Skip to content

Commit afea034

Browse files
werwurmwerwurm
committed
Add nat20cli command line tool for nat20device.
This commandline tool provides a primitive interface to communicate with a nat20 device.
1 parent 46066d2 commit afea034

9 files changed

Lines changed: 1354 additions & 1 deletion

File tree

‎examples/linux/br_external/Config.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
# along with this program; if not, see
3434
# <https://www.gnu.org/licenses/>.
3535

36+
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20cli/Config.in"
3637
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20crypto/Config.in"
3738
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20device/Config.in"
3839
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20sw/Config.in"

‎examples/linux/br_external/configs/qemu_br_defconfig‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3976,6 +3976,7 @@ BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR=""
39763976
#
39773977
# Provides NAT20 related packages.
39783978
#
3979+
BR2_PACKAGE_NAT20CLI=y
39793980
BR2_PACKAGE_NAT20CRYPTO=y
39803981
BR2_PACKAGE_NAT20DEVICE=y
39813982
BR2_PACKAGE_NAT20SW=y

‎examples/linux/br_external/package/nat20cli/Config.in‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
config BR2_PACKAGE_NAT20CLI
37+
bool "nat20cli"
38+
depends on BR2_PACKAGE_LIBNAT20
39+
help
40+
Enable building the nat20cli tool.

‎examples/linux/br_external/package/nat20cli/nat20cli.mk‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
NAT20CLI_VERSION = origin/main
37+
NAT20CLI_SITE = https://github.com/aurora-opensource/libnat20.git
38+
NAT20CLI_SITE_METHOD = git
39+
NAT20CLI_SUBDIR = examples/linux/nat20cli
40+
NAT20CLI_LICENSE = Apache-2.0
41+
42+
NAT20CLI_INSTALL_TARGET = YES
43+
NAT20CLI_DEPENDENCIES += libnat20
44+
45+
$(eval $(cmake-package))

‎examples/linux/br_external/utils/envsetup.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ fi
4646

4747
source .env
4848

49+
export NAT20CLI_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
4950
export NAT20CRYPTO_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5051
export NAT20SW_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5152
export NAT20DEVICE_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
@@ -71,6 +72,7 @@ function brrebuild() {
7172
echo "Available targets:"
7273
echo " all - Rebuild all components"
7374
echo " linux - Rebuild the linux kernel"
75+
echo " nat20cli - Rebuild the Dice CLI"
7476
echo " nat20crypto - Rebuild the nat20crypto module"
7577
echo " libnat20 - Rebuild the libnat20 library"
7678
echo " nat20device - Rebuild the nat20device module"
@@ -82,7 +84,7 @@ function brrebuild() {
8284

8385
case "$1" in
8486
all)
85-
ensure_popd make linux-rebuild nat20crypto-rebuild libnat20-rebuild nat20device-rebuild nat20sw-rebuild nat20lib-rebuild all
87+
ensure_popd make linux-rebuild nat20cli-rebuild nat20crypto-rebuild libnat20-rebuild nat20device-rebuild nat20sw-rebuild nat20lib-rebuild all
8688
;;
8789
*)
8890
ensure_popd make $1-rebuild all

‎examples/linux/nat20cli/CMakeLists.txt‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
cmake_minimum_required(VERSION 3.22)
37+
38+
project(NAT20CLI VERSION 0.0.1 LANGUAGES C)
39+
40+
# The C standard shall be C11.
41+
set(CMAKE_C_STANDARD 11)
42+
43+
# CMake shall generate a compile_commands.json file for
44+
# the benfit of clangd based IDE support.
45+
set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
46+
47+
###################################################################################################
48+
# The following section defines all the groups of source files.
49+
# All files must be specified explicitly; no globbing or other generation is allowed.
50+
51+
set(NAT20CLI_SOURCES
52+
# Add the core library source files here.
53+
src/main.c
54+
)
55+
56+
###################################################################################################
57+
58+
###################################################################################################
59+
# The nat20_service library is also part of the product of this project.
60+
# It will always be compiled.
61+
add_executable(nat20cli)
62+
63+
find_package(LibNat20 REQUIRED)
64+
65+
target_sources(nat20cli
66+
PRIVATE ${NAT20CLI_SOURCES}
67+
)
68+
69+
target_link_libraries(nat20cli PRIVATE LibNat20::nat20 LibNat20::nat20_service LibNat20::nat20_crypto_nat20)
70+
71+
target_compile_options(nat20cli
72+
PRIVATE -pedantic
73+
PRIVATE -Wall
74+
PRIVATE -Wextra
75+
PRIVATE -Werror
76+
)
77+
78+
install(TARGETS nat20cli RUNTIME DESTINATION bin)
79+
install(PROGRAMS nat20clitest.sh DESTINATION bin)
80+
install(FILES openssl_dice.cnf DESTINATION bin)
81+
82+
###################################################################################################

‎examples/linux/nat20cli/nat20clitest.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/sh
2+
3+
# Copyright 2026 Aurora Operations, Inc.
4+
#
5+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
6+
#
7+
# This work is dual licensed.
8+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
9+
#
10+
# Licensed under the Apache License, Version 2.0 (the "License");
11+
# you may not use this file except in compliance with the License.
12+
# You may obtain a copy of the License at
13+
#
14+
# http://www.apache.org/licenses/LICENSE-2.0
15+
#
16+
# Unless required by applicable law or agreed to in writing, software
17+
# distributed under the License is distributed on an "AS IS" BASIS,
18+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19+
# See the License for the specific language governing permissions and
20+
# limitations under the License.
21+
#
22+
# OR
23+
#
24+
# This program is free software; you can redistribute it and/or
25+
# modify it under the terms of the GNU General Public License
26+
# as published by the Free Software Foundation; either version 2
27+
# of the License, or (at your option) any later version.
28+
#
29+
# This program is distributed in the hope that it will be useful,
30+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
31+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
32+
# GNU General Public License for more details.
33+
#
34+
# You should have received a copy of the GNU General Public License
35+
# along with this program; if not, see
36+
# <https://www.gnu.org/licenses/>.
37+
38+
SCRIPT_DIR="$(dirname "$0")"
39+
export OPENSSL_CONF="${SCRIPT_DIR}/openssl_dice.cnf"
40+
41+
modprobe nat20sw
42+
mount -t securityfs none /sys/kernel/security
43+
44+
nat20cli cdi-cert --key-type p256 --parent-key-type p256 --output cdi_0.der --certificate-format x509 --code-desc 795375622d322e332e343a33386334353963666164666132623839353333363939353465313266373534386433613161633937336338383830303563336236646232333436636263386631 --code 228d8f76c811276e991012cf5f46090377fc72c95a6ef9e1ccd4eebec8997be5b57f0fb2c7f4804af212711e7b49533f8bc00ddee9480f76155b3da1101604b9 --conf-desc 45787472616f7264696e617279206e6f726d616c20636f6e66696775726174696f6e --conf 671e957aff5565a55961dcaef7634f1a665d8f286e7bd99593532741417f22981b57bdc39241c9685f7377e3622067c261c3ce974e6db5f18d121adad2d76185 --auth-desc 41206365727469666963617465 --auth 50808e4ab921ecf31ca5f662b6d8b85b98ec4d3f64175c8b5d70c1f0e2fef048f87b3178907e1f2d652bd8588fa84f4c374347cc34b97dae13a5b981790b38cb --mode normal --hidden 2f299d2cc916e5219a6bcbc14c7135fa25e9a71018c2bafe8c0658d4041de6c87aa444aedcc68e7d7674b81b5838be1b74bf19d4d6fb05fb0db9ee7e297afc09
45+
nat20cli cdi-cert --key-type p256 --parent-key-type p256 --output cdi_0.cose --certificate-format cose --code-desc 795375622d322e332e343a33386334353963666164666132623839353333363939353465313266373534386433613161633937336338383830303563336236646232333436636263386631 --code 228d8f76c811276e991012cf5f46090377fc72c95a6ef9e1ccd4eebec8997be5b57f0fb2c7f4804af212711e7b49533f8bc00ddee9480f76155b3da1101604b9 --conf-desc 45787472616f7264696e617279206e6f726d616c20636f6e66696775726174696f6e --conf 671e957aff5565a55961dcaef7634f1a665d8f286e7bd99593532741417f22981b57bdc39241c9685f7377e3622067c261c3ce974e6db5f18d121adad2d76185 --auth-desc 41206365727469666963617465 --auth 50808e4ab921ecf31ca5f662b6d8b85b98ec4d3f64175c8b5d70c1f0e2fef048f87b3178907e1f2d652bd8588fa84f4c374347cc34b97dae13a5b981790b38cb --mode normal --hidden 2f299d2cc916e5219a6bcbc14c7135fa25e9a71018c2bafe8c0658d4041de6c87aa444aedcc68e7d7674b81b5838be1b74bf19d4d6fb05fb0db9ee7e297afc09
46+
nat20cli promote -i 790fd72ee1352017d822773bc8f5c1ac6e4bf310dfac72fbff622368c01372bc78324f0c06cbc37964e32b18588560a386357e4517ffe93052c67fe6213c38bc
47+
nat20cli cdi-cert --key-type p256 --parent-key-type p256 --output cdi_1.der --certificate-format x509 --code-desc 795375622d322e332e343a33386334353963666164666132623839353333363939353465313266373534386433613161633937336338383830303563336236646232333436636263386631 --code 228d8f76c811276e991012cf5f46090377fc72c95a6ef9e1ccd4eebec8997be5b57f0fb2c7f4804af212711e7b49533f8bc00ddee9480f76155b3da1101604b9 --conf-desc 45787472616f7264696e617279206e6f726d616c20636f6e66696775726174696f6e --conf 671e957aff5565a55961dcaef7634f1a665d8f286e7bd99593532741417f22981b57bdc39241c9685f7377e3622067c261c3ce974e6db5f18d121adad2d76185 --auth-desc 41206365727469666963617465 --auth 50808e4ab921ecf31ca5f662b6d8b85b98ec4d3f64175c8b5d70c1f0e2fef048f87b3178907e1f2d652bd8588fa84f4c374347cc34b97dae13a5b981790b38cb --mode normal --hidden 2f299d2cc916e5219a6bcbc14c7135fa25e9a71018c2bafe8c0658d4041de6c87aa444aedcc68e7d7674b81b5838be1b74bf19d4d6fb05fb0db9ee7e297afc09
48+
nat20cli cdi-cert --key-type p256 --parent-key-type p256 --output cdi_1.cose --certificate-format cose --code-desc 795375622d322e332e343a33386334353963666164666132623839353333363939353465313266373534386433613161633937336338383830303563336236646232333436636263386631 --code 228d8f76c811276e991012cf5f46090377fc72c95a6ef9e1ccd4eebec8997be5b57f0fb2c7f4804af212711e7b49533f8bc00ddee9480f76155b3da1101604b9 --conf-desc 45787472616f7264696e617279206e6f726d616c20636f6e66696775726174696f6e --conf 671e957aff5565a55961dcaef7634f1a665d8f286e7bd99593532741417f22981b57bdc39241c9685f7377e3622067c261c3ce974e6db5f18d121adad2d76185 --auth-desc 41206365727469666963617465 --auth 50808e4ab921ecf31ca5f662b6d8b85b98ec4d3f64175c8b5d70c1f0e2fef048f87b3178907e1f2d652bd8588fa84f4c374347cc34b97dae13a5b981790b38cb --mode normal --hidden 2f299d2cc916e5219a6bcbc14c7135fa25e9a71018c2bafe8c0658d4041de6c87aa444aedcc68e7d7674b81b5838be1b74bf19d4d6fb05fb0db9ee7e297afc09
49+
50+
openssl x509 -inform der -outform pem -in cdi_0.der -out cdi_0.pem
51+
openssl x509 -inform der -outform pem -in cdi_1.der -out cdi_1.pem
52+
openssl x509 -inform der -in /sys/kernel/security/nat200/dice_chain -outform pem -out uds_cert_p256.pem
53+
54+
cat uds_cert_p256.pem cdi_0.pem > chain.pem
55+
56+
openssl x509 -inform pem -in uds_cert_p256.pem -noout -text
57+
openssl x509 -inform pem -in cdi_0.pem -noout -text
58+
openssl x509 -inform pem -in cdi_1.pem -noout -text
59+
60+
openssl verify -ignore_critical -CAfile chain.pem cdi_1.pem
61+
62+
63+
# nat20cli cdi-cert --key-type p384 --parent-key-type p384 --output /run/cdi0 --certificate-format cose --code-desc 795375622d322e332e343a33386334353963666164666132623839353333363939353465313266373534386433613161633937336338383830303563336236646232333436636263386631 --code 228d8f76c811276e991012cf5f46090377fc72c95a6ef9e1ccd4eebec8997be5b57f0fb2c7f4804af212711e7b49533f8bc00ddee9480f76155b3da1101604b9 --conf-desc 45787472616f7264696e617279206e6f726d616c20636f6e66696775726174696f6e --conf 671e957aff5565a55961dcaef7634f1a665d8f286e7bd99593532741417f22981b57bdc39241c9685f7377e3622067c261c3ce974e6db5f18d121adad2d76185 --auth-desc 41206365727469666963617465 --auth 50808e4ab921ecf31ca5f662b6d8b85b98ec4d3f64175c8b5d70c1f0e2fef048f87b3178907e1f2d652bd8588fa84f4c374347cc34b97dae13a5b981790b38cb --mode normal --hidden 2f299d2cc916e5219a6bcbc14c7135fa25e9a71018c2bafe8c0658d4041de6c87aa444aedcc68e7d7674b81b5838be1b74bf19d4d6fb05fb0db9ee7e297afc09
64+
# nat20cli cdi-cert --key-type p384 --parent-key-type p384 --output /run/cdi1 --certificate-format cose --code-desc 795375622d322e332e343a33386334353963666164666132623839353333363939353465313266373534386433613161633937336338383830303563336236646232333436636263386631 --code 228d8f76c811276e991012cf5f46090377fc72c95a6ef9e1ccd4eebec8997be5b57f0fb2c7f4804af212711e7b49533f8bc00ddee9480f76155b3da1101604b9 --conf-desc 45787472616f7264696e617279206e6f726d616c20636f6e66696775726174696f6e --conf 671e957aff5565a55961dcaef7634f1a665d8f286e7bd99593532741417f22981b57bdc39241c9685f7377e3622067c261c3ce974e6db5f18d121adad2d76185 --auth-desc 41206365727469666963617465 --auth 50808e4ab921ecf31ca5f662b6d8b85b98ec4d3f64175c8b5d70c1f0e2fef048f87b3178907e1f2d652bd8588fa84f4c374347cc34b97dae13a5b981790b38cb --mode normal --hidden 2f299d2cc916e5219a6bcbc14c7135fa25e9a71018c2bafe8c0658d4041de6c87aa444aedcc68e7d7674b81b5838be1b74bf19d4d6fb05fb0db9ee7e297afc09

‎examples/linux/nat20cli/openssl_dice.cnf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
# OpenSSL configuration for DICE certificate extensions.
37+
#
38+
# DICE certificates contain critical X.509v3 extensions with OIDs that
39+
# vanilla OpenSSL does not recognize. This config registers their names
40+
# for human-readable display in `openssl x509 -text` output.
41+
#
42+
# Because OpenSSL has no config-level mechanism to register handlers for
43+
# custom critical extensions, `openssl verify` must also be invoked with
44+
# -ignore_critical when verifying DICE certificate chains.
45+
#
46+
# Usage:
47+
# export OPENSSL_CONF=/path/to/openssl_dice.cnf
48+
# openssl x509 -in cert.pem -noout -text
49+
# openssl verify -ignore_critical -CAfile chain.pem leaf.pem
50+
51+
openssl_conf = openssl_init
52+
53+
[openssl_init]
54+
oid_section = dice_oids
55+
56+
[dice_oids]
57+
openDiceInput = Open DICE Input, 1.3.6.1.4.1.11129.2.1.24
58+
tcgDiceTcbInfo = TCG DICE TCB Info, 2.23.133.5.4.1
59+
tcgDiceMultiTcbInfo = TCG DICE Multi-TCB Info, 2.23.133.5.4.5
60+
tcgDiceUeid = TCG DICE UEID, 2.23.133.5.4.4
61+
tcgDiceTcbFreshness = TCG DICE TCB Freshness, 2.23.133.5.4.11

0 commit comments

Comments
 (0)