Skip to content

Commit f43eb04

Browse files
gsanchezgaviergsanchezgavier
authored
fix: code signature keyId API modification (#1013)
* fix: rename keyId field * add algorithm
1 parent 906f536 commit f43eb04

File tree

4 files changed

+72
-27
lines changed

4 files changed

+72
-27
lines changed

‎agent-control/src/opamp/callbacks.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -496,7 +496,7 @@ pub(crate) mod tests {
496496
"unique": [{
497497
"signature": "fake config",
498498
"signingAlgorithm": "ED25519",
499-
"keyID": "fake keyid"
499+
"keyId": "fake keyid"
500500
}]
501501
}"#
502502
.as_bytes()
@@ -526,7 +526,7 @@ pub(crate) mod tests {
526526
"unique": [{
527527
"signature": "fake config",
528528
"signingAlgorithm": "ED25519",
529-
"keyID": "fake keyid"
529+
"keyId": "fake keyid"
530530
}]
531531
}"#
532532
.as_bytes()
@@ -552,7 +552,7 @@ pub(crate) mod tests {
552552
"unique": [{
553553
"signature": "fake config",
554554
"signingAlgorithm": "ED25519",
555-
"keyID": "fake keyid"
555+
"keyId": "fake keyid"
556556
}]
557557
}"#
558558
.as_bytes()

‎agent-control/src/opamp/remote_config/signature.rs‎

Lines changed: 67 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@ pub const SIGNATURE_CUSTOM_CAPABILITY: &str = "com.newrelic.security.configSigna
1313
pub const SIGNATURE_CUSTOM_MESSAGE_TYPE: &str = "newrelicRemoteConfigSignature";
1414
// Supported signature algorithms
1515
// RSA regex matching supported RSA signature algorithms, length between 2048 and 8192 bits
16-
pub const RSA_REGEX: &str = "RSA_PKCS1_([0-9]+)_SHA(256|512)";
16+
pub const RSA_REGEX: &str = "RSA_PKCS1_([0-9]+)_SHA(256|384|512)";
1717
pub const RSA_PKCS1_2048_8192_SHA256: &str = "RSA_PKCS1_2048_8192_SHA256";
18+
pub const RSA_PKCS1_2048_8192_SHA384: &str = "RSA_PKCS1_2048_8192_SHA384";
1819
pub const RSA_PKCS1_2048_8192_SHA512: &str = "RSA_PKCS1_2048_8192_SHA512";
1920
pub const ECDSA_P256_SHA256: &str = "ECDSA_P256_SHA256";
2021
pub const ECDSA_P256_SHA384: &str = "ECDSA_P256_SHA384";
@@ -32,6 +33,7 @@ fn rsa_regex() -> &'static Regex {
3233
#[allow(non_camel_case_types)]
3334
pub enum SigningAlgorithm {
3435
RSA_PKCS1_2048_8192_SHA256,
36+
RSA_PKCS1_2048_8192_SHA384,
3537
RSA_PKCS1_2048_8192_SHA512,
3638
ECDSA_P256_SHA256,
3739
ECDSA_P256_SHA384,
@@ -64,6 +66,7 @@ impl AsRef<str> for SigningAlgorithm {
6466
fn as_ref(&self) -> &str {
6567
match self {
6668
SigningAlgorithm::RSA_PKCS1_2048_8192_SHA256 => RSA_PKCS1_2048_8192_SHA256,
69+
SigningAlgorithm::RSA_PKCS1_2048_8192_SHA384 => RSA_PKCS1_2048_8192_SHA384,
6770
SigningAlgorithm::RSA_PKCS1_2048_8192_SHA512 => RSA_PKCS1_2048_8192_SHA512,
6871
SigningAlgorithm::ECDSA_P256_SHA256 => ECDSA_P256_SHA256,
6972
SigningAlgorithm::ECDSA_P256_SHA384 => ECDSA_P256_SHA384,
@@ -78,6 +81,7 @@ impl From<&SigningAlgorithm> for &SignatureAlgorithm {
7881
fn from(value: &SigningAlgorithm) -> Self {
7982
match value {
8083
SigningAlgorithm::RSA_PKCS1_2048_8192_SHA256 => &webpki::RSA_PKCS1_2048_8192_SHA256,
84+
SigningAlgorithm::RSA_PKCS1_2048_8192_SHA384 => &webpki::RSA_PKCS1_2048_8192_SHA384,
8185
SigningAlgorithm::RSA_PKCS1_2048_8192_SHA512 => &webpki::RSA_PKCS1_2048_8192_SHA512,
8286
SigningAlgorithm::ECDSA_P256_SHA256 => &webpki::ECDSA_P256_SHA256,
8387
SigningAlgorithm::ECDSA_P256_SHA384 => &webpki::ECDSA_P256_SHA384,
@@ -105,6 +109,7 @@ fn parse_rsa_algorithm(algo: &str) -> Option<SigningAlgorithm> {
105109

106110
match hash_bytes {
107111
b"256" => Some(SigningAlgorithm::RSA_PKCS1_2048_8192_SHA256),
112+
b"384" => Some(SigningAlgorithm::RSA_PKCS1_2048_8192_SHA384),
108113
b"512" => Some(SigningAlgorithm::RSA_PKCS1_2048_8192_SHA512),
109114
_ => None,
110115
}
@@ -143,7 +148,7 @@ fn parse_rsa_algorithm(algo: &str) -> Option<SigningAlgorithm> {
143148
/// "signingAlgorithm": "RSA_PKCS1_2048_SHA256",
144149
/// "signatureSpecification": "PKCS #1 v2.2",
145150
/// "signingDomain": "iast-csec-se.test-poised-pear.cell.us.nr-data.net",
146-
/// "keyID": "778b223984d389ad6555bdbbbf118420290c53296b6511e1964309965ec5f710"
151+
/// "keyId": "778b223984d389ad6555bdbbbf118420290c53296b6511e1964309965ec5f710"
147152
/// }]
148153
/// }
149154
/// }
@@ -164,17 +169,17 @@ fn parse_rsa_algorithm(algo: &str) -> Option<SigningAlgorithm> {
164169
/// {
165170
/// "signature": "some signature",
166171
/// "signingAlgorithm": "UNSUPPORTED",
167-
/// "keyID": "some key id"
172+
/// "keyId": "some key id"
168173
/// },
169174
/// {
170175
/// "signature": "some signature",
171176
/// "signingAlgorithm": "ED25519",
172-
/// "keyID": "some key id"
177+
/// "keyId": "some key id"
173178
/// },
174179
/// {
175180
/// "signature": "some signature",
176181
/// "signingAlgorithm": "RSA_PKCS1_2048_SHA256",
177-
/// "keyID": "some key id"
182+
/// "keyId": "some key id"
178183
/// }
179184
/// ]
180185
/// }"#.as_bytes().to_vec();
@@ -236,16 +241,15 @@ impl<'de> Deserialize<'de> for Signatures {
236241
/// data before validation ([RawSignatureData], where the signing algorithm is a string) and after validation
237242
/// [SignatureData] (where the signing algorithm is represented by the [SigningAlgorithm] type).
238243
#[derive(Debug, Deserialize, Serialize, PartialEq, Clone)]
244+
#[serde(rename_all = "camelCase")]
239245
pub struct SignatureFields<A> {
240246
/// RemoteConfiguration signature on TLS's `DigitallySigned.signature` format encoded in base64.
241247
pub signature: String,
242248
/// Public key identifier.
243-
#[serde(rename = "keyID")]
244249
pub key_id: String,
245250
/// Signing algorithm used the config:
246251
/// [ECDSA_P256_SHA256,ECDSA_P256_SHA384,ECDSA_P384_SHA256,ECDSA_P384_SHA384,RSA_PKCS1_[2048-8192]_SHA256,
247252
/// RSA_PKCS1_2048_8192_SHA384,RSA_PKCS1_2048_8192_SHA512,RSA_PKCS1_3072_8192_SHA384,ED25519]
248-
#[serde(rename = "signingAlgorithm")]
249253
pub signing_algorithm: A,
250254
}
251255

@@ -333,6 +337,7 @@ mod tests {
333337
use super::Signatures;
334338
use crate::opamp::remote_config::signature::SigningAlgorithm;
335339
use crate::opamp::remote_config::signature::ECDSA_P256_SHA256;
340+
use crate::opamp::remote_config::signature::ECDSA_P256_SHA384;
336341
use crate::opamp::remote_config::signature::ED25519;
337342
use opamp_client::opamp::proto::CustomMessage;
338343
use std::collections::HashMap;
@@ -372,11 +377,14 @@ mod tests {
372377
struct TestCase {
373378
name: &'static str,
374379
custom_message: CustomMessage,
380+
algorithm: SigningAlgorithm,
375381
}
376382
impl TestCase {
377383
fn run(self) {
378-
let _ = Signatures::try_from(&self.custom_message)
384+
let signatures = Signatures::try_from(&self.custom_message)
379385
.unwrap_or_else(|err| panic!("case: {} - {}", self.name, err));
386+
let (_, signature) = signatures.iter().next().unwrap();
387+
assert_eq!(signature.signing_algorithm, self.algorithm);
380388
}
381389
}
382390
let test_cases = vec![
@@ -393,10 +401,11 @@ mod tests {
393401
"signingAlgorithm": "RSA_PKCS1_2048_SHA256",
394402
"signatureSpecification": "PKCS #1 v2.2",
395403
"signingDomain": "iast-csec-se.test-poised-pear.cell.us.nr-data.net",
396-
"keyID": "778b223984d389ad6555bdbbbf118420290c53296b6511e1964309965ec5f710"
404+
"keyId": "778b223984d389ad6555bdbbbf118420290c53296b6511e1964309965ec5f710"
397405
}]
398406
}"#.as_bytes().to_vec(),
399407
},
408+
algorithm: SigningAlgorithm::RSA_PKCS1_2048_8192_SHA256,
400409
},
401410
TestCase {
402411
name: "required fields only, RSA_PKCS1_2048_SHA256",
@@ -407,10 +416,11 @@ mod tests {
407416
"3936250589": [{
408417
"signature": "fake",
409418
"signingAlgorithm": "RSA_PKCS1_2048_SHA256",
410-
"keyID": "fake"
419+
"keyId": "fake"
411420
}]
412421
}"#.as_bytes().to_vec(),
413422
},
423+
algorithm: SigningAlgorithm::RSA_PKCS1_2048_8192_SHA256,
414424
},
415425
TestCase {
416426
name: "RSA_PKCS1_2048_SHA512",
@@ -421,10 +431,11 @@ mod tests {
421431
"3936250589": [{
422432
"signature": "fake",
423433
"signingAlgorithm": "RSA_PKCS1_2048_SHA512",
424-
"keyID": "fake"
434+
"keyId": "fake"
425435
}]
426436
}"#.as_bytes().to_vec(),
427437
},
438+
algorithm: SigningAlgorithm::RSA_PKCS1_2048_8192_SHA512,
428439
},
429440
TestCase {
430441
name: "RSA_PKCS1_2049_SHA512",
@@ -435,10 +446,26 @@ mod tests {
435446
"3936250589": [{
436447
"signature": "fake",
437448
"signingAlgorithm": "RSA_PKCS1_2049_SHA512",
438-
"keyID": "fake"
449+
"keyId": "fake"
439450
}]
440451
}"#.as_bytes().to_vec(),
441452
},
453+
algorithm: SigningAlgorithm::RSA_PKCS1_2048_8192_SHA512,
454+
},
455+
TestCase {
456+
name: "RSA_PKCS1_3072_SHA384",
457+
custom_message: CustomMessage {
458+
capability: super::SIGNATURE_CUSTOM_CAPABILITY.to_string(),
459+
r#type: super::SIGNATURE_CUSTOM_MESSAGE_TYPE.to_string(),
460+
data: r#"{
461+
"3936250589": [{
462+
"signature": "fake",
463+
"signingAlgorithm": "RSA_PKCS1_3072_SHA384",
464+
"keyId": "fake"
465+
}]
466+
}"#.as_bytes().to_vec(),
467+
},
468+
algorithm: SigningAlgorithm::RSA_PKCS1_2048_8192_SHA384,
442469
},
443470
TestCase {
444471
name: ECDSA_P256_SHA256,
@@ -449,10 +476,26 @@ mod tests {
449476
"3936250589": [{
450477
"signature": "fake",
451478
"signingAlgorithm": "ECDSA_P256_SHA256",
452-
"keyID": "fake"
479+
"keyId": "fake"
480+
}]
481+
}"#.as_bytes().to_vec(),
482+
},
483+
algorithm: SigningAlgorithm::ECDSA_P256_SHA256,
484+
},
485+
TestCase {
486+
name: ECDSA_P256_SHA384,
487+
custom_message: CustomMessage {
488+
capability: super::SIGNATURE_CUSTOM_CAPABILITY.to_string(),
489+
r#type: super::SIGNATURE_CUSTOM_MESSAGE_TYPE.to_string(),
490+
data: r#"{
491+
"3936250589": [{
492+
"signature": "fake",
493+
"signingAlgorithm": "ECDSA_P256_SHA384",
494+
"keyId": "fake"
453495
}]
454496
}"#.as_bytes().to_vec(),
455497
},
498+
algorithm: SigningAlgorithm::ECDSA_P256_SHA384,
456499
},
457500
TestCase {
458501
name: ED25519,
@@ -463,10 +506,11 @@ mod tests {
463506
"3936250589": [{
464507
"signature": "fake",
465508
"signingAlgorithm": "ED25519",
466-
"keyID": "fake"
509+
"keyId": "fake"
467510
}]
468511
}"#.as_bytes().to_vec(),
469512
},
513+
algorithm: SigningAlgorithm::ED25519,
470514
},
471515
TestCase {
472516
name: "Unsupported + ED25519",
@@ -478,16 +522,17 @@ mod tests {
478522
{
479523
"signature": "fake",
480524
"signingAlgorithm": "unsupported",
481-
"keyID": "fake"
525+
"keyId": "fake"
482526
},
483527
{
484528
"signature": "fake",
485529
"signingAlgorithm": "ED25519",
486-
"keyID": "fake"
530+
"keyId": "fake"
487531
}
488532
]
489533
}"#.as_bytes().to_vec(),
490534
},
535+
algorithm: SigningAlgorithm::ED25519,
491536
},
492537

493538
];
@@ -507,17 +552,17 @@ mod tests {
507552
{
508553
"signature": "fake",
509554
"signingAlgorithm": "unsupported",
510-
"keyID": "fake"
555+
"keyId": "fake"
511556
},
512557
{
513558
"signature": "fake",
514559
"signingAlgorithm": "ED25519",
515-
"keyID": "fake"
560+
"keyId": "fake"
516561
},
517562
{
518563
"signature": "fake",
519564
"signingAlgorithm": "ECDSA_P256_SHA256",
520-
"keyID": "fake"
565+
"keyId": "fake"
521566
}
522567
]
523568
}"#
@@ -552,7 +597,7 @@ mod tests {
552597
"3936250589": [{
553598
"signature": "fake",
554599
"signingAlgorithm": "unknown",
555-
"keyID": "fake"
600+
"keyId": "fake"
556601
}]
557602
}"#
558603
.as_bytes()
@@ -568,7 +613,7 @@ mod tests {
568613
"3936250589": [{
569614
"signature": "fake",
570615
"signingAlgorithm": "RSA_PKCS1_8193_SHA512",
571-
"keyID": "fake"
616+
"keyId": "fake"
572617
}]
573618
}"#
574619
.as_bytes()
@@ -597,7 +642,7 @@ mod tests {
597642
"config_id2": [{
598643
"signature": "fake",
599644
"signingAlgorithm": "ED25519",
600-
"keyID": "fake"
645+
"keyId": "fake"
601646
}]
602647
}"#
603648
.as_bytes()

‎agent-control/src/opamp/remote_config/validators/signature/certificate_store.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ use tracing::log::error;
1010
pub enum CertificateStoreError {
1111
#[error("fetching certificate: `{0}`")]
1212
CertificateFetch(String),
13-
#[error("signature keyID({signature_key_id}) does not match certificate keyID({certificate_key_id})")]
13+
#[error("signature keyId({signature_key_id}) does not match certificate keyId({certificate_key_id})")]
1414
KeyMismatch {
1515
signature_key_id: String,
1616
certificate_key_id: String,

‎agent-control/src/opamp/remote_config/validators/signature/test_data/verify.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
# "signingAlgorithm": "RSA_PKCS1_2048_SHA256",
2525
# "signatureSpecification": "PKCS #1 v2.2",
2626
# "signingDomain": "iast-csec-se.test-poised-pear.cell.us.nr-data.net",
27-
# "keyID": "778b223984d389ad6555bdbbbf118420290c53296b6511e1964309965ec5f710"
27+
# "keyId": "778b223984d389ad6555bdbbbf118420290c53296b6511e1964309965ec5f710"
2828
# }]
2929
# }
3030
# }

0 commit comments

Comments
 (0)