attest.c File Reference

#include <assert.h>
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/pem.h>
#include <openssl/x509.h>
#include <yubihsm.h>
#include "openssl-compat.h"

Include dependency graph for attest.c:

Go to the source code of this file.

Macros
#define	DEFAULT_CONNECTOR_URL   "http://127.0.0.1:12345"

Functions
int	main (void)

Variables
const char	attestation_template_file [] = "attestation_template.pem"
const char *	key_label = "label"
const uint8_t	password [] = "password"

Macro Definition Documentation

DEFAULT_CONNECTOR_URL

#define DEFAULT_CONNECTOR_URL   "http://127.0.0.1:12345"

Definition at line 34 of file attest.c.

Function Documentation

main()

int main

(

void

)

Definition at line 107 of file attest.c.

               {
  yh_connector *connector = NULL;
  yh_session *session = NULL;
  yh_rc yrc = YHR_GENERIC_ERROR;
 
  uint16_t authkey = 1;
 
  const char *connector_url;
 
  connector_url = getenv("DEFAULT_CONNECTOR_URL");
  if (connector_url == NULL) {
    connector_url = DEFAULT_CONNECTOR_URL;
  }
 
  yrc = yh_init();
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_init_connector(connector_url, &connector);
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_connect(connector, 0);
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_create_session_derived(connector, authkey, password,
                                  sizeof(password), false, &session);
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_authenticate_session(session);
  assert(yrc == YHR_SUCCESS);
 
  uint8_t session_id;
  yrc = yh_get_session_id(session, &session_id);
  assert(yrc == YHR_SUCCESS);
 
  printf("Successfully established session %02d\n", session_id);
 
  yh_capabilities capabilities = {{0}};
  yrc =
    yh_string_to_capabilities("sign-attestation-certificate", &capabilities);
  assert(yrc == YHR_SUCCESS);
 
  uint16_t domain_five = 0;
  yrc = yh_string_to_domains("5", &domain_five);
  assert(yrc == YHR_SUCCESS);
 
  uint16_t attesting_key_id = 0; // ID 0 lets the device generate an ID
 
  yrc = yh_util_generate_ec_key(session, &attesting_key_id, key_label,
                                domain_five, &capabilities, YH_ALGO_EC_P256);
  assert(yrc == YHR_SUCCESS);
 
  printf("Generated attesting key with ID %04x\n", attesting_key_id);
 
  FILE *fp = fopen(attestation_template_file, "rb");
  assert(fp != NULL);
 
  X509 *attestation_template = PEM_read_X509(fp, NULL, NULL, NULL);
  assert(attestation_template != NULL);
  fclose(fp);
 
  uint8_t attestation_template_buffer[3072];
  uint16_t attestation_template_buffer_len =
    i2d_X509(attestation_template, NULL);
  assert(sizeof(attestation_template_buffer) >=
         attestation_template_buffer_len);
 
  unsigned char *certptr = attestation_template_buffer;
 
  i2d_X509(attestation_template, &certptr);
  X509_free(attestation_template);
 
  memset(capabilities.capabilities, 0, YH_CAPABILITIES_LEN);
  yrc =
    yh_util_import_opaque(session, &attesting_key_id, key_label, domain_five,
                          &capabilities, YH_ALGO_OPAQUE_X509_CERTIFICATE,
                          attestation_template_buffer,
                          attestation_template_buffer_len);
  assert(yrc == YHR_SUCCESS);
 
  uint8_t tmpbuf[3072];
  size_t tmpbuf_len = sizeof(tmpbuf);
  yrc = yh_util_get_opaque(session, attesting_key_id, tmpbuf, &tmpbuf_len);
  assert(yrc == YHR_SUCCESS);
  assert(tmpbuf_len == attestation_template_buffer_len);
  assert(memcmp(attestation_template_buffer, tmpbuf, tmpbuf_len) == 0);
 
  memset(capabilities.capabilities, 0, YH_CAPABILITIES_LEN);
  yrc = yh_string_to_capabilities("sign-ecdsa", &capabilities);
  assert(yrc == YHR_SUCCESS);
 
  uint16_t attested_key_id = 0; // ID 0 lets the device generate an ID
  yrc = yh_util_generate_ec_key(session, &attested_key_id, key_label,
                                domain_five, &capabilities, YH_ALGO_EC_P256);
  assert(yrc == YHR_SUCCESS);
 
  printf("Generated attested key with ID %04x\n", attested_key_id);
 
  uint8_t attestation[2048];
  size_t attestation_len = sizeof(attestation);
 
  yrc = yh_util_sign_attestation_certificate(session, attested_key_id,
                                             attesting_key_id, attestation,
                                             &attestation_len);
  assert(yrc == YHR_SUCCESS);
 
  const unsigned char *ptr = attestation;
 
  X509 *x509 = d2i_X509(NULL, &ptr, attestation_len);
  assert(x509 != NULL);
 
  BIO *STDout = BIO_new_fp(stdout, BIO_NOCLOSE);
 
  X509_print_ex(STDout, x509, 0, 0);
 
  BIO_free(STDout);
 
  const STACK_OF(X509_EXTENSION) *extensions_list = X509_get0_extensions(x509);
  assert(sk_X509_EXTENSION_num(extensions_list) >= 6);
 
  for (int i = 0; i < sk_X509_EXTENSION_num(extensions_list); i++) {
    X509_EXTENSION *extension;
 
    extension = sk_X509_EXTENSION_value(extensions_list, i);
 
    print_extension(extension);
  }
 
  X509_free(x509);
 
  yrc = yh_util_close_session(session);
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_destroy_session(&session);
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_disconnect(connector);
  assert(yrc == YHR_SUCCESS);
 
  yrc = yh_exit();
  assert(yrc == YHR_SUCCESS);
 
  return 0;
}

Here is the call graph for this function:

Variable Documentation

attestation_template_file

const char attestation_template_file[] = "attestation_template.pem"

Definition at line 37 of file attest.c.

key_label

const char* key_label = "label"

Definition at line 38 of file attest.c.

password

const uint8_t password[] = "password"

Definition at line 39 of file attest.c.