(WIP) : HTTPS support for manufacturing-server and manufacturing-client for DI - #579
Draft
sarmahaj wants to merge 3 commits into
Draft
(WIP) : HTTPS support for manufacturing-server and manufacturing-client for DI#579sarmahaj wants to merge 3 commits into
sarmahaj wants to merge 3 commits into
Conversation
7flying
self-requested a review
November 27, 2023 09:41
sarmahaj
force-pushed
the
fdo_di_https
branch
from
January 18, 2024 12:54
0a84b37 to
baab2b4
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
sarmahaj
changed the title
sarmahaj
force-pushed
the
fdo_di_https
branch
from
January 18, 2024 13:09
baab2b4 to
87e96b8
Compare
| Some(&mfg_server), | ||
| |cfg| { | ||
| cfg.env("DEVICE_CREDENTIAL_FILENAME", "devicecredential.dc") | ||
| .env("MANUFACTURING_SERVER_URL", "https://localhost:8086") |
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling.
sarmahaj
force-pushed
the
fdo_di_https
branch
from
January 19, 2024 14:20
87e96b8 to
15f22ec
Compare
sarmahaj
force-pushed
the
fdo_di_https
branch
from
January 23, 2024 16:00
15f22ec to
3b57dce
Compare
sarmahaj
force-pushed
the
fdo_di_https
branch
2 times, most recently
from
February 7, 2024 11:54
3a58471 to
f0c60c0
Compare
- warp::service and hyper::server combination used to run https server - separate bind address for http and https - tls_config containes tls config for htpps - now manufacturing-server supports both http and https requests from client. Signed-off-by: Sarita Mahajan <sarmahaj@redhat.com>
- changes on client side to support https request Signed-off-by: Sarita Mahajan <sarmahaj@redhat.com>
- still WIP Signed-off-by: Sarita Mahajan <sarmahaj@redhat.com>
sarmahaj
force-pushed
the
fdo_di_https
branch
from
February 7, 2024 12:10
f0c60c0 to
5d71f77
Compare
| // cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test"); | ||
| // cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test"); | ||
| // cfg.insert("bind_http", "8085"); | ||
| // cfg.insert("bind_https", &("127.0.0.1:{}" )); |
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling.
| "bind", | ||
| &format!("127.0.0.1:{}", self.server_number.server_port().unwrap()), | ||
| ); | ||
| cfg.insert("bind_https", &format!("127.0.0.1:{}", 6000)); |
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling.
|
|
||
| // Set subject for the certificate | ||
| let mut name_builder = X509NameBuilder::new()?; | ||
| name_builder.append_entry_by_nid(openssl::nid::Nid::COMMONNAME, "localhost")?; |
Check notice
Code scanning / devskim
Accessing localhost could indicate debug code, or could hinder scaling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR (currently in draft state) contains-
(Meanwhile to test manually, use following commands )
To create key & certs:
openssl genpkey -algorithm RSA -out server.keyopenssl req -new -key server.key -out server.csropenssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crtMention this address in manufacturing_server_https_key and manufacturing_server_https_cert fields in manufacturing_server.config file.
(This part to generate cert and key will be taken care in separate PR as a part of admin-tool)
sudo MANUFACTURING_SERVER_CONF=/usr/share/fdo/manufacturing_server.yml LOG_LEVEL=trace ./target/debug/fdo-manufacturing-server
HTTPS request:
sudo DEV_ENVIRONMENT=1 MANUFACTURING_SERVER_URL=https://localhost:8084 LOG_LEVEL=trace DIUN_PUB_KEY_ROOTCERTS=aio-dir/keys/diun_cert.pem ./target/debug/fdo-manufacturing-client
HTTP request:
sudo DEV_ENVIRONMENT=0 MANUFACTURING_SERVER_URL=http://localhost:8080 LOG_LEVEL=trace DIUN_PUB_KEY_ROOTCERTS=aio-dir/keys/diun_cert.pem ./target/debug/fdo-manufacturing-client
DI should work and create device_credentials file under /etc/device-credentials.