| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
We want to require that whenever we generate a key that's persistent
(stored in KeyMgr), it's going to be made from a stronger-than-usual
Rng. This trait helps us enforce that.
We also add a FakeEntropicRng struct to use for testing.
Note that this turned up a case that we'd missed, which required
an internal change in tor-hsservice.
|
| |
|
|
| |
- `rand::thread_rng()` has been deprecated and renamed to `rand::rng()`
|
| |
|
|
|
|
|
| |
This helps us get rid of our uses of `KeyUnknownCert`. Needed because
`KeyUnknownCert` can't readily be converted back to `EncodedEd25519Cert`
(while `ParsedEd25519Cert` *can* -- see the `certs` module from
`tor-relay-crypto`).
|
| |
|
|
|
|
| |
This updates and reenables the cert management tests.
Part of #1768
|
| | |
|
| |
|
|
|
|
|
|
| |
This is necessary because `ParsedCert`s will not be `EncodableItem`s.
This is because we cannot (and don't want to) write certificates that
have not yet been validated to the keystore. They do need to be
retrievable from the keystore though, so we also change `ErasedKey`
to be `Box<dyn ItemType>` instead.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We need two different types to represent
* certs that have been parsed, but not yet validated
(`KeyUnknownCert`)
* newly generated encodable certs (`EncodedEd25519Cert`)
Currently, we don't use `KeyUnknownCert` anywhere, and instead use
`EncodedEd25519Cert` to represent "parsed" but not-yet-validated certs.
This approach is wrong and relies on a broken (no-op)
`EncodedEd25519Cert::from_bytes` implementation. A future commit will
address this problem by replacing `EncodedEd25519Cert::from_bytes` with
`Ed25519Cert::decode` to actually parse the cert upon retrieving it from
the keystore.
|
| |
|
|
|
|
|
|
| |
In practice, we won't be able to obtain an `ToEncodableCert` type from
an `EncodableItem` cert without validating it first, so we need to
collapse `validate` into `from_encodable_cert`.
Part of #1768
|
| | |
|
| |
|
|
|
| |
This replaces a placeholder error with a concrete
`KeystoreCorruptionError` variant.
|
| | |
|
| |
|
|
|
| |
We're about to reuse TestKey as our test key "certificate",
so let's preemptively rename it to something more fitting.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
We're soon going to need the "raw" version of the function (the one that
returns the key as `K::Key`).
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
This function now returns a `KeystoreItemType`, enabling us to represent
certs as `EncodableItem`s.
|
| | |
|
| | |
|
| |
|
|
|
| |
This is part of the work needed to support storing certificates in the
keystore (they won't have a `KeyType`, but rather `CertType`).
|
| |
|
|
|
|
|
|
| |
This is the first step in replacing `EncodableKey` with the new
`EncodableItem` trait (see doc/dev/keymgr-certificates.md).
(this refactoring is split over multiple commits to make reviewing
easier)
|
| |
|
|
|
|
|
| |
`KeyPath::matches` now returns a boolean (because we can't return a
matching "range" for `CTorPaths`, because unlike ArtiPaths, they're not
represented as `String`s, and do not have variable parts that need to be
captured).
|
| |
|
|
|
|
|
|
| |
The `KeyMgrBuilder` now returns an error if the configured keystores
don't have pairwise unique IDs. This is needed because some keymgr
operations take a `KeystoreSelector` specifying the ID of the keystore
the operation should be performed on, and assume that the keystore ID
uniquely identifies a single keystore.
|
| |
|
|
|
|
|
|
|
|
| |
Previously, arti's primary keystore was referred to as its "default"
keystore. However, "default" is inaccurate here: there is no way to
meaningfully override this "default" (the "default" store acts as the
main keystore). Throughout the codebase, we query all keystores for keys
(including the secondary ones), but only ever write to the
default/primary keystore. This is OK for now, because it enables us to
have one mutable keystore, and multiple secondary, read-only stores.
|
| | |
|
| |
|
|
| |
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2393#note_3073480
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
keypair
Now that:
- KeySpecifier::get_keypair_specifier() can be used to convert the
KeySpecifier for a public key into the KeySpecifier for its secret key
- ToEncodableKey<Key=PublicKey> has a "type level pointer" to
ToEncodableKey<Key=KeyPair>
We can use these two features together to automatically satisfy any request to
get a public key using the corresponding secret key (if available).
|
| |
|
|
|
|
|
|
|
|
| |
This comment adds a second associated type `KeyPair` to ToEncodableKey. For a
`ToEncodableKey` which represents a (secret) KeyPair, this type is Self. For
a `ToEncodableKey` which represents a public key, this is the `ToEncodableKey`
whose `Key` is the pair of which this is the public part.
This is essentially a "type level pointer" from the ToEncodableKey for a
public key to the ToEncodableKey for its secret key.
|
| |
|
|
|
|
|
| |
This commit adds a new method `get_keypair_specifier()` to `KeySpecifier`.
This method is used to indicate when one KeySpecifier (e.g. `KP_hs_id`) is the
public part of another keypair (e.g. `KS_hs_id`). It will return the
containing keypair in this case, and `None` otherwise.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
FooKeypairSpecifier` instances
This adds the following trivial `From` instances:
- tor_hsservice: impl From<&HsIdPublicKeySpecifier> for HsIdKeypairSpecifier
- tor_hsservice: impl From<&BlindIdPublicKeySpecifier> for BlindIdKeypairSpecifier
- tor_hscrypto::pk: impl From<HsBlindIdKeypair> for HsBlindIdKey
- tor_llcrypto::pk::ed25519: impl From<ExpandedKeypair> for PublicKey
- tor_keymgr::mgr: impl From<TestKey> for TestPublicKey
- tor::hscrypto::pk: impl From<HsIdKeypair> for HsIdKey
|
| |
|
|
| |
Signed-off-by: David Goulet <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
| |
Everything copied in the previous commits to tor-keys is now removed and
tor-keys crate is used accross the code.
Minor changes to tor-keys to accomodate this change.
Part of #1137
Signed-off-by: David Goulet <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The derive ed25519 keypair macro now implements the keymgr trait so the
key wrapper can now be used with a keystore without needing to specify
it in the tor-keymgr crate.
For this to work, a slight change to the KeygenRng trait was needed as
in to expect the CryptoRngCore trait which is what ed25519-dalek
requires.
And also, the removal of the Sealed trait since now it is accepted to
implement these traits outside tor-keymgr.
Fixes #1137
Signed-off-by: David Goulet <[email protected]>
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This updates the keymgr tests to be slightly more robust.
These tests attach some metadata to each key, such as the "nickname" of
the key (which only exists for testing purposes), whether the key was
auto-generated, and the keystore ID of the keystore from which the key
was retrieved.
Previously, the metadata was encoded in the key "material" itself (the
test "keys" were actually just `String`s with a hacky `EncodableKey`
implementation that abused the "encrypted" variant of `KeypairData`).
This was only possible because we had access to the key internals
(through `SshKeyData::Public`/`SshKeyData::Private`), but since the
internals are inaccessible now, the tests need to be updated.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As explained in the docs, this trait should not be implementable outside
of the `tor-keymgr` crate. The `SshKeyData::into_erased` and
`UnparsedOpensshKey::parse_ssh_format_erased` impls assume the types
implementing `EncodableKey` form a statically known closed set.
If we later decide to make the supported key types an open set, we
should make this trait implementable outside of `tor-keymgr` too.
External types wanting to create custom "key types" for use in the
keymgr should use the non-sealed `ToEncodableKey` trait, which specifies
the `EncodableKey` type to use.
This trait is mainly used to create `SshKeyData` IMO, we should make
`SshKeyData` opaque, since it's not meant to be constructed through
other means (`SshKeyData` is currently a public enum, so its variants
and the `ssh_key` types they wrap are public). A future commit will make
it opaque.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is the combination of a number of separate commits, many of which
were generated by seddery, and then rebased and squashed.
Cargo.toml
perl -i~ -pe 's{^derive-adhoc}{derive-deftly = "0.10"}' crates/*/Cargo.toml
(not regenerated during rebase)
update Cargo.lock
`cargo fetch` without --locked
(regenerated during rebase)
seddery
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{^use derive_adhoc}{use derive_deftly}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bdefine_derive_adhoc\b}{define_derive_deftly}g'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bAdhoc\b}{Deftly}g if m{derive}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\#\[derive_adhoc\b}{#[derive_deftly}g'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{use derive_adhoc}{use derive_deftly}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bderive_adhoc\b}{derive_deftly_adhoc} if m{use.*deftly}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bderive_adhoc!}{derive_deftly_adhoc!}'
(not regenerated during rebase)
Manually add `#[derive_deftly_adhoc]` where needed.
seddery
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\#\[adhoc\b}{#[deftly}g'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bderive_adhoc_template}{derive_deftly_template}'
(not regenerated during rebase)
Manually fix up an import
Manually update some builder attrs
Manually fix up tor_rtmock::time_core
This was missed in my seddery, due to me rebasing the branch and not
redoing the seddery.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
I am not so sure it makes sense to unify these functions, so let's
remove the TODO.
|
| | |
|
| | |
|
