Skip to content

Commit 33c8381

Browse files
roger2hkroger2hk
authored
Replace hammer with the preloader in codelab docs (#372)
1 parent 4157081 commit 33c8381

2 files changed

Lines changed: 40 additions & 70 deletions

File tree

‎deployment/live/aws/test/README.md‎

Lines changed: 21 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -168,46 +168,35 @@ go run github.com/google/certificate-transparency-go/trillian/integration/ct_ham
168168

169169
### With real HTTPS certificates
170170

171-
We'll run a TesseraCT and copy certificates from an existing RFC6962 log to it.
172-
It uses the [ct_hammer tool from certificate-transparency-go](https://github.com/google/certificate-transparency-go/tree/aceb1d4481907b00c087020a3930c7bd691a0110/trillian/integration/ct_hammer).
171+
We'll run a TesseraCT instance and copy certificates from an existing RFC6962
172+
log to it. It uses the [preloader tool from certificate-transparency-go](https://github.com/google/certificate-transparency-go/blob/master/preload/preloader/preloader.go).
173173

174174
First, save the source log URI:
175175

176176
```bash
177-
export SRC_LOG_URI=https://ct.googleapis.com/logs/xenon2022
177+
export SOURCE_LOG_URI=https://ct.googleapis.com/logs/xenon2022
178178
```
179179

180180
Then, get fetch the roots the source logs accepts, and edit configs accordingly.
181181
Two roots that TesseraCT cannot load with the [internal/lax509](/internal/lax509/)
182182
library need to be removed.
183183

184184
```bash
185-
aws secretsmanager get-secret-value --secret-id test-static-ct-ecdsa-p256-public-key --query SecretString --output text > /tmp/log_public_key.pem
186-
LOG_PUBLIC_KEY_DER=$(openssl pkey -pubin -in /tmp/log_public_key.pem -outform DER | xxd -i -c1000 | sed s/\,\ 0/\\\\/g | sed s/^..0x/\\\\x/g)
187-
mkdir -p /tmp/hammercfg
188185
go run github.com/google/certificate-transparency-go/client/ctclient@master get-roots --log_uri=${SRC_LOG_URI} --text=false | \
189186
awk \
190187
'/-----BEGIN CERTIFICATE-----/{c=1; pem=$0; show=1; next}
191188
c{pem=pem ORS $0}
192189
/-----END CERTIFICATE-----/{c=0; if(show) print pem}
193190
($0=="MIIFxDCCBKygAwIBAgIBAzANBgkqhkiG9w0BAQUFADCCAUsxGDAWBgNVBC0DDwBT"||$0=="MIIFVjCCBD6gAwIBAgIQ7is969Qh3hSoYqwE893EATANBgkqhkiG9w0BAQUFADCB"){show=0}' \
194-
> /tmp/hammercfg/roots.pem
195-
cat > /tmp/hammercfg/hammer.cfg << EOF
196-
config {
197-
roots_pem_file: "/tmp/hammercfg/roots.pem"
198-
public_key: {
199-
der: "$LOG_PUBLIC_KEY_DER"
200-
}
201-
}
202-
EOF
191+
> /tmp/log_roots.pem
203192
```
204193

205194
Run TesseraCT with the same roots:
206195

207196
```bash
208197
go run ./cmd/aws \
209198
--http_endpoint=localhost:6962 \
210-
--roots_pem_file=/tmp/hammercfg/roots.pem \
199+
--roots_pem_file=/tmp/log_roots.pem \
211200
--origin=test-static-ct \
212201
--bucket=${TESSERACT_BUCKET_NAME} \
213202
--db_name=tesseract \
@@ -217,31 +206,28 @@ go run ./cmd/aws \
217206
--db_password=${TESSERACT_DB_PASSWORD} \
218207
--antispam_db_name=antispam_db \
219208
--signer_public_key_secret_name=${TESSERACT_SIGNER_ECDSA_P256_PUBLIC_KEY_ID} \
220-
--signer_private_key_secret_name=${TESSERACT_SIGNER_ECDSA_P256_PRIVATE_KEY_ID} \
221-
-v=3
209+
--signer_private_key_secret_name=${TESSERACT_SIGNER_ECDSA_P256_PRIVATE_KEY_ID}
222210
```
223211

224-
Run `ct_hammer` in a different terminal:
212+
In a different terminal, run `preloader` to submit certificates from another log to TesseraCT.
225213

226214
```bash
227-
go run github.com/google/certificate-transparency-go/trillian/integration/ct_hammer@master \
228-
--ct_http_servers=localhost:6962/test-static-ct \
229-
--max_retry=2m \
230-
--invalid_chance=0 \
231-
--get_sth=0 \
232-
--get_sth_consistency=0 \
233-
--get_proof_by_hash=0 \
234-
--get_entries=0 \
235-
--get_roots=0 \
236-
--get_entry_and_proof=0 \
237-
--max_parallel_chains=4 \
238-
--skip_https_verify=true \
239-
--operations=10000 \
240-
--rate_limit=150 \
241-
--log_config=/tmp/hammercfg/hammer.cfg \
242-
--src_log_uri=${SRC_LOG_URI}
215+
go run github.com/google/certificate-transparency-go/preload/preloader@master \
216+
--target_log_uri=http://localhost:6962/${TESSERA_BASE_NAME} \
217+
--source_log_uri=${SOURCE_LOG_URI} \
218+
--num_workers=8 \
219+
--parallel_fetch=4 \
220+
--parallel_submit=4
243221
```
244222

223+
Since the source and destination log [might not be configured the exact same set of roots](/internal/lax509/README.md#Chains), it is expected to see errors when submitting a certificate chaining to a missing root. This is what the error would look like:
224+
225+
```
226+
W0623 11:57:05.122711 6819 handlers.go:168] test-static-ct: AddPreChain handler error: failed to verify add-chain contents: chain failed to validate: x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA" while trying to verify candidate authority certificate "Merge Delay Monitor Root")
227+
```
228+
229+
## Cleanup
230+
245231
> [!IMPORTANT]
246232
> Do not forget to delete all the resources to avoid incuring any further cost
247233
> when you're done using the log. The easiest way to do this, is to [close the account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html).

‎deployment/live/gcp/test/README.md‎

Lines changed: 19 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -141,37 +141,26 @@ go run ./trillian/integration/ct_hammer \
141141
### With real HTTPS certificates
142142

143143
We'll run a TesseraCT instance and copy certificates from an existing RFC6962
144-
log to it. It uses the [ct_hammer tool from certificate-transparency-go](https://github.com/google/certificate-transparency-go/blob/master/trillian/integration/ct_hammer/main.go).
144+
log to it. It uses the [preloader tool from certificate-transparency-go](https://github.com/google/certificate-transparency-go/blob/master/preload/preloader/preloader.go).
145145

146146
First, save the source log URI:
147147

148148
```bash
149-
export SRC_LOG_URI=https://ct.googleapis.com/logs/xenon2022
149+
export SOURCE_LOG_URI=https://ct.googleapis.com/logs/xenon2022
150150
```
151151

152152
Then, get fetch the roots the source logs accepts, and edit configs accordingly.
153153
Two roots that TesseraCT cannot load with the [internal/lax509](/internal/lax509/)
154154
library need to be removed.
155155

156156
```bash
157-
gcloud secrets versions access $TESSERACT_SIGNER_ECDSA_P256_PUBLIC_KEY_ID > /tmp/log_public_key.pem
158-
LOG_PUBLIC_KEY_DER=$(openssl pkey -pubin -in /tmp/log_public_key.pem -outform DER | xxd -i -c1000 | sed s/\,\ 0/\\\\/g | sed s/^..0x/\\\\x/g)
159-
mkdir -p /tmp/hammercfg
160-
go run github.com/google/certificate-transparency-go/client/ctclient@master get-roots --log_uri=${SRC_LOG_URI} --text=false | \
157+
go run github.com/google/certificate-transparency-go/client/ctclient@master get-roots --log_uri=${SOURCE_LOG_URI} --text=false | \
161158
awk \
162159
'/-----BEGIN CERTIFICATE-----/{c=1; pem=$0; show=1; next}
163160
c{pem=pem ORS $0}
164161
/-----END CERTIFICATE-----/{c=0; if(show) print pem}
165162
($0=="MIIFxDCCBKygAwIBAgIBAzANBgkqhkiG9w0BAQUFADCCAUsxGDAWBgNVBC0DDwBT"||$0=="MIIFVjCCBD6gAwIBAgIQ7is969Qh3hSoYqwE893EATANBgkqhkiG9w0BAQUFADCB"){show=0}' \
166-
> /tmp/hammercfg/roots.pem
167-
cat > /tmp/hammercfg/hammer.cfg << EOF
168-
config {
169-
roots_pem_file: "/tmp/hammercfg/roots.pem"
170-
public_key: {
171-
der: "$LOG_PUBLIC_KEY_DER"
172-
}
173-
}
174-
EOF
163+
> /tmp/log_roots.pem
175164
```
176165

177166
Run TesseraCT with the same roots:
@@ -180,32 +169,27 @@ Run TesseraCT with the same roots:
180169
go run ./cmd/gcp/ \
181170
--bucket=${GOOGLE_PROJECT}-${TESSERA_BASE_NAME}-bucket \
182171
--spanner_db_path=projects/${GOOGLE_PROJECT}/instances/${TESSERA_BASE_NAME}/databases/${TESSERA_BASE_NAME}-db \
183-
--roots_pem_file=/tmp/hammercfg/roots.pem \
172+
--roots_pem_file=/tmp/log_roots.pem \
184173
--origin=${TESSERA_BASE_NAME} \
185174
--spanner_antispam_db_path=projects/${GOOGLE_PROJECT}/instances/${TESSERA_BASE_NAME}/databases/${TESSERA_BASE_NAME}-antispam-db \
186175
--signer_public_key_secret_name=${TESSERACT_SIGNER_ECDSA_P256_PUBLIC_KEY_ID} \
187176
--signer_private_key_secret_name=${TESSERACT_SIGNER_ECDSA_P256_PRIVATE_KEY_ID} \
188-
--otel_project_id=${GOOGLE_PROJECT} \
189-
-v=3
177+
--otel_project_id=${GOOGLE_PROJECT}
190178
```
191179

192-
Clone the [certificate-transparency-go](https://github.com/google/certificate-transparency-go) repo, and from there run `ct_hammer` in a different terminal:
180+
In a different terminal, run `preloader` to submit certificates from another log to TesseraCT.
193181

194182
```bash
195-
go run ./trillian/integration/ct_hammer \
196-
--ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} \
197-
--max_retry=2m \
198-
--invalid_chance=0 \
199-
--get_sth=0 \
200-
--get_sth_consistency=0 \
201-
--get_proof_by_hash=0 \
202-
--get_entries=0 \
203-
--get_roots=0 \
204-
--get_entry_and_proof=0 \
205-
--max_parallel_chains=4 \
206-
--skip_https_verify=true \
207-
--operations=10000 \
208-
--rate_limit=150 \
209-
--log_config=/tmp/hammercfg/hammer.cfg \
210-
--src_log_uri=${SRC_LOG_URI}
183+
go run github.com/google/certificate-transparency-go/preload/preloader@master \
184+
--target_log_uri=http://localhost:6962/${TESSERA_BASE_NAME} \
185+
--source_log_uri=${SOURCE_LOG_URI} \
186+
--num_workers=8 \
187+
--parallel_fetch=4 \
188+
--parallel_submit=4
189+
```
190+
191+
Since the source and destination log [might not be configured the exact same set of roots](/internal/lax509/README.md#Chains), it is expected to see errors when submitting a certificate chaining to a missing root. This is what the error would look like:
192+
211193
```
194+
W0623 11:57:05.122711 6819 handlers.go:168] test-static-ct: AddPreChain handler error: failed to verify add-chain contents: chain failed to validate: x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA" while trying to verify candidate authority certificate "Merge Delay Monitor Root")
195+
```

0 commit comments

Comments
 (0)