(WIP) : HTTPS support for manufacturing-server and manufacturing-client for DI #579
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sarmahaj
force-pushed
the
fdo_di_https
branch
from
0a84b37
to
baab2b4
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
sarmahaj
changed the title
sarmahaj
force-pushed
the
fdo_di_https
branch
from
baab2b4
to
87e96b8
Compare
sarmahaj
force-pushed
the
fdo_di_https
branch
from
87e96b8
to
15f22ec
Compare
sarmahaj
force-pushed
the
fdo_di_https
branch
from
15f22ec
to
3b57dce
Compare
sarmahaj
force-pushed
the
fdo_di_https
branch
2 times, most recently
from
3a58471
to
f0c60c0
Compare
- warp::service and hyper::server combination used to run https server - separate bind address for http and https - tls_config containes tls config for htpps - now manufacturing-server supports both http and https requests from client. Signed-off-by: Sarita Mahajan <[email protected]>
- changes on client side to support https request Signed-off-by: Sarita Mahajan <[email protected]>
- still WIP Signed-off-by: Sarita Mahajan <[email protected]>
sarmahaj
force-pushed
the
fdo_di_https
branch
from
f0c60c0
to
5d71f77
Compare
| // cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test"); | ||
| // cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test"); | ||
| // cfg.insert("bind_http", "8085"); | ||
| // cfg.insert("bind_https", &("127.0.0.1:{}" )); |
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling. Note test
| @@ -801,6 +900,7 @@ | |||
| "bind", | |||
| &format!("127.0.0.1:{}", self.server_number.server_port().unwrap()), | |||
| ); | |||
| cfg.insert("bind_https", &format!("127.0.0.1:{}", 6000)); | |||
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling. Note test
|
|
||
| // Set subject for the certificate | ||
| let mut name_builder = X509NameBuilder::new()?; | ||
| name_builder.append_entry_by_nid(openssl::nid::Nid::COMMONNAME, "localhost")?; |
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling. Note test
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR (currently in draft state) contains-
(Meanwhile to test manually, use following commands )
To create key & certs:
openssl genpkey -algorithm RSA -out server.keyopenssl req -new -key server.key -out server.csropenssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crtMention this address in manufacturing_server_https_key and manufacturing_server_https_cert fields in manufacturing_server.config file.
(This part to generate cert and key will be taken care in separate PR as a part of admin-tool)
sudo MANUFACTURING_SERVER_CONF=/usr/share/fdo/manufacturing_server.yml LOG_LEVEL=trace ./target/debug/fdo-manufacturing-server
HTTPS request:
sudo DEV_ENVIRONMENT=1 MANUFACTURING_SERVER_URL=https://localhost:8084 LOG_LEVEL=trace DIUN_PUB_KEY_ROOTCERTS=aio-dir/keys/diun_cert.pem ./target/debug/fdo-manufacturing-client
HTTP request:
sudo DEV_ENVIRONMENT=0 MANUFACTURING_SERVER_URL=http://localhost:8080 LOG_LEVEL=trace DIUN_PUB_KEY_ROOTCERTS=aio-dir/keys/diun_cert.pem ./target/debug/fdo-manufacturing-client
DI should work and create device_credentials file under /etc/device-credentials.