some update
Change-Id: I91acb87febd9c74521a5afc20024229bd92438df
diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index f04d3df..e378314 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -252,12 +252,6 @@
"Cannot derive a shared secret using the provided ECDH key."));
return;
}
- // generate salt for HKDF
- std::array<uint8_t, 32> salt;
- random::generateSecureBytes(salt.data(), salt.size());
- // hkdf
- std::array<uint8_t, 16> aesKey;
- hkdf(sharedSecret.data(), sharedSecret.size(), salt.data(), salt.size(), aesKey.data(), aesKey.size());
// verify identity name
if (!m_config.caProfile.caPrefix.isPrefixOf(clientCert->getIdentity())
@@ -334,6 +328,13 @@
requestState.requestId = id;
requestState.requestType = requestType;
requestState.cert = *clientCert;
+ // generate salt for HKDF
+ std::array<uint8_t, 32> salt;
+ random::generateSecureBytes(salt.data(), salt.size());
+ // hkdf
+ std::array<uint8_t, 16> aesKey;
+ hkdf(sharedSecret.data(), sharedSecret.size(), salt.data(), salt.size(),
+ aesKey.data(), aesKey.size(), id.data(), id.size());
requestState.encryptionKey = aesKey;
try {
m_storage->addRequest(requestState);
diff --git a/src/detail/challenge-encoder.cpp b/src/detail/challenge-encoder.cpp
index 083fa61..3870c95 100644
--- a/src/detail/challenge-encoder.cpp
+++ b/src/detail/challenge-encoder.cpp
@@ -53,25 +53,25 @@
void
challengetlv::decodeDataContent(const Block& contentBlock, requester::Request& state)
{
- auto result = decodeBlockWithAesGcm128(contentBlock, state.aesKey.data(),
- state.requestId.data(), state.requestId.size(),
- state.decryptionIv);
+ auto result = decodeBlockWithAesGcm128(contentBlock, state.m_aesKey.data(),
+ state.m_requestId.data(), state.m_requestId.size(),
+ state.m_decryptionIv);
auto data = makeBinaryBlock(tlv::EncryptedPayload, result.data(), result.size());
data.parse();
- state.status = statusFromBlock(data.get(tlv::Status));
+ state.m_status = statusFromBlock(data.get(tlv::Status));
if (data.find(tlv::ChallengeStatus) != data.elements_end()) {
- state.challengeStatus = readString(data.get(tlv::ChallengeStatus));
+ state.m_challengeStatus = readString(data.get(tlv::ChallengeStatus));
}
if (data.find(tlv::RemainingTries) != data.elements_end()) {
- state.remainingTries = readNonNegativeInteger(data.get(tlv::RemainingTries));
+ state.m_remainingTries = readNonNegativeInteger(data.get(tlv::RemainingTries));
}
if (data.find(tlv::RemainingTime) != data.elements_end()) {
- state.freshBefore = time::system_clock::now() +
- time::seconds(readNonNegativeInteger(data.get(tlv::RemainingTime)));
+ state.m_freshBefore = time::system_clock::now() +
+ time::seconds(readNonNegativeInteger(data.get(tlv::RemainingTime)));
}
if (data.find(tlv::IssuedCertName) != data.elements_end()) {
Block issuedCertNameBlock = data.get(tlv::IssuedCertName);
- state.issuedCertName = Name(issuedCertNameBlock.blockFromValue());
+ state.m_issuedCertName = Name(issuedCertNameBlock.blockFromValue());
}
if (data.find(tlv::ParameterKey) != data.elements_end() &&
readString(data.get(tlv::ParameterKey)) == "nonce") {
@@ -82,7 +82,7 @@
if (nonceBlock.value_size() != 16) {
NDN_THROW(std::runtime_error("Wrong nonce length"));
}
- memcpy(state.nonce.data(), nonceBlock.value(), 16);
+ memcpy(state.m_nonce.data(), nonceBlock.value(), 16);
}
}
diff --git a/src/requester-request.cpp b/src/requester-request.cpp
index 72f7162..5929794 100644
--- a/src/requester-request.cpp
+++ b/src/requester-request.cpp
@@ -121,8 +121,8 @@
}
Request::Request(security::KeyChain& keyChain, const CaProfile& profile, RequestType requestType)
- : caProfile(profile)
- , type(requestType)
+ : m_caProfile(profile)
+ , m_type(requestType)
, m_keyChain(keyChain)
{}
@@ -131,26 +131,26 @@
const time::system_clock::TimePoint& notBefore,
const time::system_clock::TimePoint& notAfter)
{
- if (!caProfile.caPrefix.isPrefixOf(newIdentityName)) {
+ if (!m_caProfile.caPrefix.isPrefixOf(newIdentityName)) {
return nullptr;
}
if (newIdentityName.empty()) {
NDN_LOG_TRACE("Randomly create a new name because newIdentityName is empty and the param is empty.");
- identityName = caProfile.caPrefix;
- identityName.append(std::to_string(random::generateSecureWord64()));
+ m_identityName = m_caProfile.caPrefix;
+ m_identityName.append(std::to_string(random::generateSecureWord64()));
}
else {
- identityName = newIdentityName;
+ m_identityName = newIdentityName;
}
// generate a newly key pair or use an existing key
const auto& pib = m_keyChain.getPib();
security::pib::Identity identity;
try {
- identity = pib.getIdentity(identityName);
+ identity = pib.getIdentity(m_identityName);
}
catch (const security::Pib::Error& e) {
- identity = m_keyChain.createIdentity(identityName);
+ identity = m_keyChain.createIdentity(m_identityName);
m_isNewlyCreatedIdentity = true;
m_isNewlyCreatedKey = true;
}
@@ -173,13 +173,13 @@
m_keyChain.sign(certRequest, signingByKey(keyName).setSignatureInfo(signatureInfo));
// generate Interest packet
- Name interestName = caProfile.caPrefix;
+ Name interestName = m_caProfile.caPrefix;
interestName.append("CA").append("NEW");
auto interest =std::make_shared<Interest>(interestName);
interest->setMustBeFresh(true);
interest->setCanBePrefix(false);
interest->setApplicationParameters(
- requesttlv::encodeApplicationParameters(RequestType::NEW, ecdh.getSelfPubKey(), certRequest));
+ requesttlv::encodeApplicationParameters(RequestType::NEW, m_ecdh.getSelfPubKey(), certRequest));
// sign the Interest packet
m_keyChain.sign(*interest, signingByKey(keyName));
@@ -189,24 +189,24 @@
shared_ptr<Interest>
Request::genRevokeInterest(const security::Certificate& certificate)
{
- if (!caProfile.caPrefix.isPrefixOf(certificate.getName())) {
+ if (!m_caProfile.caPrefix.isPrefixOf(certificate.getName())) {
return nullptr;
}
// generate Interest packet
- Name interestName = caProfile.caPrefix;
+ Name interestName = m_caProfile.caPrefix;
interestName.append("CA").append("REVOKE");
auto interest =std::make_shared<Interest>(interestName);
interest->setMustBeFresh(true);
interest->setCanBePrefix(false);
interest->setApplicationParameters(
- requesttlv::encodeApplicationParameters(RequestType::REVOKE, ecdh.getSelfPubKey(), certificate));
+ requesttlv::encodeApplicationParameters(RequestType::REVOKE, m_ecdh.getSelfPubKey(), certificate));
return interest;
}
std::list<std::string>
Request::onNewRenewRevokeResponse(const Data& reply)
{
- if (!security::verifySignature(reply, *caProfile.cert)) {
+ if (!security::verifySignature(reply, *m_caProfile.cert)) {
NDN_LOG_ERROR("Cannot verify replied Data packet signature.");
NDN_THROW(std::runtime_error("Cannot verify replied Data packet signature."));
}
@@ -215,12 +215,13 @@
const auto& contentTLV = reply.getContent();
std::vector<uint8_t> ecdhKey;
std::array<uint8_t, 32> salt;
- auto challenges = requesttlv::decodeDataContent(contentTLV, ecdhKey, salt, requestId);
+ auto challenges = requesttlv::decodeDataContent(contentTLV, ecdhKey, salt, m_requestId);
// ECDH and HKDF
- auto sharedSecret = ecdh.deriveSecret(ecdhKey);
+ auto sharedSecret = m_ecdh.deriveSecret(ecdhKey);
hkdf(sharedSecret.data(), sharedSecret.size(),
- salt.data(), salt.size(), aesKey.data(), aesKey.size());
+ salt.data(), salt.size(), m_aesKey.data(), m_aesKey.size(),
+ m_requestId.data(), m_requestId.size());
// update state
return challenges;
@@ -233,33 +234,33 @@
if (challenge == nullptr) {
NDN_THROW(std::runtime_error("The challenge selected is not supported by your current version of NDNCERT."));
}
- challengeType = challengeSelected;
- return challenge->getRequestedParameterList(status, challengeStatus);
+ m_challengeType = challengeSelected;
+ return challenge->getRequestedParameterList(m_status, m_challengeStatus);
}
shared_ptr<Interest>
Request::genChallengeInterest(std::multimap<std::string, std::string>&& parameters)
{
- if (challengeType == "") {
+ if (m_challengeType == "") {
NDN_THROW(std::runtime_error("The challenge has not been selected."));
}
- auto challenge = ChallengeModule::createChallengeModule(challengeType);
+ auto challenge = ChallengeModule::createChallengeModule(m_challengeType);
if (challenge == nullptr) {
NDN_THROW(std::runtime_error("The challenge selected is not supported by your current version of NDNCERT."));
}
- auto challengeParams = challenge->genChallengeRequestTLV(status, challengeStatus, std::move(parameters));
+ auto challengeParams = challenge->genChallengeRequestTLV(m_status, m_challengeStatus, std::move(parameters));
- Name interestName = caProfile.caPrefix;
- interestName.append("CA").append("CHALLENGE").append(requestId.data(), requestId.size());
+ Name interestName = m_caProfile.caPrefix;
+ interestName.append("CA").append("CHALLENGE").append(m_requestId.data(), m_requestId.size());
auto interest =std::make_shared<Interest>(interestName);
interest->setMustBeFresh(true);
interest->setCanBePrefix(false);
// encrypt the Interest parameters
- auto paramBlock = encodeBlockWithAesGcm128(ndn::tlv::ApplicationParameters, aesKey.data(),
+ auto paramBlock = encodeBlockWithAesGcm128(ndn::tlv::ApplicationParameters, m_aesKey.data(),
challengeParams.value(), challengeParams.value_size(),
- requestId.data(), requestId.size(),
- encryptionIv);
+ m_requestId.data(), m_requestId.size(),
+ m_encryptionIv);
interest->setApplicationParameters(paramBlock);
m_keyChain.sign(*interest, signingByKey(m_keyPair.getName()));
return interest;
@@ -268,7 +269,7 @@
void
Request::onChallengeResponse(const Data& reply)
{
- if (!security::verifySignature(reply, *caProfile.cert)) {
+ if (!security::verifySignature(reply, *m_caProfile.cert)) {
NDN_LOG_ERROR("Cannot verify replied Data packet signature.");
NDN_THROW(std::runtime_error("Cannot verify replied Data packet signature."));
}
@@ -279,7 +280,7 @@
shared_ptr<Interest>
Request::genCertFetchInterest() const
{
- Name interestName = issuedCertName;
+ Name interestName = m_issuedCertName;
auto interest =std::make_shared<Interest>(interestName);
interest->setMustBeFresh(false);
interest->setCanBePrefix(false);
@@ -302,17 +303,17 @@
void
Request::endSession()
{
- if (status == Status::SUCCESS) {
+ if (m_status == Status::SUCCESS) {
return;
}
if (m_isNewlyCreatedIdentity) {
// put the identity into the if scope is because it may cause an error
// outside since when endSession is called, identity may not have been created yet.
- auto identity = m_keyChain.getPib().getIdentity(identityName);
+ auto identity = m_keyChain.getPib().getIdentity(m_identityName);
m_keyChain.deleteIdentity(identity);
}
else if (m_isNewlyCreatedKey) {
- auto identity = m_keyChain.getPib().getIdentity(identityName);
+ auto identity = m_keyChain.getPib().getIdentity(m_identityName);
m_keyChain.deleteKey(identity, m_keyPair);
}
}
diff --git a/src/requester-request.hpp b/src/requester-request.hpp
index f27c873..a1817ea 100644
--- a/src/requester-request.hpp
+++ b/src/requester-request.hpp
@@ -211,63 +211,63 @@
/**
* @brief The CA profile for this request.
*/
- CaProfile caProfile;
+ CaProfile m_caProfile;
/**
* @brief The type of request. Either NEW, RENEW, or REVOKE.
*/
- RequestType type;
+ RequestType m_type;
/**
* @brief The identity name for the requesting certificate.
*/
- Name identityName;
+ Name m_identityName;
/**
* @brief The CA-generated request ID for the request.
*/
- RequestId requestId;
+ RequestId m_requestId;
/**
* @brief The current status of the request.
*/
- Status status = Status::BEFORE_CHALLENGE;
+ Status m_status = Status::BEFORE_CHALLENGE;
/**
* @brief The type of challenge chosen.
*/
- std::string challengeType;
+ std::string m_challengeType;
/**
* @brief The status of the current challenge.
*/
- std::string challengeStatus;
+ std::string m_challengeStatus;
/**
* @brief The remaining number of tries left for the challenge
*/
- int remainingTries = 0;
+ int m_remainingTries = 0;
/**
* @brief The time this challenge will remain fresh
*/
- time::system_clock::TimePoint freshBefore;
+ time::system_clock::TimePoint m_freshBefore;
/**
* @brief the name of the certificate being issued.
*/
- Name issuedCertName;
+ Name m_issuedCertName;
/**
* @brief ecdh state.
*/
- ECDHState ecdh;
+ ECDHState m_ecdh;
/**
* @brief AES key derived from the ecdh shared secret.
*/
- std::array<uint8_t, 16> aesKey = {};
+ std::array<uint8_t, 16> m_aesKey = {};
/**
* @brief The last Initialization Vector used by the AES encryption.
*/
- std::vector<uint8_t> encryptionIv;
+ std::vector<uint8_t> m_encryptionIv;
/**
* @brief The last Initialization Vector used by the other side's AES encryption.
*/
- std::vector<uint8_t> decryptionIv;
+ std::vector<uint8_t> m_decryptionIv;
/**
* @brief Store Nonce for signature
*/
- std::array<uint8_t, 16> nonce = {};
+ std::array<uint8_t, 16> m_nonce = {};
private:
/**
diff --git a/tests/unit-tests/bench.t.cpp b/tests/unit-tests/bench.t.cpp
index 6f7b61c..7e321e3 100644
--- a/tests/unit-tests/bench.t.cpp
+++ b/tests/unit-tests/bench.t.cpp
@@ -130,8 +130,8 @@
BOOST_CHECK(security::verifySignature(response, cert));
state.onChallengeResponse(response);
- BOOST_CHECK(state.status == Status::CHALLENGE);
- BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::NEED_CODE);
+ BOOST_CHECK(state.m_status == Status::CHALLENGE);
+ BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::NEED_CODE);
auto paramList = state.selectOrContinueChallenge("pin");
challengeInterest2 = state.genChallengeInterest(std::move(paramList));
}
@@ -140,8 +140,8 @@
BOOST_CHECK(security::verifySignature(response, cert));
state.onChallengeResponse(response);
- BOOST_CHECK(state.status == Status::CHALLENGE);
- BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::WRONG_CODE);
+ BOOST_CHECK(state.m_status == Status::CHALLENGE);
+ BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::WRONG_CODE);
auto paramList = state.selectOrContinueChallenge("pin");
auto request = ca.getCertificateRequest(*challengeInterest2);
@@ -155,7 +155,7 @@
count++;
BOOST_CHECK(security::verifySignature(response, cert));
state.onChallengeResponse(response);
- BOOST_CHECK(state.status == Status::SUCCESS);
+ BOOST_CHECK(state.m_status == Status::SUCCESS);
}
});
diff --git a/tests/unit-tests/ca-module.t.cpp b/tests/unit-tests/ca-module.t.cpp
index 3c4dbb4..385f7ef 100644
--- a/tests/unit-tests/ca-module.t.cpp
+++ b/tests/unit-tests/ca-module.t.cpp
@@ -262,7 +262,7 @@
RequestId requestId;
std::memcpy(requestId.data(), contentBlock.get(tlv::RequestId).value(), contentBlock.get(tlv::RequestId).value_size());
auto ca_encryption_key = ca.getCaStorage()->getRequest(requestId).encryptionKey;
- BOOST_CHECK_EQUAL_COLLECTIONS(state.aesKey.begin(), state.aesKey.end(),
+ BOOST_CHECK_EQUAL_COLLECTIONS(state.m_aesKey.begin(), state.m_aesKey.end(),
ca_encryption_key.begin(), ca_encryption_key.end());
});
face.receive(*interest);
@@ -450,8 +450,8 @@
BOOST_CHECK(security::verifySignature(response, cert));
state.onChallengeResponse(response);
- BOOST_CHECK(state.status == Status::CHALLENGE);
- BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::NEED_CODE);
+ BOOST_CHECK(state.m_status == Status::CHALLENGE);
+ BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::NEED_CODE);
auto paramList = state.selectOrContinueChallenge("pin");
challengeInterest2 = state.genChallengeInterest(std::move(paramList));
}
@@ -460,8 +460,8 @@
BOOST_CHECK(security::verifySignature(response, cert));
state.onChallengeResponse(response);
- BOOST_CHECK(state.status == Status::CHALLENGE);
- BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::WRONG_CODE);
+ BOOST_CHECK(state.m_status == Status::CHALLENGE);
+ BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::WRONG_CODE);
auto paramList = state.selectOrContinueChallenge("pin");
auto request = ca.getCertificateRequest(*challengeInterest2);
@@ -473,7 +473,7 @@
count++;
BOOST_CHECK(security::verifySignature(response, cert));
state.onChallengeResponse(response);
- BOOST_CHECK(state.status == Status::SUCCESS);
+ BOOST_CHECK(state.m_status == Status::SUCCESS);
}
});
@@ -550,7 +550,7 @@
RequestId requestId;
std::memcpy(requestId.data(), contentBlock.get(tlv::RequestId).value(), contentBlock.get(tlv::RequestId).value_size());
auto ca_encryption_key = ca.getCaStorage()->getRequest(requestId).encryptionKey;
- BOOST_CHECK_EQUAL_COLLECTIONS(state.aesKey.begin(), state.aesKey.end(),
+ BOOST_CHECK_EQUAL_COLLECTIONS(state.m_aesKey.begin(), state.m_aesKey.end(),
ca_encryption_key.begin(), ca_encryption_key.end());
});
face.receive(*interest);
diff --git a/tests/unit-tests/protocol-encoders.t.cpp b/tests/unit-tests/protocol-encoders.t.cpp
index 23ee95a..61128e3 100644
--- a/tests/unit-tests/protocol-encoders.t.cpp
+++ b/tests/unit-tests/protocol-encoders.t.cpp
@@ -158,16 +158,16 @@
auto contentBlock = challengetlv::encodeDataContent(state, Name("/ndn/ucla/a/b/c"));
requester::Request context(m_keyChain, caCache.getKnownProfiles().front(), RequestType::NEW);
- context.requestId = id;
- std::memcpy(context.aesKey.data(), key, sizeof(key));
+ context.m_requestId = id;
+ std::memcpy(context.m_aesKey.data(), key, sizeof(key));
advanceClocks(time::seconds(10));
challengetlv::decodeDataContent(contentBlock, context);
- BOOST_CHECK_EQUAL(static_cast<size_t>(context.status), static_cast<size_t>(Status::PENDING));
- BOOST_CHECK_EQUAL(context.challengeStatus, "test");
- BOOST_CHECK_EQUAL(context.remainingTries, 3);
- BOOST_CHECK_EQUAL(context.freshBefore, tp + time::seconds(3600) + time::seconds(10));
- BOOST_CHECK_EQUAL(context.issuedCertName, "/ndn/ucla/a/b/c");
+ BOOST_CHECK_EQUAL(static_cast<size_t>(context.m_status), static_cast<size_t>(Status::PENDING));
+ BOOST_CHECK_EQUAL(context.m_challengeStatus, "test");
+ BOOST_CHECK_EQUAL(context.m_remainingTries, 3);
+ BOOST_CHECK_EQUAL(context.m_freshBefore, tp + time::seconds(3600) + time::seconds(10));
+ BOOST_CHECK_EQUAL(context.m_issuedCertName, "/ndn/ucla/a/b/c");
}
BOOST_AUTO_TEST_SUITE_END()
diff --git a/tools/ndncert-client.cpp b/tools/ndncert-client.cpp
index 816ec34..08c88f4 100644
--- a/tools/ndncert-client.cpp
+++ b/tools/ndncert-client.cpp
@@ -133,13 +133,13 @@
std::cerr << "Error when decoding challenge step: " << e.what() << std::endl;
exit(1);
}
- if (requesterState->status == Status::SUCCESS) {
+ if (requesterState->m_status == Status::SUCCESS) {
std::cerr << "Certificate has already been issued, downloading certificate..." << std::endl;
face.expressInterest(*requesterState->genCertFetchInterest(), bind(&certFetchCb, _2),
bind(&onNackCb), bind(&timeoutCb));
return;
}
- runChallenge(requesterState->challengeType);
+ runChallenge(requesterState->m_challengeType);
}
static void