From 409bb9c0868f5d254126003dfd181d5b0d5de615 Mon Sep 17 00:00:00 2001 From: Tim Bruijnzeels Date: Sat, 13 Aug 2022 09:26:29 +0200 Subject: [PATCH] Keep parent ID cert PEM in history #870 --- src/commons/api/admin.rs | 30 +++++++++++++----------- src/daemon/ca/manager.rs | 9 ++----- src/upgrades/mod.rs | 4 ++++ src/upgrades/pre_0_10_0/cas_migration.rs | 6 +---- src/upgrades/pre_0_10_0/old_events.rs | 10 +++----- 5 files changed, 26 insertions(+), 33 deletions(-) diff --git a/src/commons/api/admin.rs b/src/commons/api/admin.rs index 02852224..fb84c26f 100644 --- a/src/commons/api/admin.rs +++ b/src/commons/api/admin.rs @@ -340,28 +340,28 @@ pub struct ParentServerInfo { /// The URI where the CA needs to send its RFC6492 messages service_uri: ServiceUri, - /// The parent CA's public key - public_key: PublicKey, - /// The handle the parent CA likes to be called by. parent_handle: ParentHandle, /// The handle the parent CA chose for the child CA. child_handle: ChildHandle, + + /// The parent's ID cert. + id_cert: IdCertInfo, } impl ParentServerInfo { pub fn new( service_uri: ServiceUri, - public_key: PublicKey, parent_handle: ParentHandle, child_handle: ChildHandle, + id_cert: IdCertInfo, ) -> Self { ParentServerInfo { service_uri, - public_key, parent_handle, child_handle, + id_cert, } } @@ -369,10 +369,6 @@ impl ParentServerInfo { &self.service_uri } - pub fn public_key(&self) -> &PublicKey { - &self.public_key - } - pub fn parent_handle(&self) -> &ParentHandle { &self.parent_handle } @@ -380,14 +376,21 @@ impl ParentServerInfo { pub fn child_handle(&self) -> &ChildHandle { &self.child_handle } + + pub fn id_cert(&self) -> &IdCertInfo { + &self.id_cert + } } impl fmt::Display for ParentServerInfo { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { writeln!(f, "service uri: {}", self.service_uri)?; - writeln!(f, "key identifier: {}", self.public_key.key_identifier())?; writeln!(f, "parent handle: {}", self.parent_handle)?; - writeln!(f, "child handle: {}", self.child_handle) + writeln!(f, "child handle: {}", self.child_handle)?; + writeln!(f, "parent certificate:")?; + writeln!(f, " key identifier: {}", self.id_cert().public_key().key_identifier())?; + writeln!(f, " hash (of cert): {}", self.id_cert().hash())?; + writeln!(f, " PEM:\n\n{}", self.id_cert().pem()) } } @@ -411,18 +414,17 @@ impl ParentCaContact { pub fn for_rfc8183_parent_response(response: idexchange::ParentResponse) -> Result { let id_cert = response.validate()?; + let id_cert = IdCertInfo::from(&id_cert); let service_uri = response.service_uri().clone(); - let pub_key = id_cert.public_key().clone(); - let parent_handle = response.parent_handle().clone(); let child_handle = response.child_handle().clone(); Ok(ParentCaContact::Rfc6492(ParentServerInfo { service_uri, - public_key: pub_key, parent_handle, child_handle, + id_cert, })) } diff --git a/src/daemon/ca/manager.rs b/src/daemon/ca/manager.rs index ee09bc27..afd9d36a 100644 --- a/src/daemon/ca/manager.rs +++ b/src/daemon/ca/manager.rs @@ -485,12 +485,7 @@ impl CaManager { let service_uri = Self::service_uri_for_ca(service_uri, ca_handle); let ca = self.get_ca(ca_handle).await?; - let server_info = ParentServerInfo::new( - service_uri, - ca.id_cert().public_key().clone(), - ca_handle.convert(), - child_handle, - ); + let server_info = ParentServerInfo::new(service_uri, ca_handle.convert(), child_handle, ca.id_cert().clone()); Ok(ParentCaContact::for_parent_server_info(server_info)) } @@ -1445,7 +1440,7 @@ impl CaManager { cms_logger.err(format!("Could not decode CMS: {}", e))?; Err(Error::Rfc6492(e)) } - Ok(cms) => match cms.validate(server_info.public_key()) { + Ok(cms) => match cms.validate(server_info.id_cert().public_key()) { Err(e) => { cms_logger.err(format!("Response invalid: {}", e))?; Err(Error::Rfc6492(e)) diff --git a/src/upgrades/mod.rs b/src/upgrades/mod.rs index 38e1f4d9..3018725b 100644 --- a/src/upgrades/mod.rs +++ b/src/upgrades/mod.rs @@ -395,6 +395,10 @@ pub fn prepare_upgrade_data_migrations(mode: UpgradeMode, config: Arc) - } Ok(Some(UpgradeReport::new(true, versions))) + } else if versions.from < KrillVersion::candidate(0, 10, 0, 3) { + Err(PrepareUpgradeError::custom( + "Cannot upgrade from 0.10.0 RC1 or RC2. Please contact rpki-team@nlnetlabs.nl", + )) } else { Ok(Some(UpgradeReport::new(false, versions))) } diff --git a/src/upgrades/pre_0_10_0/cas_migration.rs b/src/upgrades/pre_0_10_0/cas_migration.rs index 85899b1d..c370e650 100644 --- a/src/upgrades/pre_0_10_0/cas_migration.rs +++ b/src/upgrades/pre_0_10_0/cas_migration.rs @@ -9,7 +9,6 @@ use crate::{ commons::{ api::StorableCaCommand, eventsourcing::{AggregateStore, KeyStoreKey, KeyValueStore, StoredCommand, StoredValueInfo}, - util::KrillVersion, }, constants::{CASERVER_DIR, CA_OBJECTS_DIR, KRILL_VERSION}, daemon::{ @@ -86,10 +85,7 @@ impl CasMigration { impl UpgradeStore for CasMigration { fn needs_migrate(&self) -> Result { - Ok(self.current_kv_store.version_is_after(KrillVersion::release(0, 9, 0))? - && self - .current_kv_store - .version_is_before(KrillVersion::candidate(0, 10, 0, 1))?) + unimplemented!("This is checked in upgrades/mod.rs") } fn prepare_new_data(&self, mode: UpgradeMode) -> Result<(), PrepareUpgradeError> { diff --git a/src/upgrades/pre_0_10_0/old_events.rs b/src/upgrades/pre_0_10_0/old_events.rs index ad081ea2..f2b4eceb 100644 --- a/src/upgrades/pre_0_10_0/old_events.rs +++ b/src/upgrades/pre_0_10_0/old_events.rs @@ -22,7 +22,7 @@ use rpki::{ use crate::{ commons::{ api::{ - AspaCustomer, AspaDefinition, AspaProvidersUpdate, CertInfo, IssuedCertificate, ObjectName, + AspaCustomer, AspaDefinition, AspaProvidersUpdate, CertInfo, IdCertInfo, IssuedCertificate, ObjectName, ParentCaContact, ParentServerInfo, PublicationServerInfo, ReceivedCert, RepositoryContact, Revocation, Revocations, RoaAggregateKey, RtaName, SuspendedCert, TaCertDetails, TrustAnchorLocator, UnsuspendedCert, }, @@ -298,12 +298,8 @@ pub struct OldParentResponse { impl From for ParentServerInfo { fn from(old: OldParentResponse) -> Self { - ParentServerInfo::new( - old.service_uri, - old.id_cert.public_key().clone(), - old.parent_handle, - old.child_handle, - ) + let id_cert_info = IdCertInfo::from(&old.id_cert); + ParentServerInfo::new(old.service_uri, old.parent_handle, old.child_handle, id_cert_info) } }