2018-07-09 18:43:13 +01:00
|
|
|
// Copyright (C) 2018 Storj Labs, Inc.
|
|
|
|
// See LICENSE for copying information.
|
|
|
|
|
|
|
|
package peertls
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto"
|
|
|
|
"crypto/ecdsa"
|
2018-08-13 09:39:45 +01:00
|
|
|
"crypto/rand"
|
2018-07-09 18:43:13 +01:00
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
2018-08-13 09:39:45 +01:00
|
|
|
"encoding/pem"
|
|
|
|
"io"
|
2018-07-09 18:43:13 +01:00
|
|
|
|
|
|
|
"github.com/zeebo/errs"
|
|
|
|
)
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
const (
|
|
|
|
// BlockTypeEcPrivateKey is the value to define a block type of private key
|
|
|
|
BlockTypeEcPrivateKey = "EC PRIVATE KEY"
|
|
|
|
// BlockTypeCertificate is the value to define a block type of certificate
|
|
|
|
BlockTypeCertificate = "CERTIFICATE"
|
|
|
|
// BlockTypeIDOptions is the value to define a block type of id options
|
|
|
|
// (e.g. `version`)
|
|
|
|
BlockTypeIDOptions = "ID OPTIONS"
|
|
|
|
)
|
|
|
|
|
2018-07-09 18:43:13 +01:00
|
|
|
var (
|
|
|
|
// ErrNotExist is used when a file or directory doesn't exist
|
|
|
|
ErrNotExist = errs.Class("file or directory not found error")
|
2018-08-27 18:28:16 +01:00
|
|
|
// ErrGenerate is used when an error occurred during cert/key generation
|
2018-07-09 18:43:13 +01:00
|
|
|
ErrGenerate = errs.Class("tls generation error")
|
2018-08-27 18:28:16 +01:00
|
|
|
// ErrUnsupportedKey is used when key type is not supported
|
2018-08-13 09:39:45 +01:00
|
|
|
ErrUnsupportedKey = errs.Class("unsupported key type")
|
2018-07-09 18:43:13 +01:00
|
|
|
// ErrTLSTemplate is used when an error occurs during tls template generation
|
|
|
|
ErrTLSTemplate = errs.Class("tls template error")
|
|
|
|
// ErrVerifyPeerCert is used when an error occurs during `VerifyPeerCertificate`
|
|
|
|
ErrVerifyPeerCert = errs.Class("tls peer certificate verification error")
|
|
|
|
// ErrVerifySignature is used when a cert-chain signature verificaion error occurs
|
|
|
|
ErrVerifySignature = errs.Class("tls certificate signature verification error")
|
|
|
|
)
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
// PeerCertVerificationFunc is the signature for a `*tls.Config{}`'s
|
|
|
|
// `VerifyPeerCertificate` function.
|
|
|
|
type PeerCertVerificationFunc func([][]byte, [][]*x509.Certificate) error
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-27 18:28:16 +01:00
|
|
|
// NewKey returns a new PrivateKey
|
2018-08-13 09:39:45 +01:00
|
|
|
func NewKey() (crypto.PrivateKey, error) {
|
|
|
|
k, err := ecdsa.GenerateKey(authECCurve, rand.Reader)
|
|
|
|
if err != nil {
|
2018-08-22 07:39:57 +01:00
|
|
|
return nil, ErrGenerate.New("failed to generate private key: %v", err)
|
2018-08-13 09:39:45 +01:00
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
return k, nil
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
// NewCert returns a new x509 certificate using the provided templates and
|
|
|
|
// signed by the `signer` key
|
2018-08-23 15:08:26 +01:00
|
|
|
func NewCert(template, parentTemplate *x509.Certificate, pubKey crypto.PublicKey, signer crypto.PrivateKey) (*x509.Certificate, error) {
|
2018-08-13 09:39:45 +01:00
|
|
|
k, ok := signer.(*ecdsa.PrivateKey)
|
|
|
|
if !ok {
|
|
|
|
return nil, ErrUnsupportedKey.New("%T", k)
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
if parentTemplate == nil {
|
|
|
|
parentTemplate = template
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
cb, err := x509.CreateCertificate(
|
|
|
|
rand.Reader,
|
|
|
|
template,
|
|
|
|
parentTemplate,
|
2018-08-23 15:08:26 +01:00
|
|
|
pubKey,
|
2018-08-13 09:39:45 +01:00
|
|
|
k,
|
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errs.Wrap(err)
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
c, err := x509.ParseCertificate(cb)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errs.Wrap(err)
|
|
|
|
}
|
|
|
|
return c, nil
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
// VerifyPeerFunc combines multiple `*tls.Config#VerifyPeerCertificate`
|
|
|
|
// functions and adds certificate parsing.
|
|
|
|
func VerifyPeerFunc(next ...PeerCertVerificationFunc) PeerCertVerificationFunc {
|
|
|
|
return func(chain [][]byte, _ [][]*x509.Certificate) error {
|
|
|
|
c, err := parseCertificateChains(chain)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
for _, n := range next {
|
|
|
|
if n != nil {
|
|
|
|
if err := n(chain, [][]*x509.Certificate{c}); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
2018-08-13 09:39:45 +01:00
|
|
|
return nil
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
2018-08-13 09:39:45 +01:00
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-27 23:23:48 +01:00
|
|
|
// VerifyPeerCertChains verifies that the first certificate chain contains certificates
|
|
|
|
// which are signed by their respective parents, ending with a self-signed root
|
2018-08-13 09:39:45 +01:00
|
|
|
func VerifyPeerCertChains(_ [][]byte, parsedChains [][]*x509.Certificate) error {
|
|
|
|
return verifyChainSignatures(parsedChains[0])
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
// NewKeyBlock converts an ASN1/DER-encoded byte-slice of a private key into
|
|
|
|
// a `pem.Block` pointer
|
|
|
|
func NewKeyBlock(b []byte) *pem.Block {
|
|
|
|
return &pem.Block{Type: BlockTypeEcPrivateKey, Bytes: b}
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewCertBlock converts an ASN1/DER-encoded byte-slice of a tls certificate
|
|
|
|
// into a `pem.Block` pointer
|
|
|
|
func NewCertBlock(b []byte) *pem.Block {
|
|
|
|
return &pem.Block{Type: BlockTypeCertificate, Bytes: b}
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
|
2018-08-27 18:28:16 +01:00
|
|
|
// TLSCert creates a tls.Certificate from chains, key and leaf
|
2018-08-13 09:39:45 +01:00
|
|
|
func TLSCert(chain [][]byte, leaf *x509.Certificate, key crypto.PrivateKey) (*tls.Certificate, error) {
|
|
|
|
var err error
|
|
|
|
if leaf == nil {
|
|
|
|
leaf, err = x509.ParseCertificate(chain[0])
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
return &tls.Certificate{
|
|
|
|
Leaf: leaf,
|
|
|
|
Certificate: chain,
|
|
|
|
PrivateKey: key,
|
|
|
|
}, nil
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
// WriteChain writes the certificate chain (leaf-first) to the writer, PEM-encoded.
|
|
|
|
func WriteChain(w io.Writer, chain ...*x509.Certificate) error {
|
|
|
|
if len(chain) < 1 {
|
|
|
|
return errs.New("expected at least one certificate for writing")
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
for _, c := range chain {
|
|
|
|
if err := pem.Encode(w, NewCertBlock(c.Raw)); err != nil {
|
|
|
|
return errs.Wrap(err)
|
|
|
|
}
|
captplanet (#159)
* captplanet
I kind of went overboard this weekend.
The major goal of this changeset is to provide an environment
for local development where all of the various services can
be easily run together. Developing on Storj v3 should be as
easy as running a setup command and a run command!
To do this, this changeset introduces a new tool called
captplanet, which combines the powers of the Overlay Cache,
the PointerDB, the PieceStore, Kademlia, the Minio Gateway,
etc.
Running 40 farmers and a heavy client inside the same process
forced a rethinking of the "services" that we had. To
avoid confusion by reusing prior terms, this changeset
introduces two new types: Providers and Responsibilities.
I wanted to avoid as many merge conflicts as possible, so
I left the existing Services and code for now, but if people
like this route we can clean up the duplication.
A Responsibility is a collection of gRPC methods and
corresponding state. The following systems are examples of
Responsibilities:
* Kademlia
* OverlayCache
* PointerDB
* StatDB
* PieceStore
* etc.
A Provider is a collection of Responsibilities that
share an Identity, such as:
* The heavy client
* The farmer
* The gateway
An Identity is a public/private key pair, a node id, etc.
Farmers all need different Identities, so captplanet
needs to support running multiple concurrent Providers
with different Identities.
Each Responsibility and Provider should allow for configuration
of multiple copies on its own so creating Responsibilities and
Providers use a new workflow.
To make a Responsibility, one should create a "config"
struct, such as:
```
type Config struct {
RepairThreshold int `help:"If redundancy falls below this number of
pieces, repair is triggered" default:"30"`
SuccessThreshold int `help:"If redundancy is above this number then
no additional uploads are needed" default:"40"`
}
```
To use "config" structs, this changeset introduces another
new library called 'cfgstruct', which allows for the configuration
of arbitrary structs through flagsets, and thus through cobra and
viper.
cfgstruct relies on Go's "struct tags" feature to document
help information and default values. Config structs can be
configured via cfgstruct.Bind for binding the struct to a flagset.
Because this configuration system makes setup and configuration
easier *in general*, additional commands are provided that allow
for easy standup of separate Providers. Please make sure to
check out:
* cmd/captplanet/farmer/main.go (a new farmer binary)
* cmd/captplanet/hc/main.go (a new heavy client binary)
* cmd/captplanet/gw/main.go (a new minio gateway binary)
Usage:
```
$ go install -v storj.io/storj/cmd/captplanet
$ captplanet setup
$ captplanet run
```
Configuration is placed by default in `~/.storj/capt/`
Other changes:
* introduces new config structs for currently existing
Responsibilities that conform to the new Responsibility
interface. Please see the `pkg/*/config.go` files for
examples.
* integrates the PointerDB API key with other global
configuration via flags, instead of through environment
variables through viper like it's been doing. (ultimately
this should also change to use the PointerDB config
struct but this is an okay shortterm solution).
* changes the Overlay cache to use a URL for database
configuration instead of separate redis and bolt config
settings.
* stubs out some peer identity skeleton code (but not the
meat).
* Fixes the SegmentStore to use the overlay client and
pointerdb clients instead of gRPC client code directly
* Leaves a very clear spot where we need to tie the object to
stream to segment store together. There's sort of a "golden
spike" opportunity to connect all the train tracks together
at the bottom of pkg/miniogw/config.go, labeled with a
bunch of TODOs.
Future stuff:
* I now prefer this design over the original
pkg/process.Service thing I had been pushing before (sorry!)
* The experience of trying to have multiple farmers
configurable concurrently led me to prefer config structs
over global flags (I finally came around) or using viper
directly. I think global flags are okay sometimes but in
general going forward we should try and get all relevant
config into config structs.
* If you all like this direction, I think we can go delete my
old Service interfaces and a bunch of flags and clean up a
bunch of stuff.
* If you don't like this direction, it's no sweat at all, and
despite how much code there is here I'm not very tied to any
of this! Considering a lot of this was written between midnight
and 6 am, it might not be any good!
* bind tests
2018-07-24 17:08:28 +01:00
|
|
|
}
|
2018-08-13 09:39:45 +01:00
|
|
|
return nil
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-27 18:28:16 +01:00
|
|
|
// WriteKey writes the private key to the writer, PEM-encoded.
|
2018-08-13 09:39:45 +01:00
|
|
|
func WriteKey(w io.Writer, key crypto.PrivateKey) error {
|
|
|
|
var (
|
|
|
|
kb []byte
|
|
|
|
err error
|
|
|
|
)
|
|
|
|
|
|
|
|
switch k := key.(type) {
|
|
|
|
case *ecdsa.PrivateKey:
|
|
|
|
kb, err = x509.MarshalECPrivateKey(k)
|
|
|
|
if err != nil {
|
|
|
|
return errs.Wrap(err)
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
return ErrUnsupportedKey.New("%T", k)
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-13 09:39:45 +01:00
|
|
|
if err := pem.Encode(w, NewKeyBlock(kb)); err != nil {
|
|
|
|
return errs.Wrap(err)
|
|
|
|
}
|
|
|
|
return nil
|
2018-07-09 18:43:13 +01:00
|
|
|
}
|