e241b33f26
Some checks failed
codecov / upload (push) Failing after 13m59s
CodeQL / Analyze (push) Failing after 1s
Testing / vet-proto (push) Failing after 1s
Testing / tests (arm, latest) (push) Waiting to run
Testing / extras (latest) (push) Failing after 1s
Testing / static checks (latest-1) (push) Failing after 1s
Testing / tests (-race, latest) (push) Failing after 1s
Testing / tests (i386, latest) (push) Failing after 1s
Testing / tests (latest) (push) Failing after 1s
Testing / tests (latest-1) (push) Failing after 1s
Lock Threads / lock (push) Failing after 1s
govulncheck / govulncheck (.) (push) Failing after 1s
govulncheck / govulncheck (./cmd/protoc-gen-go-grpc) (push) Failing after 1s
govulncheck / govulncheck (./gcp/observability) (push) Failing after 1s
govulncheck / govulncheck (./security/advancedtls) (push) Failing after 1s
govulncheck / govulncheck (./stats/opencensus) (push) Failing after 1s
Stale bot / stale (push) Failing after 1s
77 lines
4.1 KiB
Markdown
77 lines
4.1 KiB
Markdown
## File Purposes
|
|
|
|
* spiffe_cert.pem - the certificate that is placed in spiffe bundles (copied
|
|
into the `x5c` field)
|
|
* server1_spiffe.pem - another certificate placed in spiffe bundles
|
|
* spiffe_multi_uri_san_cert.pem - another certificate placed in spiffe bundles
|
|
* spiffe-openssl.cnf - the configuration file passed to the openssl CLI when
|
|
creating these certificate files
|
|
* spiffebundle.json - the valid spiffe bundle for happy path testing
|
|
* spiffebundle2.json - Another valid spiffe bundle that is used in testing
|
|
file reloading (a different file is needed to ensure changes are picked up).
|
|
It is just the `example.com` trust domain from spiffebundle.json.
|
|
* spiffebundle_corrupted_cert.json - manually modifies the `x5c` field and
|
|
removes a character to create an invalid certificate
|
|
* spiffebundle_empty_keys.json - the `keys` field is an empty array
|
|
* spiffebundle_empty_string_keys.json - the `keys` field contains an entry
|
|
* with an empty string key
|
|
* spiffebundle_invalid_trustdomain - uses a `#` in the trust domain which is a
|
|
disallowed character per the spec
|
|
* spiffebundle_malformed.json - a fully wrong json
|
|
* spiffebundle_match_client_spiffe.json - a valid spiffe bundle with a trust
|
|
domain matching the SPIFFE ID in spiffe_cert.pem
|
|
* spiffebundle_wrong_kid.json - has the `kid` field instead of the `kty` field
|
|
* spiffebundle_wrong_kty.json - Uses `EC` instead of `RSA` in the `kty` field
|
|
* spiffebundle_wrong_multi_certs.json - place 2 certificates in the `x5c`
|
|
field
|
|
* spiffebundle_wrong_root.json - The top level json string is `trustDomains`
|
|
instead of `trust_domains`
|
|
* spiffebundle_wrong_seq_type.json - the `spiffe_sequence` number must be an
|
|
integer
|
|
* spiffebundle_wrong_use.json - The `use` field must be `x509-svid` or
|
|
`jwt-svid` (we are expecting and support `x509-svid` per the gRFC)
|
|
|
|
## Test File Creation:
|
|
|
|
The SPIFFE related extensions are listed in spiffe-openssl.cnf config. Both
|
|
client_spiffe.pem and server1_spiffe.pem are generated in the same way as the
|
|
client and server certificates described in the testdata/x509 with the same CAs.
|
|
Specifically they were made with the following commands:
|
|
|
|
```
|
|
$ openssl req -new -key client.key -out spiffe-cert.csr \
|
|
-subj /C=US/ST=CA/L=SVL/O=gRPC/CN=testclient/ \
|
|
-config spiffe-openssl.cnf -reqexts spiffe_client_e2e
|
|
$ openssl x509 -req -CA ca.pem -CAkey ca.key -CAcreateserial \
|
|
-in spiffe-cert.csr -out client_spiffe.pem -extensions spiffe_client_e2e \
|
|
-extfile spiffe-openssl.cnf -days 3650 -sha256
|
|
$ openssl req -new -key server1.key -out spiffe-cert.csr \
|
|
-subj /C=US/ST=CA/L=SVL/O=gRPC/CN=*.test.google.com/ \
|
|
-config spiffe-openssl.cnf -reqexts spiffe_server_e2e
|
|
$ openssl x509 -req -CA ca.pem -CAkey ca.key -CAcreateserial \
|
|
-in spiffe-cert.csr -out server1_spiffe.pem -extensions spiffe_server_e2e \
|
|
-extfile spiffe-openssl.cnf -days 3650 -sha256
|
|
```
|
|
|
|
Additionally, the SPIFFE trust bundle map files (spiffebundle*.json) are
|
|
manually created for end to end testing. The spiffebundle.json contains the
|
|
"example.com" trust domain (only this entry is used in e2e tests) matching URI
|
|
SAN of server1_spiffe.pem, and the CA certificate there is ca.pem. The
|
|
spiffebundle.json file contains "foo.bar.com" trust domain (only this entry is
|
|
used in e2e tests) matching URI SAN of client_spiffe.pem, and the CA certificate
|
|
there is also ca.pem.
|
|
|
|
If updating these files, the `x5c` field in the json is the raw PEM certificates
|
|
and can be copy pasted from the certificate file. `n` and `e` are values from
|
|
the public key. `e` should *probably* be `AQAB` as it is the exponent. `n` can
|
|
be fetched from the certificate by getting the RSA key from the cert and
|
|
extracting the value. This can be done in golang with the following codeblock:
|
|
``` func GetBase64ModulusFromPublicKey(key *rsa.PublicKey) string { return
|
|
base64.RawURLEncoding.EncodeToString(key.N.Bytes()) }
|
|
|
|
block, _ := pem.Decode(rawPemCert) cert, _ := x509.ParseCertificate(block.Bytes)
|
|
publicKey := cert.PublicKey.(*rsa.PublicKey)
|
|
fmt.Println(GetBase64ModulusFromPublicKey(publicKey)) ```
|
|
|
|
The rest of the files are manually modified as described above.
|