Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: HSM auth - c8y connection init & built in bridge #3366

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

feat: HSM auth - c8y connection init & built in bridge #3366

wants to merge 4 commits into from

Conversation

Bravo555
Copy link
Contributor

Proposed changes

Types of changes

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
  • Documentation Update (if none of the other choices apply)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue


Checklist

  • I have read the CONTRIBUTING doc
  • I have signed the CLA (in all commits with git commit -s)
  • I ran cargo fmt as mentioned in CODING_GUIDELINES
  • I used cargo clippy as mentioned in CODING_GUIDELINES
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

Further comments

@codecov Codecov
Copy link

codecov bot commented Jan 28, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 56.03933% with 626 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
...ate/src/rustls022/parse_root_certificate/pkcs11.rs 0.00% 298 Missing ⚠️
...ertificate/src/rustls022/parse_root_certificate.rs 52.30% 107 Missing and 17 partials ⚠️
...ertificate/src/rustls022/cloud_root_certificate.rs 0.00% 70 Missing ⚠️
crates/common/certificate/src/rustls022/mod.rs 86.14% 33 Missing and 17 partials ⚠️
crates/common/certificate/src/rustls021/mod.rs 91.13% 12 Missing and 20 partials ⚠️
crates/core/tedge/src/cli/connect/command.rs 0.00% 13 Missing ⚠️
crates/extensions/tedge_mqtt_bridge/src/lib.rs 0.00% 9 Missing ⚠️
...ore/tedge/src/cli/connect/c8y_direct_connection.rs 0.00% 7 Missing ⚠️
crates/extensions/tedge_mqtt_bridge/src/config.rs 0.00% 5 Missing ⚠️
crates/common/certificate/src/lib.rs 0.00% 4 Missing ⚠️
... and 9 more
Additional details and impacted files

📢 Thoughts on this report? Let us know!

@Bravo555 Bravo555 mentioned this pull request Jan 28, 2025
Open
11 tasks
@Bravo555 Bravo555 changed the title feat: HSM auth - c8y direct connection feat: HSM auth - c8y connection init & built in bridge Jan 29, 2025
@Bravo555
deps: upgrade to rumqttc-0.24, rustls-0.22
37dfc44 
As a preparation for the HSM support, we upgrade to the latest version
of rustls that supports FIPS mode using aws-lc-rs that is compatible
with rumqttc, i.e. rustls-0.22 from 0.21.

Because of breaking changes in rustls (Certificate and PrivateKey types
were replaced with CertificateDer and PrivateKeyDer types) relatively
big changes in certificate crate were required: the crate was split to
expose rustls-0.21 and rustls-0.22 variants of its public items. The
reason for this was that there were some crates (axum-server) that
bumped rustls 0.21->0.23(not yet supported by rumqttc) and had no
rustls-0.22 support, so they had to keep using rustls-0.21 compatible
structs, while our callsites to rumqttc were updated to use rustls-0.22
compatible structs.

This split was made to get on with rustls-0.22 as fast as possible and
an effort should be made in the future to reduce it as much as possible
by refactoring dependencies, erasing relevant types, and so on.

Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
Direct connection to c8y authorizing using HSM
99ce8de 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
using HSM in tedge-mapper-c8y
f0f2ceb 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
patch libloading to remove libdl link on musl
130ad99 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555 Bravo555 temporarily deployed to Test Pull Request January 30, 2025 13:45 — with GitHub Actions Inactive
@github-actions GitHub Actions
Copy link
Contributor

Robot Results

✅ Passed ❌ Failed ⏭️ Skipped Total Pass % ⏱️ Duration
560 0 3 560 100 1h31m56.432405999s

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@didier-wenzek didier-wenzek Awaiting requested review from didier-wenzek didier-wenzek will be requested when the pull request is marked ready for review didier-wenzek is a code owner

@albinsuresh albinsuresh Awaiting requested review from albinsuresh albinsuresh will be requested when the pull request is marked ready for review albinsuresh is a code owner

@jarhodes314 jarhodes314 Awaiting requested review from jarhodes314 jarhodes314 will be requested when the pull request is marked ready for review jarhodes314 is a code owner

@rina23q rina23q Awaiting requested review from rina23q rina23q will be requested when the pull request is marked ready for review rina23q is a code owner

@reubenmiller reubenmiller Awaiting requested review from reubenmiller reubenmiller will be requested when the pull request is marked ready for review reubenmiller is a code owner

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@Bravo555