Skip to content

Commit 8afadb1

Browse files
IceManGreenIceManGreen
authored
Support RSA OAEP encryption (#50)
* feature: update go version to 1.23.0 Signed-off-by: Louis Cailliot <louis.cailliot@thalesgroup.com> * feature: support of RSA OAEP algorithm Signed-off-by: Louis Cailliot <louis.cailliot@thalesgroup.com> * feat: update gose to v0.9.1 and crypto to v1.3.0 Signed-off-by: Louis Cailliot <louis.cailliot@thalesgroup.com> --------- Signed-off-by: Louis Cailliot <louis.cailliot@thalesgroup.com>
1 parent 5a6998a commit 8afadb1

25 files changed

Lines changed: 1144 additions & 407 deletions

‎.go-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.21.6
1+
1.23.0

‎QUICKSTART.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ k8s-kms-plugin serve --socket $SOCKET \
5050
--enable-server
5151
```
5252

53-
Start a K3S cluster with the proper KMS configuration in [encryption-conf.yaml](k8s/encryption-conf.yaml) :
53+
Start a K3S cluster with the proper KMS configuration in [encryption-conf.yaml](deployments/k8s/encryption-conf.yaml) :
5454

5555
```sh
5656
curl -sfL https://get.k3s.io | sh -s - \

‎README.md‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,35 @@ Both EST and KMS-Plugin binaries are in the `/cmd` dir
6969

7070
The `Makefile` contains commands for easy execution:
7171
- `make gen` - generates all apis into gRPC or OpenAPI Servers and Clients
72-
- `make dev` - loads project into your kubernetes cluster (minikube or GKE will work just fine), and continously builds and deploys as you develop.
72+
- `make dev` - loads project into your kubernetes cluster (minikube or GKE will work just fine), and continuously builds and deploys as you develop.
7373
- `make build` - builds the standalone `k8s-kms-plugin` binary
7474

75+
If you need to build using `crypto11` and `gose` development branches :
76+
77+
1. Push your dev modifications in a dedicated branch in the `crypto11` repo (ex: my-dev-branch)
78+
2. Go to the `gose` repo and update the *go.mod* file with `crytpo11` dev branch and push the update :
79+
80+
```sh
81+
# In gose repo
82+
# in a dev branch
83+
go switch -c my-dev-branch
84+
GOPROXY=direct go get -u github.com/ThalesGroup/crypto11@my-dev-branch
85+
go mod tidy
86+
git add go.mod
87+
git commit -S -s -m "dev: update gose with crytpo11 dev changes"
88+
git push
89+
```
90+
91+
3. Go to the `k8s-kms-plugin` repo and update the *go.mod* file with `crytpo11` and `gose` dev branches, then build :
92+
93+
```sh
94+
go switch -c my-dev-branch
95+
GOPROXY=direct go get -u github.com/ThalesGroup/crypto11@my-dev-branch
96+
GOPROXY=direct go get -u github.com/ThalesGroup/gose@my-dev-branch
97+
go mod tidy
98+
make build
99+
```
100+
75101
## Debug Environment
76102

77103
For a remote debug, build the plugin with debug mode :

‎cmd/k8s-kms-plugin/cmd/serve.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ var (
8282
UNKNOWNALG = Algorithm{""}
8383
AESGCM = Algorithm{"aes-gcm"}
8484
AESCBC = Algorithm{"aes-cbc"}
85+
RSAOAEP = Algorithm{"rsa-oaep"}
8586
)
8687

8788
func algFromString(s string) (jose.Alg, error) {
@@ -90,6 +91,8 @@ func algFromString(s string) (jose.Alg, error) {
9091
return jose.AlgA256GCM, nil
9192
case AESCBC.slug:
9293
return jose.AlgA256CBC, nil
94+
case RSAOAEP.slug:
95+
return jose.AlgRSAOAEP, nil
9396
default:
9497
return "", gose.ErrInvalidAlgorithm
9598
}

‎deployments/container/ContainerfileSofthsm‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# Copyright 2024 Thales
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
#==============================================================================#
16+
# This container image is based on the GoLang Debian officical image and
17+
# and embarks Goreleaser "github.com/goreleaser/goreleaser" and GCC for both
18+
# linux/amd64 (x86_64) and linux/arm64 (aarch64).
19+
#==============================================================================#
20+
21+
# Set Go & tools versions. Be carreful when upgrading these versions, make sure
22+
# to keep them in sync with the version golang
23+
ARG GOLANG_VERSION=1.23.0
24+
25+
# Set Debian version name (e.g. bookworm)
26+
ARG DEBIAN_VERSION=bookworm
27+
28+
# Builder image's registry
29+
# A Debian Bookworm based GoLang image is chosen over "docker.io/goreleaser/goreleaser" Alpine based
30+
# goreleaser official image (https://hub.docker.com/r/goreleaser/goreleaser),
31+
# because debian uses glibc and Alpine uses libc musl.
32+
ARG BUILDER_IMAGE_REGISTRY=docker.io/library
33+
ARG BUILDER_IMAGE_NAME=golang
34+
ARG BUILDER_IMAGE_TAG=${GOLANG_VERSION}-${DEBIAN_VERSION}
35+
36+
# For OCI labels
37+
ARG BASE_REGISTRY=${BUILDER_IMAGE_REGISTRY}
38+
ARG BASE_IMAGE=${BUILDER_IMAGE_NAME}
39+
ARG BASE_IMAGE_TAG=${BUILDER_IMAGE_TAG}
40+
41+
#==============================================================================#
42+
# Go Debian image with support for both linux/amd64 and linux/arm64
43+
#==============================================================================#
44+
FROM ${BUILDER_IMAGE_REGISTRY}/${BUILDER_IMAGE_NAME}:${BUILDER_IMAGE_TAG} AS builder-base
45+
46+
# Install linux/arm64 GCC
47+
RUN apt-get update && apt-get install -y \
48+
softhsm2 \
49+
opensc \
50+
gcc \
51+
sqlite3 \
52+
git vim \
53+
&& rm -rf /var/lib/apt/lists/*
54+
55+
#==============================================================================#
56+
# Final softhsm builder image for building thales-softhsm
57+
#==============================================================================#
58+
FROM builder-base as thales-softhsm
59+
60+
# SoftHSM variables
61+
ARG SOPIN="mysopin"
62+
ARG PIN="mypin"
63+
ARG TOKENLABEL="mylabel"
64+
ARG TOKENSLOT=0
65+
ARG MODULE="/usr/lib/softhsm/libsofthsm2.so"
66+
ARG STORE=""
67+
ARG AESKEYLABEL="aes0"
68+
ARG RSAKEYLABEL="rsa0"
69+
70+
# Set SoftHSM environment for the user
71+
#RUN cp /etc/softhsm/softhsm2.conf $HOME
72+
#RUN chown $USER:$USER $HOME/softhsm2.conf
73+
#RUN echo 'export SOFTHSM2_CONF=$HOME/softhsm2.conf' >> $HOME/.bashrc
74+
#RUN source $HOME/.bashrc
75+
# if rootless, use :
76+
#RUN sudo usermod -aG softhsm $USER
77+
78+
# HSM provisioning
79+
RUN softhsm2-util --init-token --slot ${TOKENSLOT} --label ${TOKENLABEL} --so-pin ${SOPIN} --pin ${PIN}
80+
# aes key
81+
RUN pkcs11-tool --module ${MODULE} --token-label ${TOKENLABEL} --login --pin ${PIN} --keygen --key-type aes:16 --label ${AESKEYLABEL}
82+
# rsa key
83+
RUN pkcs11-tool --module ${MODULE} --token-label ${TOKENLABEL} --login --pin ${PIN} --keypairgen --key-type rsa:4096 --label ${RSAKEYLABEL}
84+
85+
ENTRYPOINT ["/bin/bash", "-s"]
86+
87+
88+
# See https://github.com/opencontainers/image-spec/blob/main/annotations.md
89+
ARG LABEL_CREATED=""
90+
ARG LABEL_AUTHOR="Thales Open Source <oss@thalesgroup.com>"
91+
ARG LABEL_URL="https://github.com/ThalesGroup/k8s-kms-plugin"
92+
ARG LABEL_DOCUMENTATION="https://github.com/ThalesGroup/k8s-kms-plugin"
93+
ARG LABEL_SOURCE="https://github.com/ThalesGroup/k8s-kms-plugin"
94+
ARG LABEL_VERSION=""
95+
ARG LABEL_REVISION=""
96+
ARG LABEL_VENDOR="Thales"
97+
ARG LABEL_LICENSES="Apache 2.0"
98+
ARG LABEL_TITLE="k8s-kms-plugin-softhsm"
99+
ARG LABEL_REF_NAME=""
100+
ARG LABEL_DESCRIPTION="Container base image for softhsm using glibc on debian. The ENTRYPOINT of this image is /bin/bash."
101+
ARG LABEL_BASE_DIGEST=""
102+
ARG BASE_REGISTRY
103+
ARG BASE_IMAGE
104+
ARG BASE_IMAGE_TAG
105+
ARG LABEL_BASE_NAME="${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_IMAGE_TAG}"
106+
LABEL org.opencontainers.image.created="${LABEL_CREATED}"
107+
LABEL org.opencontainers.image.authors="${LABEL_AUTHOR}"
108+
LABEL org.opencontainers.image.url="${LABEL_URL}"
109+
LABEL org.opencontainers.image.documentation="${LABEL_DOCUMENTATION}"
110+
LABEL org.opencontainers.image.source="${LABEL_SOURCE}"
111+
LABEL org.opencontainers.image.version="${LABEL_VERSION}"
112+
LABEL org.opencontainers.image.revision="${LABEL_REVISION}"
113+
LABEL org.opencontainers.image.vendor="${LABEL_VENDOR}"
114+
LABEL org.opencontainers.image.licenses="${LABEL_LICENSES}"
115+
LABEL org.opencontainers.image.title="${LABEL_TITLE}"
116+
LABEL org.opencontainers.image.ref.name="${LABEL_REF_NAME}"
117+
LABEL org.opencontainers.image.description="${LABEL_DESCRIPTION}"
118+
LABEL org.opencontainers.image.base.digest="${LABEL_BASE_DIGEST}"
119+
LABEL org.opencontainers.image.base.name="${LABEL_BASE_NAME}"

‎deployments/container/ContainerfileSwtpm‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
# Copyright 2024 Thales
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
#==============================================================================#
16+
# This container image is based on the GoLang Debian officical image and
17+
# and embarks Goreleaser "github.com/goreleaser/goreleaser" and GCC for both
18+
# linux/amd64 (x86_64) and linux/arm64 (aarch64).
19+
#==============================================================================#
20+
21+
# Set Go & tools versions. Be carreful when upgrading these versions, make sure
22+
# to keep them in sync with the version golang
23+
ARG GOLANG_VERSION=1.23.0
24+
25+
# Set Debian version name (e.g. bookworm)
26+
ARG DEBIAN_VERSION=bookworm
27+
28+
# Builder image's registry
29+
# A Debian Bookworm based GoLang image is chosen over "docker.io/goreleaser/goreleaser" Alpine based
30+
# goreleaser official image (https://hub.docker.com/r/goreleaser/goreleaser),
31+
# because debian uses glibc and Alpine uses libc musl.
32+
ARG BUILDER_IMAGE_REGISTRY=docker.io/library
33+
ARG BUILDER_IMAGE_NAME=golang
34+
ARG BUILDER_IMAGE_TAG=${GOLANG_VERSION}-${DEBIAN_VERSION}
35+
36+
# For OCI labels
37+
ARG BASE_REGISTRY=${BUILDER_IMAGE_REGISTRY}
38+
ARG BASE_IMAGE=${BUILDER_IMAGE_NAME}
39+
ARG BASE_IMAGE_TAG=${BUILDER_IMAGE_TAG}
40+
41+
#==============================================================================#
42+
# Go Debian image with support for both linux/amd64 and linux/arm64
43+
#==============================================================================#
44+
FROM ${BUILDER_IMAGE_REGISTRY}/${BUILDER_IMAGE_NAME}:${BUILDER_IMAGE_TAG} AS builder-base
45+
46+
RUN apt-get update
47+
48+
# VTPM dependencies for debian
49+
RUN apt install -y \
50+
build-essential \
51+
procps \
52+
git \
53+
tpm2-abrmd libtpm2-pkcs11-1 libtpm2-pkcs11-tools libtss2-tcti-tabrmd0 \
54+
automake autoconf libtool make gcc libc-dev \
55+
dh-autoreconf libssl-dev \
56+
libtasn1-6-dev pkg-config \
57+
net-tools iproute2 libjson-glib-dev \
58+
libgnutls28-dev expect gawk socat \
59+
libseccomp-dev make \
60+
gnutls-bin libfuse-dev \
61+
dbus opensc
62+
# && rm -rf /var/lib/apt/lists/*
63+
64+
# install libtpms
65+
RUN cd $HOME && \
66+
git clone https://github.com/stefanberger/libtpms.git && \
67+
cd libtpms && \
68+
./autogen.sh --with-tpm2 --with-openssl --prefix=/usr && \
69+
make -j$(nproc) && \
70+
make install
71+
72+
# install software tpm
73+
RUN cd $HOME && \
74+
git clone https://github.com/stefanberger/swtpm.git && \
75+
cd swtpm && \
76+
./autogen.sh --with-gnutls --with-cuse --prefix=/usr && \
77+
make -j$(nproc) && \
78+
make install
79+
80+
#==============================================================================#
81+
# Final softhsm builder image for building thales-softhsm
82+
#==============================================================================#
83+
FROM builder-base as thales-softhsm
84+
85+
# SoftHSM variables
86+
ARG SOPIN="mysopin"
87+
ARG PIN="mypin"
88+
ARG TOKENLABEL="mylabel"
89+
ARG TOKENSLOT=0
90+
ARG MODULE="/usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1"
91+
ARG SWTPMDIR="${HOME}/tpm2"
92+
ARG SWTPMSTATEDIR="${SWTPMDIR}/tpmstate"
93+
ARG SWTPMRUNDIR="/run/vtpm2"
94+
ARG SWTPMRUNFILE="${SWTPMRUNDIR}/swtpm.run"
95+
ARG SWTPMPIDFILE="${SWTPMRUNDIR}/swtpm.pid"
96+
ARG SWTPMLOGFILE="${SWTPMRUNDIR}/swtpm.log"
97+
ARG SWTPMABRMDRUNFILE="${SWTPMRUNDIR}/tpm2-abrmd.run"
98+
ARG SWTPMABRMDPIDFILE="${SWTPMRUNDIR}/tpm2-abrmd.pid"
99+
ARG SWTPMLOGLEVEL=5
100+
ARG SWTPMDATAPORT=3333
101+
ARG SWTPMCTRLPORT=3334
102+
ARG AESKEYLABEL="aes0"
103+
ARG HMACKEYLABEL="hmac0"
104+
ARG RSAKEYLABEL="rsa0"
105+
106+
# tpm2 launch scripts
107+
COPY scripts/swtpm.sh ${HOME}
108+
COPY scripts/tpm2-abrmd.sh ${HOME}
109+
COPY scripts/tpm2-provisioning.sh ${HOME}
110+
111+
# swtpm user and env
112+
# This is necesseary for the k8s-kms-plugin user
113+
RUN printf "export SOPIN=${SOPIN}\nexport PIN=${PIN}\nexport TOKENLABEL=${TOKENLABEL}\nexport TOKENSLOT=${TOKENSLOT}\nexport MODULE=${MODULE}\nexport SWTPMDIR=${SWTPMDIR}\nexport SWTPMSTATEDIR=${SWTPMSTATEDIR}\nexport SWTPMRUNDIR=${SWTPMRUNDIR}\nexport SWTPMRUNFILE=${SWTPMRUNFILE}\nexport SWTPMPIDFILE=${SWTPMPIDFILE}\nexport SWTPMLOGFILE=${SWTPMLOGFILE}\nexport SWTPMABRMDRUNFILE=${SWTPMABRMDRUNFILE}\nexport SWTPMABRMDPIDFILE=${SWTPMABRMDPIDFILE}\nexport SWTPMLOGLEVEL=${SWTPMLOGLEVEL}\nexport SWTPMDATAPORT=${SWTPMDATAPORT}\nexport SWTPMCTRLPORT=${SWTPMCTRLPORT}\nexport AESKEYLABEL=${AESKEYLABEL}\nexport HMACKEYLABEL=${HMACKEYLABEL}\nexport RSAKEYLABEL=${RSAKEYLABEL}\nexport TPM2_PKCS11_STORE=${SWTPMDIR}" >> ${HOME}/.bashrc
114+
115+
CMD [ "${HOME}/swtpm.sh" ]
116+
CMD [ "${HOME}/tpm2-abrmd.sh" ]
117+
ENTRYPOINT ["/bin/bash", "-s"]
118+
119+
120+
# See https://github.com/opencontainers/image-spec/blob/main/annotations.md
121+
#ARG LABEL_CREATED=""
122+
#ARG LABEL_AUTHOR="Thales Open Source <oss@thalesgroup.com>"
123+
#ARG LABEL_URL="https://github.com/ThalesGroup/k8s-kms-plugin"
124+
#ARG LABEL_DOCUMENTATION="https://github.com/ThalesGroup/k8s-kms-plugin"
125+
#ARG LABEL_SOURCE="https://github.com/ThalesGroup/k8s-kms-plugin"
126+
#ARG LABEL_VERSION=""
127+
#ARG LABEL_REVISION=""
128+
#ARG LABEL_VENDOR="Thales"
129+
#ARG LABEL_LICENSES="Apache 2.0"
130+
#ARG LABEL_TITLE="k8s-kms-plugin-softhsm"
131+
#ARG LABEL_REF_NAME=""
132+
#ARG LABEL_DESCRIPTION="Container base image for softhsm using glibc on debian. The ENTRYPOINT of this image is /bin/bash."
133+
#ARG LABEL_BASE_DIGEST=""
134+
#ARG BASE_REGISTRY
135+
#ARG BASE_IMAGE
136+
#ARG BASE_IMAGE_TAG
137+
#ARG LABEL_BASE_NAME="${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_IMAGE_TAG}"
138+
#LABEL org.opencontainers.image.created="${LABEL_CREATED}"
139+
#LABEL org.opencontainers.image.authors="${LABEL_AUTHOR}"
140+
#LABEL org.opencontainers.image.url="${LABEL_URL}"
141+
#LABEL org.opencontainers.image.documentation="${LABEL_DOCUMENTATION}"
142+
#LABEL org.opencontainers.image.source="${LABEL_SOURCE}"
143+
#LABEL org.opencontainers.image.version="${LABEL_VERSION}"
144+
#LABEL org.opencontainers.image.revision="${LABEL_REVISION}"
145+
#LABEL org.opencontainers.image.vendor="${LABEL_VENDOR}"
146+
#LABEL org.opencontainers.image.licenses="${LABEL_LICENSES}"
147+
#LABEL org.opencontainers.image.title="${LABEL_TITLE}"
148+
#LABEL org.opencontainers.image.ref.name="${LABEL_REF_NAME}"
149+
#LABEL org.opencontainers.image.description="${LABEL_DESCRIPTION}"
150+
#LABEL org.opencontainers.image.base.digest="${LABEL_BASE_DIGEST}"
151+
#LABEL org.opencontainers.image.base.name="${LABEL_BASE_NAME}"

0 commit comments

Comments
 (0)