WEBDIENSTE/NLnetLabs-krill
1
0
Fork 0
mirror of https://github.com/NLnetLabs/krill.git synced 2026-09-20 16:37:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove TA specific API code. TA is now initialised from krill.conf. Closes #67

Browse Source
This commit is contained in:
Tim Bruijnzeels
2019-09-09 11:17:29 +02:00
parent 2d70997ee3
commit d22f030571
21 changed files with 125 additions and 594 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/client.rs
+1 -37
View File
@@ -7,7 +7,6 @@ use rpki::uri;
use krill_commons::api::{
CertAuthInfo, ParentCaContact, PublisherDetails, PublisherList, PublisherRequest, Token,
TrustAnchorInfo,
};
use krill_commons::remote::api::{ClientAuth, ClientInfo};
use krill_commons::remote::rfc8183;
@@ -15,9 +14,7 @@ use krill_commons::remote::rfc8183::RepositoryResponse;
use krill_commons::util::file;
use krill_commons::util::httpclient;
use crate::options::{
CaCommand, Command, Options, PublishersCommand, Rfc8181Command, TrustAnchorCommand,
};
use crate::options::{CaCommand, Command, Options, PublishersCommand, Rfc8181Command};
use crate::report::{ApiResponse, ReportError};
/// Command line tool for Krill admin tasks
@@ -49,7 +46,6 @@ impl KrillClient {
};
match options.command {
Command::Health => client.health(),
Command::TrustAnchor(cmd) => client.trustanchor(cmd),
Command::CertAuth(cmd) => client.certauth(cmd),
Command::Publishers(cmd) => client.publishers(cmd),
Command::Rfc8181(cmd) => client.rfc8181(cmd),
@@ -62,38 +58,6 @@ impl KrillClient {
Ok(ApiResponse::Health)
}
fn trustanchor(&self, command: TrustAnchorCommand) -> Result<ApiResponse, Error> {
match command {
TrustAnchorCommand::Init => {
let uri = self.resolve_uri("api/v1/trustanchor");
httpclient::post_empty(&uri, Some(&self.token))?;
Ok(ApiResponse::Empty)
}
TrustAnchorCommand::Show => {
let uri = self.resolve_uri("api/v1/trustanchor");
let ta: TrustAnchorInfo = self.get_json(&uri)?;
Ok(ApiResponse::TrustAnchorInfo(ta))
}
TrustAnchorCommand::Publish => {
let uri = self.resolve_uri("api/v1/republish");
httpclient::post_empty(&uri, Some(&self.token))?;
Ok(ApiResponse::Empty)
}
TrustAnchorCommand::AddChild(req) => {
let uri = self.resolve_uri("api/v1/trustanchor/children");
let info: ParentCaContact =
httpclient::post_json_with_response(&uri, req, Some(&self.token))?;
Ok(ApiResponse::ParentCaContact(info))
}
TrustAnchorCommand::UpdateChild(child, req) => {
let uri = format!("api/v1/trustanchor/children/{}", child);
let uri = self.resolve_uri(&uri);
httpclient::post_json(&uri, req, Some(&self.token))?;
Ok(ApiResponse::Empty)
}
}
}
fn certauth(&self, command: CaCommand) -> Result<ApiResponse, Error> {
match command {
CaCommand::Init(init) => {
client/src/options.rs
+2 -213
View File
@@ -74,121 +74,6 @@ impl Options {
all is well, exit code 1 in case of any issues")
)
.subcommand(SubCommand::with_name("trustanchor")
.about("Manage embedded Trust Anchor (used for testing)")
.subcommand(SubCommand::with_name("init")
.about("Initialise embedded TA.")
)
.subcommand(SubCommand::with_name("show")
.about("Show embedded TA details.")
)
.subcommand(SubCommand::with_name("publish")
.about("Force publication for embedded TA now.")
)
.subcommand(SubCommand::with_name("children")
.about("Manage children of the embbeded TA")
.subcommand(SubCommand::with_name("add")
.about("Add a child to the embedded CA")
.arg(Arg::with_name("asn")
.short("a")
.long("asn")
.value_name("AS resources")
.help("The delegated AS resources: e.g. AS1, AS3-4")
.required(false)
)
.arg(Arg::with_name("ipv4")
.short("4")
.long("ipv4")
.value_name("IPv4 resources")
.help("The delegated IPv4 resources: e.g. 192.168.0.0/16")
.required(false)
)
.arg(Arg::with_name("ipv6")
.short("6")
.long("ipv6")
.value_name("IPv6 resources")
.help("The delegated IPv6 resources: e.g. 2001:db8::/32")
.required(false)
)
.subcommand(SubCommand::with_name("embedded")
.about("Add an embedded child")
.arg(Arg::with_name("handle")
.short("h")
.long("handle")
.value_name("child-handle")
.help("The handle of the child")
.required(true)
)
)
.subcommand(SubCommand::with_name("rfc6492")
.about("Add an RFC 6492 child")
.arg(Arg::with_name("handle")
.short("h")
.long("handle")
.value_name("child-handle")
.help("Override the handle in the XML")
.required(false)
)
.arg(Arg::with_name("xml")
.short("x")
.long("xml")
.value_name("FILE")
.help("RFC 8183 Child Request XML")
.required(true)
)
)
)
.subcommand(SubCommand::with_name("update")
.about("Update details for a child")
.arg(Arg::with_name("handle")
.short("h")
.long("handle")
.value_name("child-handle")
.help("Override the handle in the XML")
.required(false)
)
.arg(Arg::with_name("xml")
.short("x")
.long("xml")
.value_name("FILE")
.help("Update child certificate from RFC 8183 Child Request XML")
.required(false)
)
.arg(Arg::with_name("asn")
.short("a")
.long("asn")
.value_name("AS resources")
.help("Update the delegated AS resources: e.g. AS1, AS3-4")
.required(false)
)
.arg(Arg::with_name("ipv4")
.short("4")
.long("ipv4")
.value_name("IPv4 resources")
.help("Update the delegated IPv4 resources: e.g. 192.168.0.0/16")
.required(false)
)
.arg(Arg::with_name("ipv6")
.short("6")
.long("ipv6")
.value_name("IPv6 resources")
.help("Update the delegated IPv6 resources: e.g. 2001:db8::/32")
.required(false)
)
.arg(Arg::with_name("force")
.short("f")
.long("force")
.takes_value(false)
.help("Force resource shrink now.")
.required(false)
)
)
)
)
.subcommand(SubCommand::with_name("cas")
.about("Manage CAs")
.subcommand(SubCommand::with_name("list")
@@ -510,89 +395,6 @@ impl Options {
command = Command::Health;
}
if let Some(m) = matches.subcommand_matches("trustanchor") {
if let Some(_m) = m.subcommand_matches("show") {
command = Command::TrustAnchor(TrustAnchorCommand::Show)
}
if let Some(_m) = m.subcommand_matches("init") {
command = Command::TrustAnchor(TrustAnchorCommand::Init)
}
if let Some(_m) = m.subcommand_matches("publish") {
command = Command::TrustAnchor(TrustAnchorCommand::Publish)
}
if let Some(m) = m.subcommand_matches("children") {
if let Some(m) = m.subcommand_matches("add") {
let asn = m.value_of("asn").unwrap_or("");
let ipv4 = m.value_of("ipv4").unwrap_or("");
let ipv6 = m.value_of("ipv6").unwrap_or("");
if let Some(m) = m.subcommand_matches("embedded") {
let handle = Handle::from(m.value_of("handle").unwrap());
let res = ResourceSet::from_strs(asn, ipv4, ipv6).unwrap();
let auth = ChildAuthRequest::Embedded;
let req = AddChildRequest::new(handle, res, auth);
command = Command::TrustAnchor(TrustAnchorCommand::AddChild(req))
}
if let Some(m) = m.subcommand_matches("rfc6492") {
let xml_path = m.value_of("xml").unwrap();
let xml = PathBuf::from(xml_path);
let bytes = file::read(&xml)?;
let cr = rfc8183::ChildRequest::validate(bytes.as_ref())?;
let handle = {
if let Some(handle) = m.value_of("handle") {
Handle::from(handle)
} else {
cr.child_handle().clone()
}
};
let res = ResourceSet::from_strs(asn, ipv4, ipv6)?;
let auth = ChildAuthRequest::Rfc8183(cr);
let req = AddChildRequest::new(handle, res, auth);
command = Command::TrustAnchor(TrustAnchorCommand::AddChild(req))
}
}
if let Some(m) = m.subcommand_matches("update") {
let handle = Handle::from(m.value_of("handle").unwrap());
let cert = match m.value_of("xml") {
Some(xml_path) => {
let xml = PathBuf::from(xml_path);
let bytes = file::read(&xml)?;
let cr = rfc8183::ChildRequest::validate(bytes.as_ref())?;
let (_, _, cert) = cr.unwrap();
Some(cert)
}
None => None,
};
let asn = m.value_of("asn").unwrap_or("");
let ipv4 = m.value_of("ipv4").unwrap_or("");
let ipv6 = m.value_of("ipv6").unwrap_or("");
let resources = ResourceSet::from_strs(asn, ipv4, ipv6)?;
let resources = if resources.is_empty() {
None
} else {
Some(resources)
};
let req = if m.is_present("force") {
UpdateChildRequest::force(cert, resources)
} else {
UpdateChildRequest::graceful(cert, resources)
};
command = Command::TrustAnchor(TrustAnchorCommand::UpdateChild(handle, req))
}
}
}
if let Some(m) = matches.subcommand_matches("cas") {
if let Some(m) = m.subcommand_matches("add") {
let handle = Handle::from(m.value_of("handle").unwrap());
@@ -637,10 +439,8 @@ impl Options {
let auth = ChildAuthRequest::Embedded;
let req = AddChildRequest::new(handle, res, auth);
command = Command::TrustAnchor(TrustAnchorCommand::AddChild(req))
}
if let Some(m) = m.subcommand_matches("rfc6492") {
command = Command::CertAuth(CaCommand::AddChild(ca, req))
} else if let Some(m) = m.subcommand_matches("rfc6492") {
let xml_path = m.value_of("xml").unwrap();
let xml = PathBuf::from(xml_path);
let bytes = file::read(&xml)?;
@@ -802,22 +602,11 @@ impl Options {
pub enum Command {
NotSet,
Health,
TrustAnchor(TrustAnchorCommand),
CertAuth(CaCommand),
Publishers(PublishersCommand),
Rfc8181(Rfc8181Command),
}
#[derive(Clone, Debug, Eq, PartialEq)]
#[allow(clippy::large_enum_variant)]
pub enum TrustAnchorCommand {
Init,
Show,
Publish,
AddChild(AddChildRequest),
UpdateChild(Handle, UpdateChildRequest),
}
#[derive(Clone, Debug, Eq, PartialEq)]
#[allow(clippy::large_enum_variant)]
pub enum CaCommand {
client/src/report.rs
+1 -45
View File
@@ -2,7 +2,7 @@ use std::str::{from_utf8_unchecked, FromStr};
use krill_commons::api::{
CertAuthInfo, CertAuthList, CurrentObjects, ParentCaContact, PublisherDetails, PublisherList,
RouteAuthorization, TrustAnchorInfo,
RouteAuthorization,
};
use krill_commons::remote::api::ClientInfo;
use krill_commons::remote::rfc8183;
@@ -16,8 +16,6 @@ use krill_commons::remote::rfc8183::RepositoryResponse;
pub enum ApiResponse {
Health,
TrustAnchorInfo(TrustAnchorInfo),
CertAuthInfo(CertAuthInfo),
CertAuths(CertAuthList),
RouteAuthorizations(Vec<RouteAuthorization>),
@@ -48,7 +46,6 @@ impl ApiResponse {
Err(ReportError::UnsupportedFormat)
}
}
ApiResponse::TrustAnchorInfo(ta) => Ok(Some(ta.report(fmt)?)),
ApiResponse::CertAuths(list) => Ok(Some(list.report(fmt)?)),
ApiResponse::CertAuthInfo(info) => Ok(Some(info.report(fmt)?)),
ApiResponse::RouteAuthorizations(auths) => Ok(Some(auths.report(fmt)?)),
@@ -111,47 +108,6 @@ trait Report {
fn report(&self, format: ReportFormat) -> Result<String, ReportError>;
}
impl Report for TrustAnchorInfo {
fn report(&self, format: ReportFormat) -> Result<String, ReportError> {
match format {
ReportFormat::Default | ReportFormat::Json => {
Ok(serde_json::to_string_pretty(self).unwrap())
}
ReportFormat::Text => {
let mut res = String::new();
let resources = self.resources();
res.push_str(&format!("ASNs: {}\n", resources.asn()));
res.push_str(&format!("IPv4: {}\n", resources.v4()));
res.push_str(&format!("IPv6: {}\n", resources.v6()));
res.push_str("\n");
res.push_str("TAL:\n");
res.push_str(&format!("{}", self.tal()));
res.push_str("\n");
res.push_str("\n");
res.push_str("Children:\n");
if !self.children().is_empty() {
for (name, details) in self.children() {
res.push_str(&format!("{}\n", name));
res.push_str(&format!(" resources: {}\n", details.entitled_resources()));
res.push_str("\n");
}
} else {
res.push_str("<none>");
}
Ok(res)
}
_ => Err(ReportError::UnsupportedFormat),
}
}
}
impl Report for CertAuthList {
fn report(&self, format: ReportFormat) -> Result<String, ReportError> {
match format {
commons/src/api/ca.rs
-51
View File
@@ -1310,57 +1310,6 @@ impl fmt::Display for ResourceSet {
}
}
//------------ TrustAnchorInfo -----------------------------------------------
/// This type represents the TrustAnchor details that need to be accessible
/// through the API (CLI and UI).
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorInfo {
resources: ResourceSet,
repo_info: RepoInfo,
children: HashMap<Handle, ChildCaInfo>,
cert: RcvdCert,
tal: TrustAnchorLocator,
}
impl TrustAnchorInfo {
pub fn new(
resources: ResourceSet,
repo_info: RepoInfo,
children: HashMap<Handle, ChildCaInfo>,
cert: RcvdCert,
tal: TrustAnchorLocator,
) -> Self {
TrustAnchorInfo {
resources,
repo_info,
children,
cert,
tal,
}
}
pub fn resources(&self) -> &ResourceSet {
&self.resources
}
pub fn repo_info(&self) -> &RepoInfo {
&self.repo_info
}
pub fn children(&self) -> &HashMap<Handle, ChildCaInfo> {
&self.children
}
pub fn cert(&self) -> &RcvdCert {
&self.cert
}
pub fn tal(&self) -> &TrustAnchorLocator {
&self.tal
}
}
//------------ CertAuthList --------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct CertAuthList {
daemon/defaults/krill.conf
+16 -4
View File
@@ -2,6 +2,12 @@
#ip = "localhost"
#port = 3000
# Have an embedded TA, for testing purposes. If set to 'true' then a TA
# will be initialised when Krill is started, if it hadn't been set up
# earlier.
#
# use_ta = false
# Specify whether https is to be used instead of plain http. Allowed values are
# "no", "yes" and "test". Defaults to "no".
#
@@ -29,10 +35,16 @@
# configuration.
#rsync_base = "rsync://localhost/repo/"
# Specify the notify SIA for this server. This will be reported in the
# response.xml files to publishers so that they can include the proper SIA
# in their certificates.
#rrdp_base_uri = "http://localhost:3000/rrdp/"
# Specify the base public URI to this service. Other URIs will be derived
# from this:
# <BASE_URI>rrdp/notification.xml (pub point or rrdp)
# <BASE_URI>rrdp/<session>/<version>/snapshot.xml
# <BASE_URI>rrdp/<session>/<version>/delta.xml
# <BASE_URI>ta/ta.cer (on TAL for embedded TA)
# <BASE_URI>rfc6492 (for remote children)
#
# MUST end with a slash.
#service_uri = "http://localhost:3000/"
# Log level
#
daemon/src/ca/certauth.rs
+1 -37
View File
@@ -14,8 +14,7 @@ use krill_commons::api::{
self, CertAuthInfo, EntitlementClass, Entitlements, Handle, IssuanceRequest, IssuanceResponse,
IssuedCert, ObjectsDelta, ParentCaContact, PubServerContact, RcvdCert, RepoInfo,
RequestResourceLimit, ResourceClassName, ResourceSet, RevocationRequest, RevocationResponse,
RouteAuthorization, RouteAuthorizationUpdates, SigningCert, Token, TrustAnchorInfo,
UpdateChildRequest,
RouteAuthorization, RouteAuthorizationUpdates, SigningCert, Token, UpdateChildRequest,
};
use krill_commons::eventsourcing::{Aggregate, StoredEvent};
use krill_commons::remote::builder::{IdCertBuilder, SignedMessageBuilder};
@@ -299,41 +298,6 @@ impl<S: Signer> Aggregate for CertAuth<S> {
/// # Data presentation
///
impl<S: Signer> CertAuth<S> {
pub fn as_ta_info(&self) -> Result<TrustAnchorInfo> {
if let Ok(ta) = self.parent(&ta_handle()) {
let tal = match ta {
ParentCaContact::Ta(details) => Some(details),
_ => None,
}
.ok_or_else(|| Error::NotTa)?
.tal()
.clone();
let rc = self
.resources
.get(&ResourceClassName::default())
.ok_or_else(|| Error::NotTa)?;
let cert = rc.current_certificate().ok_or_else(|| Error::NotTa)?;
let resources = cert.resources().clone();
let repo_info = self.base_repo.clone();
let mut children = HashMap::new();
for (handle, details) in &self.children {
children.insert(handle.clone(), details.clone().into());
}
Ok(TrustAnchorInfo::new(
resources,
repo_info,
children,
cert.clone(),
tal,
))
} else {
Err(Error::NotTa)
}
}
pub fn as_ca_info(&self) -> CertAuthInfo {
let handle = self.handle.clone();
let base_repo = self.base_repo.clone();
daemon/src/ca/keys.rs
+2 -7
View File
@@ -164,7 +164,6 @@ impl DerefMut for OldKey {
}
}
//------------ KeyState ------------------------------------------------------
/// This type contains the keys for a resource class and guards that keys
@@ -420,12 +419,8 @@ impl KeyState {
KeyState::RollPending(p, c) => {
ResourceClassKeysInfo::RollPending(p.as_info(), c.as_info())
}
KeyState::RollNew(n, c) => {
ResourceClassKeysInfo::RollNew(n.as_info(), c.as_info())
}
KeyState::RollOld(c, o) => {
ResourceClassKeysInfo::RollOld(c.as_info(), o.as_info())
}
KeyState::RollNew(n, c) => ResourceClassKeysInfo::RollNew(n.as_info(), c.as_info()),
KeyState::RollOld(c, o) => ResourceClassKeysInfo::RollOld(c.as_info(), o.as_info()),
}
}
}
daemon/src/ca/rc.rs
+6 -9
View File
@@ -9,18 +9,17 @@ use rpki::x509::Time;
use krill_commons::api::{
AddedObject, CurrentObject, CurrentObjects, EntitlementClass, HexEncodedHash, IssuanceRequest,
IssuanceResponse, IssuedCert, ObjectName, ObjectsDelta, RcvdCert, ReplacedObject, RepoInfo,
RequestResourceLimit, KeyStateInfo, ResourceClassName, ResourceSet, Revocation,
RevocationRequest, RevokedObject, RouteAuthorization, SigningCert, UpdatedObject,
WithdrawnObject,
IssuanceResponse, IssuedCert, KeyStateInfo, ObjectName, ObjectsDelta, RcvdCert, ReplacedObject,
RepoInfo, RequestResourceLimit, ResourceClassName, ResourceSet, Revocation, RevocationRequest,
RevokedObject, RouteAuthorization, SigningCert, UpdatedObject, WithdrawnObject,
};
use crate::ca::events::RoaUpdates;
use crate::ca::signing::CsrInfo;
use crate::ca::{
self, ta_handle, AddedOrUpdated, Certificates, CertifiedKey, CrlBuilder, CurrentKey,
CurrentObjectSetDelta, Error, EvtDet, ManifestBuilder, NewKey, OldKey, ParentHandle,
PendingKey, KeyState, Result, RoaInfo, Roas, SignSupport, Signer,
CurrentObjectSetDelta, Error, EvtDet, KeyState, ManifestBuilder, NewKey, OldKey, ParentHandle,
PendingKey, Result, RoaInfo, Roas, SignSupport, Signer,
};
//------------ ResourceClass -----------------------------------------------
@@ -591,9 +590,7 @@ impl ResourceClass {
pub fn received_cert(&mut self, key_id: KeyIdentifier, cert: RcvdCert) {
// if there is a pending key, then we need to do some promotions..
match &mut self.key_state {
KeyState::Pending(_pending) => {
panic!("Would have received KeyPendingToActive event")
}
KeyState::Pending(_pending) => panic!("Would have received KeyPendingToActive event"),
KeyState::Active(current) => {
current.set_incoming_cert(cert);
}
daemon/src/config.rs
+24 -19
View File
@@ -32,6 +32,9 @@ impl ConfigDefaults {
fn port() -> u16 {
3000
}
fn use_ta() -> bool {
false
}
fn use_ssl() -> SslChoice {
SslChoice::Test
}
@@ -41,8 +44,8 @@ impl ConfigDefaults {
fn rsync_base() -> uri::Rsync {
uri::Rsync::from_str("rsync://localhost/repo/").unwrap()
}
fn rrdp_base_uri() -> uri::Https {
uri::Https::from_str("https://localhost:3000/rrdp/").unwrap()
fn service_uri() -> String {
"https://localhost:3000/".to_string()
}
fn log_level() -> LevelFilter {
LevelFilter::Info
@@ -87,6 +90,9 @@ pub struct Config {
#[serde(default = "ConfigDefaults::port")]
port: u16,
#[serde(default = "ConfigDefaults::use_ta")]
use_ta: bool,
#[serde(default = "ConfigDefaults::use_ssl")]
use_ssl: SslChoice,
@@ -96,8 +102,8 @@ pub struct Config {
#[serde(default = "ConfigDefaults::rsync_base")]
pub rsync_base: uri::Rsync,
#[serde(default = "ConfigDefaults::rrdp_base_uri")]
pub rrdp_base_uri: uri::Https,
#[serde(default = "ConfigDefaults::service_uri")]
service_uri: String,
#[serde(
default = "ConfigDefaults::log_level",
@@ -149,22 +155,19 @@ impl Config {
}
pub fn service_uri(&self) -> uri::Https {
let mut uri = String::new();
uri.push_str("https://");
uri::Https::from_str(&self.service_uri).unwrap()
}
if self.ip == ConfigDefaults::ip() {
uri.push_str("localhost");
} else {
uri.push_str(&self.ip.to_string())
}
pub fn rrdp_base_uri(&self) -> uri::Https {
uri::Https::from_string(format!("{}rrdp/", &self.service_uri)).unwrap()
}
if self.port != 443 {
uri.push_str(&format!(":{}", self.port));
}
pub fn ta_cert_uri(&self) -> uri::Https {
uri::Https::from_string(format!("{}ta/ta.cer", &self.service_uri)).unwrap()
}
uri.push_str("/");
uri::Https::from_string(uri).unwrap()
pub fn use_ta(&self) -> bool {
self.use_ta
}
}
@@ -173,10 +176,11 @@ impl Config {
pub fn test(data_dir: &PathBuf) -> Self {
let ip = ConfigDefaults::ip();
let port = ConfigDefaults::port();
let use_ta = true;
let use_ssl = SslChoice::Test;
let data_dir = data_dir.clone();
let rsync_base = ConfigDefaults::rsync_base();
let rrdp_base_uri = ConfigDefaults::rrdp_base_uri();
let service_uri = ConfigDefaults::service_uri();
let log_level = LevelFilter::Info;
let log_type = LogType::Stderr;
let mut log_file = data_dir.clone();
@@ -188,10 +192,11 @@ impl Config {
let c = Config {
ip,
port,
use_ta,
use_ssl,
data_dir,
rsync_base,
rrdp_base_uri,
service_uri,
log_level,
log_type,
log_file,
daemon/src/endpoints.rs
+16 -78
View File
@@ -18,7 +18,7 @@ use krill_pubd::publishers::PublisherError;
use krill_pubd::repo::RrdpServerError;
use crate::auth::Auth;
use crate::ca::{self, ta_handle, ParentHandle};
use crate::ca::{self, ParentHandle};
use crate::http::server::AppServer;
use crate::krillserver;
@@ -245,49 +245,22 @@ pub fn repository_response(
//------------ Admin: TrustAnchor --------------------------------------------
pub fn ta_info(server: web::Data<AppServer>, auth: Auth) -> HttpResponse {
if_api_allowed(&server, &auth, || match server.read().ta_info() {
Some(ta) => render_json(ta),
None => api_not_found(),
})
}
pub fn ta_init(server: web::Data<AppServer>, auth: Auth) -> HttpResponse {
if_api_allowed(&server, &auth, || {
render_empty_res(server.write().ta_init())
})
}
pub fn tal(server: web::Data<AppServer>) -> HttpResponse {
match server.read().ta_info() {
Some(ta) => HttpResponse::Ok()
match server.read().ta() {
Ok(ta) => HttpResponse::Ok()
.content_type("text/plain")
.body(format!("{}", ta.tal())),
None => api_not_found(),
Err(_) => api_not_found(),
}
}
pub fn ta_cer(server: web::Data<AppServer>) -> HttpResponse {
match server.read().trust_anchor_cert() {
Some(cert) => HttpResponse::Ok().body(cert.der_encoded().to_vec()),
Some(cert) => HttpResponse::Ok().body(cert.to_captured().to_vec()),
None => api_not_found(),
}
}
// TODO: Deprecate!
pub fn ta_add_child(
server: web::Data<AppServer>,
req: Json<AddChildRequest>,
auth: Auth,
) -> HttpResponse {
if_api_allowed(&server, &auth, || {
match server.read().ca_add_child(&ta_handle(), req.into_inner()) {
Ok(info) => render_json(info),
Err(e) => server_error(&Error::ServerError(e)),
}
})
}
pub fn ca_add_child(
server: web::Data<AppServer>,
parent: Path<ParentHandle>,
@@ -305,67 +278,32 @@ pub fn ca_add_child(
})
}
// TODO: Deprecate
pub fn ta_update_child(
server: web::Data<AppServer>,
child: Path<Handle>,
req: Json<UpdateChildRequest>,
auth: Auth,
) -> HttpResponse {
if_api_allowed(&server, &auth, || {
render_empty_res(server.read().ca_update_child(
&ta_handle(),
child.into_inner(),
req.into_inner(),
))
})
}
pub fn ca_update_child(
server: web::Data<AppServer>,
parent: Path<Handle>,
child: Path<Handle>,
ca_and_child: Path<(Handle, Handle)>,
req: Json<UpdateChildRequest>,
auth: Auth,
) -> HttpResponse {
if_api_allowed(&server, &auth, || {
render_empty_res(server.read().ca_update_child(
&parent.into_inner(),
child.into_inner(),
req.into_inner(),
))
})
}
let ca_and_child = ca_and_child.into_inner();
let ca = ca_and_child.0;
let child = ca_and_child.1;
// TODO: Deprecate
pub fn ta_show_child(
server: web::Data<AppServer>,
child: Path<Handle>,
auth: Auth,
) -> HttpResponse {
if_api_allowed(&server, &auth, || {
match server
.read()
.ca_show_child(&ta_handle(), &child.into_inner())
{
Ok(Some(child)) => render_json(child),
Ok(None) => api_not_found(),
Err(e) => server_error(&Error::ServerError(e)),
}
render_empty_res(server.read().ca_update_child(&ca, child, req.into_inner()))
})
}
pub fn ca_show_child(
server: web::Data<AppServer>,
parent: Path<Handle>,
child: Path<Handle>,
ca_and_child: Path<(Handle, Handle)>,
auth: Auth,
) -> HttpResponse {
let ca_and_child = ca_and_child.into_inner();
let ca = ca_and_child.0;
let child = ca_and_child.1;
if_api_allowed(&server, &auth, || {
match server
.read()
.ca_show_child(&parent.into_inner(), &child.into_inner())
{
match server.read().ca_show_child(&ca, &child) {
Ok(Some(child)) => render_json(child),
Ok(None) => api_not_found(),
Err(e) => server_error(&Error::ServerError(e)),
daemon/src/http/server.rs
-5
View File
@@ -75,11 +75,6 @@ pub fn start(config: &Config) -> Result<(), Error> {
"/rfc8181/{handle}/response.xml",
get().to(repository_response),
)
.route("/trustanchor", get().to(ta_info))
.route("/trustanchor", post().to(ta_init))
.route("/trustanchor/children", post().to(ta_add_child))
.route("/trustanchor/children/{handle}", get().to(ta_show_child))
.route("/trustanchor/children/{handle}", post().to(ta_update_child))
.route("/cas", post().to(ca_init))
.route("/cas", get().to(cas))
.route("/cas/{ca}", get().to(ca_info))
daemon/src/krillserver.rs
+44 -43
View File
@@ -6,13 +6,13 @@ use std::sync::Arc;
use bcder::Captured;
use bytes::Bytes;
use chrono::Duration;
use rpki::cert::Cert;
use rpki::uri;
use krill_commons::api::{
AddChildRequest, AddParentRequest, CertAuthInfo, CertAuthInit, CertAuthList, CertAuthPubMode,
ChildCaInfo, Handle, ListReply, ParentCaContact, PublishDelta, PublishRequest,
PublisherRequest, RcvdCert, RouteAuthorizationUpdates, Token, TrustAnchorInfo,
UpdateChildRequest,
PublisherRequest, RouteAuthorizationUpdates, TaCertDetails, Token, UpdateChildRequest,
};
use krill_commons::remote::api::ClientInfo;
use krill_commons::remote::proxy;
@@ -76,7 +76,7 @@ impl KrillServer {
let work_dir = &config.data_dir;
let base_uri = &config.rsync_base;
let service_uri = config.service_uri();
let rrdp_base_uri = &config.rrdp_base_uri;
let rrdp_base_uri = &config.rrdp_base_uri();
let token = &config.auth_token;
let ca_refresh_rate = config.ca_refresh;
@@ -93,11 +93,41 @@ impl KrillServer {
let proxy_server = ProxyServer::init(work_dir, &service_uri)?;
let signer = OpenSslSigner::build(work_dir)?;
let event_queue = Arc::new(EventQueueListener::in_mem());
let caserver = Arc::new(ca::CaServer::build(work_dir, event_queue.clone(), signer)?);
if config.use_ta() {
let ta_handle = ta_handle();
if caserver.get_ca(&ta_handle).is_err() {
let repo_info = pubserver.repo_info_for(&ta_handle)?;
let ta_uri = config.ta_cert_uri();
let ta_aia = format!("{}ta/ta.cer", config.rsync_base.to_string());
let ta_aia = uri::Rsync::from_string(ta_aia).unwrap();
let token = caserver.random_token();
// Add publisher
let req = PublisherRequest::new(
ta_handle.clone(),
token.clone(),
repo_info.base_uri().clone(),
);
pubserver.create_publisher(req).map_err(Error::PubServer)?;
// Add TA
caserver
.init_ta(repo_info, ta_aia, vec![ta_uri])
.map_err(Error::CaServerError)?;
// Force initial publication
caserver.republish(&ta_handle)?;
info!("Created embedded Trust Anchor");
}
}
let scheduler = Scheduler::build(
event_queue,
caserver.clone(),
@@ -260,49 +290,20 @@ impl KrillServer {
}
}
/// # Admin Trust Anchor
/// # Admin CA as parent
///
impl KrillServer {
pub fn ta_info(&self) -> Option<TrustAnchorInfo> {
match self.caserver.get_trust_anchor() {
Ok(ta) => ta.as_ta_info().ok(),
_ => None,
pub fn ta(&self) -> KrillRes<TaCertDetails> {
let ta = self.caserver.get_ca(&ta_handle())?;
if let ParentCaContact::Ta(ta) = ta.parent(&ta_handle()).unwrap() {
Ok(ta.clone())
} else {
panic!("Found TA which was not initialized as TA.")
}
}
pub fn trust_anchor_cert(&self) -> Option<RcvdCert> {
self.ta_info().map(|ta| ta.cert().clone())
}
pub fn ta_init(&mut self) -> EmptyRes {
let ta_handle = ta_handle();
let repo_info = self.pubserver.repo_info_for(&ta_handle)?;
let ta_uri = format!("{}{}", self.service_uri.to_string(), "ta/ta.cer");
let ta_uri = uri::Https::from_string(ta_uri).unwrap();
let ta_aia = self.pubserver.ta_aia();
let token = self.caserver.random_token();
// Add publisher
let req = PublisherRequest::new(
ta_handle.clone(),
token.clone(),
repo_info.base_uri().clone(),
);
self.add_publisher(req)?;
// Add TA
self.caserver
.init_ta(repo_info, ta_aia, vec![ta_uri])
.map_err(Error::CaServerError)?;
// Force initial publication
self.caserver.republish(&ta_handle)?;
Ok(())
pub fn trust_anchor_cert(&self) -> Option<Cert> {
self.ta().ok().map(|details| details.cert().clone())
}
/// Adds a child to a CA and returns the ParentCaInfo that the child
daemon/src/test.rs
+7 -9
View File
@@ -5,7 +5,7 @@ use std::{thread, time};
use rpki::uri::Rsync;
use krill_client::options::{CaCommand, Command, Options, PublishersCommand, TrustAnchorCommand};
use krill_client::options::{CaCommand, Command, Options, PublishersCommand};
use krill_client::report::{ApiResponse, ReportFormat};
use krill_client::{Error, KrillClient};
@@ -95,10 +95,6 @@ pub fn krill_admin_expect_error(command: Command) -> Error {
}
}
pub fn init_ta() {
krill_admin(Command::TrustAnchor(TrustAnchorCommand::Init));
}
pub fn init_child(handle: &Handle, token: &Token) {
let init = CertAuthInit::new(handle.clone(), token.clone(), CertAuthPubMode::Embedded);
krill_admin(Command::CertAuth(CaCommand::Init(init)));
@@ -114,7 +110,7 @@ pub fn child_request(handle: &Handle) -> rfc8183::ChildRequest {
pub fn add_child_to_ta_embedded(handle: &Handle, resources: ResourceSet) -> ParentCaContact {
let auth = ChildAuthRequest::Embedded;
let req = AddChildRequest::new(handle.clone(), resources, auth);
let res = krill_admin(Command::TrustAnchor(TrustAnchorCommand::AddChild(req)));
let res = krill_admin(Command::CertAuth(CaCommand::AddChild(ta_handle(), req)));
match res {
ApiResponse::ParentCaContact(info) => info,
@@ -129,7 +125,7 @@ pub fn add_child_to_ta_rfc6492(
) -> ParentCaContact {
let auth = ChildAuthRequest::Rfc8183(req);
let req = AddChildRequest::new(handle.clone(), resources, auth);
let res = krill_admin(Command::TrustAnchor(TrustAnchorCommand::AddChild(req)));
let res = krill_admin(Command::CertAuth(CaCommand::AddChild(ta_handle(), req)));
match res {
ApiResponse::ParentCaContact(info) => info,
@@ -155,7 +151,8 @@ pub fn add_child_rfc6492(
pub fn update_child(handle: &Handle, resources: &ResourceSet) {
let req = UpdateChildRequest::graceful(None, Some(resources.clone()));
match krill_admin(Command::TrustAnchor(TrustAnchorCommand::UpdateChild(
match krill_admin(Command::CertAuth(CaCommand::UpdateChild(
ta_handle(),
handle.clone(),
req,
))) {
@@ -166,7 +163,8 @@ pub fn update_child(handle: &Handle, resources: &ResourceSet) {
pub fn force_update_child(handle: &Handle, resources: &ResourceSet) {
let req = UpdateChildRequest::force(None, Some(resources.clone()));
match krill_admin(Command::TrustAnchor(TrustAnchorCommand::UpdateChild(
match krill_admin(Command::CertAuth(CaCommand::UpdateChild(
ta_handle(),
handle.clone(),
req,
))) {
daemon/tests/admin_publishers.rs
+5 -6
View File
@@ -48,12 +48,11 @@ fn admin_publishers() {
// Find "alice" in list
let res = list_publishers();
match res {
ApiResponse::PublisherList(list) => {
// there should be one and it should be alice
assert_eq!(1, list.publishers().len());
let alice = &list.publishers().get(0).unwrap();
assert_eq!("alice", alice.id());
}
ApiResponse::PublisherList(list) => assert!(list
.publishers()
.iter()
.find(|p| { p.id() == "alice" })
.is_some()),
_ => panic!("Expected publisher list"),
}
daemon/tests/ca_keyroll_under_rfc6492_ta.rs
-1
View File
@@ -11,7 +11,6 @@ use krill_daemon::test::*;
fn ca_keyroll_under_rfc6492_ta() {
test_with_krill_server(|_d| {
let ta_handle = ta_handle();
init_ta();
let child = Handle::from("rfc6492");
let child_token = Token::from("rfc6492");
daemon/tests/ca_roas.rs
-1
View File
@@ -26,7 +26,6 @@ fn ca_roas() {
// Set up under parent ----------------------------------------------------------------
{
init_ta();
let parent = {
let parent_contact = add_child_to_ta_embedded(&child, child_resources.clone());
AddParentRequest::new(ta_handle(), parent_contact)
daemon/tests/ca_under_embedded_ta.rs
-2
View File
@@ -12,8 +12,6 @@ fn ca_under_embedded_ta() {
test_with_krill_server(|_d| {
let ta_handle = ta_handle();
init_ta();
let child = Handle::from("child");
let child_token = Token::from("child");
let child_resources = ResourceSet::from_strs("", "10.0.0.0/16", "").unwrap();
daemon/tests/ca_under_rfc6492_ta.rs
-1
View File
@@ -11,7 +11,6 @@ use krill_daemon::test::*;
fn ca_under_rfc6492_ta() {
test_with_krill_server(|_d| {
let ta_handle = ta_handle();
init_ta();
let child = Handle::from("rfc6492");
let child_token = Token::from("rfc6492");
daemon/tests/embedded_trust_anchor.rs
-20
View File
@@ -1,20 +0,0 @@
extern crate krill_client;
extern crate krill_commons;
extern crate krill_daemon;
use krill_client::options::{Command, TrustAnchorCommand};
use krill_daemon::test::{krill_admin, test_with_krill_server};
#[test]
fn embedded_trust_anchor() {
test_with_krill_server(|_d| {
let command = Command::TrustAnchor(TrustAnchorCommand::Init);
krill_admin(command);
let command = Command::TrustAnchor(TrustAnchorCommand::Show);
krill_admin(command);
// let command = Command::TrustAnchor(TrustAnchorCommand::Publish);
// let _res = execute_krillc_command(command);
});
}
daemon/tests/grand_children.rs
-1
View File
@@ -30,7 +30,6 @@ fn grand_children() {
// -------------------- TA -----------------------------------------------
let ta_handle = ta_handle();
init_ta();
let ta_key = ca_key_for_rcn(&ta_handle, &rcn_0);
let ta_mft_file = ta_key.incoming_cert().mft_name().to_string();
pubd/src/pubserver.rs
-5
View File
@@ -76,11 +76,6 @@ impl PubServer {
let rpki_notify = self.rrdp_server()?.notification_uri();
Ok(RepoInfo::new(base_uri, rpki_notify))
}
pub fn ta_aia(&self) -> uri::Rsync {
let uri = format!("{}ta.cer", self.base_rsync_uri.to_string());
uri::Rsync::from_string(uri).unwrap()
}
}
/// # Publication Protocol support