Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for SSL/TLS client authentication #169

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Add support for SSL/TLS client authentication #169

wants to merge 7 commits into from

Conversation

rvdgracht
Copy link

Add support for mutual TLS authentication. This is the preferred method of authentication for bosch-iot-suite and the only one that allows you to keep the authenticator in a (f)TPM.

Optionally, an Openssl engine can be configured if required for access to the ssl private key.

@rvdgracht rvdgracht changed the title Add support for SSL/TLS client authentication authentication Add support for SSL/TLS client authentication Jan 31, 2024
@rvdgracht
Copy link
Author

When using an ssl engine with a slow secure key storage, i.e. OPTEE with pkcs11 TA on a stm32mp151 setting up a TLS connection can take some time (I've seen 5 to 50 seconds). Because rauc-hawkbit-updater creates a new connection to the server for EVERY status update and poll, this can be cumbersome. For that I've opened a different pull request with a change that keeps the connection open between request. See PR #170

@Bastian-Krause
Copy link
Member

Did you see #166? My understanding is that this PR is quite similar.

Bastian-Krause
Bastian-Krause reviewed Feb 15, 2024
View reviewed changes
Copy link
Member

@Bastian-Krause Bastian-Krause left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes look good to me, although very similar to #166.

This does not support HTTP streaming installation (stream_bundle = true), right? #166 seems to support this, although I don't really see how. I would have expected that the tls-cert, tls-key, tls-ca arguments would be set in RAUC's InstallBundle(). Would you be willing to add client cert authentication support for HTTP streaming installations?

#166 also contains tests for client cert authentication. It would like to have them included here.

If you don't use the HTTP streaming feature, cherry-picking the test without streaming support would be a way forward. #166 could then be rebased to add HTTP streaming support later.

@Bastian-Krause Bastian-Krause added the enhancement New feature or request label Feb 15, 2024
@rvdgracht
Copy link
Author

rvdgracht commented Feb 20, 2024 •
edited
Loading

Did you see #166? My understanding is that this PR is quite similar.

Yes. At the last moment when I was creating the PR.
I decided to create a separate PR anyway since #166 seemed stale, and had no support for pkcs11.

Would you be willing to add client cert authentication support for HTTP streaming installations?

We're not actually using the streaming installation feature, but I added it anyway.
I added the mtls test as well.

The mtls test is heavily based on the work of @flobz (Florain Bezannier).
Cherry picking his patch wasn't possible, since my API is slightly different and because I wanted to use key/cert supplied through the arguments of InstallBundle() instead of externally through a test fixture.
I took the liberty of chopping Florians patch up in more manageble/reviewable chunks.
I wanted to give Florian credit and added his signed-off to paches where I haven't (or barely) changed his code, I hope thats ok.

@flobz
Copy link

flobz commented Feb 20, 2024

#166 isn't stale I'm waiting for @Bastian-Krause final review :)

@Bastian-Krause
Copy link
Member

@rvdgracht Thanks for adding streaming support and testing. Do you want to have a look at the failing tests or should I?

@Bastian-Krause
Copy link
Member

The overall approach looks good to me, once the test failures and the heap-use-after-free are solved, I can fix up some minor Python formatting and maybe simplify a thing or two. Then, this should be ready.

@Bastian-Krause
Copy link
Member

Bastian-Krause commented Mar 11, 2024 •
edited
Loading

I tend to reviewing/merging this instead of #166: the implementation seems more straight forward and the commits are more comprehensible.

@flobz What do you think of this? Would this work for you, too? Is there anything missing in comparison to #166?

@rvdgracht
Copy link
Author

@Bastian-Krause I found and fixed the heap-use-after-free.

rvdgracht and others added 7 commits January 8, 2025 15:00
@rvdgracht @Bastian-Krause
config-file: reorganize SSL options
5028fd1 
This is preparation for a new authentication method mTLS being
introduced in a future commit.

Move the SSL options up, so mTLS options can be added before bailing out
due to no valid authentication option set. Also move the existence check
for auth/gateway token into a new variable, so we can check for them in
a combined fashion.

Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@rvdgracht @Bastian-Krause
hawkbit-client/config-file: add support for mTLS authentication
a873895 
Add support for mutual TLS authentication. This is the preferred method
of authentication for bosch-iot-suite.com's hawkBit instance and the only
one that allows keeping the authenticator in a (f)TPM.

Optionally, an OpenSSL engine can be configured if required for access to
the SSL private key.

Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@rvdgracht @Bastian-Krause
treewide: support mTLS authentication for HTTP streaming installations
7f840ba 
This works by passing the client key and cert on to RAUC's
"tls-key"/"tls-cert" properties.

Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@rvdgracht @Bastian-Krause
github/README: run Hawkbit with native forward-headers-strategy
e21b8d9 
A future commit will set up a nginx reverse proxy between
rauc-hawkbit-updater and hawkbit for mTLS testing.

server.forward-headers-strategy=NATIVE makes Hawkbit take the
X-Forwarded-For/X-Forwarded-Proto headers into account.

Signed-off-by: Florian Bezannier <florian.bezannier@hotmail.fr>
Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@flobz @Bastian-Krause
test: add PKI for mTLS authentication
0a03636 
Inspired by https://eclipse.dev/hawkbit/concepts/authentication/ .

The files in test/pki/ were generated by running this command in the
repository's root directory:

  $ test/gen_pki.sh test/pki

Signed-off-by: Florian Bezannier <florian.bezannier@hotmail.fr>
Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <basti@randomprojects.de>
@rvdgracht @Bastian-Krause
test: conftest: add fxtures for a HTTPS nginx proxy
5381664 
Inspired by https://eclipse.dev/hawkbit/concepts/authentication/, add
options to the nginx proxy configuration for mTLS tests and some new
infrastructure fixtures to make use of this feature in a future commit.

Signed-off-by: Florian Bezannier <florian.bezannier@hotmail.fr>
Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@rvdgracht @Bastian-Krause
test: add mTLS test for download and streaming installation
3493b80 
Based on the work of Florain Bezannier.

Client key and certificate are now provided to rauc_dbus_dummy by
rauc-hawkbit-updater through arguments of the InstallBundle method call
(for streaming installations). This also removes the need for a separate
mTLS rauc_dbus_dummy fixture.

Signed-off-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@Bastian-Krause
Copy link
Member

I have reworked the patches:

  • rebased on latest master
  • fixed a crustify error
  • added a warning for mTLS auth error
  • rephrased some sentences in the new mTLS docs section
  • simplified set_auth_curl_ssl() and install_loop_thread()
  • added test key material to the repo (instead of re-generating it on each test run)
  • dropped a lot of overly complex mTLS test infrastructure

@Bastian-Krause Bastian-Krause requested a review from ejoerns January 8, 2025 14:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Bastian-Krause Bastian-Krause Bastian-Krause approved these changes

@ejoerns ejoerns Awaiting requested review from ejoerns

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@rvdgracht @Bastian-Krause @flobz