50 Commits (main)

Author SHA1 Message Date
Jan Dittberner 2a800ecaf7 Update to Go 1.21
- bump go module version to 1.21
- replace deprecated CRL APIs
- update dependencies
6 months ago
Jan Dittberner e4c4d0b9eb Regenerate msgpackgen definitions 1 year ago
Jan Dittberner e35e9e9df6 Cleanup command and response types
- use consistent method recipient names
- move ErrorResponse to the end of the messages
- fix email address output in SignCertificateCommand String() method
1 year ago
Jan Dittberner f92bba5496 Define command and response for SignOpenPGP 1 year ago
Jan Dittberner c452453c31 Define command and response for RevokeCertificate 1 year ago
Jan Dittberner ad6b987c91 Implement sign certificate command
- decouple config and messages
- cainfo maps from config.Profile to messages.CAProfile
- config parses profile usage
- validity can be configured per certificate profile, defaults are defined in
  a defaultValidity method of the profile usage
- the client simulator emits certificate signing requests at random intervals
- add implementation of SingCertificateCommand to MsgPackHandler
- remove indirection signing.RequestSignature
1 year ago
Jan Dittberner 40b3219c7e Add serialization/deserialization tests 1 year ago
Jan Dittberner a0b6fdce98 Refactor public API tests for messages
- move tests for public API to messages_test package
1 year ago
Jan Dittberner 51ca9cc69d Refactor public API tests for protocol
- move tests for public API to protocol_test package
- add tests for context handling of COBSFramer
1 year ago
Jan Dittberner 7852c4d3df Add explicit channel direction information
This commit adds explicit input and output channel type information to
make the channel's intent visible to developers.
1 year ago
Jan Dittberner 46407b3685 Implement write canceling in COBSFramer 1 year ago
Jan Dittberner afe7d23c9b Implement CA information command
This commit defines command codes for planned commands and response codes for
their corresponding responses.

The health response from the HSM access component has been reduced to avoid
unnecessary data transmissions.

A new CA information command has been implemented. This command can be used
to retrieve the CA certificate and profile information for a given CA name.

The client simulator has been updated to retrieve CA information for all
CAs when the list of CAs changes.
1 year ago
Jan Dittberner 1374fe58e8 Implement graceful shutdown on interrupt or SIGTERM 1 year ago
Jan Dittberner 37d3b1e021 Update dependencies
This commit updates all external dependencies. The cobs module has a
changed API and code using cobs has been adapted to this new API.
1 year ago
Jan Dittberner 19436c06c2 Implement unit tests for public packages
This commit adds a comprehensive unit test suite for all public packages.
1 year ago
Jan Dittberner 51afebf2c1 Test and refactor messages
- add unit tests for all handwritten code in messages package
- use uuid.NewString() instead of uuid.NewUUID() to avoid unnecessary error
  handling
- sort code in messages.go to put type related code close to each other
- move checkFailed from hsm.Access.Healthy method to messages.CertificateInfoFailed
- add typing for Status field of messages.CertificateInfo
1 year ago
Jan Dittberner 65c5bac2d9 Implement delta CRL support
This commit provides real CRL support with persistent storage of CRLs as well
as support for delta CRLs using github.com/balacode/go-delta
1 year ago
Jan Dittberner 1031ee3118 Implement configuration support for CA profiles 1 year ago
Jan Dittberner af40662c7d Refactor client protocol
- define protocols.ClientHandler interface as base for client implementations
- implement protocols.ClientHandler in clientsim's ClientHandler type
- move protocol state handling into protocols.ServerProtocol and
  protocols.ClientProtocol
- move protocolState type into protocols.go
- reduce clientsim's TestCommandGenerator responsibility to test command
  generation
1 year ago
Jan Dittberner f429d3da45 Refactor server handler
- rename protocols.Handler to ServerHandler
- rename ServerHandler methods to better express their purpose
- pass command and response as parameters
- simplify state machine and handle errors in serial/seriallink.go
- implement command read timeout
- remove currentCommand and currentResponse fields from MsgPackHandler
1 year ago
Jan Dittberner 9905d748d9 Improve signer robustness
- let client simulator send some garbage bytes before starting real commands
- handle EOF during reads
1 year ago
Jan Dittberner e5dcf7afa9 Refactor COBS wire protocol
Wire protocol handling has been moved to protocol.Framer and its
implementation protocol.COBSFramer
1 year ago
Jan Dittberner faaadbe5aa Move internal code to internal packages 1 year ago
Jan Dittberner f0d456dd13 Protocol improvements
- add a client generated command ID for tracing commands and responses
- define protocol delimiter in protocol.CobsDelimiter
- apply code simplifications suggested by golangci-lint
- add Makefile
- add compile time build information for signer binary
- make sure that dependencies for msgpackgen survive go mod tidy
- extract MsgPackHandler into its own file
- add CRL number to fetch CRL response
- remove port.Flush() to avoid removing written data before it reaches the
  client
1 year ago
Jan Dittberner 8e443bd8b4 Implement protocol improvements
This commit implements a client and server side state machine
for the serial protocol.
1 year ago
Jan Dittberner 2de592d30c Implement command type handling
This commit changes the wire protocol to split between command
announcement and command payload to allow proper typing of sent and
received msgpack messages.

CRL fetching has been implemented as second command after the existing
health check command.
1 year ago
Jan Dittberner 472091b374 Switch to logrus for structured logging 1 year ago
Jan Dittberner 4c24e4692b Fix golangci-lint warnings 1 year ago
Jan Dittberner 175a72298d Centralize serial number generation 1 year ago
Jan Dittberner 82a1284073 Rename intermediary CA to subordinate CA
This refactoring commit renames all occurrences of the term "intermediary CA"
to "subordinate CA" for better alignment with the terms used in RFC-5280 and
other standard documents.
2 years ago
Jan Dittberner 60be959c24 Implement health check infrastructure
This commit adds health check capabilities to the hsm.Access and health
response data to the messages returned by the health command.
2 years ago
Jan Dittberner 3107ad8abb Implement serial link and protocol handling infrastructure
This commit adds basic serial link and protocol support. None of the commands
from the docs/design.md document is implemented yet.

The following new packages have been added:

- seriallink containing the serial link handler including COBS decoding and
  encoding
- protocol containing the protocol handler including msgpack unmarshalling
  and marshaling
- health containing a rudimentary health check implementation
- messages containing command and response types and generated msgpack
  marshaling code

A client simulation command has been added in cmd/clientsim.

README.md got instructions how to run the client simulator. The
docs/config.sample.yaml contains a new section for the serial connection
parameters.
2 years ago
Jan Dittberner c2b987fd31 Allow hsm to use relative paths 2 years ago
Jan Dittberner 0d69a9013d Refactor HSM setup
- create new type hsm.Access to encapsulate HSM operations
- make setup options operate on hsm.Access instances
- adapt tests and cmd/signer to work with hsm.Access
2 years ago
Jan Dittberner c532ec436a Improve test coverage of package hsm 2 years ago
Jan Dittberner 057852ede6 Implement proper support for CRLEntry extensions 2 years ago
Jan Dittberner 474e7717cc Fix Goland code inspection warnings 2 years ago
Jan Dittberner 79cb5c96bf Extract test helper functions 2 years ago
Jan Dittberner 510ba2ad25 Add test for pkg/hsm/context.go 2 years ago
Jan Dittberner 23c9e6f3e0 Improve test coverage of X.509 revoking 2 years ago
Jan Dittberner c538be4385 Fix error message spelling 2 years ago
Jan Dittberner baf6d0f037 Configure and apply golangci-lint 2 years ago
Jan Dittberner 63c3716b5b Move x509 and openpgp into pkg
small refactoring to unify package structure. Use crypto.rand for serial
number generation in tests.
2 years ago
Jan Dittberner 42c7dc7170 Improve config handling and test coverage 2 years ago
Jan Dittberner 7d415ff181 Increase coverage for pkg/config 2 years ago
Jan Dittberner 9fd40af603 Add -verbose flag, implement config options 2 years ago
Jan Dittberner 2e343498af Fix failing test 2 years ago
Jan Dittberner 47d5b2afff Improve configuration, implement setup mode
- implement a dedicated setup mode for creating CA certificates that is
  triggered by the '-setup' command line flag
- switch to YAML configuration for comment support and more human
  readable syntax. Format documentation is in docs/config.sample.yaml
- move HSM related code to pkg/hsm
- improve consistency checks in pkg/config
2 years ago
Jan Dittberner 24f9ef297c Extract variable for policy OID 2 years ago
Jan Dittberner de997913cf Implement configuration and CA hierarchy setup
This commit implements a mechanism to load CA configuration dynamically from
JSON files. Missing keys and certificates can be generated in a PKCS#11 HSM
or Smartcard. Certificates are stored as PEM encoded .crt files in the
filesystem.

The default PKCS#11 module (softhsm2) is now loaded from a platform specific
path using go:build comments.
2 years ago