Simplify command line client flags (#738)

* simlify flags

* update docker-compose

* Update trusted root, and adjust VerifyInclusionByIndex for off by one root

* Simplify and remove unused variables

.keytransparency.yaml

@@ -1,8 +1,3 @@
log-key: "genfiles/trillian-log.pem"
vrf:    "genfiles/vrf-pubkey.pem"
kt-key: "genfiles/server.crt"
kt-sig: "genfiles/p256-pubkey.pem"
domain: "example.com"
kt-url: "35.184.134.53:8080"
client-secret: "client_secret.json"
service-key: ""
kt-url: localhost:8080
client-secret: 
service-key: 

README.md

@@ -101,5 +101,6 @@ source scripts/configure_trillian.sh && createLog && createMap
- `docker-compose up -d`
- `docker-compose logs --tail=0 --follow`
- [https://localhost:8080/v1/users/foo@bar.com](https://localhost:8080/v1/users/foo@bar.com)
- [https://localhost:8080/v1/domain/info](https://localhost:8080/v1/domain/info)
- [Prometheus graphs](http://localhost:9090/graph)

cmd/keytransparency-client/cmd/root.go

@@ -25,16 +25,14 @@ import (
	"github.com/google/keytransparency/cmd/keytransparency-client/grpcc"
	"github.com/google/keytransparency/core/authentication"
	"github.com/google/keytransparency/core/client/kt"
	"github.com/google/keytransparency/core/crypto/keymaster"
	"github.com/google/keytransparency/core/crypto/signatures"
	"github.com/google/keytransparency/core/crypto/vrf"
	"github.com/google/keytransparency/core/crypto/vrf/p256"
	gauth "github.com/google/keytransparency/impl/google/authentication"
	pb "github.com/google/keytransparency/impl/proto/keytransparency_v1_service"

	"github.com/google/trillian"
	"github.com/google/trillian/client"
	"github.com/google/trillian/crypto/keys"
	"github.com/google/trillian/merkle/coniks"
	"github.com/google/trillian/merkle/hashers"
	_ "github.com/google/trillian/merkle/objhasher" // Register objhasher
	"github.com/spf13/cobra"
@@ -78,15 +76,13 @@ func Execute() {
func init() {
	cobra.OnInitialize(initConfig)
	RootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default is $HOME/.keytransparency.yaml)")
	RootCmd.PersistentFlags().String("vrf", "testdata/vrf-pubkey.pem", "path to vrf public key")

	RootCmd.PersistentFlags().Int64("log-id", 0, "Log ID of the backend log server")
	RootCmd.PersistentFlags().String("log-url", "", "URL of Certificate Transparency server")
	RootCmd.PersistentFlags().String("log-key", "", "Path to public key PEM for Trillian Log server")

	RootCmd.PersistentFlags().String("kt-url", "", "URL of Key Transparency server")
	RootCmd.PersistentFlags().String("kt-key", "testdata/server.crt", "Path to public key for Key Transparency")
	RootCmd.PersistentFlags().String("kt-sig", "testdata/p256-pubkey.pem", "Path to public key for signed map heads")
	RootCmd.PersistentFlags().String("kt-cert", "genfiles/server.crt", "Path to public key for Key Transparency")
	RootCmd.PersistentFlags().String("vrf", "genfiles/vrf-pubkey.pem", "path to vrf public key")

	RootCmd.PersistentFlags().String("log-key", "genfiles/trillian-log.pem", "Path to public key PEM for Trillian Log server")
	RootCmd.PersistentFlags().String("map-key", "genfiles/trillian-map.pem", "Path to public key PEM for Trillian Map server")

	RootCmd.PersistentFlags().String("fake-auth-userid", "", "userid to present to the server as identity for authentication. Only succeeds if fake auth is enabled on the server side.")

@@ -173,32 +169,6 @@ func getServiceCreds(serviceKeyFile string) (credentials.PerRPCCredentials, erro
	return oauth.NewServiceAccountFromKey(b, gauth.RequiredScopes...)
}

func readSignatureVerifier(ktPEM string) (signatures.Verifier, error) {
	pem, err := ioutil.ReadFile(ktPEM)
	if err != nil {
		return nil, err
	}
	ver, err := keymaster.NewVerifierFromPEM(pem)
	if err != nil {
		return nil, err
	}
	return ver, nil
}

func getClient(cc *grpc.ClientConn, vrfPubFile, ktSig string, log client.LogVerifier) (*grpcc.Client, error) {
	// Create Key Transparency client.
	vrfKey, err := readVrfKey(vrfPubFile)
	if err != nil {
		return nil, err
	}
	verifier, err := readSignatureVerifier(ktSig)
	if err != nil {
		return nil, fmt.Errorf("error reading key transparency PEM: %v", err)
	}
	cli := pb.NewKeyTransparencyServiceClient(cc)
	return grpcc.New(cli, vrfKey, verifier, log), nil
}

func dial(ktURL, caFile, clientSecretFile string, serviceKeyFile string) (*grpc.ClientConn, error) {
	ctx := context.Background()
	var opts []grpc.DialOption
@@ -253,32 +223,46 @@ func dial(ktURL, caFile, clientSecretFile string, serviceKeyFile string) (*grpc.
// GetClient connects to the server and returns a key transparency verification
// client.
func GetClient(clientSecretFile string) (*grpcc.Client, error) {
	vrfFile := viper.GetString("vrf")
	ktURL := viper.GetString("kt-url")
	ktPEM := viper.GetString("kt-key")
	ktSig := viper.GetString("kt-sig")
	logPEM := viper.GetString("log-key")
	serviceKeyFile := viper.GetString("service-key")
	cc, err := dial(ktURL, ktPEM, clientSecretFile, serviceKeyFile)
	ktCert := viper.GetString("kt-cert")
	vrfPubFile := viper.GetString("vrf")
	logPEMFile := viper.GetString("log-key")
	mapPEMFile := viper.GetString("map-key")
	serviceKeyFile := viper.GetString("service-key") // Anonymous user creds.

	// Client Connection.
	cc, err := dial(ktURL, ktCert, clientSecretFile, serviceKeyFile)
	if err != nil {
		return nil, fmt.Errorf("Error Dialing %v: %v", ktURL, err)
	}

	// Log verifier.
	logPubKey, err := keys.NewFromPublicPEMFile(logPEM)
	// Log PubKey.
	logPubKey, err := keys.NewFromPublicPEMFile(logPEMFile)
	if err != nil {
		return nil, fmt.Errorf("Failed to open public key %v: %v", logPubKey, err)
	}

	hasher, err := hashers.NewLogHasher(trillian.HashStrategy_OBJECT_RFC6962_SHA256)
	// Log Hasher.
	logHasher, err := hashers.NewLogHasher(trillian.HashStrategy_OBJECT_RFC6962_SHA256)
	if err != nil {
		return nil, fmt.Errorf("Failed retrieving LogHasher from registry: %v", err)
	}
	log := client.NewLogVerifier(hasher, logPubKey)

	c, err := getClient(cc, vrfFile, ktSig, log)
	// VRF PubKey.
	vrfPubKey, err := readVrfKey(vrfPubFile)
	if err != nil {
		return nil, fmt.Errorf("Error creating client: %v", err)
		return nil, err
	}
	return c, nil

	// MapPubKey.
	mapPubKey, err := keys.NewFromPublicPEMFile(mapPEMFile)
	if err != nil {
		return nil, fmt.Errorf("error reading key transparency PEM: %v", err)
	}

	// Map Hasher
	mapHasher := coniks.Default

	logVerifier := client.NewLogVerifier(logHasher, logPubKey)
	return grpcc.New(cc, vrfPubKey, mapPubKey, mapHasher, logVerifier), nil
}

cmd/keytransparency-client/grpcc/grpc_client.go

@@ -34,7 +34,7 @@ import (

	"github.com/golang/protobuf/proto"
	"github.com/google/trillian/client"
	"github.com/google/trillian/merkle/coniks"
	"github.com/google/trillian/merkle/hashers"
	"golang.org/x/net/context"
	"google.golang.org/grpc"

@@ -79,23 +79,22 @@ type Client struct {
	cli        spb.KeyTransparencyServiceClient
	vrf        vrf.PublicKey
	kt         *kt.Verifier
	log        client.LogVerifier
	mutator    mutator.Mutator
	RetryCount int
	RetryDelay time.Duration
	trusted    trillian.SignedLogRoot
}

// New creates a new client.
func New(client spb.KeyTransparencyServiceClient,
func New(cc *grpc.ClientConn,
	vrf vrf.PublicKey,
	verifier crypto.PublicKey,
	log client.LogVerifier) *Client {
	mapPubKey crypto.PublicKey,
	mapHasher hashers.MapHasher,
	logVerifier client.LogVerifier) *Client {
	return &Client{
		cli:        client,
		cli:        spb.NewKeyTransparencyServiceClient(cc),
		vrf:        vrf,
		kt:         kt.New(vrf, coniks.Default, verifier, log),
		log:        log,
		kt:         kt.New(vrf, mapHasher, mapPubKey, logVerifier),
		mutator:    entry.New(),
		RetryCount: 1,
		RetryDelay: 3 * time.Second,

core/client/kt/verify.go

@@ -46,22 +46,22 @@ var (

// Verifier is a client helper library for verifying request and responses.
type Verifier struct {
	vrf    vrf.PublicKey
	hasher hashers.MapHasher
	sig    crypto.PublicKey
	log    client.LogVerifier
	vrf         vrf.PublicKey
	hasher      hashers.MapHasher
	mapPubKey   crypto.PublicKey
	logVerifier client.LogVerifier
}

// New creates a new instance of the client verifier.
func New(vrf vrf.PublicKey,
	hasher hashers.MapHasher,
	sig crypto.PublicKey,
	log client.LogVerifier) *Verifier {
	mapPubKey crypto.PublicKey,
	logVerifier client.LogVerifier) *Verifier {
	return &Verifier{
		vrf:    vrf,
		hasher: hasher,
		sig:    sig,
		log:    log,
		vrf:         vrf,
		hasher:      hasher,
		mapPubKey:   mapPubKey,
		logVerifier: logVerifier,
	}
}

@@ -120,25 +120,27 @@ func (v *Verifier) VerifyGetEntryResponse(ctx context.Context, userID, appID str
	// by removing the signature from the object.
	smr := *in.GetSmr()
	smr.Signature = nil // Remove the signature from the object to be verified.
	if err := tcrypto.VerifyObject(v.sig, smr, in.GetSmr().GetSignature()); err != nil {
	if err := tcrypto.VerifyObject(v.mapPubKey, smr, in.GetSmr().GetSignature()); err != nil {
		Vlog.Printf("✗ Signed Map Head signature verification failed.")
		return fmt.Errorf("sig.Verify(SMR): %v", err)
	}
	Vlog.Printf("✓ Signed Map Head signature verified.")

	// Verify consistency proof between root and newroot.
	// TODO(gdbelvin): Gossip root.
	if err := v.log.VerifyRoot(trusted, in.GetLogRoot(), in.GetLogConsistency()); err != nil {
	if err := v.logVerifier.VerifyRoot(trusted, in.GetLogRoot(), in.GetLogConsistency()); err != nil {
		return fmt.Errorf("VerifyRoot(%v, %v): %v", in.GetLogRoot(), in.GetLogConsistency(), err)
	}
	Vlog.Printf("✓ Log root updated.")
	trusted = in.GetLogRoot()

	// Verify inclusion proof.
	b, err := json.Marshal(in.GetSmr())
	if err != nil {
		return fmt.Errorf("json.Marshal(): %v", err)
	}
	if err := v.log.VerifyInclusionAtIndex(trusted, b, in.GetSmr().GetMapRevision(),
	logLeafIndex := in.GetSmr().GetMapRevision() - 1
	if err := v.logVerifier.VerifyInclusionAtIndex(trusted, b, logLeafIndex,
		in.GetLogInclusion()); err != nil {
		return fmt.Errorf("VerifyInclusionAtIndex(%s, %v, _): %v",
			b, in.GetSmr().GetMapRevision(), err)

docker-compose.yml

@@ -35,11 +35,17 @@ services:
    ports:
      - "8090:8090" # gRPC
      - "8091:8091" # HTTP & Metrics
    environment:
      DB_HOST: db:3306
      DB_DATABASE: test
      DB_USER: test
      DB_PASSWORD: zaphod 
    entrypoint:
      - /go/bin/trillian_log_server
      - --mysql_uri=test:zaphod@tcp(db:3306)/test
      - --rpc_endpoint=0.0.0.0:8090
      - --http_endpoint=0.0.0.0:8091
      - --alsologtostderr 
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8091/metrics"]
      interval: 30s
      timeout: 30s
      retries: 3

  trillian-log-signer:
    depends_on:
@@ -51,13 +57,21 @@ services:
    restart: always
    ports:
      - "8092:8091" # HTTP & Metrics
    environment:
      DB_HOST: db:3306
      DB_DATABASE: test
      DB_USER: test
      DB_PASSWORD: zaphod
      SEQUENCER_INTERVAL: 1s

    entrypoint: 
      - /go/bin/trillian_log_signer
      - --mysql_uri=test:zaphod@tcp(db:3306)/test
      - --http_endpoint=0.0.0.0:8091
      - --sequencer_guard_window=0s
      - --sequencer_interval=1s
      - --num_sequencers=1
      - --batch_size=50
      - --force_master=true
      - --alsologtostderr
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8091/metrics"]
      interval: 30s
      timeout: 30s
      retries: 3

  trillian-map:
    depends_on:
@@ -70,11 +84,17 @@ services:
    ports:
      - "8093:8090" # gRPC
      - "8094:8091" # HTTP & Metrics
    environment:
      DB_HOST: db:3306
      DB_DATABASE: test
      DB_USER: test
      DB_PASSWORD: zaphod 
    entrypoint:
      - /go/bin/trillian_map_server
      - --mysql_uri=test:zaphod@tcp(db:3306)/test
      - --rpc_endpoint=0.0.0.0:8090
      - --http_endpoint=0.0.0.0:8091
      - --alsologtostderr 
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8091/metrics"]
      interval: 30s
      timeout: 30s
      retries: 3

  kt-server:
    depends_on:

integration/testutil.go

@@ -39,6 +39,7 @@ import (

	"github.com/google/trillian"
	"github.com/google/trillian/crypto/keys"
	"github.com/google/trillian/merkle/coniks"
	"github.com/google/trillian/testonly/integration"
	"golang.org/x/net/context"
	"google.golang.org/grpc"
@@ -145,7 +146,7 @@ func NewEnv(t *testing.T) *Env {
		t.Fatalf("SetLeaves(): %v", err)
	}

	verifier, err := keys.NewFromPublicDER(tree.GetPublicKey().GetDer())
	mapPubKey, err := keys.NewFromPublicDER(tree.GetPublicKey().GetDer())
	if err != nil {
		t.Fatalf("Failed to load signing keypair: %v", err)
	}
@@ -192,8 +193,8 @@ func NewEnv(t *testing.T) *Env {
	if err != nil {
		t.Fatalf("Dial(%v) = %v", addr, err)
	}
	cli := pb.NewKeyTransparencyServiceClient(cc)
	client := grpcc.New(cli, vrfPub, verifier, fake.NewFakeTrillianLogVerifier())
	client := grpcc.New(cc, vrfPub, mapPubKey, coniks.Default,
		fake.NewFakeTrillianLogVerifier())
	client.RetryCount = 0

	return &Env{
@@ -206,7 +207,7 @@ func NewEnv(t *testing.T) *Env {
		db:         sqldb,
		Factory:    factory,
		VrfPriv:    vrfPriv,
		Cli:        cli,
		Cli:        pb.NewKeyTransparencyServiceClient(cc),
		mapLog:     hs,
	}
}