mirror of
https://github.com/corda/corda.git
synced 2024-12-27 08:22:35 +00:00
2725f53ef5
* Initial WIP. * Configure IAS host via system properties. * Create separate Gretty configurations for testing and for IAS. * (WIP) Separate configuration values from WAR; Add msg3 -> msg4 handling. * Check the IAS report's cryptographic signature. * Accept CertPath from IAS instead of a Certificate. * Validate the certificate chain for the IAS report. * Refactor response handling, and add a secret to Message4. * Append public DH keys to generated shared secret. * Use DH secret to generate a 256 bit AES key. * Fix runISV Gradle task so that it creates WAR file. * Migrate MockIAS service into a separate package. * Remove unused aesCMAC field from Message3. * Configure HTTP sessions to expire after 10 idle minutes. * Ensure we select the "isv" key for MTLS with Intel Attestation Service. * Set key alias for Intel's public certificate. * Implement GET /attest/provision endpoint. * Use elliptic curves for Diffie-Hellman keys. * Pass public keys as Little Endian byte arrays without ASN.1 encoding. * Add AES-CMAC signature to Message2. * Remove signature fields from QUOTE body for sending to IAS. * Add a dummy AES-CMAC field to Message3 for later validation. * Generate AEC-CMAC for Message 3, and refactor crypto functionality. * Calculate AES-CMAC using AES/CBC/PKCS5Padding algorithm. * Use BouncyCastle's AESCMAC algorithm for MAC calculation. * Include standard crypto test vectors to the unit tests. * Encrypt MSG3 secret using AES/GCM/NoPadding with 128 bit key. * Hash shared key with Little Endian versions of public keys. * Refactor so that hexToBytes() is a utility. * Simplify signing of MocKIAS report. * Separate AES/GCM authentication tag from the encrypted data. * Create /ias/report endpoint for ISV which proxies IAS. * Remove unnecessary @Throws from MockIAS handlers. * Log HTTP error status from IAS. * Replace runISV task with startISV and stopISV tasks. * Refactor tests to use CryptoProvider @Rule instead of @Suite. * Move Web server for integration tests to use non-production ports. * Add proxy endpoint for IAS revocation list. * Generate an ECDSA "service key" for signing (gb|ga). * Generate a persistent key-pair for the ISV to sign with. * Verify the (Gb|Ga) signature from Message2. * Add debugging aids. * Fix Gradle warning. * Remove TLV header from Platform Info Body for MSG4. * Small tidy-up. * Use SPID "as-is" when calculating CMAC for MSG2. * Add DEBUG messages for MSG2's KDK and SMK values (AES-CMAC). * Add DEBUG logging for ECDH shared secret. * More DEBUG logging. * The ECDH shared secret *is* the x-coordinate: no need to subrange. * Adjust MockIAS to return an empty revocationList for GID 0000000b. * Fix ArrayOutOfBoundsException for "small" integer values. * Test MSG1 with empty revocation list. * Add extra logging for IAS report request. * ReportResponse object cannot be null. * Fix misreading of spec - don't remove quote's signature when requesting report from IAS. * Log invalid contents of X-IAS-Report-Signing-Certificate HTTP header. * Build CertPath for IAS from explicit list of Certificates. * Rename quote fields on IAS ReportResponse to match Intel. * Log report ID and quote status from IAS. * Add a revocation list checker to the certificate path validator. * Tweak revocation list options, depending on IAS vs MockIAS. * Extract Intel's certificate specifically by alias for PKIX. * Tune quote body returned by MockIAS. * Add AES-CMAC field to Message4 for validation. * Increase GCM authentication tag to 128 bits. * Receive platformInfoBlob from IAS as hexadecimal string. * Generate secret encryption key using KDK and SK values. * Marshall platformInfoBlob between Base16 string and ByteArray. * Interpret status results from IAS as enums. * Use lateinit for HttpServletRequest field. * Refactor ExceptionHandler out of messages package. * Alias is for ISV, so rename it. * Refactor classes into more correct packages. * Use random 96 bit IV for GCM encryption. * Parameterise HTTP/HTTPS ports via Gradle. * Do not forward a securityManifest containing only zeros to IAS. * Address review comments. * Review comment: Use NativePRNGNonBlocking for SecureRandom. * Rename isv.pfx to isv-svc.pfx * Rename keystore to isv.pfx, for clarity. * Update scripts so that they no longer require user input. * Generate isv.pfx from the key and certificates. * Remove private key from repository. * Declare an empty PSE Manifest to be invalid. * Generate keystores "on the fly". * Rename integration tests to end in "IT" instead of "Test". * Add README * Turn remote-attestation into a separate Gradle project.
85 lines
2.2 KiB
Batchfile
85 lines
2.2 KiB
Batchfile
@if "%DEBUG%" == "" @echo off
|
|
@rem ##########################################################################
|
|
@rem
|
|
@rem Gradle startup script for Windows
|
|
@rem
|
|
@rem ##########################################################################
|
|
|
|
@rem Set local scope for the variables with windows NT shell
|
|
if "%OS%"=="Windows_NT" setlocal
|
|
|
|
set DIRNAME=%~dp0
|
|
if "%DIRNAME%" == "" set DIRNAME=.
|
|
set APP_BASE_NAME=%~n0
|
|
set APP_HOME=%DIRNAME%
|
|
|
|
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
|
set DEFAULT_JVM_OPTS=
|
|
|
|
@rem Find java.exe
|
|
if defined JAVA_HOME goto findJavaFromJavaHome
|
|
|
|
set JAVA_EXE=java.exe
|
|
%JAVA_EXE% -version >NUL 2>&1
|
|
if "%ERRORLEVEL%" == "0" goto init
|
|
|
|
echo.
|
|
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
|
|
echo.
|
|
echo Please set the JAVA_HOME variable in your environment to match the
|
|
echo location of your Java installation.
|
|
|
|
goto fail
|
|
|
|
:findJavaFromJavaHome
|
|
set JAVA_HOME=%JAVA_HOME:"=%
|
|
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
|
|
|
|
if exist "%JAVA_EXE%" goto init
|
|
|
|
echo.
|
|
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
|
|
echo.
|
|
echo Please set the JAVA_HOME variable in your environment to match the
|
|
echo location of your Java installation.
|
|
|
|
goto fail
|
|
|
|
:init
|
|
@rem Get command-line arguments, handling Windows variants
|
|
|
|
if not "%OS%" == "Windows_NT" goto win9xME_args
|
|
|
|
:win9xME_args
|
|
@rem Slurp the command line arguments.
|
|
set CMD_LINE_ARGS=
|
|
set _SKIP=2
|
|
|
|
:win9xME_args_slurp
|
|
if "x%~1" == "x" goto execute
|
|
|
|
set CMD_LINE_ARGS=%*
|
|
|
|
:execute
|
|
@rem Setup the command line
|
|
|
|
set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
|
|
|
|
@rem Execute Gradle
|
|
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
|
|
|
|
:end
|
|
@rem End local scope for the variables with windows NT shell
|
|
if "%ERRORLEVEL%"=="0" goto mainEnd
|
|
|
|
:fail
|
|
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
|
|
rem the _cmd.exe /c_ return code!
|
|
if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
|
|
exit /b 1
|
|
|
|
:mainEnd
|
|
if "%OS%"=="Windows_NT" endlocal
|
|
|
|
:omega
|