core: Spiffe Utils #11522

erm-g · 2024-09-13T03:28:06Z

No description provided.

matthewstevenson88

Thanks for putting this together @erm-g! I took an initial pass and left some comments. Please give me a ping when it's ready for another look. :)

matthewstevenson88 · 2024-09-13T04:47:16Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+    checkArgument(checkNotNull(certChain, "certChain").length > 0, "CertChain can't be empty");
+    Collection<List<?>> subjectAltNames = certChain[0].getSubjectAlternativeNames();
+    if (subjectAltNames != null) {
+      for (List<?> altName : subjectAltNames) {


Please ensure that there is a unique URI SAN.

matthewstevenson88 · 2024-09-13T04:47:24Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+
+  private SpiffeUtil() {}
+
+  public static Optional<SpiffeId> extractSpiffeId(X509Certificate[] certChain)


Please add a Javadoc.

matthewstevenson88 · 2024-09-13T04:47:36Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+  private static final Integer URI_SAN_TYPE = 6;
+  private static final String USE_PARAMETER_VALUE = "x509-svid";
+
+  private SpiffeUtil() {}


nit: Please move to the bottom of the class.

Dropped it completely, similar to #11490 (comment)

matthewstevenson88 · 2024-09-13T04:48:05Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+
+  public static class TrustBundle {
+
+    private final Map<String, Long> sequenceNumbers;


What are the sequence numbers? Could you explain why they're relevant here?

In short it's a number that indicates the bundle version for a particular TB, however it's not mandatory -
https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md#411-sequence-number

Thanks for explaining. Are we going to use the sequence numbers for anything? If not, should we drop them?

matthewstevenson88 · 2024-09-13T04:48:16Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+    }
+  }
+
+  public static class TrustBundle {


Please add a Javadoc for this class and its methods.

matthewstevenson88 · 2024-09-13T04:50:35Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+      for (Map<String, ?> keyNode : keysNode) {
+        String kid = JsonUtil.getString(keyNode, "kid");
+        if (kid != null && !kid.equals("")) {
+          log.log(Level.SEVERE, String.format("'kid' parameter must not be set but value '%s' "


Here and throughout this method: since this is a library, should we throw an exception rather than logging?

We still need to construct a map even if we can't process some of the entries, i.e json like

domain: google.com cert:correctBytes domain: google.com.test cert:corruptedBytes

should still produce a valid entry for google.com. WDYT?

Ah I see, good question. I was thinking that we should be strict for the start and fail if anything is malformed and, if we need to change in the future, we can do so without breaking users. However, if we start off allowing malformed entries, then we can't disallow them in the future without a breaking change. WDYT?

matthewstevenson88 · 2024-09-13T04:50:56Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+
+    private final Map<String, Long> sequenceNumbers;
+
+    private final Map<String, List<X509Certificate>> trustBundleMap;


nit: Prefer ImmutableMap and ImmutableList.

matthewstevenson88 · 2024-09-13T04:54:44Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+    return Optional.absent();
+  }
+
+  public static TrustBundle loadTrustBundleFromFile(String trustBundleFile) throws IOException {


Could you point me to the spec you're using as a reference for this method?

https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md

Thanks! What's confusing me is the following - the code and the examples seem to suggest that the file has the following format:

{ "trust_domains": { "trust_domain": { // JWK set } } }

But the spec only seems to talk about the structure of the JWK set. Where is the rest of the structure specified?

Apologies in advance if I'm missing something obvious. :)

matthewstevenson88 · 2024-09-13T04:54:55Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+    for (String trustDomainName : trustDomainsNode.keySet()) {
+      Map<String, ?> domainNode = JsonUtil.getObject(trustDomainsNode, trustDomainName);
+      if (domainNode == null || domainNode.size() == 0) {
+        trustBundleMap.put(trustDomainName, Collections.emptyList());


Is this allowed?

From connection status perspective it's the same. However, from monitoring/debugging perspective I think it's useful to differentiate between 'Hey, the file we loaded doesn't contain the domain' and 'Hey, the the domain doesn't have the correct root to validate this conn'.
WDYT?

Makes sense. I'm surprised that the spec allows an empty key or empty value, but agree with you that it doesn't matter from an authentication point of view.

matthewstevenson88 · 2024-09-13T04:55:33Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+              trustDomainName));
+          break;
+        }
+        String rawCert = JsonUtil.getString(keyNode, "x5c");


Is this DER-encoded or PEM-encoded?

https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md#appendix-a-spiffe-bundle-example suggests the former, but all of our discussions have been slanted to the latter.

…methods

matthewstevenson88 · 2024-09-20T03:29:35Z

core/src/main/java/io/grpc/internal/SpiffeUtil2.java

+    if (subjectAltNames != null) {
+      boolean spiffeFound = false;
+      for (List<?> altName : subjectAltNames) {
+        if (URI_SAN_TYPE.equals(altName.get(0))) {


nit: Should we check that altName.length > 0?

matthewstevenson88 · 2024-09-20T03:34:41Z

core/src/main/java/io/grpc/internal/SpiffeUtil2.java

+      throws CertificateParsingException {
+    checkArgument(checkNotNull(certChain, "certChain").length > 0, "CertChain can't be empty");
+    Collection<List<?>> subjectAltNames = certChain[0].getSubjectAlternativeNames();
+    if (subjectAltNames != null) {


Readability suggestion: To minimize nesting, consider returning early here, e.g.

if (subjectAltNames == null) { return Optional.absent(); }

matthewstevenson88 · 2024-09-20T03:37:03Z

core/src/main/java/io/grpc/internal/SpiffeUtil2.java

+    checkArgument(checkNotNull(certChain, "certChain").length > 0, "CertChain can't be empty");
+    Collection<List<?>> subjectAltNames = certChain[0].getSubjectAlternativeNames();
+    if (subjectAltNames != null) {
+      boolean spiffeFound = false;


WDYT of storing the SPIFFE ID instead of a boolean, so we don't need to iterate over the list twice?

For example,

Optional<String> uriSan = Optional.absent(); for (List<?> altName : subjectAltNames) { if (altName.length > 0 && altName.get(0).equals(URI_SAN_TYPE) { if (uriSan.absent()) { uriSan = Optional.of(altName.get(0)); } else { throw exception } } }

matthewstevenson88 · 2024-09-20T03:39:34Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+
+  public static class TrustBundle {
+
+    private final Map<String, Long> sequenceNumbers;


Thanks for explaining. Are we going to use the sequence numbers for anything? If not, should we drop them?

matthewstevenson88 · 2024-09-20T04:06:28Z

core/src/main/java/io/grpc/internal/SpiffeUtil2.java

+  private static final String USE_PARAMETER_VALUE = "x509-svid";
+
+  /**
+   * Parses a leaf certificate from the chain to extract unique SPIFFE ID. In case of success,


Suggested edit: "Returns the SPIFFE ID from the leaf certificate, if present."

matthewstevenson88 · 2024-09-20T04:09:02Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+    for (String trustDomainName : trustDomainsNode.keySet()) {
+      Map<String, ?> domainNode = JsonUtil.getObject(trustDomainsNode, trustDomainName);
+      if (domainNode == null || domainNode.size() == 0) {
+        trustBundleMap.put(trustDomainName, Collections.emptyList());


Makes sense. I'm surprised that the spec allows an empty key or empty value, but agree with you that it doesn't matter from an authentication point of view.

matthewstevenson88 · 2024-09-20T04:17:45Z

core/src/test/resources/io/grpc/internal/spiffebundle.json

+          "e": "AQAB"
+        },
+        {
+          "kty": "RSA",


Should we add the x5c key so that we can confirm in our tests that multiple certs for the same trust domain get properly captured in the spiffe bundle?

matthewstevenson88 · 2024-09-20T04:23:06Z

core/src/main/java/io/grpc/internal/SpiffeUtil.java

+      for (Map<String, ?> keyNode : keysNode) {
+        String kid = JsonUtil.getString(keyNode, "kid");
+        if (kid != null && !kid.equals("")) {
+          log.log(Level.SEVERE, String.format("'kid' parameter must not be set but value '%s' "


Ah I see, good question. I was thinking that we should be strict for the start and fail if anything is malformed and, if we need to change in the future, we can do so without breaking users. However, if we start off allowing malformed entries, then we can't disallow them in the future without a breaking change. WDYT?

matthewstevenson88 · 2024-09-20T04:24:20Z

core/src/main/java/io/grpc/internal/SpiffeUtil2.java

+      try {
+        Collection<? extends Certificate> certs = CertificateFactory.getInstance("X509")
+            .generateCertificates(stream);
+        if (certs.size() > 0) {


Could this be > 1? If yes, should we take those into account? What does the spec say about this case?

matthewstevenson88 · 2024-09-20T04:27:31Z

core/src/main/java/io/grpc/internal/SpiffeUtil2.java

+      String trustDomainName) {
+    List<X509Certificate> result = new ArrayList<>();
+    for (Map<String, ?> keyNode : keysNode) {
+      String kid = JsonUtil.getString(keyNode, "kid");


optional: To make the code more readable, consider moving the checks on the "kid" and "use" claims into a helper function.

erm-g added 6 commits September 9, 2024 03:30

Spiffe extraction logic with basic tests

23c7c2f

TrustBundle load API

af0698b

Move spiffebundle.txt to correct module

02ad4e4

Unit tests

5fe87fa

Additional spec checks

c2a6035

SpiffeId parsing from non spiffe cert

adb7e31

erm-g requested a review from matthewstevenson88 September 13, 2024 03:28

matthewstevenson88 reviewed Sep 13, 2024

View reviewed changes

erm-g added 7 commits September 17, 2024 17:37

Tests and certs for Multi URI SAN

df19d44

Address PR comments

0312dc1

JsonParser to not allow duplicate elements

775de8f

Add a parameter to JsonParser to select parsing mode

f60a829

Expose extra api for no duplicate parsing

cc64e6d

Fix typo

add1f55

Extracted functionality from loadTrustBundleFromFile into few helper …

00967a3

…methods

erm-g requested a review from matthewstevenson88 September 20, 2024 02:07

matthewstevenson88 reviewed Sep 20, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

core: Spiffe Utils #11522

core: Spiffe Utils #11522

erm-g commented Sep 13, 2024

matthewstevenson88 left a comment

matthewstevenson88 Sep 13, 2024

matthewstevenson88 Sep 13, 2024

matthewstevenson88 Sep 13, 2024

erm-g Sep 20, 2024

matthewstevenson88 Sep 13, 2024

erm-g Sep 19, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 13, 2024

matthewstevenson88 Sep 13, 2024

erm-g Sep 19, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 13, 2024

matthewstevenson88 Sep 13, 2024

erm-g Sep 19, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 13, 2024

erm-g Sep 19, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 13, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024

matthewstevenson88 Sep 20, 2024


		private SpiffeUtil() {}

		public static Optional<SpiffeId> extractSpiffeId(X509Certificate[] certChain)


		public static class TrustBundle {

		private final Map<String, Long> sequenceNumbers;


		private final Map<String, Long> sequenceNumbers;

		private final Map<String, List<X509Certificate>> trustBundleMap;

core: Spiffe Utils #11522

Are you sure you want to change the base?

core: Spiffe Utils #11522

Conversation

erm-g commented Sep 13, 2024

matthewstevenson88 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment