Repository: scionproto/scion
Pull request #3586 (2020-01-08 08:41:26)

Topo file: add support for v2 trust attributes
The source file for topology generation now has support for  primary attributes as listed in
https://github.com/scionproto/scion/blob/master/doc/ControlPlanePKI.md#primary-ases

Also add support to scion-pki for those properties.

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/scionproto/scion/3586)
<!-- Reviewable:end -->



Patch:
diff --git a/acceptance/topo_br_reload_util/Tinier.topo b/acceptance/topo_br_reload_util/Tinier.topo
index 9f357c0f8..a6aa0d57f 100644
--- a/acceptance/topo_br_reload_util/Tinier.topo
+++ b/acceptance/topo_br_reload_util/Tinier.topo
@@ -2,6 +2,9 @@
 ASes:
   "1-ff00:0:110":
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
     mtu: 1400
   "1-ff00:0:111":
     cert_issuer: 1-ff00:0:110
diff --git a/go/tools/scion-pki/internal/v2/tmpl/topo.go b/go/tools/scion-pki/internal/v2/tmpl/topo.go
index c54581fad..360d64f7b 100644
--- a/go/tools/scion-pki/internal/v2/tmpl/topo.go
+++ b/go/tools/scion-pki/internal/v2/tmpl/topo.go
@@ -89,7 +89,7 @@ func (g topoGen) genTRCs(topo topoFile) (map[addr.ISD]conf.TRC2, error) {
 }
 
 func (g topoGen) genTRC(isd addr.ISD, topo topoFile) conf.TRC2 {
-	cores := topo.Cores(isd)
+	primaries := topo.Primaries(isd)
 	reset := true
 	cfg := conf.TRC2{
 		Description: fmt.Sprintf("ISD %d", isd),
@@ -97,21 +97,14 @@ func (g topoGen) genTRC(isd addr.ISD, topo topoFile) conf.TRC2 {
 		BaseVersion: 1,
 		// XXX(roosd): Choose quorum according to your security needs.
 		// This simply serves an example.
-		VotingQuorum:      uint16(len(cores)/2 + 1),
+		VotingQuorum:      uint16(primaries.Voters()/2 + 1),
 		TrustResetAllowed: &reset,
 		Votes:             []addr.AS{},
 		Validity:          g.Validity,
 		PrimaryASes:       make(map[addr.AS]conf.Primary),
 	}
-	for _, as := range cores {
-		iss, on, off := scrypto.KeyVersion(1), scrypto.KeyVersion(1), scrypto.KeyVersion(1)
-		cfg.PrimaryASes[as] = conf.Primary{
-			Attributes: []trc.Attribute{trc.Authoritative, trc.Core, trc.Issuing,
-				trc.Voting},
-			IssuingKeyVersion:       &iss,
-			VotingOfflineKeyVersion: &off,
-			VotingOnlineKeyVersion:  &on,
-		}
+	for _, primaryAS := range primaries {
+		cfg.PrimaryASes[primaryAS.AS] = primaryAS.ToConf()
 	}
 	return cfg
 }
@@ -253,17 +246,63 @@ func (t topoFile) ISDs() map[addr.ISD]struct{} {
 	return m
 }
 
-func (t topoFile) Cores(isd addr.ISD) []addr.AS {
-	var cores []addr.AS
+func (t topoFile) Primaries(isd addr.ISD) primaryASes {
+	var primaries primaryASes
 	for ia, entry := range t.ASes {
-		if ia.I == isd && entry.Core {
-			cores = append(cores, ia.A)
+		if ia.I == isd && entry.Primary() {
+			primaries = append(primaries, primaryAS{AS: ia.A, asEntry: entry})
 		}
 	}
-	return cores
+	return primaries
 }
 
 type asEntry struct {
-	Core   bool    `yaml:"core"`
-	Issuer addr.IA `yaml:"cert_issuer"`
+	Authoritative bool    `yaml:"authoritative"`
+	Core          bool    `yaml:"core"`
+	Issuing       bool    `yaml:"issuing"`
+	Voting        bool    `yaml:"voting"`
+	Issuer        addr.IA `yaml:"cert_issuer"`
+}
+
+func (e asEntry) Primary() bool {
+	return e.Authoritative || e.Core || e.Issuing || e.Voting
+}
+
+type primaryAS struct {
+	AS addr.AS
+	asEntry
+}
+
+func (p primaryAS) ToConf() conf.Primary {
+	cp := conf.Primary{}
+	if p.Authoritative {
+		cp.Attributes = append(cp.Attributes, trc.Authoritative)
+	}
+	if p.Core {
+		cp.Attributes = append(cp.Attributes, trc.Core)
+	}
+	if p.Issuing {
+		iss := scrypto.KeyVersion(1)
+		cp.Attributes = append(cp.Attributes, trc.Issuing)
+		cp.IssuingKeyVersion = &iss
+	}
+	if p.Voting {
+		on, off := scrypto.KeyVersion(1), scrypto.KeyVersion(1)
+		cp.Attributes = append(cp.Attributes, trc.Voting)
+		cp.VotingOnlineKeyVersion = &on
+		cp.VotingOfflineKeyVersion = &off
+	}
+	return cp
+}
+
+type primaryASes []primaryAS
+
+func (p primaryASes) Voters() int {
+	voters := 0
+	for _, pAS := range p {
+		if pAS.Voting {
+			voters++
+		}
+	}
+	return voters
 }
diff --git a/python/topology/topo.py b/python/topology/topo.py
index 0aa69e690..1ac0d4cf3 100755
--- a/python/topology/topo.py
+++ b/python/topology/topo.py
@@ -187,8 +187,13 @@ class TopoGenerator(object):
         mtu = as_conf.get('mtu', self.args.default_mtu)
         assert mtu >= SCION_MIN_MTU, mtu
         self.topo_dicts[topo_id] = {
-            'Core': as_conf.get('core', False), 'ISD_AS': str(topo_id),
-            'MTU': mtu, 'Overlay': self.overlay
+            'Core': as_conf.get('core', False),
+            'Voting': as_conf.get('voting', False),
+            'Authoritative': as_conf.get('authoritative', False),
+            'Issuing': as_conf.get('issuing', False),
+            'ISD_AS': str(topo_id),
+            'MTU': mtu,
+            'Overlay': self.overlay,
         }
         for i in SCION_SERVICE_NAMES:
             self.topo_dicts[topo_id][i] = {}
diff --git a/topology/Default.topo b/topology/Default.topo
index cf8911364..dd2a053cf 100644
--- a/topology/Default.topo
+++ b/topology/Default.topo
@@ -2,11 +2,20 @@
 ASes:
   "1-ff00:0:110": # old 1-11
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
     path_servers: 3
   "1-ff00:0:120": # old 1-12
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
   "1-ff00:0:130": # old 1-13
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
     beacon_servers: 2
   "1-ff00:0:111": # old 1-14
     cert_issuer: 1-ff00:0:110
@@ -27,9 +36,15 @@ ASes:
     cert_issuer: 1-ff00:0:130
   "2-ff00:0:210": # old 2-21
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
     mtu: 1280
   "2-ff00:0:220": # old 2-22
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
   "2-ff00:0:211": # old 2-23
     cert_issuer: 2-ff00:0:210
   "2-ff00:0:212": # old 2-25
diff --git a/topology/Tiny.topo b/topology/Tiny.topo
index 77ce8b2e8..c000e02c4 100644
--- a/topology/Tiny.topo
+++ b/topology/Tiny.topo
@@ -2,6 +2,9 @@
 ASes:
   "1-ff00:0:110": # old 1-11
     core: true
+    voting: true
+    authoritative: true
+    issuing: true
     mtu: 1400
   "1-ff00:0:111": # old 1-12
     cert_issuer: 1-ff00:0:110
diff --git a/topology/Wide.topo b/topology/Wide.topo
index 59ada02b0..89d45d159 100644
--- a/topology/Wide.topo
+++ b/topology/Wide.topo
@@ -1,21 +1,21 @@
 ---
 ASes:
-  "1-ff00:0:110": {core: true}
-  "1-ff00:0:120": {core: true}
+  "1-ff00:0:110": {core: true, voting: true, authoritative: true, issuing: true}
+  "1-ff00:0:120": {core: true, voting: true, authoritative: true, issuing: true}
   "1-ff00:0:111": {cert_issuer: "1-ff00:0:110"}
   "1-ff00:0:121": {cert_issuer: "1-ff00:0:120"}
-  "2-ff00:0:210": {core: true}
-  "2-ff00:0:220": {core: true}
+  "2-ff00:0:210": {core: true, voting: true, authoritative: true, issuing: true}
+  "2-ff00:0:220": {core: true, voting: true, authoritative: true, issuing: true}
   "2-ff00:0:221": {cert_issuer: "2-ff00:0:220"}
   "2-ff00:0:222": {cert_issuer: "2-ff00:0:220"}
-  "3-ff00:0:310": {core: true}
+  "3-ff00:0:310": {core: true, voting: true, authoritative: true, issuing: true}
   "3-ff00:0:311": {cert_issuer: "3-ff00:0:310"}
   "3-ff00:0:312": {cert_issuer: "3-ff00:0:310"}
   "3-ff00:0:313": {cert_issuer: "3-ff00:0:310"}
-  "4-ff00:0:410": {core: true}
-  "5-ff00:0:510": {core: true}
-  "5-ff00:0:520": {core: true}
-  "5-ff00:0:530": {core: true}
+  "4-ff00:0:410": {core: true, voting: true, authoritative: true, issuing: true}
+  "5-ff00:0:510": {core: true, voting: true, authoritative: true, issuing: true}
+  "5-ff00:0:520": {core: true, voting: true, authoritative: true, issuing: true}
+  "5-ff00:0:530": {core: true, voting: true, authoritative: true, issuing: true}
   "5-ff00:0:511": {cert_issuer: "5-ff00:0:510"}
   "5-ff00:0:531": {cert_issuer: "5-ff00:0:530"}
 links:


Test patch:
diff --git a/go/tools/scion-pki/internal/v2/tmpl/topo_test.go b/go/tools/scion-pki/internal/v2/tmpl/topo_test.go
index 5da9a1981..12d81f523 100644
--- a/go/tools/scion-pki/internal/v2/tmpl/topo_test.go
+++ b/go/tools/scion-pki/internal/v2/tmpl/topo_test.go
@@ -43,7 +43,7 @@ func TestTopoGen(t *testing.T) {
 
 	topo := topoFile{
 		ASes: map[addr.IA]asEntry{
-			ia110: {Core: true},
+			ia110: {Core: true, Authoritative: true, Issuing: true, Voting: true},
 			ia111: {Issuer: ia110},
 			ia112: {Issuer: ia110},
 		},