Skip to content

Commit 484277c

Browse files
mmelonimmeloni
committed
chore: removing audit-signature and add serverSigningPubKey
Signed-off-by: Michele Meloni <[email protected]>
1 parent 10b0c16 commit 484277c

File tree

16 files changed

+110
-157
lines changed

16 files changed

+110
-157
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -336,7 +336,7 @@ Environment variables:
336336
IMMUCLIENT_PKEY=./tools/mtls/4_client/private/localhost.key.pem
337337
IMMUCLIENT_CERTIFICATE=./tools/mtls/4_client/certs/localhost.cert.pem
338338
IMMUCLIENT_CLIENTCAS=./tools/mtls/2_intermediate/certs/ca-chain.cert.pem
339-
IMMUCLIENT_PUBLIC_KEY=
339+
IMMUCLIENT_SERVER_SIGNING_PUB_KEY=
340340

341341
IMPORTANT: All get and safeget functions return base64-encoded keys and values, while all set and safeset functions expect base64-encoded inputs.
342342

‎cmd/immuadmin/command/login_test.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ func TestCommandLine_Connect(t *testing.T) {
5858
options := server.DefaultOptions().WithAuth(true)
5959
bs := servertest.NewBufconnServer(options)
6060

61-
bs.Start()
61+
err := bs.Start()
62+
require.NoError(t, err)
6263
defer bs.Stop()
6364

6465
defer os.RemoveAll(options.Dir)
@@ -73,7 +74,7 @@ func TestCommandLine_Connect(t *testing.T) {
7374
context: context.Background(),
7475
options: opts,
7576
}
76-
err := cmdl.connect(&cobra.Command{}, []string{})
77+
err = cmdl.connect(&cobra.Command{}, []string{})
7778
assert.Nil(t, err)
7879
}
7980

‎cmd/immuclient/audit/auditagent.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ func options() *client.Options {
171171
prometheusPort := viper.GetString("prometheus-port")
172172
prometheusHost := viper.GetString("prometheus-host")
173173
logfilename := viper.GetString("logfile")
174-
publicKey := viper.GetString("public-key")
174+
serverSigningPubKey := viper.GetString("server-signing-pub-key")
175175
options := client.DefaultOptions().
176176
WithPort(port).
177177
WithAddress(address).
@@ -180,7 +180,7 @@ func options() *client.Options {
180180
WithPrometheusPort(prometheusPort).
181181
WithPrometheusHost(prometheusHost).
182182
WithLogFileName(logfilename).
183-
WithPublicKey(publicKey)
183+
WithServerSigningPubKey(serverSigningPubKey)
184184
if mtls {
185185
// todo https://golang.org/src/crypto/x509/root_linux.go
186186
options.MTLsOptions = client.DefaultMTLsOptions().

‎cmd/immuclient/audit/auditor.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,6 @@ func (cAgent *auditAgent) InitAgent() (AuditAgent, error) {
9494
auditDatabases = append(auditDatabases, dbPrefix)
9595
}
9696
}
97-
auditSignature := viper.GetString("audit-signature")
9897
auditNotificationURL := viper.GetString("audit-notification-url")
9998
auditNotificationUsername := viper.GetString("audit-notification-username")
10099
auditNotificationPassword := viper.GetString("audit-notification-password")
@@ -105,8 +104,8 @@ func (cAgent *auditAgent) InitAgent() (AuditAgent, error) {
105104
}
106105

107106
var pk *ecdsa.PublicKey
108-
if cliOpts.PublicKey != "" {
109-
pk, err = signer.ParsePublicKeyFile(cliOpts.PublicKey)
107+
if cliOpts.ServerSigningPubKey != "" {
108+
pk, err = signer.ParsePublicKeyFile(cliOpts.ServerSigningPubKey)
110109
if err != nil {
111110
return nil, err
112111
}
@@ -118,7 +117,6 @@ func (cAgent *auditAgent) InitAgent() (AuditAgent, error) {
118117
auditUsername,
119118
auditPassword,
120119
auditDatabases,
121-
auditSignature,
122120
pk,
123121
auditor.AuditNotificationConfig{
124122
URL: auditNotificationURL,

‎cmd/immuclient/command/init.go‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,10 @@ func (cl *commandline) configureFlags(cmd *cobra.Command) error {
4949
cmd.PersistentFlags().String("audit-username", "", "immudb username used to login during audit")
5050
cmd.PersistentFlags().String("audit-password", "", "immudb password used to login during audit; can be plain-text or base64 encoded (must be prefixed with 'enc:' if it is encoded)")
5151
cmd.PersistentFlags().String("audit-databases", "", "Optional comma-separated list of databases (names) to be audited. Can be full name(s) or just name prefix(es).")
52-
cmd.PersistentFlags().String("audit-signature", "", "Audit signature mode. ignore|validate. If 'ignore' is set auditor doesn't check for the root server signature. If 'validate' is set auditor verify that the root is signed properly by immudb server. Default value is 'ignore'")
5352
cmd.PersistentFlags().String("audit-notification-url", "", "If set, auditor will send a POST request at this URL with audit result details.")
5453
cmd.PersistentFlags().String("audit-notification-username", "", "Username used to authenticate when publishing audit result to 'audit-notification-url'.")
5554
cmd.PersistentFlags().String("audit-notification-password", "", "Password used to authenticate when publishing audit result to 'audit-notification-url'.")
56-
cmd.PersistentFlags().String("public-key", "", "Path to the public key to verify signatures when presents")
55+
cmd.PersistentFlags().String("server-signing-pub-key", "", "Path to the public key to verify signatures when presents")
5756

5857
viper.BindPFlag("immudb-port", cmd.PersistentFlags().Lookup("immudb-port"))
5958
viper.BindPFlag("immudb-address", cmd.PersistentFlags().Lookup("immudb-address"))
@@ -72,11 +71,10 @@ func (cl *commandline) configureFlags(cmd *cobra.Command) error {
7271
viper.BindPFlag("audit-username", cmd.PersistentFlags().Lookup("audit-username"))
7372
viper.BindPFlag("audit-password", cmd.PersistentFlags().Lookup("audit-password"))
7473
viper.BindPFlag("audit-databases", cmd.PersistentFlags().Lookup("audit-databases"))
75-
viper.BindPFlag("audit-signature", cmd.PersistentFlags().Lookup("audit-signature"))
7674
viper.BindPFlag("audit-notification-url", cmd.PersistentFlags().Lookup("audit-notification-url"))
7775
viper.BindPFlag("audit-notification-username", cmd.PersistentFlags().Lookup("audit-notification-username"))
7876
viper.BindPFlag("audit-notification-password", cmd.PersistentFlags().Lookup("audit-notification-password"))
79-
viper.BindPFlag("public-key", cmd.PersistentFlags().Lookup("public-key"))
77+
viper.BindPFlag("server-signing-pub-key", cmd.PersistentFlags().Lookup("server-signing-pub-key"))
8078

8179
viper.SetDefault("immudb-port", client.DefaultOptions().Port)
8280
viper.SetDefault("immudb-address", client.DefaultOptions().Address)
@@ -93,12 +91,11 @@ func (cl *commandline) configureFlags(cmd *cobra.Command) error {
9391
viper.SetDefault("roots-filepath", os.TempDir())
9492
viper.SetDefault("audit-password", "")
9593
viper.SetDefault("audit-username", "")
96-
viper.SetDefault("audit-signature", "ignore")
9794
viper.SetDefault("audit-databases", "")
9895
viper.SetDefault("audit-notification-url", "")
9996
viper.SetDefault("audit-notification-username", "")
10097
viper.SetDefault("audit-notification-password", "")
101-
viper.SetDefault("public-key", "")
98+
viper.SetDefault("server-signing-pub-key", "")
10299
viper.SetDefault("dir", os.TempDir())
103100
return nil
104101
}

‎cmd/immuclient/command/root.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ Environment variables:
3737
IMMUCLIENT_PKEY=./tools/mtls/4_client/private/localhost.key.pem
3838
IMMUCLIENT_CERTIFICATE=./tools/mtls/4_client/certs/localhost.cert.pem
3939
IMMUCLIENT_CLIENTCAS=./tools/mtls/2_intermediate/certs/ca-chain.cert.pem
40-
IMMUCLIENT_PUBLIC_KEY=
40+
IMMUCLIENT_SERVER_SIGNING_PUB_KEY=
4141
4242
IMPORTANT: All get and safeget functions return base64-encoded keys and values, while all set and safeset functions expect base64-encoded inputs.`,
4343
DisableAutoGenTag: true,

‎cmd/immuclient/immuc/init.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ func Options() *client.Options {
118118
WithTokenFileName(viper.GetString("tokenfile")).
119119
WithMTLs(viper.GetBool("mtls")).
120120
WithTokenService(client.NewTokenService().WithTokenFileName(viper.GetString("tokenfile")).WithHds(client.NewHomedirService())).
121-
WithPublicKey(viper.GetString("public-key"))
121+
WithServerSigningPubKey(viper.GetString("server-signing-pub-key"))
122122

123123
if viper.GetBool("mtls") {
124124
// todo https://golang.org/src/crypto/x509/root_linux.go

‎configs/immuclient.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ pkey = "./tools/mtls/4_client/private/localhost.key.pem"
88
certificate = "./tools/mtls/4_client/certs/localhost.cert.pem"
99
clientcas = "./tools/mtls/2_intermediate/certs/ca-chain.cert.pem"
1010
audit-signature = "ignore"
11-
public-key = "" #used to verify signatures
11+
server-signing-pub-key = "" #used to verify signatures

‎pkg/client/auditor/auditor.go‎

Lines changed: 19 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"crypto/ecdsa"
2323
"encoding/base64"
2424
"encoding/json"
25-
"errors"
2625
"fmt"
2726
"io/ioutil"
2827
"net/http"
@@ -61,22 +60,21 @@ type AuditNotificationConfig struct {
6160
}
6261

6362
type defaultAuditor struct {
64-
index uint64
65-
databaseIndex int
66-
logger logger.Logger
67-
serverAddress string
68-
dialOptions []grpc.DialOption
69-
history cache.HistoryCache
70-
ts client.TimestampService
71-
username []byte
72-
databases []string
73-
password []byte
74-
auditDatabases []string
75-
auditSignature string
76-
publicKey *ecdsa.PublicKey
77-
notificationConfig AuditNotificationConfig
78-
serviceClient schema.ImmuServiceClient
79-
uuidProvider state.UUIDProvider
63+
index uint64
64+
databaseIndex int
65+
logger logger.Logger
66+
serverAddress string
67+
dialOptions []grpc.DialOption
68+
history cache.HistoryCache
69+
ts client.TimestampService
70+
username []byte
71+
databases []string
72+
password []byte
73+
auditDatabases []string
74+
serverSigningPubKey *ecdsa.PublicKey
75+
notificationConfig AuditNotificationConfig
76+
serviceClient schema.ImmuServiceClient
77+
uuidProvider state.UUIDProvider
8078

8179
slugifyRegExp *regexp.Regexp
8280
updateMetrics func(string, string, bool, bool, bool, *schema.ImmutableState, *schema.ImmutableState)
@@ -90,23 +88,14 @@ func DefaultAuditor(
9088
username string,
9189
passwordBase64 string,
9290
auditDatabases []string,
93-
auditSignature string,
94-
publicKey *ecdsa.PublicKey,
91+
serverSigningPubKey *ecdsa.PublicKey,
9592
notificationConfig AuditNotificationConfig,
9693
serviceClient schema.ImmuServiceClient,
9794
uuidProvider state.UUIDProvider,
9895
history cache.HistoryCache,
9996
updateMetrics func(string, string, bool, bool, bool, *schema.ImmutableState, *schema.ImmutableState),
10097
log logger.Logger) (Auditor, error) {
10198

102-
switch auditSignature {
103-
case "validate":
104-
case "ignore":
105-
case "":
106-
default:
107-
return nil, errors.New("auditSignature allowed values are 'validate' or 'ignore'")
108-
}
109-
11099
password, err := auth.DecodeBase64Password(passwordBase64)
111100
if err != nil {
112101
return nil, err
@@ -131,8 +120,7 @@ func DefaultAuditor(
131120
nil,
132121
[]byte(password),
133122
auditDatabases,
134-
auditSignature,
135-
publicKey,
123+
serverSigningPubKey,
136124
notificationConfig,
137125
serviceClient,
138126
uuidProvider,
@@ -258,8 +246,8 @@ func (a *defaultAuditor) audit() error {
258246
return noErr
259247
}
260248

261-
if a.auditSignature == "validate" {
262-
if okSig, err := state.CheckSignature(a.publicKey); err != nil || !okSig {
249+
if a.serverSigningPubKey != nil {
250+
if okSig, err := state.CheckSignature(a.serverSigningPubKey); err != nil || !okSig {
263251
a.logger.Errorf(
264252
"audit #%d aborted: could not verify signature on server state at %s @ %s",
265253
a.index, serverID, a.serverAddress)

‎pkg/client/auditor/auditor_test.go‎

Lines changed: 4 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ func TestDefaultAuditor(t *testing.T) {
6060
"immudb",
6161
"immudb",
6262
nil,
63-
"ignore",
6463
nil,
6564
AuditNotificationConfig{},
6665
nil,
@@ -90,7 +89,6 @@ func TestDefaultAuditorPasswordDecodeErr(t *testing.T) {
9089
"immudb",
9190
"enc:"+string([]byte{0}),
9291
nil,
93-
"ignore",
9492
nil,
9593
AuditNotificationConfig{},
9694
nil,
@@ -124,7 +122,6 @@ func TestDefaultAuditorLoginErr(t *testing.T) {
124122
"immudb",
125123
"immudb",
126124
nil,
127-
"ignore",
128125
nil,
129126
AuditNotificationConfig{},
130127
&serviceClient,
@@ -162,7 +159,6 @@ func TestDefaultAuditorDatabaseListErr(t *testing.T) {
162159
"immudb",
163160
"immudb",
164161
nil,
165-
"ignore",
166162
nil,
167163
AuditNotificationConfig{},
168164
&serviceClient,
@@ -202,7 +198,6 @@ func TestDefaultAuditorDatabaseListEmpty(t *testing.T) {
202198
"immudb",
203199
"immudb",
204200
nil,
205-
"ignore",
206201
nil,
207202
AuditNotificationConfig{},
208203
&serviceClient,
@@ -245,7 +240,6 @@ func TestDefaultAuditorUseDatabaseErr(t *testing.T) {
245240
"immudb",
246241
"immudb",
247242
nil,
248-
"ignore",
249243
nil,
250244
AuditNotificationConfig{},
251245
&serviceClient,
@@ -291,7 +285,6 @@ func TestDefaultAuditorCurrentRootErr(t *testing.T) {
291285
"immudb",
292286
"immudb",
293287
nil,
294-
"ignore",
295288
nil,
296289
AuditNotificationConfig{},
297290
&serviceClient,
@@ -329,7 +322,6 @@ func TestDefaultAuditorRunOnEmptyDb(t *testing.T) {
329322
"immudb",
330323
"immudb",
331324
nil,
332-
"ignore",
333325
nil,
334326
AuditNotificationConfig{},
335327
serviceClient,
@@ -390,7 +382,6 @@ func TestDefaultAuditorRunOnDb(t *testing.T) {
390382
"immudb",
391383
"immudb",
392384
nil,
393-
"ignore",
394385
nil,
395386
AuditNotificationConfig{},
396387
serviceClient,
@@ -467,7 +458,6 @@ func TestRepeatedAuditorRunOnDb(t *testing.T) {
467458
"immudb",
468459
"immudb",
469460
[]string{"SomeNonExistentDb", ""},
470-
"ignore",
471461
nil,
472462
alertConfig,
473463
serviceClient,
@@ -543,7 +533,6 @@ func TestDefaultAuditorRunOnDbWithSignature(t *testing.T) {
543533
"immudb",
544534
"immudb",
545535
nil,
546-
"validate",
547536
pk,
548537
AuditNotificationConfig{},
549538
serviceClient,
@@ -587,6 +576,9 @@ func TestDefaultAuditorRunOnDbWithFailSignature(t *testing.T) {
587576
return &empty.Empty{}, nil
588577
}
589578

579+
pk, err := signer.ParsePublicKeyFile("./../../../test/signer/ec1.pub")
580+
require.NoError(t, err)
581+
590582
da, err := DefaultAuditor(
591583
time.Duration(0),
592584
fmt.Sprintf("%s:%d", "address", 0),
@@ -596,8 +588,7 @@ func TestDefaultAuditorRunOnDbWithFailSignature(t *testing.T) {
596588
"immudb",
597589
"immudb",
598590
nil,
599-
"validate",
600-
nil,
591+
pk,
601592
AuditNotificationConfig{},
602593
serviceClient,
603594
state.NewUUIDProvider(serviceClient),
@@ -613,28 +604,6 @@ func TestDefaultAuditorRunOnDbWithFailSignature(t *testing.T) {
613604
require.Nil(t, err)
614605
}
615606

616-
func TestDefaultAuditorRunOnDbWithWrongAuditSignatureMode(t *testing.T) {
617-
serviceClient := clienttest.ImmuServiceClientMock{}
618-
_, err := DefaultAuditor(
619-
time.Duration(0),
620-
fmt.Sprintf("%s:%d", "address", 0),
621-
&[]grpc.DialOption{
622-
grpc.WithInsecure(),
623-
},
624-
"immudb",
625-
"immudb",
626-
nil,
627-
"wrong",
628-
nil,
629-
AuditNotificationConfig{},
630-
&serviceClient,
631-
state.NewUUIDProvider(&serviceClient),
632-
cache.NewHistoryFileCache(dirname),
633-
func(string, string, bool, bool, bool, *schema.ImmutableState, *schema.ImmutableState) {},
634-
logger.NewSimpleLogger("test", os.Stdout))
635-
require.Errorf(t, err, "auditSignature allowed values are 'validate' or 'ignore'")
636-
}
637-
638607
type PasswordReader struct {
639608
Pass []string
640609
callNumber int

0 commit comments

Comments
 (0)