AntelopeIO · spoonincode · Sep 10, 2022 · Sep 9, 2022
diff --git a/.cicd/platforms/ubuntu18.Dockerfile b/.cicd/platforms/ubuntu18.Dockerfile
@@ -7,10 +7,13 @@ RUN apt-get update && apt-get upgrade -y && \
                                                       g++-8                       \
                                                       git                         \
                                                       jq                          \
+                                                      libcurl4-openssl-dev        \
                                                       libgmp-dev                  \
                                                       libssl-dev                  \
+                                                      libusb-1.0-0-dev            \
                                                       llvm-7-dev                  \
                                                       ninja-build                 \
+                                                      pkg-config                  \
                                                       python3                     \
                                                       software-properties-common  \
                                                       zlib1g-dev                  \

diff --git a/.cicd/platforms/ubuntu20.Dockerfile b/.cicd/platforms/ubuntu20.Dockerfile
@@ -7,8 +7,11 @@ RUN apt-get update && apt-get upgrade -y && \
                                                       git                  \
                                                       jq                   \
                                                       libboost-all-dev     \
+                                                      libcurl4-openssl-dev \
                                                       libgmp-dev           \
                                                       libssl-dev           \
+                                                      libusb-1.0-0-dev     \
                                                       llvm-11-dev          \
                                                       ninja-build          \
+                                                      pkg-config           \
                                                       zstd
diff --git a/.cicd/platforms/ubuntu22.Dockerfile b/.cicd/platforms/ubuntu22.Dockerfile
@@ -7,8 +7,11 @@ RUN apt-get update && apt-get upgrade -y && \
                                                       git                  \
                                                       jq                   \
                                                       libboost-all-dev     \
+                                                      libcurl4-openssl-dev \
                                                       libgmp-dev           \
                                                       libssl-dev           \
+                                                      libusb-1.0-0-dev     \
                                                       llvm-11-dev          \
                                                       ninja-build          \
+                                                      pkg-config           \
                                                       zstd
diff --git a/.gitmodules b/.gitmodules
@@ -16,6 +16,9 @@
 [submodule "libraries/rapidjson"]
 	path = libraries/rapidjson
 	url = https://github.com/Tencent/rapidjson/
+[submodule "libraries/yubihsm"]
+	path = libraries/yubihsm
+	url = https://github.com/Yubico/yubihsm-shell
 [submodule "tests/abieos"]
 	path = tests/abieos
 	url = https://github.com/AntelopeIO/abieos

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -227,6 +227,7 @@ configure_file(libraries/fc/src/network/LICENSE.go                      licenses
 configure_file(libraries/eos-vm/LICENSE                                 licenses/leap/LICENSE.eos-vm    COPYONLY)
 configure_file(libraries/fc/libraries/ff/LICENSE                        licenses/leap/LICENSE.libff     COPYONLY)
 configure_file(programs/cleos/LICENSE.CLI11                             licenses/leap/LICENSE.CLI11     COPYONLY)
+configure_file(libraries/yubihsm/LICENSE                                licenses/leap/LICENSE.yubihsm   COPYONLY)
 
 install(DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/licenses/leap" DESTINATION "${CMAKE_INSTALL_FULL_DATAROOTDIR}/licenses/" COMPONENT base)
 
@@ -237,6 +238,9 @@ add_custom_target(dev-install
   USES_TERMINAL
 )
 
+get_property(_CTEST_CUSTOM_TESTS_IGNORE GLOBAL PROPERTY CTEST_CUSTOM_TESTS_IGNORE)
+file(WRITE "${CMAKE_BINARY_DIR}/CTestCustom.cmake" "SET(CTEST_CUSTOM_TESTS_IGNORE ${_CTEST_CUSTOM_TESTS_IGNORE})")
+
 include(doxygen)
 
 include(package.cmake)

diff --git a/README.md b/README.md
@@ -18,7 +18,7 @@ Recent Ubuntu LTS releases are the only Linux distributions that we fully suppor
 * CMake 3.8+
 * (for Linux only) LLVM 7 - 11 (newer versions do not work)
 
-A few other common libraries are tools also required such as openssl 1.1+, curl, GMP, Python 3, and zlib.
+A few other common libraries are tools also required such as openssl 1.1+, libcurl, curl, libusb, GMP, Python 3, and zlib.
 
 **A Warning On Parallel Compilation Jobs (`-j` flag)**: When building C/C++ software often the build is performed in parallel via a command such as `make -j $(nproc)` which uses the number of CPU cores as the number of compilation jobs to perform simultaneously. However, be aware that some compilation units (.cpp files) in Leap are extremely complex and will consume nearly 4GB of memory to compile. You may need to reduce the level of parallelization depending on the amount of memory on your build host. e.g. instead of `make -j $(nproc)` run `make -j2`. Failures due to memory exhaustion will typically but not always manifest as compiler crashes.
 
@@ -33,8 +33,6 @@ The binary package will be produced in the Leap build directory that was supplie
 
 #### Manual (non "pinned") Build Instructions
 
-These instructions are valid for this branch. Other release branches may have different requirements so ensure you follow the directions in the branch or release you intend to build.
-
 <details>
   <summary>Ubuntu 20.04 & 22.04 Build Instructions</summary>
 
@@ -46,9 +44,12 @@ apt-get update && apt-get install   \
         curl                        \
         git                         \
         libboost-all-dev            \
+        libcurl4-openssl-dev        \
         libgmp-dev                  \
         libssl-dev                  \
-        llvm-11-dev
+        libusb-1.0-0-dev            \
+        llvm-11-dev                 \
+        pkg-config
 ```
 and perform the build:
 ```
@@ -71,9 +72,12 @@ apt-get update && apt-get install   \
         curl                        \
         g++-8                       \
         git                         \
+        libcurl4-openssl-dev        \
         libgmp-dev                  \
         libssl-dev                  \
+        libusb-1.0-0-dev            \
         llvm-7-dev                  \
+        pkg-config                  \
         python3                     \
         zlib1g-dev
 

diff --git a/docs/03_keosd/10_usage.md b/docs/03_keosd/10_usage.md
@@ -91,6 +91,11 @@ Config Options for eosio::wallet_plugin:
                                         number of seconds of inactivity.
                                         Activity is defined as any wallet
                                         command e.g. list-wallets.
+  --yubihsm-url URL                     Override default URL of
+                                        http://localhost:12345 for connecting
+                                        to yubihsm-connector
+  --yubihsm-authkey key_num             Enables YubiHSM support using given
+                                        Authkey
 
 Application Config Options:
   --plugin arg                          Plugin(s) to enable, may be specified

diff --git a/docs/03_keosd/30_how-to-guides/how-to-attach-a-yubihsm-hard-wallet.md b/docs/03_keosd/30_how-to-guides/how-to-attach-a-yubihsm-hard-wallet.md
@@ -0,0 +1,73 @@
+---
+content_title: How To Attach a YubiHSM Hard Wallet
+link_text: How To Attach a YubiHSM Hard Wallet
+---
+
+## Goal
+
+Attach a YubiHSM as a hard wallet
+
+## Before you begin
+
+* Install the currently supported version of `keosd`
+
+* Install YubiHSM2 Software Toolkit (YubiHSM2 SDK)
+
+* Create an AuthKey with at least the following Capabilities:
+
+   * sign-ecdsa
+   * generate-asymmetric-key
+   * export-wrapped
+
+* **Delete the default AuthKey**
+
+[[warning | Security]]
+| It is extremely important to create a new AuthKey and remove the default AuthKey before proceed to the following steps.
+
+## Steps
+
+### Configure `keosd`
+
+   There are two options to connect `keosd` to YubiHSM:
+
+   #### Using a YubiHSM connector
+
+   By default, `keosd` will connect to the YubiHSM connector on the default host and port. If a non-default URL is used, set the `--yubihsm-url` option or `yubihsm-url` in `config.ini` with the correct connector URL
+
+   #### Directly connect via USB
+
+   `keosd` also can directly connect to YubiHSM via USB protocol
+
+   If this option is used, set `keosd` startup option as the below:
+
+   ```sh
+   --yubihsm-url=ysb://
+   ```
+
+### Start `keosd` with AuthKey:
+
+   ```sh
+   --yubihsm-authkey Your_AuthKey_Object_Number
+   ```
+
+   if a YubiHSM connector is used, check the YubiHSM connector is up and running by visiting YubiHSM URL:
+      http://YubiHSM_HOST:YubiHSM_PORT/connector/status ((Default HOST and Port: http://127.0.0.1:12345)
+
+   You should see something like this:
+
+   ```console
+   status=OK
+   serial=*
+   version=2.0.0
+   pid=666
+   address=localhost
+   port=12345
+   ```
+
+### Unlock YubiHSM wallet with the password of AuthKey using the following option:
+
+   ```sh
+   cleos wallet unlock -n YubiHSM --password YOUR_AUTHKEY_PASSWORD
+   ```
+
+After unlocking the wallet, you can use `cleos wallet` commands as usual. Beware as a part of security mechanism, some wallet subcommands, such as retrieve private keys, or remove a key, are not supported when a YubiHSM is used
diff --git a/docs/03_keosd/30_how-to-guides/index.md b/docs/03_keosd/30_how-to-guides/index.md
@@ -0,0 +1,5 @@
+---
+content_title: Keosd How-to Guides
+---
+
+* [How to attach a YubiHSM hard wallet](how-to-attach-a-yubihsm-hard-wallet.md)
diff --git a/libraries/CMakeLists.txt b/libraries/CMakeLists.txt
@@ -30,3 +30,17 @@ set(ENABLE_PROFILE OFF CACHE BOOL "Enable for profile builds")
 if(eos-vm IN_LIST EOSIO_WASM_RUNTIMES OR eos-vm-jit IN_LIST EOSIO_WASM_RUNTIMES)
 add_subdirectory( eos-vm )
 endif()
+
+set(ENABLE_STATIC ON)
+set(CMAKE_MACOSX_RPATH OFF)
+set(BUILD_ONLY_LIB ON CACHE BOOL "Library only build")
+message(STATUS "Starting yubihsm configuration...")
+add_subdirectory( yubihsm EXCLUDE_FROM_ALL )
+target_compile_options(yubihsm_static PRIVATE -fno-lto -fcommon)
+message(STATUS "yubihsm configuration complete")
+
+get_property(_CTEST_CUSTOM_TESTS_IGNORE GLOBAL PROPERTY CTEST_CUSTOM_TESTS_IGNORE)
+set_property(GLOBAL PROPERTY CTEST_CUSTOM_TESTS_IGNORE
+  "change_authkey import_ed decrypt_ec decrypt_rsa ssh logs generate_rsa import_ec echo\
+  yubico_otp wrap_data wrap info import_rsa import_authkey generate_hmac generate_ec\
+  attest pbkdf2 parsing ${_CTEST_CUSTOM_TESTS_IGNORE}")
diff --git a/libraries/yubihsm b/libraries/yubihsm
diff --git a/plugins/wallet_plugin/CMakeLists.txt b/plugins/wallet_plugin/CMakeLists.txt
@@ -19,7 +19,11 @@ add_library( wallet_plugin
              wallet_plugin.cpp
              wallet_manager.cpp
              ${SE_WALLET_SOURCES}
+             yubihsm_wallet.cpp
              ${HEADERS} )
 
-target_link_libraries( wallet_plugin eosio_chain appbase ${security_framework} ${corefoundation_framework} ${localauthentication_framework} ${cocoa_framework})
+target_link_libraries( wallet_plugin yubihsm_static eosio_chain appbase ${security_framework} ${corefoundation_framework} ${localauthentication_framework} ${cocoa_framework})
 target_include_directories( wallet_plugin PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/include" )
+
+#sadly old cmake 2.8 support in yubihsm cmake prevents usage of target_include_directories there
+target_include_directories( wallet_plugin PRIVATE "${CMAKE_SOURCE_DIR}/libraries/yubihsm/lib" )
diff --git a/plugins/wallet_plugin/include/eosio/wallet_plugin/yubihsm_wallet.hpp b/plugins/wallet_plugin/include/eosio/wallet_plugin/yubihsm_wallet.hpp
@@ -0,0 +1,41 @@
+#pragma once
+
+#include <eosio/chain/types.hpp>
+#include <eosio/wallet_plugin/wallet_api.hpp>
+
+using namespace std;
+using namespace eosio::chain;
+
+namespace eosio { namespace wallet {
+
+namespace detail {
+struct yubihsm_wallet_impl;
+}
+
+class yubihsm_wallet final : public wallet_api {
+   public:
+      yubihsm_wallet(const string& connector, const uint16_t authkey);
+      ~yubihsm_wallet();
+
+      private_key_type get_private_key(public_key_type pubkey) const override;
+
+      bool is_locked() const override;
+      void lock() override;
+      void unlock(string password) override;
+      void check_password(string password) override;
+      void set_password(string password) override;
+
+      map<public_key_type, private_key_type> list_keys() override;
+      flat_set<public_key_type> list_public_keys() override;
+
+      bool import_key(string wif_key) override;
+      string create_key(string key_type) override;
+      bool remove_key(string key) override;
+
+      std::optional<signature_type> try_sign_digest(const digest_type digest, const public_key_type public_key) override;
+
+   private:
+      std::unique_ptr<detail::yubihsm_wallet_impl> my;
+};
+
+}}
diff --git a/plugins/wallet_plugin/wallet_plugin.cpp b/plugins/wallet_plugin/wallet_plugin.cpp
@@ -1,5 +1,6 @@
 #include <eosio/wallet_plugin/wallet_plugin.hpp>
 #include <eosio/wallet_plugin/wallet_manager.hpp>
+#include <eosio/wallet_plugin/yubihsm_wallet.hpp>
 #include <eosio/chain/exceptions.hpp>
 #include <boost/filesystem/path.hpp>
 #include <chrono>
@@ -26,6 +27,10 @@ void wallet_plugin::set_program_options(options_description& cli, options_descri
           "Timeout for unlocked wallet in seconds (default 900 (15 minutes)). "
           "Wallets will automatically lock after specified number of seconds of inactivity. "
           "Activity is defined as any wallet command e.g. list-wallets.")
+         ("yubihsm-url", bpo::value<string>()->value_name("URL"),
+          "Override default URL of http://localhost:12345 for connecting to yubihsm-connector")
+         ("yubihsm-authkey", bpo::value<uint16_t>()->value_name("key_num"),
+          "Enables YubiHSM support using given Authkey")
          ;
 }
 
@@ -48,6 +53,15 @@ void wallet_plugin::plugin_initialize(const variables_map& options) {
          std::chrono::seconds t(timeout);
          wallet_manager_ptr->set_timeout(t);
       }
+      if (options.count("yubihsm-authkey")) {
+         uint16_t key = options.at("yubihsm-authkey").as<uint16_t>();
+         string connector_endpoint = "http://localhost:12345";
+         if(options.count("yubihsm-url"))
+            connector_endpoint = options.at("yubihsm-url").as<string>();
+         try {
+            wallet_manager_ptr->own_and_use_wallet("YubiHSM", make_unique<yubihsm_wallet>(connector_endpoint, key));
+         }FC_LOG_AND_RETHROW()
+      }
    } FC_LOG_AND_RETHROW()
 }