Skip to content

Commit

Permalink
refactor(security)!: change API to a CRUD API
Browse files Browse the repository at this point in the history
Update the OPI security API to use CRUD operations and to use more
non-implementation specific types. The v1 API messages were very specifc
to a strongSwan implementation. This version updates the API to
align with the more generic types from the IETF yang model described
in RFC 9061.

Using an API version tag of v2alpha1 as the API is not backwards
compatible with the v1 IPsec APIs.

Adpoting protobuf naming conventions for all messages and services.

fixes: #446, #104

BREAKING-CHANGE: Breaks compatiblity with the existing OPI security
API definition.

Signed-off-by: Stephen Doyle <stephen.doyle@intel.com>
  • Loading branch information
stevedoyle committed Jun 24, 2024
1 parent 46989ae commit 840235f
Show file tree
Hide file tree
Showing 10 changed files with 9,545 additions and 447 deletions.
15 changes: 11 additions & 4 deletions security/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -2,22 +2,29 @@
# Copyright (C) 2022 Intel Corporation
# Copyright (c) 2022 Dell Inc, or its subsidiaries.

APIVER = v2alpha1

all: buflint bufgen doc

doc:
rm -rf ./google
rm -f ./v1/autogen.md
mkdir -p ./v1
rm -f ./${APIVER}/autogen.md
mkdir -p ./${APIVER}

# protoc doesn't include annotation and http googleapis, so we have to get them here
curl -kL https://github.com/googleapis/googleapis/archive/master.tar.gz | tar --strip=1 -zxvf - googleapis-master/google/api

docker run --user=$$(id -u):$$(id -g) --rm --entrypoint=sh -v "${PWD}"/v1/:/out -w /out -v "${PWD}":/protos pseudomuto/protoc-gen-doc:1.5.1 -c "protoc -I /protos --doc_out=/out --doc_opt=markdown,autogen.md /protos/*.proto"
docker run --user=$$(id -u):$$(id -g) --rm --entrypoint=sh \
-v "${PWD}/${APIVER}":/out \
-v "${PWD}/../network/opinetcommon":/opinetcommon \
-w /out \
-v "${PWD}":/protos \
pseudomuto/protoc-gen-doc:1.5.1 -c "protoc -I /protos -I /opinetcommon --doc_out=/out --doc_opt=markdown,autogen.md /protos/*.proto"

rm -rf "${PWD}"/google

buflint:
docker run --rm -v "${PWD}":/out -w /out bufbuild/buf lint

bufgen:
docker run --rm -v "${PWD}/..":/base -v "${PWD}":/out -w /out msandersdell/bufbuild-go-gen:1.1.0 generate --template /base/buf.gen.yaml -o v1
docker run --rm -v "${PWD}/..":/base -v "${PWD}":/out -w /out msandersdell/bufbuild-go-gen:1.1.0 generate --template /base/buf.gen.yaml -o ${APIVER}
11 changes: 3 additions & 8 deletions security/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,7 @@

## Documentation for Reference

* [strongSwan VICI Protocol](https://www.strongswan.org/apidoc/md_src_libcharon_plugins_vici_README.html)
* [vici protocol](https://github.com/strongswan/strongswan/blob/master/src/libcharon/plugins/vici/README.md)
* [govici](https://github.com/strongswan/govici)
* [RFC 9061](https://datatracker.ietf.org/doc/rfc9061/)

## Terminology

Expand All @@ -28,11 +26,8 @@ even more specifically. currently on the IPsec portion of that API.

## Architecture

The OPI Security APIs are currently focusing on implementing an IPsec API which
maps on top of the [strongSwan](https://www.strongswan.org)
[vici Plugin](https://docs.strongswan.org/docs/5.9/plugins/vici.html). For
more details on the vici protocol, you can look at the strongSwan documentation
found [here](https://github.com/strongswan/strongswan/blob/master/src/libcharon/plugins/vici/README.md).
This version of the OPI Security APIs are based on the IPsec configuration
model from on [RFC 9061](https://datatracker.ietf.org/doc/rfc9061/).

The architecture is seen in the diagram below.

Expand Down
13 changes: 9 additions & 4 deletions security/buf.lock
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,15 @@ deps:
- remote: buf.build
owner: googleapis
repository: googleapis
commit: 28151c0d0a1641bf938a7672c500e01d
digest: shake256:49215edf8ef57f7863004539deff8834cfb2195113f0b890dd1f67815d9353e28e668019165b9d872395871eeafcbab3ccfdb2b5f11734d3cca95be9e8d139de
commit: f0e53af8f2fc4556b94f482688b57223
digest: shake256:de26a277fc28b8b411ecf58729d78d32fcf15090ffd998a4469225b17889bfb51442eaab04bb7a8d88d203ecdf0a9febd4ffd52c18ed1c2229160c7bd353ca95
- remote: buf.build
owner: grpc-ecosystem
repository: grpc-gateway
commit: f460f71081c14a80b66cc72526e0b322
digest: shake256:122def85e91fc3ef4ab351680060b8f70e9d09a7ae6d1412aeb2bddfeee5c4d3fc8819da33fef56192cec0a817ac0c3e6d49bb2acf02eb5c9e9131739a60ddfc
commit: f04e50c23f5f40f786d0e8fa3fe3d713
digest: shake256:67b115260e12cb2d6c5d5ce8dbbf3a095c86f0e52b84f9dbd16dec9433b218f8694bc9aadb1d45eb6fd52f5a7029977d460e2d58afb3208ab6c680e7b21c80e4
- remote: buf.build
owner: opiproject
repository: opinetcommon
commit: 9779e55c83de44b3a14925b8195cf7e7
digest: shake256:20d43132a22c5d3341919f5167669f137b79b23e807a5c34a3168216a28e07a114f3f7a94b73925f824befd5862ac354d5ad45a3136761ca429f041286657524
3 changes: 2 additions & 1 deletion security/buf.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ name: buf.build/opiproject/security
deps:
- buf.build/googleapis/googleapis
- buf.build/grpc-ecosystem/grpc-gateway
- buf.build/opiproject/opinetcommon
lint:
except:
- PACKAGE_DIRECTORY_MATCH
- PACKAGE_DIRECTORY_MATCH
Loading

0 comments on commit 840235f

Please sign in to comment.