trust

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 14, 2019 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Overview

Package trust defines type Store, a unified interface for TRC and Certificate retrieval.

Index

Constants

View Source 
const (
	// MaxPldAge indicates the maximum age of a control payload signature.
	MaxPldAge = 2 * time.Second
	// MaxInFuture indicates the maximum time a timestamp may be in the future.
	MaxInFuture = time.Second
)
View Source 
const (
	// HandlerTimeout is the handler lifetime.
	HandlerTimeout = 3 * time.Second
)

Variables

View Source 
var (
	// ErrNotFoundLocally indicates that a chain or TRC was not found locally.
	ErrNotFoundLocally = serrors.New("chain/TRC not found locally")
	// ErrMissingAuthoritative indicates that eventhough the trust store is
	// authoritative for the requested object, it wasn't found.
	ErrMissingAuthoritative = serrors.New("trust store is authoritative for requested object," +
		" and object was not found")
	// ErrNotFound indicates that a chain or TRC was not found even after a
	// network lookup.
	ErrNotFound = serrors.New("chain/TRC not found")
	// ErrChainVerification indicates the chain verification failed.
	ErrChainVerification = errors.New("chain verification failed")
	// ErrParse indicates the trust material could not be parsed.
	ErrParse = errors.New("unable to parse")
	// ErrInvalidResponse indicates an invalid response was received.
	ErrInvalidResponse = errors.New("invalid response")
)

Functions

func CreateSignMeta added in v0.4.0 

func CreateSignMeta(ctx context.Context, ia addr.IA,
	trustDB trustdb.TrustDB) (infra.SignerMeta, error)

func VerifyChain added in v0.1.1 

func VerifyChain(ctx context.Context, subject addr.IA, chain *cert.Chain,
	store infra.ExtendedTrustStore) error

VerifyChain verifies the chain based on the TRCs present in the store.

Types

type BasicSigner added in v0.4.0 

type BasicSigner struct {
	// contains filtered or unexported fields
}

BasicSigner is a simple implementation of Signer.

func NewBasicSigner added in v0.4.0 

func NewBasicSigner(key common.RawBytes, meta infra.SignerMeta) (*BasicSigner, error)

NewBasicSigner creates a Signer that uses the supplied meta to sign messages.

func (*BasicSigner) Meta added in v0.4.0 

func (b *BasicSigner) Meta() infra.SignerMeta

Meta returns the meta data the signer uses when signing.

func (*BasicSigner) Sign added in v0.4.0 

func (b *BasicSigner) Sign(msg common.RawBytes) (*proto.SignS, error)

Sign signs the message.

type BasicVerifier added in v0.4.0 

type BasicVerifier struct {
	// contains filtered or unexported fields
}

BasicVerifier is a verifier that ignores signatures on cert_mgmt.TRC and cert_mgmt.Chain messages, to avoid dependency cycles.

func NewBasicVerifier added in v0.4.0 

func NewBasicVerifier(store *Store) *BasicVerifier

NewBasicVerifier creates a new verifier.

func (*BasicVerifier) Verify added in v0.4.0 

func (v *BasicVerifier) Verify(ctx context.Context, msg common.RawBytes, sign *proto.SignS) error

Verify verifies the message based on the provided sign meta data.

func (*BasicVerifier) VerifyPld added in v0.4.0 

func (v *BasicVerifier) VerifyPld(ctx context.Context, spld *ctrl.SignedPld) (*ctrl.Pld, error)

VerifyPld verifies and unpacks the signed payload. In addition to the regular checks, this also verifies that the signature is not older than SignatureValidity.

func (*BasicVerifier) WithIA added in v0.4.0 

func (v *BasicVerifier) WithIA(ia addr.IA) infra.Verifier

WithIA creates a verifier that is bound to the remote AS. Only signatures created by that AS are accepted.

func (*BasicVerifier) WithServer added in v0.4.0 

func (v *BasicVerifier) WithServer(server net.Addr) infra.Verifier

WithServer returns a verifier that requests the required crypto material from the specified server.

func (*BasicVerifier) WithSignatureTimestampRange added in v0.4.0 

func (v *BasicVerifier) WithSignatureTimestampRange(
	timestampRange infra.SignatureTimestampRange) infra.Verifier

WithSignatureTimestampRange returns a verifier that uses the specified signature timestamp range configuration.

func (*BasicVerifier) WithSrc added in v0.4.0 

func (v *BasicVerifier) WithSrc(src ctrl.SignSrcDef) infra.Verifier

WithSrc returns a verifier that is bound to the specified source. The verifies against the specified source, and not the value provided by the sign meta data.

type Config added in v0.1.1 

type Config struct {
	// MustHaveLocalChain states that chain requests for the trust store's own
	// IA must always return a valid chain. This is set to true on infra
	// services BS, CS, PS and false on others.
	MustHaveLocalChain bool
	// ServiceType is the type of the service that uses the store.
	ServiceType proto.ServiceType
	// Router is used to determine paths to other ASes.
	Router snet.Router
	// TopoProvider provides the local topology.
	TopoProvider itopo.ProviderI
}

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store manages requests for TRC and Certificate Chain objects.

Chain and TRC requests from the local process (running the trust store) are handled by GetValidChain/GetChain and GetValidTRC/GetTRC respectively, while requests from other services can be handled via NewXxxReqHandler methods.

By default, a Store object can only return objects that are already present in the database. To allow a Store to use the SCION network to retrieve objects from other infrastructure services, an infra.Messenger must be set with SetMessenger.

Store is backed by a database in package go/lib/infra/modules/trust/trustdb.

func NewStore 

func NewStore(db trustdb.TrustDB, local addr.IA, options Config, logger log.Logger) *Store

NewStore initializes a TRC/Certificate Chain cache/resolver backed by db. Parameter local must specify the AS in which the trust store resides (which is used during request forwarding decisions).

func (*Store) ByAttributes added in v0.4.0 

func (store *Store) ByAttributes(ctx context.Context, isd addr.ISD,
	opts infra.ASInspectorOpts) ([]addr.IA, error)

ByAttributes returns a list of ASes in the specified ISD that hold all attributes.

func (*Store) ChooseServer added in v0.1.1 

func (store *Store) ChooseServer(ctx context.Context, destination addr.IA) (net.Addr, error)

ChooseServer builds a CS address for crypto material regarding the destination AS.

For non CSes this selects an AS-local CS. For CSes this selects

  • a local core CS if destination is isd-local or any core CS.
  • a remote core CS if destination is remote isd.

func (*Store) GetChain 

func (store *Store) GetChain(ctx context.Context, ia addr.IA, version scrypto.Version,
	opts infra.ChainOpts) (*cert.Chain, error)

GetChain asks the trust store to return a valid certificate chain for ia. The optionally configured server is queried over the network if the certificate chain is not available locally. Otherwise, the default server is queried.

func (*Store) GetTRC 

func (store *Store) GetTRC(ctx context.Context, isd addr.ISD, version scrypto.Version,
	opts infra.TRCOpts) (*trc.TRC, error)

GetTRC asks the trust store to return a valid and active TRC for isd. The optionally configured server is queried over the network if the TRC is not available locally. Otherwise, the default server is queried.

FIXME(roosd): Currently this does not check whether the TRC is active.

func (*Store) HasAttributes added in v0.4.0 

func (store *Store) HasAttributes(ctx context.Context, ia addr.IA,
	opts infra.ASInspectorOpts) (bool, error)

HasAttributes indicates whether an AS holds all the specified attributes. The first return value is always false for non-primary ASes.

func (*Store) LoadAuthoritativeChain added in v0.1.1 

func (store *Store) LoadAuthoritativeChain(dir string) error

func (*Store) LoadAuthoritativeCrypto added in v0.4.0 

func (store *Store) LoadAuthoritativeCrypto(dir string) error

LoadAuthoritativeCrypto loads the authoritative TRC and chain.

func (*Store) LoadAuthoritativeTRC added in v0.1.1 

func (store *Store) LoadAuthoritativeTRC(dir string) error

func (*Store) NewChainPushHandler added in v0.1.1 

func (store *Store) NewChainPushHandler() infra.Handler

NewChainPushHandler returns an infra.Handler for Certifificate Chain pushes coming from a peer, backed by the trust store. Certificate chains are pushed by other ASes during core registration. Pushes are allowed from all local ISD sources.

func (*Store) NewChainReqHandler 

func (store *Store) NewChainReqHandler(recurse bool) infra.Handler

NewChainReqHandler returns an infra.Handler for Certificate Chain requests coming from a peer, backed by the trust store. If recurse is set to true, the handler is allowed to issue new TRC and Certificate Chain requests over the network. This method should only be used when servicing requests coming from remote nodes.

func (*Store) NewSigner added in v0.4.0 

func (store *Store) NewSigner(key common.RawBytes, meta infra.SignerMeta) (infra.Signer, error)

func (*Store) NewTRCPushHandler added in v0.1.1 

func (store *Store) NewTRCPushHandler() infra.Handler

NewTRCPushHandler returns an infra.Handler for TRC pushes coming from a peer, backed by the trust store. TRCs are pushed by local BSes during beaconing. Pushes are allowed from all local AS sources.

func (*Store) NewTRCReqHandler 

func (store *Store) NewTRCReqHandler(recurse bool) infra.Handler

NewTRCReqHandler returns an infra.Handler for TRC requests coming from a peer, backed by the trust store. If recurse is set to true, the handler is allowed to issue new TRC requests over the network. This method should only be used when servicing requests coming from remote nodes.

func (*Store) NewVerifier added in v0.4.0 

func (store *Store) NewVerifier() infra.Verifier

func (*Store) SetMessenger 

func (store *Store) SetMessenger(msger infra.Messenger)

SetMessenger enables network access for the trust store via msger. The messenger can only be set once.

type ValidateChainFunc added in v0.4.0 

type ValidateChainFunc func(ctx context.Context, chain *cert.Chain) error

type ValidateTRCFunc added in v0.4.0 

type ValidateTRCFunc func(ctx context.Context, trcObj *trc.TRC) error

Source Files

View all Source files

Directories

Path Synopsis
internal
metrics
Package trustdb provides wrappers for SQL calls for managing a database containing TRCs and Certificate Chains.
 Package trustdb provides wrappers for SQL calls for managing a database containing TRCs and Certificate Chains.
mock_trustdb
Package mock_trustdb is a generated GoMock package.
 Package mock_trustdb is a generated GoMock package.
trustdbsqlite
Package trustdbsqlite implements the trustdb interface with a sqlite backed DB.
 Package trustdbsqlite implements the trustdb interface with a sqlite backed DB.
trustdbtest
v2
internal/decoded
mock_v2
Package mock_v2 is a generated GoMock package.
 Package mock_v2 is a generated GoMock package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.