Security Module Plugin API #713

usmansaleem · 2020-04-15T05:03:24Z

PR description

Introduce Security Module Plugin API. This allows to switch to a different security module provider to provide cryptographic function that can be used by NodeKey (such as sign, ECDHKeyAgreement etc.). By default register KeyPairSecurityModule otherwise attempt to load Security Module via plugin API.

CLI Options:
--security-module=<name>. (defaults to localfile)

Signed-off-by: Usman Saleem <[email protected]>

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

besu/src/main/java/org/hyperledger/besu/cli/subcommands/PublicKeySubCommand.java

Signed-off-by: Usman Saleem <[email protected]>

besu/src/main/java/org/hyperledger/besu/controller/BesuControllerBuilder.java

Signed-off-by: Usman Saleem <[email protected]>

acceptance-tests/dsl/build.gradle

...s/dsl/src/main/java/org/hyperledger/besu/tests/acceptance/dsl/node/ThreadBesuNodeRunner.java

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

besu/src/main/java/org/hyperledger/besu/cli/subcommands/PublicKeySubCommand.java

besu/src/main/java/org/hyperledger/besu/services/SecurityModuleServiceImpl.java

besu/src/test/java/org/hyperledger/besu/cli/BesuCommandTest.java

besu/src/test/java/org/hyperledger/besu/cli/PublicKeySubCommandTest.java

crypto/src/main/java/org/hyperledger/besu/crypto/BouncyCastleSecurityModule.java

Signed-off-by: Usman Saleem <[email protected]>

NicolasMassart · 2020-04-23T08:09:18Z

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

+
+  private File nodePrivateKeyFile() {
+    final Optional<File> nodePrivateKeyFile =
+        isDocker ? Optional.empty() : Optional.ofNullable(standaloneCommands.nodePrivateKeyFile);


There should no be any docker specific behaviour

This whole file is using docker specific behavior using org/hyperledger/besu/cli/BesuCommand.java:2103

private boolean isFullInstantiation() { return !isDocker; }

It's garbage code to be deleted. We don't provide the parameter in the docker image since 29c3c14#diff-ebacf6f6ae4ee68078bb16454b23247dL19 so this part of the code is dead since July 2019. It was discussed about removing it but it was not a priority. Now, if it's confusing, it should be a priority IMO.

👍 I have created #785 and will clean it out in a separate PR.

👍 Its a shame the docker code wasn't cleaned out before now - but the removal shouldn't be part of this work.

Signed-off-by: Usman Saleem <[email protected]>

crypto/src/main/java/org/hyperledger/besu/crypto/KeyPairSecurityModule.java

crypto/src/main/java/org/hyperledger/besu/crypto/ECPointUtil.java

Signed-off-by: Usman Saleem <[email protected]>

Conflicts: plugin-api/build.gradle Signed-off-by: Usman Saleem <[email protected]>

rain-on · 2020-04-26T03:29:41Z

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

+
+  private File nodePrivateKeyFile() {
+    final Optional<File> nodePrivateKeyFile =
+        isDocker ? Optional.empty() : Optional.ofNullable(standaloneCommands.nodePrivateKeyFile);


👍 Its a shame the docker code wasn't cleaned out before now - but the removal shouldn't be part of this work.

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

crypto/src/main/java/org/hyperledger/besu/crypto/ECPointUtil.java

rain-on · 2020-04-26T06:27:18Z

crypto/src/main/java/org/hyperledger/besu/crypto/KeyPairSecurityModule.java

+  private final SECP256K1.KeyPair keyPair;
+  private final PublicKey publicKey;
+
+  public KeyPairSecurityModule(final SECP256K1.KeyPair keyPair) {


nit: given there's crypto operations happening here, do we want to move this to a static creator? which passes in a privkey and a PublicKey?

we only require SECP256K1.KeyPair. The PublicKey is the interface (with ECPoint) that is meant to be converted from SECP256K1's PublicKey. The other option would be to initialize public key on the first access via getPublicKey. I don't feel the need of creator factory method.

rain-on · 2020-04-26T06:29:23Z

plugin-api/src/main/java/org/hyperledger/besu/plugin/services/SecurityModuleService.java

+  /**
+   * Registers a provider of security modules.
+   *
+   * @param name The name to identify the Security Provider Supplier Function


Suggested change

* @param name The name to identify the Security Provider Supplier Function

* @param name The name to identify the Security Provider Supplier

javadoc updated.

plugin-api/src/main/java/org/hyperledger/besu/plugin/services/SecurityModuleService.java

Signed-off-by: Usman Saleem <[email protected]>

…rityModuleService Signed-off-by: Usman Saleem <[email protected]>

Signed-off-by: Usman Saleem <[email protected]>

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

Signed-off-by: Usman Saleem <[email protected]>

usmansaleem added 10 commits April 14, 2020 19:10

Node Key Security Provider BouncyCastle backed internal plugin

8dff540

Signed-off-by: Usman Saleem <[email protected]>

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

33482d5

Signed-off-by: Usman Saleem <[email protected]>

wip

bf62f2c

Signed-off-by: Usman Saleem <[email protected]>

wip - renaming plugin name

76f01f1

Signed-off-by: Usman Saleem <[email protected]>

refactoring package name

3db6b44

Signed-off-by: Usman Saleem <[email protected]>

wip

72b4dc9

Signed-off-by: Usman Saleem <[email protected]>

wip - refactor package name

3a30a73

Signed-off-by: Usman Saleem <[email protected]>

wip

d5392e7

Signed-off-by: Usman Saleem <[email protected]>

Merge upstream/master

160d9df

Signed-off-by: Usman Saleem <[email protected]>

wip - clean compile

b934f3a

Signed-off-by: Usman Saleem <[email protected]>

usmansaleem commented Apr 15, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java Outdated Show resolved Hide resolved

usmansaleem commented Apr 15, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/cli/subcommands/PublicKeySubCommand.java Outdated Show resolved Hide resolved

spotless fix

2505c3d

Signed-off-by: Usman Saleem <[email protected]>

usmansaleem commented Apr 15, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/controller/BesuControllerBuilder.java Outdated Show resolved Hide resolved

usmansaleem added 15 commits April 15, 2020 15:28

test compilation fix

afd1124

Signed-off-by: Usman Saleem <[email protected]>

spotless fix

87e063f

Signed-off-by: Usman Saleem <[email protected]>

license header

977b3f0

Signed-off-by: Usman Saleem <[email protected]>

spotless fix

5c3e76a

Signed-off-by: Usman Saleem <[email protected]>

spotless fix

8a69d3a

Signed-off-by: Usman Saleem <[email protected]>

mock fix in CommandTestAbstract

4d14a37

Signed-off-by: Usman Saleem <[email protected]>

supplier memoize

e044e49

Signed-off-by: Usman Saleem <[email protected]>

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

4b2209a

Signed-off-by: Usman Saleem <[email protected]>

supplier memoize moved into BouncyCastleSecurityModule

94f2996

Signed-off-by: Usman Saleem <[email protected]>

Fixing PublicKeySubCommand and its unit tests

295caef

Signed-off-by: Usman Saleem <[email protected]>

updating plugin cli option and removing unit test cases

7bd3790

Signed-off-by: Usman Saleem <[email protected]>

Register SecurityModuleService in dsl ThreadBesuRunner

4f08b33

Signed-off-by: Usman Saleem <[email protected]>

refactoring threadbesunoderunner

3b18e3e

Signed-off-by: Usman Saleem <[email protected]>

variable names cleanup

a2187a3

Signed-off-by: Usman Saleem <[email protected]>

cleanup

c133689

Signed-off-by: Usman Saleem <[email protected]>

rain-on reviewed Apr 15, 2020

View reviewed changes

removing internal plugin from acceptance dsl

afbc588

Signed-off-by: Usman Saleem <[email protected]>

usmansaleem changed the title ~~Local File Security Module Plugin~~ Security Module Plugin API Apr 23, 2020

javadoc

6283c0c

Signed-off-by: Usman Saleem <[email protected]>

NicolasMassart reviewed Apr 23, 2020

View reviewed changes

usmansaleem added 5 commits April 23, 2020 18:16

final keywords

26aebd3

Signed-off-by: Usman Saleem <[email protected]>

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

eb6712a

Signed-off-by: Usman Saleem <[email protected]>

ECPointUtil toUnsignedByteArray cleanup and unit tests

317bc51

Signed-off-by: Usman Saleem <[email protected]>

cleaning up KeyPairSecurityModule

6f675cb

Signed-off-by: Usman Saleem <[email protected]>

typo

5dee1ab

Signed-off-by: Usman Saleem <[email protected]>

jframe reviewed Apr 24, 2020

View reviewed changes

usmansaleem added 2 commits April 24, 2020 15:45

review suggestion - exception message in keypairsecuritymodule

73df123

Signed-off-by: Usman Saleem <[email protected]>

ECPointUtil cleanup - Use BC BigIntegers.asUnsignedByteArray

5f83f01

Signed-off-by: Usman Saleem <[email protected]>

jframe approved these changes Apr 24, 2020

View reviewed changes

Merge upstream master

3f62973

Conflicts: plugin-api/build.gradle Signed-off-by: Usman Saleem <[email protected]>

rain-on reviewed Apr 26, 2020

View reviewed changes

usmansaleem added 5 commits April 27, 2020 10:03

review suggestions

6a36b4e

Signed-off-by: Usman Saleem <[email protected]>

review suggestion - Register default SecurityModuleProvider with Secu…

75c5803

…rityModuleService Signed-off-by: Usman Saleem <[email protected]>

spotless fix

b18f39b

Signed-off-by: Usman Saleem <[email protected]>

plugin api checksum

b5dba6d

Signed-off-by: Usman Saleem <[email protected]>

Using Supplier<SecurityModule> instead of SecurityModuleSupplier

6322e08

Signed-off-by: Usman Saleem <[email protected]>

jframe reviewed Apr 27, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java Outdated Show resolved Hide resolved

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java Outdated Show resolved Hide resolved

usmansaleem added 2 commits April 27, 2020 13:16

plugin api checksum

3405b17

Signed-off-by: Usman Saleem <[email protected]>

--security-module cli option instead of --security-module-provider

519370c

Signed-off-by: Usman Saleem <[email protected]>

rain-on approved these changes Apr 27, 2020

View reviewed changes

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

a47c113

Signed-off-by: Usman Saleem <[email protected]>

usmansaleem merged commit c2dcf62 into hyperledger:master Apr 27, 2020

usmansaleem mentioned this pull request Apr 27, 2020

Move BouncyCastleNodeKey into a local Plugin #678

Closed

usmansaleem added a commit that referenced this pull request Apr 29, 2020

Changelog update for #713 (#801)

4655fa4

Signed-off-by: Usman Saleem <[email protected]>

MadelineMurray mentioned this pull request May 1, 2020

Doc security module plugin API hyperledger/besu-docs#349

Closed

usmansaleem deleted the nodekey_plugin branch May 4, 2020 23:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security Module Plugin API #713

Security Module Plugin API #713

usmansaleem commented Apr 15, 2020 •

edited

Loading

NicolasMassart Apr 23, 2020

usmansaleem Apr 23, 2020

NicolasMassart Apr 24, 2020

usmansaleem Apr 25, 2020

rain-on Apr 26, 2020

rain-on Apr 26, 2020

rain-on Apr 26, 2020

usmansaleem Apr 26, 2020

rain-on Apr 26, 2020

usmansaleem Apr 27, 2020

	* @param name The name to identify the Security Provider Supplier Function
	* @param name The name to identify the Security Provider Supplier

Security Module Plugin API #713

Security Module Plugin API #713

Conversation

usmansaleem commented Apr 15, 2020 • edited Loading

PR description

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

usmansaleem commented Apr 15, 2020 •

edited

Loading