feat: make both http & https functional

other changes include:
- read cert and key from config
- grammar fixes

Signed-off-by: Rupanshi Jain <rupanshijain45678@gmail.com>

Author: rdotjain

admin-tool/src/aio/configure.rs

@@ -25,7 +25,9 @@ pub(super) struct Configuration {
     #[clap(long, default_value_t = 8080)]
     pub listen_port_manufacturing_server: u16,
     #[clap(long, default_value_t = 8081)]
-    pub listen_port_owner_onboarding_server: u16,
+    pub listen_port_http_owner_onboarding_server: u16,
+    #[clap(long, default_value_t = 8085)]
+    pub listen_port_https_owner_onboarding_server: u16,
     #[clap(long, default_value_t = 8082)]
     pub listen_port_rendezvous_server: u16,
     #[clap(long, default_value_t = 8083)]
@@ -78,7 +80,8 @@ impl Default for Configuration {
 
             listen_ip_address: String::from("0.0.0.0"),
             listen_port_manufacturing_server: 8080,
-            listen_port_owner_onboarding_server: 8081,
+            listen_port_http_owner_onboarding_server: 8081,
+            listen_port_https_owner_onboarding_server: 8085,
             listen_port_rendezvous_server: 8082,
             listen_port_serviceinfo_api_server: 8083,
 
@@ -155,7 +158,7 @@ impl Configuration {
         Ok(vec![fdo_data_formats::types::RemoteConnection::new(
             fdo_data_formats::types::RemoteTransport::Http,
             owner_addresses,
-            self.listen_port_owner_onboarding_server,
+            self.listen_port_http_owner_onboarding_server,
         )])
     }
 
@@ -309,7 +312,17 @@ fn generate_configs(aio_dir: &Path, config_args: &Configuration) -> Result<(), E
                 path: aio_dir.join("stores").join("owner_onboarding_sessions"),
             },
 
-            bind: get_bind(config_args.listen_port_owner_onboarding_server)?,
+            owner_server_https_cert: AbsolutePathBuf::new(
+                aio_dir.join("keys").join("owner_server_https_cert.crt"),
+            )
+            .unwrap(),
+            owner_server_https_key: AbsolutePathBuf::new(
+                aio_dir.join("keys").join("owner_server_https_key.key"),
+            )
+            .unwrap(),
+
+            bind_http: get_bind(config_args.listen_port_http_owner_onboarding_server)?,
+            bind_https: get_bind(config_args.listen_port_https_owner_onboarding_server)?,
 
             ownership_voucher_store_driver: StoreConfig::Directory {
                 path: aio_dir.join("stores").join("owner_vouchers"),

admin-tool/src/aio/execute.rs

@@ -203,7 +203,7 @@ impl ChildBinary {
     fn port(&self, config: &Configuration) -> u16 {
         match self {
             ChildBinary::ManufacturingServer => config.listen_port_manufacturing_server,
-            ChildBinary::OwnerOnboardingServer => config.listen_port_owner_onboarding_server,
+            ChildBinary::OwnerOnboardingServer => config.listen_port_http_owner_onboarding_server,
             ChildBinary::RendezvousServer => config.listen_port_rendezvous_server,
             ChildBinary::ServiceInfoApiServer => config.listen_port_serviceinfo_api_server,
             _ => unreachable!(),

owner-onboarding-server/src/main.rs

@@ -1,6 +1,5 @@
 use std::convert::{TryFrom, TryInto};
 use std::fs;
-use std::net::SocketAddr;
 use std::sync::Arc;
 
 use anyhow::{bail, Context, Result};
@@ -38,12 +37,13 @@ use std::convert::Infallible;
 use tls_listener::TlsListener;
 
 pub mod tls_config;
+use tls_config::tls_acceptor;
 
 mod handlers;
 mod ov_management;
 use crate::ov_management::ov_filter;
 
-pub(crate) struct OwnerServiceUD {
+pub struct OwnerServiceUD {
     // Trusted keys
     #[allow(dead_code)]
     trusted_device_keys: X5Bag,
@@ -58,6 +58,8 @@ pub(crate) struct OwnerServiceUD {
         >,
     >,
     session_store: Arc<fdo_http_wrapper::server::SessionStore>,
+    owner_server_https_cert: AbsolutePathBuf,
+    owner_server_https_key: AbsolutePathBuf,
 
     // Our keys
     owner_key: PKey<Private>,
@@ -285,8 +287,8 @@ async fn main() -> Result<()> {
         .context("Error parsing configuration")?;
 
     // Bind information
-    let bind_addr = settings.bind.clone();
-    let addr = SocketAddr::from(([0, 0, 0, 0], 8081));
+    let bind_http_addr = settings.bind_http.clone();
+    let bind_https_addr = settings.bind_https.clone();
 
     // Trusted keys
     let trusted_device_keys = {
@@ -352,6 +354,8 @@ async fn main() -> Result<()> {
         // Stores
         ownership_voucher_store,
         session_store: session_store.clone(),
+        owner_server_https_cert: settings.owner_server_https_cert,
+        owner_server_https_key: settings.owner_server_https_key,
 
         // Trusted keys
         trusted_device_keys,
@@ -424,56 +428,75 @@ async fn main() -> Result<()> {
     let routes = warp::post()
         .and(
             hello
-                .or(handler_ping)
-                .or(handler_report_to_rendezvous)
+                .or(handler_ping.clone())
+                .or(handler_report_to_rendezvous.clone())
                 // TO2
-                .or(handler_to2_hello_device)
-                .or(handler_to2_get_ov_next_entry)
-                .or(handler_to2_prove_device)
-                .or(handler_to2_device_service_info_ready)
-                .or(handler_to2_device_service_info)
-                .or(handler_to2_done)
+                .or(handler_to2_hello_device.clone())
+                .or(handler_to2_get_ov_next_entry.clone())
+                .or(handler_to2_prove_device.clone())
+                .or(handler_to2_device_service_info_ready.clone())
+                .or(handler_to2_device_service_info.clone())
+                .or(handler_to2_done.clone())
                 .or(ov_filter(user_data.clone())),
         )
         .recover(fdo_http_wrapper::server::handle_rejection)
-        .with(warp::log("owner-onboarding-service"));
+        .with(warp::log(
+            "owner-onboarding-service to handle http and https",
+        ));
 
-    log::info!("Listening on {}", addr);
-
-    let service = warp::service(routes);
+    let service = warp::service(routes.clone());
 
     let make_svc = hyper::service::make_service_fn(move |_| {
         let svc = service.clone();
         async move { Ok::<_, Infallible>(svc) }
     });
 
     let incoming = TlsListener::new(
-        tls_config::tls_config::tls_acceptor(),
-        AddrIncoming::bind(&addr)?,
+        tls_acceptor(user_data.clone()),
+        AddrIncoming::bind(&bind_https_addr.into())?,
+    );
+    let https_server = hyper::Server::builder(incoming).serve(make_svc);
+    let https_server = https_server.with_graceful_shutdown(async {
+        signal(SignalKind::terminate()).unwrap().recv().await;
+        log::info!("Terminating HTTPS server");
+    });
+    let https_server_handle = tokio::spawn(https_server);
+
+    let http_server = warp::serve(routes.clone());
+    let http_server = http_server
+        .bind_with_graceful_shutdown(bind_http_addr, async {
+            signal(SignalKind::terminate()).unwrap().recv().await;
+            log::info!("Terminating HTTP server");
+        })
+        .1;
+    let http_server_handle = tokio::spawn(http_server);
+
+    let maintenance_runner_handle =
+        tokio::spawn(async move { perform_maintenance(user_data.clone()).await });
+
+    log::info!("starting both servers with http & https support");
+    // Join all the three handlers and wait
+    let (http_result, https_result, maintenance_result) = tokio::join!(
+        http_server_handle,
+        https_server_handle,
+        maintenance_runner_handle
     );
-    let server = hyper::Server::builder(incoming).serve(make_svc);
-    log::info!("starting at https://{}", addr);
-    server.await?;
-    // let server = warp::serve(routes);
-
-    // let maintenance_runner =
-    //     tokio::spawn(async move { perform_maintenance(user_data.clone()).await });
-
-    // let server = server
-    //     .bind_with_graceful_shutdown(bind_addr, async {
-    //         signal(SignalKind::terminate()).unwrap().recv().await;
-    //         log::info!("Terminating");
-    //     })
-    //     .1;
-    // let server = tokio::spawn(server);
-
-    // tokio::select!(
-    // _ = server => {
-    //     log::info!("Server terminated");
-    // },
-    // _ = maintenance_runner => {
-    //     log::info!("Maintenance runner terminated");
-    // });
+
+    // Check the results and handle accordingly since we have joined
+    match http_result {
+        Ok(_) => log::info!("HTTP server terminated successfully"),
+        Err(err) => log::error!("HTTP server terminated with an error: {:?}", err),
+    }
+
+    match https_result {
+        Ok(_) => log::info!("HTTPS server terminated successfully"),
+        Err(err) => log::error!("HTTPS server terminated with an error: {:?}", err),
+    }
+
+    match maintenance_result {
+        Ok(_) => log::info!("Maintenance runner terminated successfully"),
+        Err(err) => log::error!("Maintenance runner terminated with an error: {:?}", err),
+    }
 
     Ok(())
 }

owner-onboarding-server/src/ov_management/mod.rs

@@ -26,7 +26,8 @@ pub(crate) fn ov_filter(
         .and(warp::body::bytes())
         .map(move |count, content_type, body| (count, content_type, body, session_store.clone()))
         .untuple_one()
-        .and_then(add_ov);
+        .and_then(add_ov)
+        .recover(recover_err);
 
     let delete = baseurl
         .and(warp::post())
@@ -139,8 +140,8 @@ async fn add_ov(
                         StatusCode::BAD_REQUEST,
                     )));
                 }
-                ErrorCode::InvalidVoucherSignatureDescription() => {
-                    let message = ErrorCode::generate(ErrorCode::InvalidVoucherSignature(i));
+                ErrorCode::InvalidVoucherSignaturesDescription() => {
+                    let message = ErrorCode::generate(ErrorCode::InvalidVoucherSignatures(i));
                     return Ok(Box::new(warp::reply::with_status(
                         warp::reply::json(&message),
                         StatusCode::BAD_REQUEST,
@@ -253,13 +254,13 @@ async fn recover_err(e: Rejection) -> Result<impl warp::Reply, warp::Rejection>
 enum ErrorCode {
     #[error("Voucher count should be positive integer")]
     VoucherCountError,
-    #[error("Content-type should be application/x-pem-file,application/cbor")]
+    #[error("Content-type should be application/x-pem-file or application/cbor")]
     RequireContentTypeHeader,
     #[error("Ownership voucher not found")]
     NoOwnershipVoucherFound,
     #[error("Unable to parse UUID")]
     UuidParseError,
-    #[error("Pem format error")]
+    #[error("PEM format error")]
     ParseError,
     #[error("{0}")]
     StoreError(String),
@@ -270,17 +271,17 @@ enum ErrorCode {
     #[error("{0:?}")]
     UnknownDevice(Vec<String>),
     #[error("Voucher signature not valid")]
-    InvalidVoucherSignature(usize),
+    InvalidVoucherSignatures(usize),
     #[error("Incomplete Voucher")]
     IncompleteVoucher(usize),
-    #[error("Error parsing pem file")]
+    #[error("Error parsing PEM file")]
     PemParseError(usize),
     #[error("")]
     PemParseErrorDescription(),
     #[error("")]
     IncompleteVoucherDescription(),
     #[error("")]
-    InvalidVoucherSignatureDescription(),
+    InvalidVoucherSignaturesDescription(),
     #[error("Something is wrong here, please try again")]
     MiscError,
 }
@@ -310,7 +311,7 @@ impl ErrorCode {
                 error_details: json! ({"error": ErrorCode::ParseError.to_string()})
             }),
             ErrorCode::InvalidNumberOfVouchers(e) => json!(ErrorMsg {
-                error_code: "invalid_number_of_voucher",
+                error_code: "invalid_number_of_vouchers",
                 error_details: json!({ "parsed": e })
             }),
             ErrorCode::UnwonedVoucher(e) => json!(ErrorMsg {
@@ -321,9 +322,9 @@ impl ErrorCode {
                 error_code: "unknown_device",
                 error_details: json!({ "unknown": e })
             }),
-            ErrorCode::InvalidVoucherSignature(idx) => json!(ErrorMsg {
-                error_code: "invalid_voucher_signature",
-                error_details: json! ({"failed_at_index": idx,"description": &ErrorCode::InvalidVoucherSignature(idx).to_string()})
+            ErrorCode::InvalidVoucherSignatures(idx) => json!(ErrorMsg {
+                error_code: "invalid_voucher_signatures",
+                error_details: json! ({"failed_at_index": idx,"description": &ErrorCode::InvalidVoucherSignatures(idx).to_string()})
             }),
             ErrorCode::IncompleteVoucher(idx) => json!(ErrorMsg {
                 error_code: "incomplete_voucher",
@@ -344,14 +345,13 @@ fn validate_ov<'a>(
 ) -> Result<bool, ErrorCode> {
     ov.iter_entries()
         .map_err(|_e| ErrorCode::PemParseErrorDescription())?
-        .into_iter()
         .next()
         .ok_or(|| ErrorCode::ParseError)
         .map_err(|_| ErrorCode::ParseError)?
         .map_err(|_e| ErrorCode::IncompleteVoucherDescription())?
         .public_key()
         .matches_pkey(owner_key)
-        .map_err(|_e| ErrorCode::InvalidVoucherSignatureDescription())
+        .map_err(|_e| ErrorCode::InvalidVoucherSignaturesDescription())
 }
 
 fn validate_count(count: HeaderValue) -> Result<usize, ErrorCode> {

owner-onboarding-server/src/tls_config/mod.rs

@@ -1,24 +1,27 @@
 pub mod tls_config {
+    use crate::OwnerServiceUD;
     use openssl::ssl::{SslContext, SslFiletype, SslMethod};
     use std::path::Path;
+    use std::sync::Arc;
     pub type Acceptor = openssl::ssl::SslContext;
 
-       fn tls_acceptor_impl<P: AsRef<Path>>(cert_file: P, key_file: P) -> Acceptor {
-   
+    fn tls_acceptor_impl<P: AsRef<Path>>(cert_file: P, key_file: P) -> Acceptor {
         let mut builder = SslContext::builder(SslMethod::tls_server()).unwrap();
         builder
             .set_certificate_file(cert_file, SslFiletype::PEM)
             .unwrap();
         builder
             .set_private_key_file(key_file, SslFiletype::PEM)
-            .unwrap();  
+            .unwrap();
         builder.build()
     }
 
-    pub fn tls_acceptor() -> Acceptor {
-        tls_acceptor_impl(
-            "/workspaces/fido-device-onboard-rs/server.crt",
-            "/workspaces/fido-device-onboard-rs/server.key",
-        )
+    pub fn tls_acceptor(user_data: Arc<OwnerServiceUD>) -> Acceptor {
+        let cert_file = &user_data.owner_server_https_cert;
+        let key_file = &user_data.owner_server_https_key;
+        tls_acceptor_impl(cert_file, key_file)
     }
 }
+
+pub use tls_config::tls_acceptor;
+pub use tls_config::Acceptor;

util/src/servers/configuration/owner_onboarding_server.rs

@@ -20,9 +20,12 @@ pub struct OwnerOnboardingServerSettings {
     // Our private owner key
     pub owner_private_key_path: AbsolutePathBuf,
     pub owner_public_key_path: AbsolutePathBuf,
+    pub owner_server_https_cert: AbsolutePathBuf,
+    pub owner_server_https_key: AbsolutePathBuf,
 
     // Bind information
-    pub bind: Bind,
+    pub bind_http: Bind,
+    pub bind_https: Bind,
 
     // Service Info API Server
     pub service_info_api_url: String,