coordinator: align mesh root naming

This also fixes a bug where the intermediate cert is returned and saved as "mesh-root.pem".
edgelesssys · Mar 7, 2024 · 15ea885 · 15ea885
1 parent de8df37
commit 15ea885
Show file tree

Hide file tree

Showing 10 changed files with 84 additions and 82 deletions.
diff --git a/cli/cmd/common.go b/cli/cmd/common.go
@@ -7,15 +7,15 @@ import (
 )
 
 const (
-	coordHashFilename      = "coordinator-policy.sha256"
-	coordRootPEMFilename   = "coordinator-root.pem"
-	coordIntermPEMFilename = "mesh-root.pem"
-	workloadOwnerPEM       = "workload-owner.pem"
-	manifestFilename       = "manifest.json"
-	settingsFilename       = "settings.json"
-	rulesFilename          = "rules.rego"
-	verifyDir              = "./verify"
-	cacheDirEnv            = "CONTRAST_CACHE_DIR"
+	coordHashFilename    = "coordinator-policy.sha256"
+	coordRootPEMFilename = "coordinator-root.pem"
+	meshRootPEMFilename  = "mesh-root.pem"
+	workloadOwnerPEM     = "workload-owner.pem"
+	manifestFilename     = "manifest.json"
+	settingsFilename     = "settings.json"
+	rulesFilename        = "rules.rego"
+	verifyDir            = "./verify"
+	cacheDirEnv          = "CONTRAST_CACHE_DIR"
 )
 
 var (

diff --git a/cli/cmd/set.go b/cli/cmd/set.go
@@ -139,8 +139,8 @@ func runSet(cmd *cobra.Command, args []string) error {
 	fmt.Fprintln(cmd.OutOrStdout(), "✔️ Manifest set successfully")
 
 	filelist := map[string][]byte{
-		path.Join(flags.workspaceDir, coordRootPEMFilename):   resp.CACert,
-		path.Join(flags.workspaceDir, coordIntermPEMFilename): resp.IntermCert,
+		path.Join(flags.workspaceDir, coordRootPEMFilename): resp.CoordinatorRoot,
+		path.Join(flags.workspaceDir, meshRootPEMFilename):  resp.MeshRoot,
 	}
 	if err := writeFilelist(".", filelist); err != nil {
 		return fmt.Errorf("writing filelist: %w", err)

diff --git a/cli/cmd/verify.go b/cli/cmd/verify.go
@@ -88,8 +88,8 @@ func runVerify(cmd *cobra.Command, _ []string) error {
 	log.Debug("Got response")
 
 	filelist := map[string][]byte{
-		coordRootPEMFilename:   resp.CACert,
-		coordIntermPEMFilename: resp.IntermCert,
+		coordRootPEMFilename: resp.CoordinatorRoot,
+		meshRootPEMFilename:  resp.MeshRoot,
 	}
 	for i, m := range resp.Manifests {
 		filelist[fmt.Sprintf("manifest.%d.json", i)] = m

diff --git a/coordinator/meshapi.go b/coordinator/meshapi.go
@@ -74,12 +74,12 @@ func (i *meshAPIServer) NewMeshCert(_ context.Context, req *meshapi.NewMeshCertR
 			"getting certificate with public key hash %q: %v", req.PeerPublicKeyHash, err)
 	}
 
-	meshCACert := i.caChainGetter.GetMeshCACert()
+	meshCACert := i.caChainGetter.GetMeshRootCert()
 	intermCert := i.caChainGetter.GetIntermCert()
 
 	return &meshapi.NewMeshCertResponse{
 		MeshCACert: meshCACert,
 		CertChain:  append(cert, intermCert...),
-		RootCACert: i.caChainGetter.GetRootCACert(),
+		RootCACert: i.caChainGetter.GetCoordinatorRootCert(),
 	}, nil
 }
diff --git a/coordinator/userapi.go b/coordinator/userapi.go
@@ -101,8 +101,8 @@ func (s *userAPIServer) SetManifest(ctx context.Context, req *userapi.SetManifes
 	}
 
 	resp := &userapi.SetManifestResponse{
-		CACert:     s.caChainGetter.GetRootCACert(),
-		IntermCert: s.caChainGetter.GetIntermCert(),
+		CoordinatorRoot: s.caChainGetter.GetCoordinatorRootCert(),
+		MeshRoot:        s.caChainGetter.GetMeshRootCert(),
 	}
 
 	s.logger.Info("SetManifest succeeded")
@@ -131,10 +131,10 @@ func (s *userAPIServer) GetManifests(_ context.Context, _ *userapi.GetManifestsR
 	}
 
 	resp := &userapi.GetManifestsResponse{
-		Manifests:  manifestBytes,
-		Policies:   policySliceToBytesSlice(policies),
-		CACert:     s.caChainGetter.GetRootCACert(),
-		IntermCert: s.caChainGetter.GetIntermCert(),
+		Manifests:       manifestBytes,
+		Policies:        policySliceToBytesSlice(policies),
+		CoordinatorRoot: s.caChainGetter.GetCoordinatorRootCert(),
+		MeshRoot:        s.caChainGetter.GetIntermCert(),
 	}
 
 	s.logger.Info("GetManifest succeeded")
@@ -210,8 +210,8 @@ func manifestSliceToBytesSlice(s []*manifest.Manifest) ([][]byte, error) {
 }
 
 type certChainGetter interface {
-	GetRootCACert() []byte
-	GetMeshCACert() []byte
+	GetCoordinatorRootCert() []byte
+	GetMeshRootCert() []byte
 	GetIntermCert() []byte
 }
 

diff --git a/coordinator/userapi_test.go b/coordinator/userapi_test.go
@@ -227,8 +227,8 @@ func TestManifestSet(t *testing.T) {
 				return
 			}
 			require.NoError(err)
-			assert.Equal([]byte("root"), resp.CACert)
-			assert.Equal([]byte("inter"), resp.IntermCert)
+			assert.Equal([]byte("root"), resp.CoordinatorRoot)
+			assert.Equal([]byte("mesh"), resp.MeshRoot)
 			assert.Equal(1, tc.mSGetter.setManifestCount)
 		})
 	}
@@ -293,8 +293,8 @@ func TestGetManifests(t *testing.T) {
 				return
 			}
 			require.NoError(err)
-			assert.Equal([]byte("root"), resp.CACert)
-			assert.Equal([]byte("inter"), resp.IntermCert)
+			assert.Equal([]byte("root"), resp.CoordinatorRoot)
+			assert.Equal([]byte("inter"), resp.MeshRoot)
 			assert.Len(resp.Policies, len(tc.policyStoreContent))
 		})
 	}
@@ -394,9 +394,9 @@ func (s *stubManifestSetGetter) LatestManifest() (*manifest.Manifest, error) {
 
 type stubCertChainGetter struct{}
 
-func (s *stubCertChainGetter) GetRootCACert() []byte { return []byte("root") }
-func (s *stubCertChainGetter) GetMeshCACert() []byte { return []byte("mesh") }
-func (s *stubCertChainGetter) GetIntermCert() []byte { return []byte("inter") }
+func (s *stubCertChainGetter) GetCoordinatorRootCert() []byte { return []byte("root") }
+func (s *stubCertChainGetter) GetMeshRootCert() []byte        { return []byte("mesh") }
+func (s *stubCertChainGetter) GetIntermCert() []byte          { return []byte("inter") }
 
 func rpcContext(key *ecdsa.PrivateKey) context.Context {
 	var peerCertificates []*x509.Certificate

diff --git a/internal/ca/ca.go b/internal/ca/ca.go
@@ -142,8 +142,8 @@ func (c *CA) RotateIntermCerts() error {
 	return nil
 }
 
-// GetRootCACert returns the root certificate of the CA in PEM format.
-func (c *CA) GetRootCACert() []byte {
+// GetCoordinatorRootCert returns the root certificate of the CA in PEM format.
+func (c *CA) GetCoordinatorRootCert() []byte {
 	return c.rootPEM
 }
 
@@ -152,8 +152,8 @@ func (c *CA) GetIntermCert() []byte {
 	return c.intermPEM
 }
 
-// GetMeshCACert returns the mesh root certificate of the CA in PEM format.
-func (c *CA) GetMeshCACert() []byte {
+// GetMeshRootCert returns the mesh root certificate of the CA in PEM format.
+func (c *CA) GetMeshRootCert() []byte {
 	return c.meshCAPEM
 }
 

diff --git a/internal/ca/ca_test.go b/internal/ca/ca_test.go
@@ -180,11 +180,11 @@ func TestCAConcurrent(t *testing.T) {
 	}
 	getMeshCACert := func() {
 		defer wg.Done()
-		assert.NotEmpty(ca.GetMeshCACert())
+		assert.NotEmpty(ca.GetMeshRootCert())
 	}
 	getRootCACert := func() {
 		defer wg.Done()
-		assert.NotEmpty(ca.GetRootCACert())
+		assert.NotEmpty(ca.GetCoordinatorRootCert())
 	}
 	rotateIntermCerts := func() {
 		defer wg.Done()

diff --git a/internal/userapi/userapi.pb.go b/internal/userapi/userapi.pb.go
diff --git a/internal/userapi/userapi.proto b/internal/userapi/userapi.proto
@@ -16,9 +16,9 @@ message SetManifestRequest {
 
 message SetManifestResponse {
   // PEM-encoded certificate
-  bytes CACert = 1;
+  bytes CoordinatorRoot = 1;
   // PEM-encoded certificate
-  bytes IntermCert = 2;
+  bytes MeshRoot = 2;
 }
 
 message GetManifestsRequest {}
@@ -27,7 +27,7 @@ message GetManifestsResponse {
   repeated bytes Manifests = 1;
   repeated bytes Policies = 2;
   // PEM-encoded certificate
-  bytes CACert = 3;
+  bytes CoordinatorRoot = 3;
   // PEM-encoded certificate
-  bytes IntermCert = 4;
+  bytes MeshRoot = 4;
 }