Security Module Plugin API #713

usmansaleem · 2020-04-15T05:03:24Z

PR description

Introduce Security Module Plugin API. This allows to switch to a different security module provider to provide cryptographic function that can be used by NodeKey (such as sign, ECDHKeyAgreement etc.). By default register KeyPairSecurityModule otherwise attempt to load Security Module via plugin API.

CLI Options:
--security-module=<name>. (defaults to localfile)

Signed-off-by: Usman Saleem <usman@usmans.info>

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

besu/src/main/java/org/hyperledger/besu/cli/subcommands/PublicKeySubCommand.java

Signed-off-by: Usman Saleem <usman@usmans.info>

besu/src/main/java/org/hyperledger/besu/controller/BesuControllerBuilder.java

Signed-off-by: Usman Saleem <usman@usmans.info>

acceptance-tests/dsl/build.gradle

...s/dsl/src/main/java/org/hyperledger/besu/tests/acceptance/dsl/node/ThreadBesuNodeRunner.java

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

besu/src/main/java/org/hyperledger/besu/cli/subcommands/PublicKeySubCommand.java

besu/src/main/java/org/hyperledger/besu/services/SecurityModuleServiceImpl.java

besu/src/test/java/org/hyperledger/besu/cli/BesuCommandTest.java

besu/src/test/java/org/hyperledger/besu/cli/PublicKeySubCommandTest.java

crypto/src/main/java/org/hyperledger/besu/crypto/BouncyCastleSecurityModule.java

Signed-off-by: Usman Saleem <usman@usmans.info>

NicolasMassart · 2020-04-23T08:09:18Z

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

+
+  private File nodePrivateKeyFile() {
+    final Optional<File> nodePrivateKeyFile =
+        isDocker ? Optional.empty() : Optional.ofNullable(standaloneCommands.nodePrivateKeyFile);


There should no be any docker specific behaviour

This whole file is using docker specific behavior using org/hyperledger/besu/cli/BesuCommand.java:2103

private boolean isFullInstantiation() { return !isDocker; }

It's garbage code to be deleted. We don't provide the parameter in the docker image since 29c3c14#diff-ebacf6f6ae4ee68078bb16454b23247dL19 so this part of the code is dead since July 2019. It was discussed about removing it but it was not a priority. Now, if it's confusing, it should be a priority IMO.

👍 I have created #785 and will clean it out in a separate PR.

👍 Its a shame the docker code wasn't cleaned out before now - but the removal shouldn't be part of this work.

Signed-off-by: Usman Saleem <usman@usmans.info>

crypto/src/main/java/org/hyperledger/besu/crypto/KeyPairSecurityModule.java

crypto/src/main/java/org/hyperledger/besu/crypto/ECPointUtil.java

Signed-off-by: Usman Saleem <usman@usmans.info>

Conflicts: plugin-api/build.gradle Signed-off-by: Usman Saleem <usman@usmans.info>

rain-on · 2020-04-26T03:29:41Z

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

+
+  private File nodePrivateKeyFile() {
+    final Optional<File> nodePrivateKeyFile =
+        isDocker ? Optional.empty() : Optional.ofNullable(standaloneCommands.nodePrivateKeyFile);


👍 Its a shame the docker code wasn't cleaned out before now - but the removal shouldn't be part of this work.

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

crypto/src/main/java/org/hyperledger/besu/crypto/ECPointUtil.java

rain-on · 2020-04-26T06:27:18Z

crypto/src/main/java/org/hyperledger/besu/crypto/KeyPairSecurityModule.java

+  private final SECP256K1.KeyPair keyPair;
+  private final PublicKey publicKey;
+
+  public KeyPairSecurityModule(final SECP256K1.KeyPair keyPair) {


nit: given there's crypto operations happening here, do we want to move this to a static creator? which passes in a privkey and a PublicKey?

we only require SECP256K1.KeyPair. The PublicKey is the interface (with ECPoint) that is meant to be converted from SECP256K1's PublicKey. The other option would be to initialize public key on the first access via getPublicKey. I don't feel the need of creator factory method.

rain-on · 2020-04-26T06:29:23Z

plugin-api/src/main/java/org/hyperledger/besu/plugin/services/SecurityModuleService.java

+  /**
+   * Registers a provider of security modules.
+   *
+   * @param name The name to identify the Security Provider Supplier Function


Suggested change

* @param name The name to identify the Security Provider Supplier Function

* @param name The name to identify the Security Provider Supplier

javadoc updated.

plugin-api/src/main/java/org/hyperledger/besu/plugin/services/SecurityModuleService.java

Signed-off-by: Usman Saleem <usman@usmans.info>

…rityModuleService Signed-off-by: Usman Saleem <usman@usmans.info>

Signed-off-by: Usman Saleem <usman@usmans.info>

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

Signed-off-by: Usman Saleem <usman@usmans.info>

usmansaleem added 10 commits April 14, 2020 19:10

Node Key Security Provider BouncyCastle backed internal plugin

8dff540

Signed-off-by: Usman Saleem <usman@usmans.info>

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

33482d5

Signed-off-by: Usman Saleem <usman@usmans.info>

wip

bf62f2c

Signed-off-by: Usman Saleem <usman@usmans.info>

wip - renaming plugin name

76f01f1

Signed-off-by: Usman Saleem <usman@usmans.info>

refactoring package name

3db6b44

Signed-off-by: Usman Saleem <usman@usmans.info>

wip

72b4dc9

Signed-off-by: Usman Saleem <usman@usmans.info>

wip - refactor package name

3a30a73

Signed-off-by: Usman Saleem <usman@usmans.info>

wip

d5392e7

Signed-off-by: Usman Saleem <usman@usmans.info>

Merge upstream/master

160d9df

Signed-off-by: Usman Saleem <usman@usmans.info>

wip - clean compile

b934f3a

Signed-off-by: Usman Saleem <usman@usmans.info>

usmansaleem commented Apr 15, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java Outdated Show resolved Hide resolved

usmansaleem commented Apr 15, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/cli/subcommands/PublicKeySubCommand.java Outdated Show resolved Hide resolved

spotless fix

2505c3d

Signed-off-by: Usman Saleem <usman@usmans.info>

usmansaleem commented Apr 15, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/controller/BesuControllerBuilder.java Outdated Show resolved Hide resolved

usmansaleem added 15 commits April 15, 2020 15:28

test compilation fix

afd1124

Signed-off-by: Usman Saleem <usman@usmans.info>

spotless fix

87e063f

Signed-off-by: Usman Saleem <usman@usmans.info>

license header

977b3f0

Signed-off-by: Usman Saleem <usman@usmans.info>

spotless fix

5c3e76a

Signed-off-by: Usman Saleem <usman@usmans.info>

spotless fix

8a69d3a

Signed-off-by: Usman Saleem <usman@usmans.info>

mock fix in CommandTestAbstract

4d14a37

Signed-off-by: Usman Saleem <usman@usmans.info>

supplier memoize

e044e49

Signed-off-by: Usman Saleem <usman@usmans.info>

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

4b2209a

Signed-off-by: Usman Saleem <usman@usmans.info>

supplier memoize moved into BouncyCastleSecurityModule

94f2996

Signed-off-by: Usman Saleem <usman@usmans.info>

Fixing PublicKeySubCommand and its unit tests

295caef

Signed-off-by: Usman Saleem <usman@usmans.info>

updating plugin cli option and removing unit test cases

7bd3790

Signed-off-by: Usman Saleem <usman@usmans.info>

Register SecurityModuleService in dsl ThreadBesuRunner

4f08b33

Signed-off-by: Usman Saleem <usman@usmans.info>

refactoring threadbesunoderunner

3b18e3e

Signed-off-by: Usman Saleem <usman@usmans.info>

variable names cleanup

a2187a3

Signed-off-by: Usman Saleem <usman@usmans.info>

cleanup

c133689

Signed-off-by: Usman Saleem <usman@usmans.info>

rain-on reviewed Apr 15, 2020

View reviewed changes

removing internal plugin from acceptance dsl

afbc588

Signed-off-by: Usman Saleem <usman@usmans.info>

usmansaleem changed the title ~~Local File Security Module Plugin~~ Security Module Plugin API Apr 23, 2020

javadoc

6283c0c

Signed-off-by: Usman Saleem <usman@usmans.info>

NicolasMassart reviewed Apr 23, 2020

View reviewed changes

usmansaleem added 5 commits April 23, 2020 18:16

final keywords

26aebd3

Signed-off-by: Usman Saleem <usman@usmans.info>

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

eb6712a

Signed-off-by: Usman Saleem <usman@usmans.info>

ECPointUtil toUnsignedByteArray cleanup and unit tests

317bc51

Signed-off-by: Usman Saleem <usman@usmans.info>

cleaning up KeyPairSecurityModule

6f675cb

Signed-off-by: Usman Saleem <usman@usmans.info>

typo

5dee1ab

Signed-off-by: Usman Saleem <usman@usmans.info>

jframe reviewed Apr 24, 2020

View reviewed changes

usmansaleem added 2 commits April 24, 2020 15:45

review suggestion - exception message in keypairsecuritymodule

73df123

Signed-off-by: Usman Saleem <usman@usmans.info>

ECPointUtil cleanup - Use BC BigIntegers.asUnsignedByteArray

5f83f01

Signed-off-by: Usman Saleem <usman@usmans.info>

jframe approved these changes Apr 24, 2020

View reviewed changes

Merge upstream master

3f62973

Conflicts: plugin-api/build.gradle Signed-off-by: Usman Saleem <usman@usmans.info>

rain-on reviewed Apr 26, 2020

View reviewed changes

usmansaleem added 5 commits April 27, 2020 10:03

review suggestions

6a36b4e

Signed-off-by: Usman Saleem <usman@usmans.info>

review suggestion - Register default SecurityModuleProvider with Secu…

75c5803

…rityModuleService Signed-off-by: Usman Saleem <usman@usmans.info>

spotless fix

b18f39b

Signed-off-by: Usman Saleem <usman@usmans.info>

plugin api checksum

b5dba6d

Signed-off-by: Usman Saleem <usman@usmans.info>

Using Supplier<SecurityModule> instead of SecurityModuleSupplier

6322e08

Signed-off-by: Usman Saleem <usman@usmans.info>

jframe reviewed Apr 27, 2020

View reviewed changes

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java Outdated Show resolved Hide resolved

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java Outdated Show resolved Hide resolved

usmansaleem added 2 commits April 27, 2020 13:16

plugin api checksum

3405b17

Signed-off-by: Usman Saleem <usman@usmans.info>

--security-module cli option instead of --security-module-provider

519370c

Signed-off-by: Usman Saleem <usman@usmans.info>

rain-on approved these changes Apr 27, 2020

View reviewed changes

Merge remote-tracking branch 'upstream/master' into nodekey_plugin

a47c113

Signed-off-by: Usman Saleem <usman@usmans.info>

usmansaleem merged commit c2dcf62 into hyperledger:master Apr 27, 2020

usmansaleem mentioned this pull request Apr 27, 2020

Move BouncyCastleNodeKey into a local Plugin #678

Closed

usmansaleem added a commit that referenced this pull request Apr 29, 2020

Changelog update for #713 (#801)

4655fa4

Signed-off-by: Usman Saleem <usman@usmans.info>

MadelineMurray mentioned this pull request May 1, 2020

Doc security module plugin API hyperledger/besu-docs#349

Closed

usmansaleem deleted the nodekey_plugin branch May 4, 2020 23:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security Module Plugin API #713

Security Module Plugin API #713

usmansaleem commented Apr 15, 2020 •

edited

Loading

NicolasMassart Apr 23, 2020

usmansaleem Apr 23, 2020

NicolasMassart Apr 24, 2020

usmansaleem Apr 25, 2020

rain-on Apr 26, 2020

rain-on Apr 26, 2020

rain-on Apr 26, 2020

usmansaleem Apr 26, 2020

rain-on Apr 26, 2020

usmansaleem Apr 27, 2020

	* @param name The name to identify the Security Provider Supplier Function
	* @param name The name to identify the Security Provider Supplier

Security Module Plugin API #713

Security Module Plugin API #713

Conversation

usmansaleem commented Apr 15, 2020 • edited Loading

PR description

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

usmansaleem commented Apr 15, 2020 •

edited

Loading