-
-
Notifications
You must be signed in to change notification settings - Fork 40
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HSM 1: KMIP walking skeleton (#566) #679
HSM 1: KMIP walking skeleton (#566) #679
Conversation
…, and support in principle selecting which signer to use for which purpose. (#539)
- Add a dependency on the backoff crate for retry support. - Add a dependency on the r2d2 crate for connection pooling support. - Uses GitHub versions of the bcder and rpki crates for the DER Unsigned Integer support needed by the KMIP signer. - Refactor signers to crypto::signers and replace the Dummy signer with a KMIP signer. - Added a "hsmtest" job to the GitHub Actions CI workflow that runs all Krill tests using the KMIP signer against PyKMIP. - Added a "hsm-tests" Cargo feature flag for configuring Krill to use ONLY KMIP as a signer, not OpenSSL at all. Currently building without the "hsm-tests" feature flag set will fail if the "hsm" feature flag is set. Krill isn't ready to be used in "hsm" mode yet. - Changes SignerProvider to implement the Signer trait so that it can be passed to builders so that their invocation of a signer also goes via SignerProvider dispatching to the correct signer.
575745d
to
870a102
Compare
… the write lock while switching to using the server as part of finishing a successful probe.
…er. Previously some Krill logic when invoked was given the same signer as handling the current purpose to invoke later even if for a different purpose. If the initial purpose required the KMIP signer as the key owning signer but the later purpose was one-off signing then that should be able to be routed if desired to the OpenSslSigner, for example. Introduces another layer of indirection: RouterSigner.
"router", not "dispatcher", and don't lock the entire SignerRouter for create/delete key operations.
…cessor PR #688 which is now redundant because those changes are now present in the 'dev' branch which this PR targets.
@timbru : Am I right in thinking that your review didn't including looking at the |
Indeed. I am just focussing on krill itself here - I am happy to look at the kmip libs as a separate effort. |
Introduces a KMIP signer, disabled by default.
The scope for this PR is deliberately limited. The KMIP signer itself is fully functional but it is not yet fully wired into Krill. It is not configurable, it has no metrics, it has no persistent mapping of Krill key identifiers to HSM key identifiers (update: added in PR #686 for that), it doesn't support async operation (update: async will not be added at the moment), there's no extensions to the API or CLI to see which Signer owns a particular key, etc. This PR is just about showing that the Krill test suite passes when forcing Krill to use a PyKMIP server via the new KMIP signer.
KMIP support can only be enabled currently by using BOTH the
hsm
andhsm-tests
feature flags. In normal usage we may want to use a local signer for some operations even when using a KMIP signer for others. Thehsm-tests
feature flag forces Krill to use KMIP for ALL operations. This is used by a new GitHub Actionshsmtest
job in the CI workflow to test Krill against PyKMIP. If you look at the test log output you can see lines like the following:To be discussed.
Other notes:
bcder
crate DER unsigned integer support.kmip-protocol
andkmip-ttlv
crates have tests, not exhaustive but also quite a bit more than nothing.Details:
kmip-protocol
crate for TCP+TLS high level KMIP client support based on the underlyingkmip-ttlv
crate, neither of which has been reviewed yet.backoff
crate for retry support.r2d2
crate for connection pooling support.crypto::signers
and replace the Dummy signer with a KMIP signer.Currently building without the "hsm-tests" feature flag set will fail if the "hsm" feature flag is set.
Krill isn't ready to be used in "hsm" mode yet.
SignerRouter
betweenKrillSigner
andSignerProvider
, to implement theSigner
trait so that it can be passed to builders so that their invocation of a signer also goes viaSignerRouter
thus dispatching to the correct signer.This PR doesn't offer any way to see that the keys have actually been created. However, the tests pass, keys are created and signing is done, the KMIP signer is shown connecting to the PyKMIP server in the logs, and the OpenSSL signer is disabled by the feature flags used by the
hsmtest
job. If you watch the PyKMIP log while the test is running you can see that it is connecting and executing KMIP operations.Using a custom local KMIP client when I inspected the keys inside my local PyKMIP instance before and after running the Krill test suite, before it was empty, and after it looked like something this:
If you run Krill with trace level logging enabled you will then see a stripped diagnostic representation of the KMIP requests and responses being sent and received, e.g.:
The
diag_to_txt
example included with thekmip-protocol
crate can render these diagnostic strings in slightly more readable form, e.g. the first line from the log example above renders like so:Operation code 2 is Create Key Pair according to the KMIP specification (see KMIP 1.0 section 9.1.3.2.26 Operation Enumeration).
The second log line, the response, renders like this:
This shows a successful response that includes the internal PyKMIP identifiers for the created keys (which are redacted in the diagnostic output).