20 Commits

Author SHA1 Message Date
Syed Paymaan Raza
c3e7542cda Update end year in copyright header 2024-08-02 09:40:11 -07:00
Xiaoge Su
91ec1fdf10 Provide actor call backtrace
See design/AcAC.md
2023-09-19 20:58:33 -07:00
Xiaoge Su
88eeb5a526 Remove WolfSSL support in FoundationDB 2023-03-23 20:17:18 -07:00
Junhyun Shim
887690ebe1 Let MkCert client/server certs share a root CA certificate by default
Currently FDB TLS is allowing exactly one root CA to be added,
which makes servers unable to talk to each other if there are more than one.
Work around this problem by letting client and server share CA
2022-12-06 14:05:10 +01:00
Junhyun Shim
c2f577dac8 Add key type and DS algorithm dimension to TokenSign benchmark
Also
- Measure performance with RSA keys
- Make RSA key 2048 > 4096 bits
2022-08-26 22:58:36 +02:00
Junhyun Shim
db449b80f7
Authz JWKS (#7519)
* Add JsonWebKeySet parser/stringifier

* Update header directory

* Make JWKS parser correctness clean for OpenSSL 1.x

Add RSA keygen support

* Make JWKS parser correctness clean for OpenSSL 3.x

+extend unique_ptr for scoped destruction of OpenSSL objects

* Use PKey::{sign|verify}() in TokenSign

* Apply AutoCPointer to MkCert

* Apply Clang format

* JWKS::toStringRef() returns StringRef > Optional<StringRef>

* Fix Mac/Windows build error

* Fix incorrect fix of Mac build

* Fix filename in license comment for AutoCPointer.h

* Refactor complex C macros into function templates
2022-07-05 10:13:09 +02:00
Junhyun Shim
3e79735b2f
Authz JWT support (#7279)
* Add JWT support to TokenSign

* Encapsulate OpenSSL public/private key type

Type-safe passing around of keys without having to DER/PEM-serialize
(OpenSSL doesn't have distinct types for public and private key)

* Apply Clang format

* Add verify benchmark for JWT and FlatBuffers token

* Unit test base64url::{encode, decode}

* Make all payload fields optional

Let user code validate non-signature fields

* Make all payload fields optional

Completely defer field check to user code

* Move rapidjson from fdbclient to contrib

* Make fdbrpc's rapidjson linkage private

Currently only sources include them.

* Modify rapidjson path in apiversioner.py

* Algorithm::Unknown > Algorithm::UNKNOWN
2022-06-02 13:22:50 +02:00
Junhyun Shim
5308a2727f Fix failing Mac build from boringssl
X509V3_EXT_conf_nid is part of 'libdecrepit' in BoringSSL.
Use X509V3_EXT_nconf_nid instead.
2022-05-16 11:58:42 +02:00
Junhyun Shim
cd4a7038fc Move CertKind::getCommonName() to source file 2022-05-12 23:14:52 +02:00
Junhyun Shim
809bc52bbc Add boringssl workaround for Mac builds 2022-05-12 23:12:51 +02:00
Junhyun Shim
88d1692de7 Fix BoringSSL-specific issues with Mac Build 2022-05-11 18:38:02 +02:00
Junhyun Shim
2e8654e048 Fix syntax error 2022-05-11 16:30:20 +02:00
Junhyun Shim
9155fbd1b8 Fix formatting and remove redundant trace field 2022-05-11 16:12:45 +02:00
Junhyun Shim
8c180e3e46 Add option to print cert chain or arguments
Also do code cleanup
2022-05-11 15:56:17 +02:00
Junhyun Shim
8789232df4 Add ScopeExit to flow and remove scattered impls 2022-05-11 11:51:11 +02:00
Junhyun Shim
ee9a047cbd Trace OpenSSL error as const char*
Remove extent from char buffer for fetching OpenSSL errors.
TraceEvent::detail() interprets passed char[] as string literal
and prints trailing \0s.
2022-05-10 19:54:12 +02:00
Junhyun Shim
0339802014 Remove debug messages 2022-05-09 14:38:57 +02:00
Junhyun Shim
637044fd54 Add testcase for when client chain is invalid
Optionally allow the leaf certificates to have already expired
2022-05-09 14:01:39 +02:00
Junhyun Shim
e5f039acf8 Apply clang format 2022-05-06 19:10:42 +02:00
Junhyun Shim
767a37f7d2 Helper functions to generate certs and keys for TLS testing 2022-05-06 12:56:35 +02:00