feat: generate mTLS key if absent on start #13363

edward-swirldslabs · 2024-05-16T18:03:48Z

Description:
This PR generates the agreement keys used for mutual TLS on startup of the node if the keys cannot be loaded from disk.

NOTE:

The address book does not provide the agreement key to the network stack and having a null key for the agreement key in the address book does not hurt anything. The agreement key is retrieved through the KeysAndCerts object for network connections.
Half the files in the new directory for private .pfx files are missing their private agreement keys.

Testing

unit tests pass.
manual run: This code change was verified to work with a locally created network by returning null from an Address in testing for the agreement key.

Related issue(s):

Fixes #10667
Fixes #10012

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

github-actions · 2024-05-16T18:26:58Z

Node: HAPI Test (Restart) Results

2 tests 2 ✅ 7m 4s ⏱️
2 suites 0 💤
2 files 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

github-actions · 2024-05-16T18:28:28Z

Node: HAPI Test (Node Death Reconnect) Results

2 tests 2 ✅ 6m 14s ⏱️
2 suites 0 💤
2 files 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

github-actions · 2024-05-16T18:39:03Z

Node: HAPI Test (Token) Results

19 files 19 suites 5m 58s ⏱️
256 tests 256 ✅ 0 💤 0 ❌
259 runs 259 ✅ 0 💤 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

github-actions · 2024-05-16T18:57:30Z

Node: HAPI Test (Misc) Results

50 files 50 suites 22m 40s ⏱️
361 tests 361 ✅ 0 💤 0 ❌
378 runs 378 ✅ 0 💤 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

github-actions · 2024-05-16T19:02:21Z

Node: HAPI Test (Crypto) Results

22 files 22 suites 13m 36s ⏱️
349 tests 349 ✅ 0 💤 0 ❌
355 runs 355 ✅ 0 💤 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

github-actions · 2024-05-16T19:14:32Z

Node: HAPI Test (Time Consuming) Results

18 tests 18 ✅ 21m 46s ⏱️
3 suites 0 💤
3 files 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

github-actions · 2024-05-16T19:21:52Z

Node: Unit Test Results

2 319 files ±0 2 319 suites ±0 3h 23m 8s ⏱️ + 9m 18s
119 365 tests +5 119 298 ✅ +5 67 💤 ±0 0 ❌ ±0
127 924 runs +5 127 857 ✅ +5 67 💤 ±0 0 ❌ ±0

Results for commit abc203b. ± Comparison against base commit 53f97bc.

This pull request removes 4003 and adds 3771 tests. Note that renamed tests count towards both.


  
             IssuerDN: CN=s-aaaa
            SubjectDN: CN=s-aaaa
           Final Date: Fri Jan 01 00:00:00 UTC 2100
           Public Key: RSA Public Key [2e:28:bc:1e:d3:83:25:92:8e:cb:98:b1:b6:84:06:9c:d5:d8:14:d5],[56:66:d1:a4]
           Start Date: Sat Jan 01 00:00:00 UTC 2000
         SerialNumber: 12482092706667292405
        modulus: c1a0ff5d2372b53d12d12bb87dd03f5e…
        modulus: c1a0ff5d2372b53d12d12bb87dd03f5…
…

com.hedera.node.app.grpc.impl.netty.GrpcServiceBuilderTest ‑ [4] 

com.hedera.node.app.grpc.impl.netty.GrpcServiceBuilderTest ‑ [6] 

com.hedera.node.app.grpc.impl.netty.GrpcServiceBuilderTest ‑ [7]   
  
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [10] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@b7c4a7ca
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [11] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@89a8548d
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [12] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@cfc84f7b
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [13] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@341e4c76
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [14] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@c2ca044b
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [15] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@b6dbc46a
com.hedera.node.app.service.mono.state.codec.VirtualKeySerdesAdapterTest ‑ [16] com.hedera.node.app.service.mono.state.codec.VirtualBlobKey@e8e4db44
…

♻️ This comment has been updated with latest results.

codecov · 2024-05-16T19:24:11Z

Codecov Report

Attention: Patch coverage is 93.75000% with 3 lines in your changes are missing coverage. Please review.

Project coverage is 67.40%. Comparing base (53f97bc) to head (d5dae24).

❗ Current head d5dae24 differs from pull request most recent head abc203b

Please upload reports for the commit abc203b to get more accurate results.

Files	Patch %	Lines
...java/com/swirlds/platform/crypto/CryptoStatic.java	88.88%	1 Missing ⚠️
...wirlds/platform/crypto/EnhancedKeyStoreLoader.java	94.11%	0 Missing and 1 partial ⚠️
...java/com/swirlds/platform/crypto/PublicStores.java	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@              Coverage Diff               @@
##             develop   #13363       +/-   ##
==============================================
+ Coverage           0   67.40%   +67.40%     
- Complexity         0    36226    +36226     
==============================================
  Files              0     3701     +3701     
  Lines              0   148996   +148996     
  Branches           0    15502    +15502     
==============================================
+ Hits               0   100430   +100430     
- Misses             0    44220    +44220     
- Partials           0     4346     +4346

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-05-16T19:37:36Z

Node: HAPI Test (Smart Contract) Results

66 files 66 suites 22m 25s ⏱️
590 tests 590 ✅ 0 💤 0 ❌
614 runs 614 ✅ 0 💤 0 ❌

Results for commit abc203b.

♻️ This comment has been updated with latest results.

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/CryptoStatic.java

.../swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/EnhancedKeyStoreLoader.java

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java

...-sdk/swirlds-platform-core/src/test/java/com/swirlds/platform/crypto/CryptoArgsProvider.java

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java

cody-littley · 2024-05-20T12:40:10Z

friendly reminder to assign yourself as the PR assignee 😜

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/CryptoStatic.java

...-sdk/swirlds-platform-core/src/test/java/com/swirlds/platform/crypto/CryptoArgsProvider.java

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java

…latform/crypto/KeysAndCerts.java Co-authored-by: Cody Littley <56973212+cody-littley@users.noreply.github.com> Signed-off-by: Edward Wertz <123979964+edward-swirldslabs@users.noreply.github.com>

…y-on-boot' into 10667-generate-mTLS-agreement-key-on-boot

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

feat: generate mTLS key if absent on start

de7ce4e

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

edward-swirldslabs requested review from nathanklick, lpetrovic05, cody-littley, poulok, alittley and kfa-aguda May 16, 2024 18:03

edward-swirldslabs marked this pull request as ready for review May 16, 2024 18:10

edward-swirldslabs requested a review from a team as a code owner May 16, 2024 18:10

missing test files.

d5dae24

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

alittley reviewed May 17, 2024

View reviewed changes

lpetrovic05 reviewed May 20, 2024

View reviewed changes

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java Outdated Show resolved Hide resolved

cody-littley assigned edward-swirldslabs May 20, 2024

cody-littley reviewed May 20, 2024

View reviewed changes

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/CryptoStatic.java Show resolved Hide resolved

...-sdk/swirlds-platform-core/src/test/java/com/swirlds/platform/crypto/CryptoArgsProvider.java Outdated Show resolved Hide resolved

edward-swirldslabs added 3 commits May 22, 2024 09:35

Merge branch 'develop' into 10667-generate-mTLS-agreement-key-on-boot

c50cc74

Merge branch 'develop' into 10667-generate-mTLS-agreement-key-on-boot

05acf2f

code review changes

7da15f0

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

edward-swirldslabs requested review from lpetrovic05, alittley and cody-littley May 22, 2024 18:02

lpetrovic05 previously approved these changes May 23, 2024

View reviewed changes

cody-littley reviewed May 23, 2024

View reviewed changes

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java Show resolved Hide resolved

alittley previously approved these changes May 23, 2024

View reviewed changes

edward-swirldslabs and others added 2 commits May 23, 2024 12:52

Merge branch 'develop' into 10667-generate-mTLS-agreement-key-on-boot

920f76f

Update platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/p…

fd19dae

…latform/crypto/KeysAndCerts.java Co-authored-by: Cody Littley <56973212+cody-littley@users.noreply.github.com> Signed-off-by: Edward Wertz <123979964+edward-swirldslabs@users.noreply.github.com>

edward-swirldslabs dismissed stale reviews from alittley and lpetrovic05 via fd19dae May 23, 2024 18:04

edward-swirldslabs added 2 commits May 23, 2024 13:04

Merge remote-tracking branch 'origin/10667-generate-mTLS-agreement-ke…

ed816f6

…y-on-boot' into 10667-generate-mTLS-agreement-key-on-boot

code review changes.

abc203b

Signed-off-by: Edward Wertz <edward@swirldslabs.com>

edward-swirldslabs requested review from cody-littley, lpetrovic05 and alittley May 23, 2024 18:11

cody-littley approved these changes May 23, 2024

View reviewed changes

alittley approved these changes May 24, 2024

View reviewed changes

edward-swirldslabs merged commit 3f7390a into develop May 24, 2024
47 of 48 checks passed

edward-swirldslabs deleted the 10667-generate-mTLS-agreement-key-on-boot branch May 24, 2024 13:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: generate mTLS key if absent on start #13363

feat: generate mTLS key if absent on start #13363

edward-swirldslabs commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

codecov bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

cody-littley commented May 20, 2024

feat: generate mTLS key if absent on start #13363

feat: generate mTLS key if absent on start #13363

Conversation

edward-swirldslabs commented May 16, 2024 • edited

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Restart) Results

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Node Death Reconnect) Results

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Token) Results

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Misc) Results

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Crypto) Results

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Time Consuming) Results

github-actions bot commented May 16, 2024 • edited

Node: Unit Test Results

codecov bot commented May 16, 2024 • edited

Codecov Report

github-actions bot commented May 16, 2024 • edited

Node: HAPI Test (Smart Contract) Results

cody-littley commented May 20, 2024

edward-swirldslabs commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited

codecov bot commented May 16, 2024 •

edited

github-actions bot commented May 16, 2024 •

edited