURL string, tlsData TlsData) (newEKMS *EKMS) {
/*
* Setup logging
*/
@@ -115,6 +128,8 @@ func NewEKMS(kmsName string, kmsUUID uuid.UUID, logOutput io.Writer, logLevel lo
kmsName: kmsName,
kmsUUID: kmsUUID,
interComAddr: interComAddr,
+ quantumAddress: quantumAddress,
+ tlsData: tlsData,
remoteKMSMapping: make(map[string]*RemoteKMS),
quantumModules: make(map[string]QuantumModule),
routingTable: make(map[uuid.UUID]*Route),
@@ -131,25 +146,42 @@ func NewEKMS(kmsName string, kmsUUID uuid.UUID, logOutput io.Writer, logLevel lo
createdEKMS.supportedKeyLengths[BitKeyLen256] = true
// start the inter communication gRPC server
- go createdEKMS.startGRPC(interComAddr)
+ go createdEKMS.startGRPC(interComAddr, quantumAddress, tlsData)
return createdEKMS
}
-func (kms *EKMS) startGRPC(interComAddr string) {
- lis, err := net.Listen("tcp", interComAddr)
+func (kms *EKMS) startGRPC(interComAddr string, quantumAddress string, tlsData TlsData) {
+ interKMSLis, err := net.Listen("tcp", interComAddr)
if err != nil {
log.Fatalf("failed to listen: %v", err)
}
- s := grpc.NewServer()
+
+ var gRPCTransportCreds credentials.TransportCredentials
+ if tlsData.TLS {
+ gRPCTransportCreds, err = generateGRPCServerTransportCredsWithTLS(tlsData.CaFile, tlsData.CertFile, tlsData.KeyFile)
+ if err != nil {
+ log.Fatalf("unable to generate TLS creds: %v", err)
+ }
+ } else {
+ gRPCTransportCreds = insecure.NewCredentials()
+ }
+
+ interKMSServer := grpc.NewServer(grpc.Creds(gRPCTransportCreds))
healthCheck := health.NewServer()
- healthpb.RegisterHealthServer(s, healthCheck)
- pbIC.RegisterKmsTalkerServer(s, &kmsTalkerServer{
+ healthpb.RegisterHealthServer(interKMSServer, healthCheck)
+ pbIC.RegisterKmsTalkerServer(interKMSServer, &kmsTalkerServer{
keyNegotiationMap: make(map[uuid.UUID]*kmsKSElement),
eKMS: kms,
})
- pbQS.RegisterKmsQkdmCommunicationServiceServer(s, &quipSecServer{
+
+ quantumLis, err := net.Listen("tcp", quantumAddress)
+ if err != nil {
+ log.Fatalf("failed to listen: %v", err)
+ }
+ quantumServ := grpc.NewServer()
+ pbQS.RegisterKmsQkdmCommunicationServiceServer(quantumServ, &quipSecServer{
eKMS: kms,
})
@@ -161,8 +193,11 @@ func (kms *EKMS) startGRPC(interComAddr string) {
// for{}
}()
- log.Infof("server listening at %v", lis.Addr())
- if err := s.Serve(lis); err != nil {
+ log.Infof("quantum server listening at %v", quantumLis.Addr())
+ go quantumServ.Serve(quantumLis) //nolint:errcheck
+
+ log.Infof("inter KMS server listening at %v", interKMSLis.Addr())
+ if err := interKMSServer.Serve(interKMSLis); err != nil {
log.Fatalf("failed to serve: %v", err)
}
}
@@ -378,7 +413,17 @@ func (kms *EKMS) GenerateAndSendKSAKey(remoteKMSId string, pathId uuid.UUID, req
// TODO: move this somewhere else!
// send to remote
- remoteConn, err := grpc.Dial(remoteKMS.Address, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ var gRPCTransportCreds credentials.TransportCredentials
+ if kms.tlsData.TLS {
+ gRPCTransportCreds, err = generateGRPCClientTransportCredsWithTLS(kms.tlsData.CaFile, kms.tlsData.CertFile, kms.tlsData.KeyFile)
+ if err != nil {
+ log.Fatalf("unable to generate TLS creds: %v", err)
+ }
+ } else {
+ gRPCTransportCreds = insecure.NewCredentials()
+ }
+
+ remoteConn, err := grpc.Dial(remoteKMS.Address, grpc.WithTransportCredentials(gRPCTransportCreds))
if err != nil {
log.Error(err)
return err
@@ -462,3 +507,54 @@ func (kms *EKMS) PeersDeepCopy() map[string]*kmsPeer {
return peersCopy
}
+
+func generateGRPCServerTransportCredsWithTLS(caFilePath, certFile, keyFile string) (credentials.TransportCredentials, error) {
+ cp := x509.NewCertPool()
+ b, err := os.ReadFile(caFilePath)
+ if err != nil {
+ return nil, err
+ }
+
+ if !cp.AppendCertsFromPEM(b) {
+ return nil, fmt.Errorf("credentials: failed to append certificates")
+ }
+
+ cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+ if err != nil {
+ return nil, err
+ }
+
+ tlsConfig := &tls.Config{
+ MinVersion: tls.VersionTLS13,
+ ClientCAs: cp,
+ Certificates: []tls.Certificate{cert},
+ ClientAuth: tls.RequireAndVerifyClientCert,
+ }
+
+ return credentials.NewTLS(tlsConfig), nil
+}
+
+func generateGRPCClientTransportCredsWithTLS(caFilePath, certFile, keyFile string) (credentials.TransportCredentials, error) {
+ cp := x509.NewCertPool()
+
+ b, err := os.ReadFile(caFilePath)
+ if err != nil {
+ return nil, err
+ }
+ if !cp.AppendCertsFromPEM(b) {
+ return nil, fmt.Errorf("credentials: failed to append certificates")
+ }
+
+ cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+ if err != nil {
+ return nil, err
+ }
+
+ tlsConfig := &