Merge branch 'iss176' into 'master'

Iss176

Implementing the initialization of the dfss platform:
- creation of the private rsa key
- creation of the root certificate
- saving/retrieving the above files on/from disk

See merge request !9

.gitlab-ci.yml

@@ -16,9 +16,10 @@ Unit tests:
   script:
     - "ln -s $(pwd) $GOPATH/src/dfss"
     - "./build/deps.sh"
-    - "go test -coverprofile auth.part -v ./auth"
-    - "go test -coverprofile mgdb.part -v ./mgdb"
-    - "go test -coverprofile mails.part -v ./mails"
+    - "go test -coverprofile auth.part -v dfss/auth"
+    - "go test -coverprofile mgdb.part -v dfss/mgdb"
+    - "go test -coverprofile mails.part -v dfss/mails"
+    - "go test -coverprofile authority.part -v dfss/dfssp/authority"
     - "echo 'mode: set' *part > c.out"
     - "grep -h -v 'mode: set' *part >> c.out"
     - "go tool cover -html=c.out -o coverage.html"
@@ -28,9 +29,11 @@ ARM tests:
   tags:
     - arm
   script:
+    - "ln -s -f $(pwd) $GOPATH/src/dfss"
     - "./build/deps.sh"
-    - "go test -cover -short -v ./auth"
-    - "go test -cover -short -v ./mgdb"
+    - "go test -cover -short -v dfss/auth"
+    - "go test -cover -short -v dfss/mgdb"
+    - "go test -cover -short -v dfss/dfssp/authority"
 
 Code lint:
   stage: test

auth/cert.go

@@ -44,13 +44,13 @@ func PEMToCertificateRequest(data []byte) (*x509.CertificateRequest, error) {
 // GetCertificate builds a certificate from a certificate request and an authoritative certificate (CA), as a PEM-encoded array of bytes.
 // This function assumes that the identity of the signee is valid.
 //
-// The serial has to be unique.
+// The serial has to be unique and positive.
 //
 // The generated certificate can safely be distributed to unknown actors.
-func GetCertificate(days int, serial int64, req *x509.CertificateRequest, parent *x509.Certificate, key *rsa.PrivateKey) ([]byte, error) {
+func GetCertificate(days int, serial uint64, req *x509.CertificateRequest, parent *x509.Certificate, key *rsa.PrivateKey) ([]byte, error) {
 
 	template := &x509.Certificate{
-		SerialNumber: big.NewInt(serial),
+		SerialNumber: new(big.Int).SetUint64(serial),
 		Subject:      req.Subject,
 		NotBefore:    time.Now(),
 		NotAfter:     time.Now().AddDate(0, 0, days),
@@ -71,13 +71,13 @@ func GetCertificate(days int, serial int64, req *x509.CertificateRequest, parent
 
 // GetSelfSignedCertificate builds a CA certificate from a private key, as a PEM-encoded array of bytes.
 //
-// The serial has to be unique.
+// The serial has to be unique and positive.
 //
 // The generated certificate should be distributed to any other actor in the network under this CA.
-func GetSelfSignedCertificate(days int, serial int64, country, organization, unit, cn string, key *rsa.PrivateKey) ([]byte, error) {
+func GetSelfSignedCertificate(days int, serial uint64, country, organization, unit, cn string, key *rsa.PrivateKey) ([]byte, error) {
 
 	template := &x509.Certificate{
-		SerialNumber: big.NewInt(serial),
+		SerialNumber: new(big.Int).SetUint64(serial),
 		Subject: pkix.Name{
 			Country:            []string{country},
 			Organization:       []string{organization},

auth/cert_test.go

@@ -147,7 +147,7 @@ func ExampleGetCertificate() {
 	signerKey, _ := PEMToPrivateKey([]byte(keyFixture))
 
 	// Generate the certificate for 365 days with a serial of 0x10 (16)
-	cert, err := GetCertificate(365, int64(0x10), certificateRequest, signerCertificate, signerKey)
+	cert, err := GetCertificate(365, uint64(0x10), certificateRequest, signerCertificate, signerKey)
 
 	if cert == nil || err != nil {
 		fmt.Println(err)

build/deps.sh

@@ -5,3 +5,6 @@ go get gopkg.in/mgo.v2
 
 # grpc
 go get google.golang.org/grpc
+
+# uuid
+go get github.com/pborman/uuid
\ No newline at end of file

dfssp/authority/rootCA.go

+package authority
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"dfss/auth"
+	"github.com/pborman/uuid"
+	"io/ioutil"
+	"math/big"
+	"os/user"
+	"path/filepath"
+)
+
+const (
+	// PkeyFileName is the private key file default name
+	PkeyFileName = "dffsp_pkey.pem"
+	// RootCAFileName is the root certificate file default name
+	RootCAFileName = "dffsp_rootCA.pem"
+)
+
+// PlatformID contains platform private key and root certificate
+type PlatformID struct {
+	pkey   *rsa.PrivateKey
+	rootCA *x509.Certificate
+}
+
+// GetHomeDir determines the home directory of the current user.
+func GetHomeDir() string {
+	usr, err := user.Current()
+
+	if err != nil {
+		panic(err)
+	}
+
+	return usr.HomeDir
+}
+
+// GenerateRootCA constructs a self-signed certificate, using a unique serial number randomly generated (see UUID)
+func GenerateRootCA(days int, country, organization, unit, cn string, key *rsa.PrivateKey) ([]byte, error) {
+	// Generating and converting the uuid to fit our needs: an 8 bytes integer.
+	uuid := uuid.NewRandom()
+	var slice []byte
+	slice = uuid[:8]
+	// TODO: improve this conversion method/need
+	serial := new(big.Int).SetBytes(slice).Uint64()
+
+	cert, err := auth.GetSelfSignedCertificate(days, serial, country, organization, unit, cn, key)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return cert, nil
+}
+
+// Initialize creates and saves the platform's private key and root certificate to a PEM format.
+//
+// The files are saved at the specified path.
+func Initialize(bits, days int, country, organization, unit, cn, path string) error {
+	// Generating the private key.
+	key, err := auth.GeneratePrivateKey(bits)
+
+	if err != nil {
+		return err
+	}
+
+	// Generating the root certificate, using the private key.
+	cert, err := GenerateRootCA(days, country, organization, unit, cn, key)
+
+	if err != nil {
+		return err
+	}
+
+	// Converting the private key to a PEM format, and saving it.
+	keyPem := auth.PrivateKeyToPEM(key)
+	keyPath := filepath.Join(path, PkeyFileName)
+	err = ioutil.WriteFile(keyPath, keyPem, 0600)
+
+	if err != nil {
+		return err
+	}
+
+	// Saving the root certificate.
+	certPath := filepath.Join(path, RootCAFileName)
+	err = ioutil.WriteFile(certPath, cert, 0600)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Start fetches the platform's private rsa key and root certificate, and create a PlatformID accordingly.
+//
+// The specified path should not end by a separator.
+//
+// The files are fetched using their default name.
+func Start(path string) (*PlatformID, error) {
+	keyPath := filepath.Join(path, PkeyFileName)
+	certPath := filepath.Join(path, RootCAFileName)
+
+	// Recovering the private rsa key from file.
+	keyBytes, err := ioutil.ReadFile(keyPath)
+
+	if err != nil {
+		return nil, err
+	}
+
+	key, err := auth.PEMToPrivateKey(keyBytes)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Recovering the root certificate from file.
+	certBytes, err := ioutil.ReadFile(certPath)
+
+	if err != nil {
+		return nil, err
+	}
+
+	cert, err := auth.PEMToCertificate(certBytes)
+
+	if err != nil {
+		return nil, err
+	}
+
+	res := &PlatformID{
+		pkey:   key,
+		rootCA: cert}
+
+	return res, nil
+}

dfssp/authority/rootCA_test.go

+package authority
+
+import (
+	"crypto/rsa"
+	"dfss/auth"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+var pkey *rsa.PrivateKey
+
+func TestMain(m *testing.M) {
+	pkey, _ = auth.GeneratePrivateKey(512)
+	os.Exit(m.Run())
+}
+
+func TestGetHomeDir(t *testing.T) {
+	res := GetHomeDir()
+
+	if res == "" {
+		t.Fatal("Result is empty")
+	}
+}
+
+func TestGenerateRootCA(t *testing.T) {
+	res, err := GenerateRootCA(365, "country", "organization", "unit", "cn", pkey)
+
+	if res == nil || err != nil {
+		t.Fatal(err)
+	}
+
+	if res[0] != '-' {
+		t.Fatalf("Bad format\n%s", res)
+	}
+}
+
+func TestInitialize(t *testing.T) {
+	path := os.TempDir()
+	keyPath := filepath.Join(path, PkeyFileName)
+	certPath := filepath.Join(path, RootCAFileName)
+
+	err := Initialize(1024, 365, "country", "organization", "unit", "cn", path)
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err = os.Stat(keyPath); os.IsNotExist(err) {
+		t.Fatal("Private key file couldn't be found")
+	} else {
+		_ = os.Remove(keyPath)
+	}
+
+	if _, err = os.Stat(certPath); os.IsNotExist(err) {
+		t.Fatal("Root certificate file couldn't be found")
+	} else {
+		_ = os.Remove(certPath)
+	}
+}
+
+func ExampleInitialize() {
+	path := os.TempDir()
+	keyPath := filepath.Join(path, PkeyFileName)
+	certPath := filepath.Join(path, RootCAFileName)
+
+	err := Initialize(1024, 365, "country", "organization", "unit", "cn", path)
+
+	if err != nil {
+		fmt.Println(err)
+	}
+
+	checkFile(keyPath, "Private key")
+	checkFile(certPath, "Certificate")
+
+	// Output:
+	// Private key file has been found
+	// Private key file has been deleted
+	// Certificate file has been found
+	// Certificate file has been deleted
+}
+
+func checkFile(path, name string) {
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		fmt.Println(name + " file couldn't be found")
+	} else {
+		fmt.Println(name + " file has been found")
+		err = os.Remove(path)
+		if err != nil {
+			fmt.Println(err)
+		} else {
+			fmt.Println(name + " file has been deleted")
+		}
+	}
+}
+
+func TestStart(t *testing.T) {
+	path := os.TempDir()
+	keyPath := filepath.Join(path, PkeyFileName)
+	certPath := filepath.Join(path, RootCAFileName)
+
+	_ = Initialize(1024, 365, "country", "organization", "unit", "cn", path)
+
+	pid, err := Start(path)
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pid == nil || pid.pkey == nil || pid.rootCA == nil {
+		t.Fatal("Data was not recovered from saved files")
+	}
+
+	_ = os.Remove(keyPath)
+	_ = os.Remove(certPath)
+}

dfssp/main.go

@@ -2,19 +2,32 @@ package main
 
 import (
 	"dfss"
+	"dfss/dfssp/authority"
 	"flag"
 	"fmt"
 	"runtime"
 )
 
 var (
-	verbose bool
+	verbose                      bool
+	path, country, org, unit, cn string
+	keySize, validity            int
+	pid                          *authority.PlatformID
 )
 
 func init() {
 
 	flag.BoolVar(&verbose, "v", false, "Print verbose messages")
 
+	flag.StringVar(&path, "path", authority.GetHomeDir(), "Path for the platform's private key and root certificate")
+	flag.StringVar(&country, "country", "France", "Country for the root certificate")
+	flag.StringVar(&org, "org", "DFSS", "Organization for the root certificate")
+	flag.StringVar(&unit, "unit", "INSA Rennes", "Organizational unit for the root certificate")
+	flag.StringVar(&cn, "cn", "dfssp", "Common name for the root certificate")
+
+	flag.IntVar(&keySize, "keySize", 512, "Encoding size for the private key")
+	flag.IntVar(&validity, "validity", 21, "Root certificate's validity duration (days)")
+
 	flag.Usage = func() {
 		fmt.Println("DFSS platform v" + dfss.Version)
 		fmt.Println("Users and contracts manager")
@@ -23,6 +36,10 @@ func init() {
 		fmt.Println("  dfssp command [flags]")
 
 		fmt.Println("\nThe commands are:")
+		fmt.Println("  init     [cn, country, keySize, org, path, unit, validity]")
+		fmt.Println("           create and save the platform's private key and root certificate")
+		fmt.Println("  start    [path]")
+		fmt.Println("           start the platform after loading its private key and root certificate")
 		fmt.Println("  help     print this help")
 		fmt.Println("  version  print dfss client version")
 
@@ -40,6 +57,22 @@ func main() {
 	switch command {
 	case "version":
 		fmt.Println("v"+dfss.Version, runtime.GOOS, runtime.GOARCH)
+	case "init":
+		err := authority.Initialize(keySize, validity, country, org, unit, cn, path)
+		if err != nil {
+			fmt.Println("An error occured during the initialization operation")
+			fmt.Println(err)
+			panic(err)
+		}
+	case "start":
+		pid, err := authority.Start(path)
+		if err != nil {
+			fmt.Println("An error occured during the start operation")
+			fmt.Println(err)
+			panic(err)
+		}
+		// TODO: use pid
+		_ = pid
 	default:
 		flag.Usage()
 	}