Skip to content

Commit

Permalink
fix: allow specifying some flags as config
Browse files Browse the repository at this point in the history 
API server URL, insecure mode, and CA certs can now be specified via a
config file, as well as command line arguments. This is a fix owing to
an oversight when support for config files was originally added.

As part of this, --api-server flag is no longer marked as mandatory (as
the corresponding config could be used instead).

Signed-off-by: Sergei Trofimov <[email protected]>
  • Loading branch information
@setrofim
setrofim committed Aug 6, 2024
1 parent 2c3b0a7 commit 40dfa3d
Show file tree
Hide file tree
Showing 8 changed files with 198 additions and 71 deletions.
52 changes: 40 additions & 12 deletions cmd/cca/verify_as_attester.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,14 @@
package cca

import (
"errors"
"fmt"
"strings"

"github.com/spf13/afero"
"github.com/spf13/cobra"
"github.com/spf13/pflag"
"github.com/spf13/viper"
"github.com/veraison/apiclient/verification"
"github.com/veraison/ccatoken"
"github.com/veraison/evcli/v2/common"
Expand All @@ -29,9 +32,9 @@ var (
attesterClaimsFile *string
platformKeyFile *string
realmKeyFile *string
attesterAPIURL *string
attesterIsInsecure *bool
attesterCerts *[]string
attesterAPIURL string
attesterIsInsecure bool
attesterCerts []string
)

var (
Expand All @@ -57,6 +60,9 @@ and realm signing key (RAK).
`,
RunE: func(cmd *cobra.Command, args []string) error {
if err := attesterCheckSubmitArgs(); err != nil {
return err
}

pClaims, rClaims, err := loadUnValidatedCCAClaimsFromFile(fs, *attesterClaimsFile)
if err != nil {
Expand Down Expand Up @@ -89,7 +95,7 @@ and realm signing key (RAK).
return err
}

if err = attesterVeraisonClient.SetSessionURI(*attesterAPIURL); err != nil {
if err = attesterVeraisonClient.SetSessionURI(attesterAPIURL); err != nil {
return err
}

Expand All @@ -98,8 +104,8 @@ and realm signing key (RAK).
}

attesterVeraisonClient.SetDeleteSession(true)
attesterVeraisonClient.SetIsInsecure(*attesterIsInsecure)
attesterVeraisonClient.SetCerts(*attesterCerts)
attesterVeraisonClient.SetIsInsecure(attesterIsInsecure)
attesterVeraisonClient.SetCerts(attesterCerts)

attestationResults, err := attesterVeraisonClient.Run()
if err != nil {
Expand All @@ -124,21 +130,46 @@ and realm signing key (RAK).
"rak", "r", "", "JWK file with the Realm Attestation Key used for signing",
)

attesterAPIURL = cmd.Flags().StringP(
cmd.Flags().StringP(
"api-server", "s", "", "URL of the Veraison verification API",
)

attesterIsInsecure = cmd.Flags().BoolP(
cmd.Flags().BoolP(
"insecure", "i", false, "Allow insecure connections (e.g. do not verify TLS certs)",
)

attesterCerts = cmd.Flags().StringArrayP(
cmd.Flags().StringArrayP(
"ca-cert", "E", nil, "path to a CA cert that will be used in addition to system certs; may be specified multiple times",
)

cmd.Flags().VisitAll(func(flag *pflag.Flag) {
cfgName := strings.ReplaceAll(flag.Name, "-", "_")
if cfgName == "claims" || cfgName == "iak" || cfgName == "rak" {
// as claims and the corresponding key files are likely
// to be different on each invocation, it does not make
// sense for them be specified via the config.
return
}

err := viper.BindPFlag(cfgName, flag)
cobra.CheckErr(err)
})

return cmd
}

func attesterCheckSubmitArgs() error {
attesterAPIURL = viper.GetString("api_server")
if attesterAPIURL == "" {
return errors.New("API server URL is not configured")
}

attesterIsInsecure = viper.GetBool("insecure")
attesterCerts = viper.GetStringSlice("ca_cert")

return nil
}

func (eb attesterEvidenceBuilder) BuildEvidence(nonce []byte, accept []string) ([]byte, string, error) {
for _, ct := range accept {
if ct != CCATokenMediaType {
Expand Down Expand Up @@ -175,7 +206,4 @@ func init() {
if err := attesterCmd.MarkFlagRequired("rak"); err != nil {
panic(err)
}
if err := attesterCmd.MarkFlagRequired("api-server"); err != nil {
panic(err)
}
}
4 changes: 2 additions & 2 deletions cmd/cca/verify_as_attester_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ func Test_AttesterCmd_ok(t *testing.T) {
mc.EXPECT().SetSessionURI(testSessionURI)
mc.EXPECT().SetEvidenceBuilder(gomock.Any())
mc.EXPECT().SetIsInsecure(false)
mc.EXPECT().SetCerts(nil)
mc.EXPECT().SetCerts([]string{})
mc.EXPECT().SetDeleteSession(true)
mc.EXPECT().SetNonceSz(uint(64))
mc.EXPECT().Run().Return([]byte("ok"), nil)
Expand Down Expand Up @@ -252,7 +252,7 @@ func Test_AttesterCmd_protocol_run_failed(t *testing.T) {
mc.EXPECT().SetSessionURI(testSessionURI)
mc.EXPECT().SetEvidenceBuilder(gomock.Any())
mc.EXPECT().SetIsInsecure(false)
mc.EXPECT().SetCerts(nil)
mc.EXPECT().SetCerts([]string{})
mc.EXPECT().SetDeleteSession(true)
mc.EXPECT().SetNonceSz(uint(64))
mc.EXPECT().Run().Return(nil, errors.New("failed"))
Expand Down
70 changes: 54 additions & 16 deletions cmd/cca/verify_as_relyingparty.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,24 @@ package cca

import (
"bytes"
"errors"
"fmt"
"strings"

"github.com/spf13/afero"
"github.com/spf13/cobra"
"github.com/spf13/pflag"
"github.com/spf13/viper"
"github.com/veraison/apiclient/verification"
"github.com/veraison/ccatoken"
"github.com/veraison/evcli/v2/common"
)

var (
relyingPartyTokenFile *string
relyingPartyAPIURL *string
relyingPartyIsInsecure *bool
relyingPartyCerts *[]string
relyingPartyAPIURL string
relyingPartyIsInsecure bool
relyingPartyCerts []string
)

var (
Expand All @@ -43,6 +46,10 @@ previous invocation to "evcli cca create" command.
`,
RunE: func(cmd *cobra.Command, args []string) error {
if err := relyingPartyCheckSubmitArgs(); err != nil {
return err
}

token, err := afero.ReadFile(fs, *relyingPartyTokenFile)
if err != nil {
return err
Expand All @@ -56,25 +63,35 @@ previous invocation to "evcli cca create" command.

nonce, err := e.RealmClaims.GetChallenge()
if err != nil {
return fmt.Errorf("cannot extract challenge from %s: %v", *relyingPartyTokenFile, err)
return fmt.Errorf("cannot extract challenge from %s: %v",
*relyingPartyTokenFile, err)
}

if err = veraisonClient.SetNonce(nonce); err != nil {
return fmt.Errorf("cannot configure nonce in Veraison API client: %v", err)
return fmt.Errorf(
"cannot configure nonce in Veraison API client: %v",
err,
)
}

if err = veraisonClient.SetSessionURI(*relyingPartyAPIURL); err != nil {
return fmt.Errorf("cannot configure URL in Veraison API client: %v", err)
if err = veraisonClient.SetSessionURI(relyingPartyAPIURL); err != nil {
return fmt.Errorf(
"cannot configure URL in Veraison API client: %v",
err,
)
}

eb := relyingPartyEvidenceBuilder{Token: token, Nonce: nonce}
if err = veraisonClient.SetEvidenceBuilder(eb); err != nil {
return fmt.Errorf("cannot configure evidence builder in Veraison API client: %v", err)
return fmt.Errorf(
"cannot configure evidence builder in Veraison API client: %v",
err,
)
}

veraisonClient.SetDeleteSession(true)
veraisonClient.SetIsInsecure(*relyingPartyIsInsecure)
veraisonClient.SetCerts(*relyingPartyCerts)
veraisonClient.SetIsInsecure(relyingPartyIsInsecure)
veraisonClient.SetCerts(relyingPartyCerts)

attestationResults, err := veraisonClient.Run()
if err != nil {
Expand All @@ -91,22 +108,46 @@ previous invocation to "evcli cca create" command.
"token", "t", "", "file containing a signed CCA attestation token",
)

relyingPartyAPIURL = cmd.Flags().StringP(
cmd.Flags().StringP(
"api-server", "s", "", "URL of the Veraison verification API",
)

relyingPartyIsInsecure = cmd.Flags().BoolP(
cmd.Flags().BoolP(
"insecure", "i", false, "Allow insecure connections (e.g. do not verify TLS certs)",
)

relyingPartyCerts = cmd.Flags().StringArrayP(
cmd.Flags().StringArrayP(
"ca-cert", "E", nil, "path to a CA cert that will be used in addition to system certs; may be specified multiple times",
)

cmd.Flags().VisitAll(func(flag *pflag.Flag) {
cfgName := strings.ReplaceAll(flag.Name, "-", "_")
if cfgName == "token" {
// as token is likely to be different on each
// invocation, it does not make sense for it be
// specified via the config.
return
}

err := viper.BindPFlag(cfgName, flag)
cobra.CheckErr(err)
})

return cmd
}

func relyingPartyCheckSubmitArgs() error {
relyingPartyAPIURL = viper.GetString("api_server")
if relyingPartyAPIURL == "" {
return errors.New("API server URL is not configured")
}

relyingPartyIsInsecure = viper.GetBool("insecure")
relyingPartyCerts = viper.GetStringSlice("ca_cert")

return nil
}

type relyingPartyEvidenceBuilder struct {
Token []byte
Nonce []byte
Expand All @@ -129,7 +170,4 @@ func init() {
if err := relyingPartyCmd.MarkFlagRequired("token"); err != nil {
panic(err)
}
if err := relyingPartyCmd.MarkFlagRequired("api-server"); err != nil {
panic(err)
}
}
4 changes: 2 additions & 2 deletions cmd/cca/verify_as_relyingparty_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ func Test_RelyingPartyCmd_ok(t *testing.T) {
mc.EXPECT().SetSessionURI(testSessionURI)
mc.EXPECT().SetEvidenceBuilder(gomock.Any())
mc.EXPECT().SetIsInsecure(false)
mc.EXPECT().SetCerts(nil)
mc.EXPECT().SetCerts([]string{})
mc.EXPECT().SetDeleteSession(true)
mc.EXPECT().Run().Return([]byte("ok"), nil)

Expand Down Expand Up @@ -115,7 +115,7 @@ func Test_RelyingPartyCmd_protocol_run_failed(t *testing.T) {
mc.EXPECT().SetSessionURI(testSessionURI)
mc.EXPECT().SetEvidenceBuilder(gomock.Any())
mc.EXPECT().SetIsInsecure(false)
mc.EXPECT().SetCerts(nil)
mc.EXPECT().SetCerts([]string{})
mc.EXPECT().SetDeleteSession(true)
mc.EXPECT().Run().Return(nil, errors.New("some kind of error"))

Expand Down
Loading

0 comments on commit 40dfa3d

Please sign in to comment.