Skip to content

Commit 7f08d8c

Browse files
Bravo555Bravo555
committed
fix wrong csr
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
1 parent aa39e94 commit 7f08d8c

File tree

7 files changed

+95
-59
lines changed

7 files changed

+95
-59
lines changed

‎crates/common/certificate/src/lib.rs

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,19 @@ pub struct RemoteKeyPair {
224224
algorithm: &'static rcgen::SignatureAlgorithm,
225225
}
226226

227+
fn shit(value: &rcgen::SignatureAlgorithm) -> tedge_p11_server::pkcs11::SigScheme {
228+
if *value == rcgen::PKCS_RSA_SHA256 {
229+
return tedge_p11_server::pkcs11::SigScheme::RsaPkcs1Sha256;
230+
}
231+
if *value == rcgen::PKCS_ECDSA_P256_SHA256 {
232+
return tedge_p11_server::pkcs11::SigScheme::EcdsaNistp256Sha256;
233+
}
234+
if *value == rcgen::PKCS_ECDSA_P384_SHA384 {
235+
return tedge_p11_server::pkcs11::SigScheme::EcdsaNistp384Sha384;
236+
}
237+
todo!()
238+
}
239+
227240
impl RemoteKeyPair {
228241
pub fn to_key_pair(&self) -> Result<KeyPair, CertificateError> {
229242
Ok(KeyPair::from_remote(Box::new(self.clone()))?)
@@ -242,7 +255,7 @@ impl rcgen::RemoteKeyPair for RemoteKeyPair {
242255
let signer = tedge_p11_server::signing_key(self.cryptoki_config.clone())
243256
.map_err(|e| rcgen::Error::PemError(e.to_string()))?;
244257
signer
245-
.sign(msg)
258+
.sign(msg, shit(self.algorithm))
246259
.map_err(|e| rcgen::Error::PemError(e.to_string()))
247260
}
248261

‎crates/extensions/tedge-p11-server/src/client.rs

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ use anyhow::Context;
77
use tracing::debug;
88
use tracing::trace;
99

10+
use crate::pkcs11::SigScheme;
11+
1012
use super::connection::Frame1;
1113
use super::service::ChooseSchemeRequest;
1214
use super::service::SignRequest;
@@ -122,7 +124,12 @@ impl TedgeP11Client {
122124
Ok(response.algorithm.0)
123125
}
124126

125-
pub fn sign(&self, message: &[u8], uri: Option<String>) -> anyhow::Result<Vec<u8>> {
127+
pub fn sign(
128+
&self,
129+
message: &[u8],
130+
sigscheme: SigScheme,
131+
uri: Option<String>,
132+
) -> anyhow::Result<Vec<u8>> {
126133
let stream = UnixStream::connect(&self.socket_path).with_context(|| {
127134
format!(
128135
"Failed to connect to tedge-p11-server UNIX socket at '{}'",
@@ -134,6 +141,7 @@ impl TedgeP11Client {
134141

135142
let request = Frame1::SignRequest(SignRequest {
136143
to_sign: message.to_vec(),
144+
sigscheme,
137145
uri,
138146
});
139147
trace!(?request);

‎crates/extensions/tedge-p11-server/src/pkcs11/mod.rs

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ use rustls::sign::Signer;
2828
use rustls::sign::SigningKey;
2929
use rustls::SignatureAlgorithm;
3030
use rustls::SignatureScheme;
31+
use serde::Deserialize;
32+
use serde::Serialize;
3133
use tracing::debug;
3234
use tracing::trace;
3335
use tracing::warn;
@@ -139,6 +141,9 @@ impl Cryptoki {
139141
let token_info = self.context.get_token_info(slot)?;
140142
debug!(?slot_info, ?token_info, "Selected slot");
141143

144+
// let supported_mechs = self.context.get_mechanism_list(slot)?;
145+
// info!(?supported_mechs);
146+
142147
let session = self.context.open_ro_session(slot)?;
143148
session.login(UserType::User, Some(&self.config.pin))?;
144149
let session_info = session.get_session_info()?;
@@ -238,22 +243,21 @@ pub struct Pkcs11Session {
238243
pub struct Pkcs11Signer {
239244
session: Pkcs11Session,
240245
key: ObjectHandle,
241-
sigscheme: SigScheme,
246+
pub sigscheme: SigScheme,
242247
}
243248

244249
impl Pkcs11Signer {
245-
pub fn sign(&self, message: &[u8]) -> Result<Vec<u8>, anyhow::Error> {
250+
pub fn sign(&self, message: &[u8], sigscheme: SigScheme) -> Result<Vec<u8>, anyhow::Error> {
246251
let session = self.session.session.lock().unwrap();
247252

248-
let mechanism = self.sigscheme.into();
253+
let mechanism = sigscheme.into();
249254
let (mechanism, digest_mechanism) = match mechanism {
250255
Mechanism::EcdsaSha256 => (Mechanism::Ecdsa, Some(Mechanism::Sha256)),
251256
Mechanism::EcdsaSha384 => (Mechanism::Ecdsa, Some(Mechanism::Sha384)),
252257
Mechanism::EcdsaSha512 => (Mechanism::Ecdsa, Some(Mechanism::Sha512)),
253-
Mechanism::Sha1RsaPkcs => (Mechanism::RsaPkcs, Some(Mechanism::Sha1)),
254-
Mechanism::Sha256RsaPkcs => (Mechanism::RsaPkcs, Some(Mechanism::Sha256)),
255-
Mechanism::Sha384RsaPkcs => (Mechanism::RsaPkcs, Some(Mechanism::Sha384)),
256-
Mechanism::Sha512RsaPkcs => (Mechanism::RsaPkcs, Some(Mechanism::Sha512)),
258+
Mechanism::Sha256RsaPkcs => (Mechanism::Sha256RsaPkcs, None),
259+
Mechanism::Sha384RsaPkcs => (Mechanism::Sha384RsaPkcs, None),
260+
Mechanism::Sha512RsaPkcs => (Mechanism::Sha512RsaPkcs, None),
257261
Mechanism::Sha256RsaPkcsPss(p) => (Mechanism::Sha256RsaPkcsPss(p), None),
258262
Mechanism::Sha384RsaPkcsPss(p) => (Mechanism::Sha384RsaPkcsPss(p), None),
259263
Mechanism::Sha512RsaPkcsPss(p) => (Mechanism::Sha512RsaPkcsPss(p), None),
@@ -306,12 +310,13 @@ impl Pkcs11Signer {
306310
}
307311

308312
/// Currently supported signature schemes.
309-
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
310-
enum SigScheme {
313+
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
314+
pub enum SigScheme {
311315
EcdsaNistp256Sha256,
312316
EcdsaNistp384Sha384,
313317
EcdsaNistp521Sha512,
314318
RsaPssSha256,
319+
RsaPkcs1Sha256,
315320
}
316321

317322
impl From<SigScheme> for rustls::SignatureScheme {
@@ -321,6 +326,7 @@ impl From<SigScheme> for rustls::SignatureScheme {
321326
SigScheme::EcdsaNistp384Sha384 => Self::ECDSA_NISTP384_SHA384,
322327
SigScheme::EcdsaNistp521Sha512 => Self::ECDSA_NISTP521_SHA512,
323328
SigScheme::RsaPssSha256 => Self::RSA_PSS_SHA256,
329+
SigScheme::RsaPkcs1Sha256 => Self::RSA_PKCS1_SHA256,
324330
}
325331
}
326332
}
@@ -331,7 +337,20 @@ impl From<SigScheme> for rustls::SignatureAlgorithm {
331337
SigScheme::EcdsaNistp256Sha256
332338
| SigScheme::EcdsaNistp384Sha384
333339
| SigScheme::EcdsaNistp521Sha512 => Self::ECDSA,
334-
SigScheme::RsaPssSha256 => Self::RSA,
340+
SigScheme::RsaPssSha256 | SigScheme::RsaPkcs1Sha256 => Self::RSA,
341+
}
342+
}
343+
}
344+
345+
impl From<rustls::SignatureScheme> for SigScheme {
346+
fn from(value: rustls::SignatureScheme) -> Self {
347+
match value {
348+
rustls::SignatureScheme::ECDSA_NISTP256_SHA256 => SigScheme::EcdsaNistp256Sha256,
349+
rustls::SignatureScheme::ECDSA_NISTP384_SHA384 => SigScheme::EcdsaNistp384Sha384,
350+
rustls::SignatureScheme::ECDSA_NISTP521_SHA512 => SigScheme::EcdsaNistp521Sha512,
351+
rustls::SignatureScheme::RSA_PSS_SHA256 => SigScheme::RsaPssSha256,
352+
rustls::SignatureScheme::RSA_PKCS1_SHA256 => SigScheme::RsaPkcs1Sha256,
353+
_ => todo!(),
335354
}
336355
}
337356
}
@@ -342,6 +361,7 @@ impl From<SigScheme> for Mechanism<'_> {
342361
SigScheme::EcdsaNistp256Sha256 => Self::EcdsaSha256,
343362
SigScheme::EcdsaNistp384Sha384 => Self::EcdsaSha384,
344363
SigScheme::EcdsaNistp521Sha512 => Self::EcdsaSha512,
364+
SigScheme::RsaPkcs1Sha256 => Self::Sha256RsaPkcs,
345365
SigScheme::RsaPssSha256 => Mechanism::Sha256RsaPkcsPss(PkcsPssParams {
346366
hash_alg: MechanismType::SHA256,
347367
mgf: PkcsMgfType::MGF1_SHA256,
@@ -373,7 +393,7 @@ impl SigningKey for Pkcs11Signer {
373393

374394
impl Signer for Pkcs11Signer {
375395
fn sign(&self, message: &[u8]) -> Result<Vec<u8>, rustls::Error> {
376-
Self::sign(self, message).map_err(|e| rustls::Error::General(e.to_string()))
396+
Self::sign(self, message, self.sigscheme).map_err(|e| rustls::Error::General(e.to_string()))
377397
}
378398

379399
fn scheme(&self) -> SignatureScheme {

‎crates/extensions/tedge-p11-server/src/server.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,10 @@ mod tests {
138138
tokio::task::spawn_blocking(move || {
139139
let client = TedgeP11Client::with_ready_check(socket_path.into());
140140
assert_eq!(client.choose_scheme(&[], None).unwrap().unwrap(), SCHEME);
141-
assert_eq!(&client.sign(&[], None).unwrap(), &SIGNATURE[..]);
141+
assert_eq!(
142+
&client.sign(&[], SCHEME.into(), None).unwrap(),
143+
&SIGNATURE[..]
144+
);
142145
})
143146
.await
144147
.unwrap();

‎crates/extensions/tedge-p11-server/src/service.rs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
use crate::pkcs11::Cryptoki;
22
use crate::pkcs11::CryptokiConfigDirect;
3+
use crate::pkcs11::SigScheme;
34

45
use anyhow::Context;
56
use rustls::sign::SigningKey;
@@ -71,7 +72,7 @@ impl SigningService for TedgeP11Service {
7172
.context("Failed to find a signing key")?;
7273

7374
let signature = signer
74-
.sign(&request.to_sign)
75+
.sign(&request.to_sign, request.sigscheme)
7576
.context("Failed to sign using PKCS #11")?;
7677
Ok(SignResponse(signature))
7778
}
@@ -92,6 +93,7 @@ pub struct ChooseSchemeResponse {
9293
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
9394
pub struct SignRequest {
9495
pub to_sign: Vec<u8>,
96+
pub sigscheme: SigScheme,
9597
pub uri: Option<String>,
9698
}
9799

‎crates/extensions/tedge-p11-server/src/signer.rs

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ use crate::client::TedgeP11Client;
1111
use crate::pkcs11::Cryptoki;
1212
use crate::pkcs11::CryptokiConfigDirect;
1313
use crate::pkcs11::Pkcs11Signer;
14+
use crate::pkcs11::SigScheme;
1415

1516
#[derive(Debug, Clone)]
1617
pub enum CryptokiConfig {
@@ -28,13 +29,13 @@ pub enum CryptokiConfig {
2829
/// Contains a handle to Pkcs11-backed private key that will be used for signing, selected at construction time.
2930
pub trait TedgeP11Signer: SigningKey {
3031
/// Signs the message using the selected private key.
31-
fn sign(&self, msg: &[u8]) -> anyhow::Result<Vec<u8>>;
32+
fn sign(&self, msg: &[u8], sigscheme: SigScheme) -> anyhow::Result<Vec<u8>>;
3233
fn to_rustls_signing_key(self: Arc<Self>) -> Arc<dyn rustls::sign::SigningKey>;
3334
}
3435

3536
impl TedgeP11Signer for Pkcs11Signer {
36-
fn sign(&self, msg: &[u8]) -> anyhow::Result<Vec<u8>> {
37-
Pkcs11Signer::sign(self, msg)
37+
fn sign(&self, msg: &[u8], sigscheme: SigScheme) -> anyhow::Result<Vec<u8>> {
38+
Pkcs11Signer::sign(self, msg, sigscheme)
3839
}
3940

4041
fn to_rustls_signing_key(self: Arc<Self>) -> Arc<dyn rustls::sign::SigningKey> {
@@ -72,9 +73,9 @@ pub struct TedgeP11ClientSigningKey {
7273
}
7374

7475
impl TedgeP11Signer for TedgeP11ClientSigningKey {
75-
fn sign(&self, msg: &[u8]) -> anyhow::Result<Vec<u8>> {
76+
fn sign(&self, msg: &[u8], sigscheme: SigScheme) -> anyhow::Result<Vec<u8>> {
7677
self.client
77-
.sign(msg, self.uri.as_ref().map(|s| s.to_string()))
78+
.sign(msg, sigscheme, self.uri.as_ref().map(|s| s.to_string()))
7879
}
7980
fn to_rustls_signing_key(self: Arc<Self>) -> Arc<dyn rustls::sign::SigningKey> {
8081
self
@@ -120,10 +121,11 @@ pub struct TedgeP11ClientSigner {
120121

121122
impl Signer for TedgeP11ClientSigner {
122123
fn sign(&self, message: &[u8]) -> Result<Vec<u8>, rustls::Error> {
123-
let response = match self
124-
.client
125-
.sign(message, self.uri.as_ref().map(|s| s.to_string()))
126-
{
124+
let response = match self.client.sign(
125+
message,
126+
self.scheme.into(),
127+
self.uri.as_ref().map(|s| s.to_string()),
128+
) {
127129
Ok(response) => response,
128130
Err(err) => {
129131
return Err(rustls::Error::Other(rustls::OtherError(Arc::from(

‎tests/RobotFramework/tests/pkcs11/private_key_storage.robot

Lines changed: 23 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -105,44 +105,15 @@ Can use PKCS11 key to renew the public certificate
105105
... can renew both a self-signed certificate and a certificate signed by C8y CA.
106106
[Setup] Set tedge-p11-server Uri value=${EMPTY}
107107

108-
Connect to C8y using new keypair type=ecdsa curve=secp256r1
109-
Execute Command tedge cert renew c8y
110-
Tedge Reconnect Should Succeed
111-
Execute Command tedge cert renew c8y
112-
Tedge Reconnect Should Succeed
113-
114-
Connect to C8y using new keypair type=ecdsa curve=secp384r1
115-
Execute Command tedge cert renew c8y
116-
Tedge Reconnect Should Succeed
117-
Execute Command tedge cert renew c8y
118-
Tedge Reconnect Should Succeed
108+
Test tedge cert renew type=ecdsa curve=secp256r1
109+
Test tedge cert renew type=ecdsa curve=secp384r1
119110

120-
# renewal isn't supported for P521 because rcgen doesn't support it
111+
# renewal isn't supported for secp521r1 because rcgen doesn't support it
121112
# https://github.com/rustls/rcgen/issues/60
122113

123-
# Connect to C8y using new keypair type=ecdsa curve=secp521r1
124-
# Execute Command tedge cert renew c8y
125-
# Tedge Reconnect Should Succeed
126-
# Execute Command tedge cert renew c8y
127-
# Tedge Reconnect Should Succeed
128-
129-
Connect to C8y using new keypair type=rsa bits=2048
130-
Execute Command tedge cert renew c8y
131-
Tedge Reconnect Should Succeed
132-
Execute Command tedge cert renew c8y
133-
Tedge Reconnect Should Succeed
134-
135-
Connect to C8y using new keypair type=rsa bits=3072
136-
Execute Command tedge cert renew c8y
137-
Tedge Reconnect Should Succeed
138-
Execute Command tedge cert renew c8y
139-
Tedge Reconnect Should Succeed
140-
141-
Connect to C8y using new keypair type=rsa bits=4096
142-
Execute Command tedge cert renew c8y
143-
Tedge Reconnect Should Succeed
144-
Execute Command tedge cert renew c8y
145-
Tedge Reconnect Should Succeed
114+
Test tedge cert renew type=rsa bits=2048
115+
Test tedge cert renew type=rsa bits=3072
116+
Test tedge cert renew type=rsa bits=4096
146117

147118
Execute Command systemctl stop tedge-p11-server tedge-p11-server.socket
148119
Command Should Fail With
@@ -222,6 +193,23 @@ Warn the user if tedge.toml cannot be parsed
222193

223194

224195
*** Keywords ***
196+
Test tedge cert renew
197+
[Arguments] ${type} ${bits}=${EMPTY} ${curve}=${EMPTY}
198+
199+
Connect to C8y using new keypair type=${type} curve=${curve} bits=${bits}
200+
201+
Execute Command tedge cert renew c8y
202+
${stderr}= Execute Command openssl req -text -noout -in /etc/tedge/device-certs/tedge.csr -verify stdout=False stderr=true
203+
Should Contain ${stderr} Certificate request self-signature verify OK
204+
205+
Tedge Reconnect Should Succeed
206+
207+
Execute Command tedge cert renew c8y
208+
${stderr}= Execute Command openssl req -text -noout -in /etc/tedge/device-certs/tedge.csr -verify stdout=False stderr=true
209+
Should Contain ${stderr} Certificate request self-signature verify OK
210+
211+
Tedge Reconnect Should Succeed
212+
225213
Connect to C8y using new keypair
226214
[Documentation] Connects to C8y with a newly generated keypair and a self-signed certificate.
227215
... The private key is saved on the token, and the self-signed certificate is registered with c8y.

0 commit comments

Comments
 (0)