Skip to content
This repository has been archived by the owner on Sep 19, 2024. It is now read-only.

Commit

Permalink
remove good old days parts (#65)
Browse files Browse the repository at this point in the history
* remove good old days parts

* remove vagrant parts
  • Loading branch information
bonifaido authored Sep 27, 2023
1 parent f1e1142 commit 931a329
Show file tree
Hide file tree
Showing 19 changed files with 10 additions and 972 deletions.
11 changes: 4 additions & 7 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -57,12 +57,9 @@ nasp-objs := third-party/wasm3/source/m3_api_libc.o \
buffer.o \
device_driver.o \
main.o \
netfilter.o \
hashtable.o \
csr.o \
rsa_tools.o \
wasm.o \
worker_thread.o \
opa.o \
proxywasm.o \
socket.o \
Expand All @@ -73,15 +70,15 @@ nasp-objs := third-party/wasm3/source/m3_api_libc.o \
# Set the path to the Kernel build utils.
KBUILD=/lib/modules/$(shell uname -r)/build/

default: socket_wasm.h
default: static/socket_wasm.h
cd third-party/BearSSL && $(MAKE) linux-km
$(MAKE) -C $(KBUILD) M=$(PWD) V=$(VERBOSE) modules

socket_wasm.h: socket.rego
static/socket_wasm.h: socket.rego
opa build -t wasm -e "socket/allow" socket.rego -o bundle.tar.gz
tar zxvf bundle.tar.gz /policy.wasm
mv policy.wasm socket.wasm
xxd -i socket.wasm socket_wasm.h
xxd -i socket.wasm static/socket_wasm.h

opa-test:
opa test *.rego -v
Expand Down Expand Up @@ -120,7 +117,7 @@ _archlinux_deps:
sudo pacman -Syu linux-headers base-devel clang go dkms git strace bc iperf socat

_install_opa:
sudo curl -L -o /usr/bin/opa https://openpolicyagent.org/downloads/v0.54.0/opa_linux_$(shell go version | cut -f2 -d'/')_static
sudo curl -L -o /usr/bin/opa https://openpolicyagent.org/downloads/v0.56.0/opa_linux_$(shell go version | cut -f2 -d'/')_static
sudo chmod +x /usr/bin/opa

setup-vm: _debian_deps _install_opa
Expand Down
53 changes: 0 additions & 53 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,28 +58,6 @@ sudo apt update && sudo apt install make
make setup-vm
```

### Vagrant/Virtualbox

If you happen to use Vagrant, there is a Vagrantfile prepared which uses VirtualBox.

On macOS install Vagrant and VirtualBox with brew:

```bash
brew install vagrant virtualbox
```

Bring up the Vagrant machine, this installs the required dependencies automatically into it:

```bash
vagrant up
```

Connect to the Vagrant machine through SSH:

```bash
vagrant ssh
```

### Coding

We are using VSCode for development and the project ships with a `c_cpp_properties.json` file which contains the required include paths for the kernel headers. The file is ARM specific from include path point-of-view so if you happen to run on x86_64 please replace the paths accordingly (arm64 -> x86, aarch64 -> x86_64).
Expand Down Expand Up @@ -148,37 +126,6 @@ The kernel module can terminate TLS connections on certain ports, and forward th

Between two applications - both of them intercepted by this module - the traffic is always encrypted by [kTLS](https://docs.kernel.org/networking/tls-offload.html). If one of them is not intercepted by the module but supports the ChaCha20-Poly1305 AEAD - kTLS is used. Otherwise the traffic is encrypted by BearSSL.

### TLS Certificates for testing

You will need `cfssl` for this (`brew install cfssl` on macOS):

```bash
# Create the CA certificate
cfssl gencert -initca ca.json | cfssljson -bare ca

# Create the client/server certificate
cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=server.json \
-profile=server \
server.json | cfssljson -bare server
```


Generate the static C resources of these certificates with BearSSL's `brssl` CLI and copy these into the given [certificate_rsa.h](certificate_rsa.h) header file:

```bash
# Trust anchor (CA)
brssl ta ca.pem

# Server certificate
brssl chain server.pem

# Server private key
brssl skey -C server-key.pem
```

### Test mTLS

The kernel module offers TLS termination on certain ports selected by a rule-set:
Expand Down
79 changes: 0 additions & 79 deletions Vagrantfile

This file was deleted.

16 changes: 0 additions & 16 deletions ca.json

This file was deleted.

49 changes: 0 additions & 49 deletions generate-certs.sh

This file was deleted.

Loading

0 comments on commit 931a329

Please sign in to comment.