diff --git a/Gopkg.toml b/Gopkg.toml
index 8e8e9943dd0a00009a9626d49bf8a20ae8e28e05..1e5c022553c12ab6426fb4b8bbe8cc54173a54ba 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -1,5 +1,5 @@
[[constraint]]
- branch = "master"
+ branch = "142-Implement_CA_cert"
name = "code.vereign.com/code/viam-apis"
[[constraint]]
diff --git a/config.yaml.sample b/config.yaml.sample
index 0ec5701dd0ea40c10f194f720f069e448cea9857..246f7b61a69df770e0bf38f4adf7fd91338622b9 100644
--- a/config.yaml.sample
+++ b/config.yaml.sample
@@ -1,10 +1,29 @@
-dataStorageClientUrl: localhost:7777
-grpcClientUrl: localhost:7877
-restClientUrl: localhost:7878
+# Make sure you have a "config.yaml" file on the root folder of this repo
-# Certificate Related Config
+# You can use this sample YAML file to configure your installation
+
+# Connection Information
+dataStorageUrl: localhost:7777
+grpcListenAddress: localhost:7877
+restListenAddress: localhost:7878
+
+# Choose a certificate method for providing PEM strings
+# 1 = Read from file (*.crt and *.key files)
+# 2 = Read from Vault server (this will require additional config information for Vault)
+certificateMethod: 1
+
+# Read Certificates From Folder and Files
certDir: cert
certFile: server.crt
certKey: server.key
vereignCertFile: vereign_ca.cer
-vereignCertKey: vereign_ca.key
\ No newline at end of file
+vereignCertKey: vereign_ca.key
+caCertFile: ca.crt
+
+# Read Certificates From Vault Server
+vaultAddress: http://10.6.10.119:8200
+vaultToken: 00000000-0000-0000-0000-000000000000
+vaultPath: /developers/data/devteam/cert
+certificateKey: certificateKey
+privateKey: privateKey
+caCertificateKey: caCertificateKey
diff --git a/handler/generate_keypair.go b/handler/generate_keypair.go
index 19f658283c8ab9b10d05a56bfa9d87d535efbbc2..89fa5a0e27e15b88eb5236ee6ec4c1c861ab1b2d 100644
--- a/handler/generate_keypair.go
+++ b/handler/generate_keypair.go
@@ -39,7 +39,7 @@ func (s *KeyStorageServerImpl) GenerateKeyPair(ctx context.Context,
auth := s.CreateAuthentication(ctx)
client := &client.DataStorageClientImpl{}
- client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath)
+ client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath, s.KeyFilePath, s.CaCertFilePath)
defer client.CloseClient()
generateKeyPairResponse := &api.GenerateKeyPairResponse{}
diff --git a/handler/handler.go b/handler/handler.go
index ab527483a014f32cb929b0f099b92b511705ac75..cd29dbdf20db89c79d9b1ec65daca34eb5fdae8a 100644
--- a/handler/handler.go
+++ b/handler/handler.go
@@ -36,6 +36,8 @@ import (
type KeyStorageServerImpl struct {
DataStorageUrl string
CertFilePath string
+ KeyFilePath string
+ CaCertFilePath string
VereignCertFilePath string
VereignPrivateKeyFilePath string
}
@@ -60,7 +62,7 @@ func (s *KeyStorageServerImpl) GetKey(ctx context.Context, in *api.GetKeyRequest
auth := s.CreateAuthentication(ctx)
client := &client.DataStorageClientImpl{}
- client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath)
+ client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath, s.KeyFilePath, s.CaCertFilePath)
defer client.CloseClient()
getKeyResponse := &api.GetKeyResponse{}
@@ -107,7 +109,7 @@ func (s *KeyStorageServerImpl) SetKey(ctx context.Context, in *api.SetKeyRequest
auth := s.CreateAuthentication(ctx)
client := &client.DataStorageClientImpl{}
- client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath)
+ client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath, s.KeyFilePath, s.CaCertFilePath)
defer client.CloseClient()
setKeyResponse := &api.SetKeyResponse{}
@@ -155,7 +157,7 @@ func (s *KeyStorageServerImpl) ReserveKeyUUID(ctx context.Context, in *api.Reser
auth := s.CreateAuthentication(ctx)
client := &client.DataStorageClientImpl{}
- client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath)
+ client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath, s.KeyFilePath, s.CaCertFilePath)
defer client.CloseClient()
reserveKeyUUIDResponse := &api.ReserveKeyUUIDResponse{}
diff --git a/handler/revoke.go b/handler/revoke.go
index 8f757b298b6d750587f54e312a3bb8388e8038a7..79994ea4abfb16d9b81531f3104683875bd1ed4b 100644
--- a/handler/revoke.go
+++ b/handler/revoke.go
@@ -29,7 +29,7 @@ func (s *KeyStorageServerImpl) Revoke(ctx context.Context, in *api.RevokeRequest
auth := s.CreateAuthentication(ctx)
client := &client.DataStorageClientImpl{}
- client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath)
+ client.SetUpClient(auth, s.DataStorageUrl, s.CertFilePath, s.KeyFilePath, s.CaCertFilePath)
defer client.CloseClient()
revokeResponse := &api.RevokeResponse{}
diff --git a/main.go b/main.go
index 076a8b7ac919e1f026a07659d6ca1176b3386b80..c6595c4d5b13a22486977b38778e134378a772c4 100644
--- a/main.go
+++ b/main.go
@@ -35,18 +35,19 @@ func main() {
return
}
- grpcAddress := viper.GetString("grpcClientUrl")
- restAddress := viper.GetString("restClientUrl")
- dataStorageAddress := viper.GetString("dataStorageClientUrl")
+ grpcAddress := viper.GetString("grpcListenAddress")
+ restAddress := viper.GetString("restListenAddress")
+ dataStorageAddress := viper.GetString("dataStorageUrl")
certFilePath := certDir + "/" + viper.GetString("certFile")
privateKeyFilePath := certDir + "/" + viper.GetString("certKey")
+ caCertFilePath := certDir + "/" + viper.GetString("caCertFile")
vereignCertFilePath := certDir + "/" + viper.GetString("vereignCertFile")
vereignPrivateKeyFilePath := certDir + "/" + viper.GetString("vereignCertKey")
// fire the gRPC server in a goroutine
go func() {
- err := server.StartGRPCServer(grpcAddress, certFilePath, privateKeyFilePath, vereignCertFilePath,
+ err := server.StartGRPCServer(grpcAddress, certFilePath, privateKeyFilePath, caCertFilePath, vereignCertFilePath,
vereignPrivateKeyFilePath, dataStorageAddress)
if err != nil {
log.Fatalf("failed to start gRPC server: %s", err)
diff --git a/server/configs.go b/server/configs.go
index 635427583f2eeae2fd99fb4263581bd7628bf8b5..6c4cbb916e56295c0cbfb0d2e4bfc4bb8ee43db0 100644
--- a/server/configs.go
+++ b/server/configs.go
@@ -9,14 +9,15 @@ func SetConfigValues() {
// Set Default Values For Config Variables
// Vereign API Related
- viper.SetDefault("grpcClientUrl", "localhost:7877")
- viper.SetDefault("restClientUrl", "localhost:7878")
- viper.SetDefault("dataStorageClientUrl", "localhost:7777")
+ viper.SetDefault("grpcListenAddress", "localhost:7877")
+ viper.SetDefault("restListenAddress", "localhost:7878")
+ viper.SetDefault("dataStorageUrl", "localhost:7777")
// Certificates Related
viper.SetDefault("certDir", "cert")
viper.SetDefault("certFile", "server.crt")
viper.SetDefault("certKey", "server.key")
+ viper.SetDefault("caCertFile", "ca.crt")
viper.SetDefault("vereignCertFile", "vereign_ca.cer")
viper.SetDefault("vereignCertKey", "vereign_ca.key")
diff --git a/server/server.go b/server/server.go
index 8a58bd72c851ee9f855224963509fbb48c2366f7..89fb106a28310a92bd0071f62e44f868e1d676e0 100644
--- a/server/server.go
+++ b/server/server.go
@@ -47,6 +47,8 @@ const (
)
var pkgCertFile string
+var pkgKeyFile string
+var pkgCaCertFile string
func credMatcher(headerName string) (mdName string, ok bool) {
if headerName == "Session" {
@@ -70,7 +72,7 @@ func authenticateClient(ctx context.Context, s *handler.KeyStorageServerImpl, in
}
sessionClient := &client.DataStorageClientImpl{}
- sessionClient.SetUpClient(viamAuth, viper.GetString("dataStorageClientUrl"), pkgCertFile)
+ sessionClient.SetUpClient(viamAuth, viper.GetString("dataStorageUrl"), pkgCertFile, pkgKeyFile, pkgCaCertFile)
defer sessionClient.CloseClient()
if clientAuth.Uuid == viamAuth.Uuid {
@@ -107,8 +109,10 @@ func unaryInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServ
return handler1(ctx, req)
}
-func StartGRPCServer(address, certFilePath, privateKeyFilePath, vereignCertFilePath, vereignPrivateKeyFilePath, dataStorageAddress string) error {
+func StartGRPCServer(address, certFilePath, privateKeyFilePath, caCertFilePath, vereignCertFilePath, vereignPrivateKeyFilePath, dataStorageAddress string) error {
pkgCertFile = certFilePath
+ pkgKeyFile = privateKeyFilePath
+ pkgCaCertFile = caCertFilePath
// create a listener on TCP port
lis, err := net.Listen("tcp", address)
@@ -120,6 +124,8 @@ func StartGRPCServer(address, certFilePath, privateKeyFilePath, vereignCertFileP
s := handler.KeyStorageServerImpl{
DataStorageUrl: dataStorageAddress,
CertFilePath: certFilePath,
+ KeyFilePath: privateKeyFilePath,
+ CaCertFilePath: caCertFilePath,
VereignCertFilePath: vereignCertFilePath,
VereignPrivateKeyFilePath: vereignPrivateKeyFilePath,
}