SPKI: Prototype TRC generation

go/lib/scrypto/asym.go

@@ -100,9 +100,13 @@ func GetPubKey(privKey []byte, algo string) ([]byte, error) {
 func Sign(sigInput, signKey common.RawBytes, signAlgo string) (common.RawBytes, error) {
 	switch strings.ToLower(signAlgo) {
 	case Ed25519:
-		if len(signKey) != ed25519.PrivateKeySize {
-			return nil, common.NewBasicError(ErrInvalidPrivKeySize, nil, "expected",
-				ed25519.PrivateKeySize, "actual", len(signKey))
+		switch len(signKey) {
+		case ed25519.PrivateKeySize:
+		case ed25519.SeedSize:
+			signKey = common.RawBytes(ed25519.NewKeyFromSeed(signKey))
+		default:
+			return nil, common.NewBasicError(ErrInvalidPrivKeySize, nil,
+				"expected", ed25519.PrivateKeySize, "actual", len(signKey))
 		}
 		return ed25519.Sign(ed25519.PrivateKey(signKey), sigInput), nil
 	default:

go/lib/scrypto/trc/v2/signed.go

@@ -78,8 +78,8 @@ func Encode(trc *TRC) (Encoded, error) {
 }
 
 // Decode returns the decoded Decode.
-func (p *Encoded) Decode() (*TRC, error) {
-	b, err := scrypto.Base64.DecodeString(string(*p))
+func (p Encoded) Decode() (*TRC, error) {
+	b, err := scrypto.Base64.DecodeString(string(p))
 	if err != nil {
 		return nil, err
 	}
@@ -110,8 +110,8 @@ func EncodeProtected(p Protected) (EncodedProtected, error) {
 }
 
 // Decode decodes and return the protected header.
-func (h *EncodedProtected) Decode() (Protected, error) {
-	b, err := scrypto.Base64.DecodeString(string(*h))
+func (h EncodedProtected) Decode() (Protected, error) {
+	b, err := scrypto.Base64.DecodeString(string(h))
 	if err != nil {
 		return Protected{}, err
 	}

go/lib/scrypto/trc/v2/update.go

@@ -86,17 +86,11 @@ func (v *UpdateValidator) Validate() (UpdateInfo, error) {
 	if err := v.sanity(); err != nil {
 		return UpdateInfo{}, common.NewBasicError(ErrSanityCheck, err)
 	}
-	keyChanges, err := v.keyChanges()
+	info, err := v.UpdateInfo()
 	if err != nil {
 		return UpdateInfo{}, err
 	}
-	attrChanges := v.attrChanges()
-	info := UpdateInfo{
-		Type:             v.updateType(keyChanges, attrChanges),
-		KeyChanges:       keyChanges,
-		AttributeChanges: attrChanges,
-	}
-	if err := v.checkProofOfPossesion(keyChanges); err != nil {
+	if err := v.checkProofOfPossesion(info.KeyChanges); err != nil {
 		return info, err
 	}
 	if err := v.checkVotes(info); err != nil {
@@ -135,6 +129,21 @@ func (v *UpdateValidator) sanity() error {
 	return nil
 }
 
+// UpdateInfo returns information about the TRC update.
+func (v *UpdateValidator) UpdateInfo() (UpdateInfo, error) {
+	keyChanges, err := v.keyChanges()
+	if err != nil {
+		return UpdateInfo{}, err
+	}
+	attrChanges := v.attrChanges()
+	info := UpdateInfo{
+		Type:             v.updateType(keyChanges, attrChanges),
+		KeyChanges:       keyChanges,
+		AttributeChanges: attrChanges,
+	}
+	return info, nil
+}
+
 func (v *UpdateValidator) keyChanges() (*KeyChanges, error) {
 	c := newKeyChanges()
 	for as, primary := range v.Next.PrimaryASes {

go/tools/scion-pki/internal/pkicmn/pkicmn.go

@@ -33,7 +33,7 @@ const (
 	TrcNameFmt      = "ISD%d-V%d.trc"
 	TRCPartsDirFmt  = "ISD%d-V%d.parts"
 	TRCSigPartFmt   = "ISD%d-V%d.sig.%s"
-	TRCProtoNameFmt = "ISD%d-V%d.proto"
+	TRCProtoNameFmt = "ISD%d-V%d.prototype"
 	TRCsDir         = "trcs"
 	CertsDir        = "certs"
 	KeysDir         = "keys"
@@ -67,6 +67,18 @@ func GetDirs() Dirs {
 	}
 }
 
+// ASMap contains all ASes matched by the selector.
+type ASMap map[addr.ISD][]addr.IA
+
+// ISDs returns all ISDs in the mapping.
+func (m ASMap) ISDs() []addr.ISD {
+	list := make([]addr.ISD, 0, len(m))
+	for isd := range m {
+		list = append(list, isd)
+	}
+	return list
+}
+
 // ParseSelector parses the given selector. The returned strings are in file format.
 func ParseSelector(selector string) (string, string, error) {
 	toks := strings.Split(selector, "-")
@@ -100,7 +112,7 @@ func ParseSelector(selector string) (string, string, error) {
 // ProcessSelector processes the given selector and returns a mapping from ISD id to ASes
 // of that ISD. In case of an ISD-only selector, i.e., a '*' or any number the lists of
 // ASes will be empty.
-func ProcessSelector(selector string) (map[addr.ISD][]addr.IA, error) {
+func ProcessSelector(selector string) (ASMap, error) {
 	isdTok, asTok, err := ParseSelector(selector)
 	if err != nil {
 		return nil, err

go/tools/scion-pki/internal/pkicmn/pkicmn_test.go

@@ -64,15 +64,15 @@ func TestProcessSelector(t *testing.T) {
 	setupTest(t)
 	tests := map[string]struct {
 		selector string
-		isdAsMap map[addr.ISD][]addr.IA
+		isdAsMap ASMap
 		err      error
 	}{
 		"Empty selector string": {
 			err: ErrInvalidSelector,
 		},
 		"ISD only selector with empty AS selector": {
 			selector: "1",
-			isdAsMap: map[addr.ISD][]addr.IA{
+			isdAsMap: ASMap{
 				addr.ISD(1): getIAFromASes(addr.ISD(1), ases),
 			},
 		},
@@ -82,7 +82,7 @@ func TestProcessSelector(t *testing.T) {
 		},
 		"Wildcard ISD selector with empty AS selector": {
 			selector: "*",
-			isdAsMap: map[addr.ISD][]addr.IA{
+			isdAsMap: ASMap{
 				addr.ISD(1): getIAFromASes(addr.ISD(1), ases),
 			},
 		},
@@ -92,13 +92,13 @@ func TestProcessSelector(t *testing.T) {
 		},
 		"Wildcard AS selector with fixed ISD selector": {
 			selector: "1-*",
-			isdAsMap: map[addr.ISD][]addr.IA{
+			isdAsMap: ASMap{
 				addr.ISD(1): getIAFromASes(addr.ISD(1), ases),
 			},
 		},
 		"Fixed ISD-AS selector": {
 			selector: "1-ff00:0:10",
-			isdAsMap: map[addr.ISD][]addr.IA{
+			isdAsMap: ASMap{
 				addr.ISD(1): getIAFromASes(addr.ISD(1), ases[:1]),
 			},
 		},

go/tools/scion-pki/internal/v2/conf/trc.go

@@ -34,6 +34,11 @@ func TRCFile(dir string, isd addr.ISD, version scrypto.Version) string {
 	return filepath.Join(pkicmn.GetIsdPath(dir, isd), fmt.Sprintf("trc-v%d.toml", version))
 }
 
+// AllTRCFiles returns a glob string that matches all TRC files for the given isd.
+func AllTRCFiles(dir string, isd addr.ISD) string {
+	return filepath.Join(pkicmn.GetIsdPath(dir, isd), "trc-v*.toml")
+}
+
 // TRC2 holds the TRC configuration.
 // TODO(roosd): rename to TRC.
 type TRC2 struct {

go/tools/scion-pki/internal/v2/keys/priv.go

@@ -36,7 +36,7 @@ type privGen struct {
 	Dirs pkicmn.Dirs
 }
 
-func (g privGen) Run(asMap map[addr.ISD][]addr.IA) error {
+func (g privGen) Run(asMap pkicmn.ASMap) error {
 	cfgs, err := g.loadConfigs(asMap)
 	if err != nil {
 		return err
@@ -54,7 +54,7 @@ func (g privGen) Run(asMap map[addr.ISD][]addr.IA) error {
 	return nil
 }
 
-func (g privGen) loadConfigs(asMap map[addr.ISD][]addr.IA) (map[addr.IA]conf.Keys, error) {
+func (g privGen) loadConfigs(asMap pkicmn.ASMap) (map[addr.IA]conf.Keys, error) {
 	cfgs := make(map[addr.IA]conf.Keys)
 	for _, ases := range asMap {
 		for _, ia := range ases {

go/tools/scion-pki/internal/v2/keys/pub.go

@@ -32,7 +32,7 @@ type pubGen struct {
 	Dirs pkicmn.Dirs
 }
 
-func (g pubGen) Run(asMap map[addr.ISD][]addr.IA) error {
+func (g pubGen) Run(asMap pkicmn.ASMap) error {
 	privKeys, err := g.loadPrivateKeys(asMap)
 	if err != nil {
 		return err
@@ -50,7 +50,7 @@ func (g pubGen) Run(asMap map[addr.ISD][]addr.IA) error {
 	return nil
 }
 
-func (g pubGen) loadPrivateKeys(asMap map[addr.ISD][]addr.IA) (map[addr.IA][]keyconf.Key, error) {
+func (g pubGen) loadPrivateKeys(asMap pkicmn.ASMap) (map[addr.IA][]keyconf.Key, error) {
 	priv := make(map[addr.IA][]keyconf.Key)
 	for _, ases := range asMap {
 		for _, ia := range ases {

go/tools/scion-pki/internal/v2/trcs/BUILD.bazel

@@ -1,15 +1,12 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "go_default_library",
     srcs = [
-        "ases.go",
         "cmd.go",
-        "combine.go",
-        "gen.go",
         "human.go",
+        "loader.go",
         "prototype.go",
-        "sign.go",
         "util.go",
     ],
     importpath = "github.com/scionproto/scion/go/tools/scion-pki/internal/v2/trcs",
@@ -21,9 +18,25 @@ go_library(
         "//go/lib/scrypto:go_default_library",
         "//go/lib/scrypto/trc/v2:go_default_library",
         "//go/lib/serrors:go_default_library",
-        "//go/lib/util:go_default_library",
         "//go/tools/scion-pki/internal/pkicmn:go_default_library",
         "//go/tools/scion-pki/internal/v2/conf:go_default_library",
+        "//go/tools/scion-pki/internal/v2/keys:go_default_library",
         "@com_github_spf13_cobra//:go_default_library",
+        "@org_golang_x_xerrors//:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["prototype_test.go"],
+    data = glob(["testdata/**"]),
+    embed = [":go_default_library"],
+    deps = [
+        "//go/lib/addr:go_default_library",
+        "//go/lib/scrypto:go_default_library",
+        "//go/lib/xtest:go_default_library",
+        "//go/tools/scion-pki/internal/pkicmn:go_default_library",
+        "@com_github_stretchr_testify//assert:go_default_library",
+        "@com_github_stretchr_testify//require:go_default_library",
     ],
 )