diff --git a/client/src/client.rs b/client/src/client.rs index 58c09622..80e25014 100644 --- a/client/src/client.rs +++ b/client/src/client.rs @@ -7,7 +7,6 @@ use rpki::uri; use krill_commons::api::{ CertAuthInfo, ParentCaContact, PublisherDetails, PublisherList, PublisherRequest, Token, - TrustAnchorInfo, }; use krill_commons::remote::api::{ClientAuth, ClientInfo}; use krill_commons::remote::rfc8183; @@ -15,9 +14,7 @@ use krill_commons::remote::rfc8183::RepositoryResponse; use krill_commons::util::file; use krill_commons::util::httpclient; -use crate::options::{ - CaCommand, Command, Options, PublishersCommand, Rfc8181Command, TrustAnchorCommand, -}; +use crate::options::{CaCommand, Command, Options, PublishersCommand, Rfc8181Command}; use crate::report::{ApiResponse, ReportError}; /// Command line tool for Krill admin tasks @@ -49,7 +46,6 @@ impl KrillClient { }; match options.command { Command::Health => client.health(), - Command::TrustAnchor(cmd) => client.trustanchor(cmd), Command::CertAuth(cmd) => client.certauth(cmd), Command::Publishers(cmd) => client.publishers(cmd), Command::Rfc8181(cmd) => client.rfc8181(cmd), @@ -62,38 +58,6 @@ impl KrillClient { Ok(ApiResponse::Health) } - fn trustanchor(&self, command: TrustAnchorCommand) -> Result { - match command { - TrustAnchorCommand::Init => { - let uri = self.resolve_uri("api/v1/trustanchor"); - httpclient::post_empty(&uri, Some(&self.token))?; - Ok(ApiResponse::Empty) - } - TrustAnchorCommand::Show => { - let uri = self.resolve_uri("api/v1/trustanchor"); - let ta: TrustAnchorInfo = self.get_json(&uri)?; - Ok(ApiResponse::TrustAnchorInfo(ta)) - } - TrustAnchorCommand::Publish => { - let uri = self.resolve_uri("api/v1/republish"); - httpclient::post_empty(&uri, Some(&self.token))?; - Ok(ApiResponse::Empty) - } - TrustAnchorCommand::AddChild(req) => { - let uri = self.resolve_uri("api/v1/trustanchor/children"); - let info: ParentCaContact = - httpclient::post_json_with_response(&uri, req, Some(&self.token))?; - Ok(ApiResponse::ParentCaContact(info)) - } - TrustAnchorCommand::UpdateChild(child, req) => { - let uri = format!("api/v1/trustanchor/children/{}", child); - let uri = self.resolve_uri(&uri); - httpclient::post_json(&uri, req, Some(&self.token))?; - Ok(ApiResponse::Empty) - } - } - } - fn certauth(&self, command: CaCommand) -> Result { match command { CaCommand::Init(init) => { diff --git a/client/src/options.rs b/client/src/options.rs index a846254c..2e7080fb 100644 --- a/client/src/options.rs +++ b/client/src/options.rs @@ -74,121 +74,6 @@ impl Options { all is well, exit code 1 in case of any issues") ) - .subcommand(SubCommand::with_name("trustanchor") - .about("Manage embedded Trust Anchor (used for testing)") - .subcommand(SubCommand::with_name("init") - .about("Initialise embedded TA.") - ) - .subcommand(SubCommand::with_name("show") - .about("Show embedded TA details.") - ) - .subcommand(SubCommand::with_name("publish") - .about("Force publication for embedded TA now.") - ) - .subcommand(SubCommand::with_name("children") - .about("Manage children of the embbeded TA") - .subcommand(SubCommand::with_name("add") - .about("Add a child to the embedded CA") - - .arg(Arg::with_name("asn") - .short("a") - .long("asn") - .value_name("AS resources") - .help("The delegated AS resources: e.g. AS1, AS3-4") - .required(false) - ) - .arg(Arg::with_name("ipv4") - .short("4") - .long("ipv4") - .value_name("IPv4 resources") - .help("The delegated IPv4 resources: e.g. 192.168.0.0/16") - .required(false) - ) - .arg(Arg::with_name("ipv6") - .short("6") - .long("ipv6") - .value_name("IPv6 resources") - .help("The delegated IPv6 resources: e.g. 2001:db8::/32") - .required(false) - ) - - .subcommand(SubCommand::with_name("embedded") - .about("Add an embedded child") - .arg(Arg::with_name("handle") - .short("h") - .long("handle") - .value_name("child-handle") - .help("The handle of the child") - .required(true) - ) - ) - - .subcommand(SubCommand::with_name("rfc6492") - .about("Add an RFC 6492 child") - .arg(Arg::with_name("handle") - .short("h") - .long("handle") - .value_name("child-handle") - .help("Override the handle in the XML") - .required(false) - ) - .arg(Arg::with_name("xml") - .short("x") - .long("xml") - .value_name("FILE") - .help("RFC 8183 Child Request XML") - .required(true) - ) - ) - ) - .subcommand(SubCommand::with_name("update") - .about("Update details for a child") - .arg(Arg::with_name("handle") - .short("h") - .long("handle") - .value_name("child-handle") - .help("Override the handle in the XML") - .required(false) - ) - .arg(Arg::with_name("xml") - .short("x") - .long("xml") - .value_name("FILE") - .help("Update child certificate from RFC 8183 Child Request XML") - .required(false) - ) - .arg(Arg::with_name("asn") - .short("a") - .long("asn") - .value_name("AS resources") - .help("Update the delegated AS resources: e.g. AS1, AS3-4") - .required(false) - ) - .arg(Arg::with_name("ipv4") - .short("4") - .long("ipv4") - .value_name("IPv4 resources") - .help("Update the delegated IPv4 resources: e.g. 192.168.0.0/16") - .required(false) - ) - .arg(Arg::with_name("ipv6") - .short("6") - .long("ipv6") - .value_name("IPv6 resources") - .help("Update the delegated IPv6 resources: e.g. 2001:db8::/32") - .required(false) - ) - .arg(Arg::with_name("force") - .short("f") - .long("force") - .takes_value(false) - .help("Force resource shrink now.") - .required(false) - ) - ) - ) - ) - .subcommand(SubCommand::with_name("cas") .about("Manage CAs") .subcommand(SubCommand::with_name("list") @@ -510,89 +395,6 @@ impl Options { command = Command::Health; } - if let Some(m) = matches.subcommand_matches("trustanchor") { - if let Some(_m) = m.subcommand_matches("show") { - command = Command::TrustAnchor(TrustAnchorCommand::Show) - } - if let Some(_m) = m.subcommand_matches("init") { - command = Command::TrustAnchor(TrustAnchorCommand::Init) - } - if let Some(_m) = m.subcommand_matches("publish") { - command = Command::TrustAnchor(TrustAnchorCommand::Publish) - } - if let Some(m) = m.subcommand_matches("children") { - if let Some(m) = m.subcommand_matches("add") { - let asn = m.value_of("asn").unwrap_or(""); - let ipv4 = m.value_of("ipv4").unwrap_or(""); - let ipv6 = m.value_of("ipv6").unwrap_or(""); - - if let Some(m) = m.subcommand_matches("embedded") { - let handle = Handle::from(m.value_of("handle").unwrap()); - let res = ResourceSet::from_strs(asn, ipv4, ipv6).unwrap(); - let auth = ChildAuthRequest::Embedded; - - let req = AddChildRequest::new(handle, res, auth); - command = Command::TrustAnchor(TrustAnchorCommand::AddChild(req)) - } - - if let Some(m) = m.subcommand_matches("rfc6492") { - let xml_path = m.value_of("xml").unwrap(); - let xml = PathBuf::from(xml_path); - let bytes = file::read(&xml)?; - let cr = rfc8183::ChildRequest::validate(bytes.as_ref())?; - - let handle = { - if let Some(handle) = m.value_of("handle") { - Handle::from(handle) - } else { - cr.child_handle().clone() - } - }; - - let res = ResourceSet::from_strs(asn, ipv4, ipv6)?; - - let auth = ChildAuthRequest::Rfc8183(cr); - - let req = AddChildRequest::new(handle, res, auth); - command = Command::TrustAnchor(TrustAnchorCommand::AddChild(req)) - } - } - - if let Some(m) = m.subcommand_matches("update") { - let handle = Handle::from(m.value_of("handle").unwrap()); - let cert = match m.value_of("xml") { - Some(xml_path) => { - let xml = PathBuf::from(xml_path); - let bytes = file::read(&xml)?; - let cr = rfc8183::ChildRequest::validate(bytes.as_ref())?; - let (_, _, cert) = cr.unwrap(); - Some(cert) - } - None => None, - }; - - let asn = m.value_of("asn").unwrap_or(""); - let ipv4 = m.value_of("ipv4").unwrap_or(""); - let ipv6 = m.value_of("ipv6").unwrap_or(""); - let resources = ResourceSet::from_strs(asn, ipv4, ipv6)?; - - let resources = if resources.is_empty() { - None - } else { - Some(resources) - }; - - let req = if m.is_present("force") { - UpdateChildRequest::force(cert, resources) - } else { - UpdateChildRequest::graceful(cert, resources) - }; - - command = Command::TrustAnchor(TrustAnchorCommand::UpdateChild(handle, req)) - } - } - } - if let Some(m) = matches.subcommand_matches("cas") { if let Some(m) = m.subcommand_matches("add") { let handle = Handle::from(m.value_of("handle").unwrap()); @@ -637,10 +439,8 @@ impl Options { let auth = ChildAuthRequest::Embedded; let req = AddChildRequest::new(handle, res, auth); - command = Command::TrustAnchor(TrustAnchorCommand::AddChild(req)) - } - - if let Some(m) = m.subcommand_matches("rfc6492") { + command = Command::CertAuth(CaCommand::AddChild(ca, req)) + } else if let Some(m) = m.subcommand_matches("rfc6492") { let xml_path = m.value_of("xml").unwrap(); let xml = PathBuf::from(xml_path); let bytes = file::read(&xml)?; @@ -802,22 +602,11 @@ impl Options { pub enum Command { NotSet, Health, - TrustAnchor(TrustAnchorCommand), CertAuth(CaCommand), Publishers(PublishersCommand), Rfc8181(Rfc8181Command), } -#[derive(Clone, Debug, Eq, PartialEq)] -#[allow(clippy::large_enum_variant)] -pub enum TrustAnchorCommand { - Init, - Show, - Publish, - AddChild(AddChildRequest), - UpdateChild(Handle, UpdateChildRequest), -} - #[derive(Clone, Debug, Eq, PartialEq)] #[allow(clippy::large_enum_variant)] pub enum CaCommand { diff --git a/client/src/report.rs b/client/src/report.rs index 138a9519..f20637ba 100644 --- a/client/src/report.rs +++ b/client/src/report.rs @@ -2,7 +2,7 @@ use std::str::{from_utf8_unchecked, FromStr}; use krill_commons::api::{ CertAuthInfo, CertAuthList, CurrentObjects, ParentCaContact, PublisherDetails, PublisherList, - RouteAuthorization, TrustAnchorInfo, + RouteAuthorization, }; use krill_commons::remote::api::ClientInfo; use krill_commons::remote::rfc8183; @@ -16,8 +16,6 @@ use krill_commons::remote::rfc8183::RepositoryResponse; pub enum ApiResponse { Health, - TrustAnchorInfo(TrustAnchorInfo), - CertAuthInfo(CertAuthInfo), CertAuths(CertAuthList), RouteAuthorizations(Vec), @@ -48,7 +46,6 @@ impl ApiResponse { Err(ReportError::UnsupportedFormat) } } - ApiResponse::TrustAnchorInfo(ta) => Ok(Some(ta.report(fmt)?)), ApiResponse::CertAuths(list) => Ok(Some(list.report(fmt)?)), ApiResponse::CertAuthInfo(info) => Ok(Some(info.report(fmt)?)), ApiResponse::RouteAuthorizations(auths) => Ok(Some(auths.report(fmt)?)), @@ -111,47 +108,6 @@ trait Report { fn report(&self, format: ReportFormat) -> Result; } -impl Report for TrustAnchorInfo { - fn report(&self, format: ReportFormat) -> Result { - match format { - ReportFormat::Default | ReportFormat::Json => { - Ok(serde_json::to_string_pretty(self).unwrap()) - } - ReportFormat::Text => { - let mut res = String::new(); - - let resources = self.resources(); - - res.push_str(&format!("ASNs: {}\n", resources.asn())); - res.push_str(&format!("IPv4: {}\n", resources.v4())); - res.push_str(&format!("IPv6: {}\n", resources.v6())); - - res.push_str("\n"); - - res.push_str("TAL:\n"); - res.push_str(&format!("{}", self.tal())); - - res.push_str("\n"); - res.push_str("\n"); - - res.push_str("Children:\n"); - if !self.children().is_empty() { - for (name, details) in self.children() { - res.push_str(&format!("{}\n", name)); - res.push_str(&format!(" resources: {}\n", details.entitled_resources())); - res.push_str("\n"); - } - } else { - res.push_str(""); - } - - Ok(res) - } - _ => Err(ReportError::UnsupportedFormat), - } - } -} - impl Report for CertAuthList { fn report(&self, format: ReportFormat) -> Result { match format { diff --git a/commons/src/api/ca.rs b/commons/src/api/ca.rs index 309fbdf7..31a9936f 100644 --- a/commons/src/api/ca.rs +++ b/commons/src/api/ca.rs @@ -1310,57 +1310,6 @@ impl fmt::Display for ResourceSet { } } -//------------ TrustAnchorInfo ----------------------------------------------- - -/// This type represents the TrustAnchor details that need to be accessible -/// through the API (CLI and UI). -#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] -pub struct TrustAnchorInfo { - resources: ResourceSet, - repo_info: RepoInfo, - children: HashMap, - cert: RcvdCert, - tal: TrustAnchorLocator, -} - -impl TrustAnchorInfo { - pub fn new( - resources: ResourceSet, - repo_info: RepoInfo, - children: HashMap, - cert: RcvdCert, - tal: TrustAnchorLocator, - ) -> Self { - TrustAnchorInfo { - resources, - repo_info, - children, - cert, - tal, - } - } - - pub fn resources(&self) -> &ResourceSet { - &self.resources - } - - pub fn repo_info(&self) -> &RepoInfo { - &self.repo_info - } - - pub fn children(&self) -> &HashMap { - &self.children - } - - pub fn cert(&self) -> &RcvdCert { - &self.cert - } - - pub fn tal(&self) -> &TrustAnchorLocator { - &self.tal - } -} - //------------ CertAuthList -------------------------------------------------- #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] pub struct CertAuthList { diff --git a/daemon/defaults/krill.conf b/daemon/defaults/krill.conf index 02c46abb..6f17d475 100644 --- a/daemon/defaults/krill.conf +++ b/daemon/defaults/krill.conf @@ -2,6 +2,12 @@ #ip = "localhost" #port = 3000 +# Have an embedded TA, for testing purposes. If set to 'true' then a TA +# will be initialised when Krill is started, if it hadn't been set up +# earlier. +# +# use_ta = false + # Specify whether https is to be used instead of plain http. Allowed values are # "no", "yes" and "test". Defaults to "no". # @@ -29,10 +35,16 @@ # configuration. #rsync_base = "rsync://localhost/repo/" -# Specify the notify SIA for this server. This will be reported in the -# response.xml files to publishers so that they can include the proper SIA -# in their certificates. -#rrdp_base_uri = "http://localhost:3000/rrdp/" +# Specify the base public URI to this service. Other URIs will be derived +# from this: +# rrdp/notification.xml (pub point or rrdp) +# rrdp///snapshot.xml +# rrdp///delta.xml +# ta/ta.cer (on TAL for embedded TA) +# rfc6492 (for remote children) +# +# MUST end with a slash. +#service_uri = "http://localhost:3000/" # Log level # diff --git a/daemon/src/ca/certauth.rs b/daemon/src/ca/certauth.rs index 2766aa3d..c583711b 100644 --- a/daemon/src/ca/certauth.rs +++ b/daemon/src/ca/certauth.rs @@ -14,8 +14,7 @@ use krill_commons::api::{ self, CertAuthInfo, EntitlementClass, Entitlements, Handle, IssuanceRequest, IssuanceResponse, IssuedCert, ObjectsDelta, ParentCaContact, PubServerContact, RcvdCert, RepoInfo, RequestResourceLimit, ResourceClassName, ResourceSet, RevocationRequest, RevocationResponse, - RouteAuthorization, RouteAuthorizationUpdates, SigningCert, Token, TrustAnchorInfo, - UpdateChildRequest, + RouteAuthorization, RouteAuthorizationUpdates, SigningCert, Token, UpdateChildRequest, }; use krill_commons::eventsourcing::{Aggregate, StoredEvent}; use krill_commons::remote::builder::{IdCertBuilder, SignedMessageBuilder}; @@ -299,41 +298,6 @@ impl Aggregate for CertAuth { /// # Data presentation /// impl CertAuth { - pub fn as_ta_info(&self) -> Result { - if let Ok(ta) = self.parent(&ta_handle()) { - let tal = match ta { - ParentCaContact::Ta(details) => Some(details), - _ => None, - } - .ok_or_else(|| Error::NotTa)? - .tal() - .clone(); - - let rc = self - .resources - .get(&ResourceClassName::default()) - .ok_or_else(|| Error::NotTa)?; - let cert = rc.current_certificate().ok_or_else(|| Error::NotTa)?; - - let resources = cert.resources().clone(); - let repo_info = self.base_repo.clone(); - let mut children = HashMap::new(); - for (handle, details) in &self.children { - children.insert(handle.clone(), details.clone().into()); - } - - Ok(TrustAnchorInfo::new( - resources, - repo_info, - children, - cert.clone(), - tal, - )) - } else { - Err(Error::NotTa) - } - } - pub fn as_ca_info(&self) -> CertAuthInfo { let handle = self.handle.clone(); let base_repo = self.base_repo.clone(); diff --git a/daemon/src/ca/keys.rs b/daemon/src/ca/keys.rs index c7bde93c..cb8f3e72 100644 --- a/daemon/src/ca/keys.rs +++ b/daemon/src/ca/keys.rs @@ -164,7 +164,6 @@ impl DerefMut for OldKey { } } - //------------ KeyState ------------------------------------------------------ /// This type contains the keys for a resource class and guards that keys @@ -420,12 +419,8 @@ impl KeyState { KeyState::RollPending(p, c) => { ResourceClassKeysInfo::RollPending(p.as_info(), c.as_info()) } - KeyState::RollNew(n, c) => { - ResourceClassKeysInfo::RollNew(n.as_info(), c.as_info()) - } - KeyState::RollOld(c, o) => { - ResourceClassKeysInfo::RollOld(c.as_info(), o.as_info()) - } + KeyState::RollNew(n, c) => ResourceClassKeysInfo::RollNew(n.as_info(), c.as_info()), + KeyState::RollOld(c, o) => ResourceClassKeysInfo::RollOld(c.as_info(), o.as_info()), } } } diff --git a/daemon/src/ca/rc.rs b/daemon/src/ca/rc.rs index 0874871b..7e56d97c 100644 --- a/daemon/src/ca/rc.rs +++ b/daemon/src/ca/rc.rs @@ -9,18 +9,17 @@ use rpki::x509::Time; use krill_commons::api::{ AddedObject, CurrentObject, CurrentObjects, EntitlementClass, HexEncodedHash, IssuanceRequest, - IssuanceResponse, IssuedCert, ObjectName, ObjectsDelta, RcvdCert, ReplacedObject, RepoInfo, - RequestResourceLimit, KeyStateInfo, ResourceClassName, ResourceSet, Revocation, - RevocationRequest, RevokedObject, RouteAuthorization, SigningCert, UpdatedObject, - WithdrawnObject, + IssuanceResponse, IssuedCert, KeyStateInfo, ObjectName, ObjectsDelta, RcvdCert, ReplacedObject, + RepoInfo, RequestResourceLimit, ResourceClassName, ResourceSet, Revocation, RevocationRequest, + RevokedObject, RouteAuthorization, SigningCert, UpdatedObject, WithdrawnObject, }; use crate::ca::events::RoaUpdates; use crate::ca::signing::CsrInfo; use crate::ca::{ self, ta_handle, AddedOrUpdated, Certificates, CertifiedKey, CrlBuilder, CurrentKey, - CurrentObjectSetDelta, Error, EvtDet, ManifestBuilder, NewKey, OldKey, ParentHandle, - PendingKey, KeyState, Result, RoaInfo, Roas, SignSupport, Signer, + CurrentObjectSetDelta, Error, EvtDet, KeyState, ManifestBuilder, NewKey, OldKey, ParentHandle, + PendingKey, Result, RoaInfo, Roas, SignSupport, Signer, }; //------------ ResourceClass ----------------------------------------------- @@ -591,9 +590,7 @@ impl ResourceClass { pub fn received_cert(&mut self, key_id: KeyIdentifier, cert: RcvdCert) { // if there is a pending key, then we need to do some promotions.. match &mut self.key_state { - KeyState::Pending(_pending) => { - panic!("Would have received KeyPendingToActive event") - } + KeyState::Pending(_pending) => panic!("Would have received KeyPendingToActive event"), KeyState::Active(current) => { current.set_incoming_cert(cert); } diff --git a/daemon/src/config.rs b/daemon/src/config.rs index 2da48f21..7a559949 100644 --- a/daemon/src/config.rs +++ b/daemon/src/config.rs @@ -32,6 +32,9 @@ impl ConfigDefaults { fn port() -> u16 { 3000 } + fn use_ta() -> bool { + false + } fn use_ssl() -> SslChoice { SslChoice::Test } @@ -41,8 +44,8 @@ impl ConfigDefaults { fn rsync_base() -> uri::Rsync { uri::Rsync::from_str("rsync://localhost/repo/").unwrap() } - fn rrdp_base_uri() -> uri::Https { - uri::Https::from_str("https://localhost:3000/rrdp/").unwrap() + fn service_uri() -> String { + "https://localhost:3000/".to_string() } fn log_level() -> LevelFilter { LevelFilter::Info @@ -87,6 +90,9 @@ pub struct Config { #[serde(default = "ConfigDefaults::port")] port: u16, + #[serde(default = "ConfigDefaults::use_ta")] + use_ta: bool, + #[serde(default = "ConfigDefaults::use_ssl")] use_ssl: SslChoice, @@ -96,8 +102,8 @@ pub struct Config { #[serde(default = "ConfigDefaults::rsync_base")] pub rsync_base: uri::Rsync, - #[serde(default = "ConfigDefaults::rrdp_base_uri")] - pub rrdp_base_uri: uri::Https, + #[serde(default = "ConfigDefaults::service_uri")] + service_uri: String, #[serde( default = "ConfigDefaults::log_level", @@ -149,22 +155,19 @@ impl Config { } pub fn service_uri(&self) -> uri::Https { - let mut uri = String::new(); - uri.push_str("https://"); + uri::Https::from_str(&self.service_uri).unwrap() + } - if self.ip == ConfigDefaults::ip() { - uri.push_str("localhost"); - } else { - uri.push_str(&self.ip.to_string()) - } + pub fn rrdp_base_uri(&self) -> uri::Https { + uri::Https::from_string(format!("{}rrdp/", &self.service_uri)).unwrap() + } - if self.port != 443 { - uri.push_str(&format!(":{}", self.port)); - } + pub fn ta_cert_uri(&self) -> uri::Https { + uri::Https::from_string(format!("{}ta/ta.cer", &self.service_uri)).unwrap() + } - uri.push_str("/"); - - uri::Https::from_string(uri).unwrap() + pub fn use_ta(&self) -> bool { + self.use_ta } } @@ -173,10 +176,11 @@ impl Config { pub fn test(data_dir: &PathBuf) -> Self { let ip = ConfigDefaults::ip(); let port = ConfigDefaults::port(); + let use_ta = true; let use_ssl = SslChoice::Test; let data_dir = data_dir.clone(); let rsync_base = ConfigDefaults::rsync_base(); - let rrdp_base_uri = ConfigDefaults::rrdp_base_uri(); + let service_uri = ConfigDefaults::service_uri(); let log_level = LevelFilter::Info; let log_type = LogType::Stderr; let mut log_file = data_dir.clone(); @@ -188,10 +192,11 @@ impl Config { let c = Config { ip, port, + use_ta, use_ssl, data_dir, rsync_base, - rrdp_base_uri, + service_uri, log_level, log_type, log_file, diff --git a/daemon/src/endpoints.rs b/daemon/src/endpoints.rs index bd8d8e36..8eb70e28 100644 --- a/daemon/src/endpoints.rs +++ b/daemon/src/endpoints.rs @@ -18,7 +18,7 @@ use krill_pubd::publishers::PublisherError; use krill_pubd::repo::RrdpServerError; use crate::auth::Auth; -use crate::ca::{self, ta_handle, ParentHandle}; +use crate::ca::{self, ParentHandle}; use crate::http::server::AppServer; use crate::krillserver; @@ -245,49 +245,22 @@ pub fn repository_response( //------------ Admin: TrustAnchor -------------------------------------------- -pub fn ta_info(server: web::Data, auth: Auth) -> HttpResponse { - if_api_allowed(&server, &auth, || match server.read().ta_info() { - Some(ta) => render_json(ta), - None => api_not_found(), - }) -} - -pub fn ta_init(server: web::Data, auth: Auth) -> HttpResponse { - if_api_allowed(&server, &auth, || { - render_empty_res(server.write().ta_init()) - }) -} - pub fn tal(server: web::Data) -> HttpResponse { - match server.read().ta_info() { - Some(ta) => HttpResponse::Ok() + match server.read().ta() { + Ok(ta) => HttpResponse::Ok() .content_type("text/plain") .body(format!("{}", ta.tal())), - None => api_not_found(), + Err(_) => api_not_found(), } } pub fn ta_cer(server: web::Data) -> HttpResponse { match server.read().trust_anchor_cert() { - Some(cert) => HttpResponse::Ok().body(cert.der_encoded().to_vec()), + Some(cert) => HttpResponse::Ok().body(cert.to_captured().to_vec()), None => api_not_found(), } } -// TODO: Deprecate! -pub fn ta_add_child( - server: web::Data, - req: Json, - auth: Auth, -) -> HttpResponse { - if_api_allowed(&server, &auth, || { - match server.read().ca_add_child(&ta_handle(), req.into_inner()) { - Ok(info) => render_json(info), - Err(e) => server_error(&Error::ServerError(e)), - } - }) -} - pub fn ca_add_child( server: web::Data, parent: Path, @@ -305,67 +278,32 @@ pub fn ca_add_child( }) } -// TODO: Deprecate -pub fn ta_update_child( - server: web::Data, - child: Path, - req: Json, - auth: Auth, -) -> HttpResponse { - if_api_allowed(&server, &auth, || { - render_empty_res(server.read().ca_update_child( - &ta_handle(), - child.into_inner(), - req.into_inner(), - )) - }) -} - pub fn ca_update_child( server: web::Data, - parent: Path, - child: Path, + ca_and_child: Path<(Handle, Handle)>, req: Json, auth: Auth, ) -> HttpResponse { - if_api_allowed(&server, &auth, || { - render_empty_res(server.read().ca_update_child( - &parent.into_inner(), - child.into_inner(), - req.into_inner(), - )) - }) -} + let ca_and_child = ca_and_child.into_inner(); + let ca = ca_and_child.0; + let child = ca_and_child.1; -// TODO: Deprecate -pub fn ta_show_child( - server: web::Data, - child: Path, - auth: Auth, -) -> HttpResponse { if_api_allowed(&server, &auth, || { - match server - .read() - .ca_show_child(&ta_handle(), &child.into_inner()) - { - Ok(Some(child)) => render_json(child), - Ok(None) => api_not_found(), - Err(e) => server_error(&Error::ServerError(e)), - } + render_empty_res(server.read().ca_update_child(&ca, child, req.into_inner())) }) } pub fn ca_show_child( server: web::Data, - parent: Path, - child: Path, + ca_and_child: Path<(Handle, Handle)>, auth: Auth, ) -> HttpResponse { + let ca_and_child = ca_and_child.into_inner(); + let ca = ca_and_child.0; + let child = ca_and_child.1; + if_api_allowed(&server, &auth, || { - match server - .read() - .ca_show_child(&parent.into_inner(), &child.into_inner()) - { + match server.read().ca_show_child(&ca, &child) { Ok(Some(child)) => render_json(child), Ok(None) => api_not_found(), Err(e) => server_error(&Error::ServerError(e)), diff --git a/daemon/src/http/server.rs b/daemon/src/http/server.rs index 71025422..e045172e 100644 --- a/daemon/src/http/server.rs +++ b/daemon/src/http/server.rs @@ -75,11 +75,6 @@ pub fn start(config: &Config) -> Result<(), Error> { "/rfc8181/{handle}/response.xml", get().to(repository_response), ) - .route("/trustanchor", get().to(ta_info)) - .route("/trustanchor", post().to(ta_init)) - .route("/trustanchor/children", post().to(ta_add_child)) - .route("/trustanchor/children/{handle}", get().to(ta_show_child)) - .route("/trustanchor/children/{handle}", post().to(ta_update_child)) .route("/cas", post().to(ca_init)) .route("/cas", get().to(cas)) .route("/cas/{ca}", get().to(ca_info)) diff --git a/daemon/src/krillserver.rs b/daemon/src/krillserver.rs index 14b7fa3b..707c8d24 100644 --- a/daemon/src/krillserver.rs +++ b/daemon/src/krillserver.rs @@ -6,13 +6,13 @@ use std::sync::Arc; use bcder::Captured; use bytes::Bytes; use chrono::Duration; +use rpki::cert::Cert; use rpki::uri; use krill_commons::api::{ AddChildRequest, AddParentRequest, CertAuthInfo, CertAuthInit, CertAuthList, CertAuthPubMode, ChildCaInfo, Handle, ListReply, ParentCaContact, PublishDelta, PublishRequest, - PublisherRequest, RcvdCert, RouteAuthorizationUpdates, Token, TrustAnchorInfo, - UpdateChildRequest, + PublisherRequest, RouteAuthorizationUpdates, TaCertDetails, Token, UpdateChildRequest, }; use krill_commons::remote::api::ClientInfo; use krill_commons::remote::proxy; @@ -76,7 +76,7 @@ impl KrillServer { let work_dir = &config.data_dir; let base_uri = &config.rsync_base; let service_uri = config.service_uri(); - let rrdp_base_uri = &config.rrdp_base_uri; + let rrdp_base_uri = &config.rrdp_base_uri(); let token = &config.auth_token; let ca_refresh_rate = config.ca_refresh; @@ -93,11 +93,41 @@ impl KrillServer { let proxy_server = ProxyServer::init(work_dir, &service_uri)?; let signer = OpenSslSigner::build(work_dir)?; - let event_queue = Arc::new(EventQueueListener::in_mem()); - let caserver = Arc::new(ca::CaServer::build(work_dir, event_queue.clone(), signer)?); + if config.use_ta() { + let ta_handle = ta_handle(); + if caserver.get_ca(&ta_handle).is_err() { + let repo_info = pubserver.repo_info_for(&ta_handle)?; + + let ta_uri = config.ta_cert_uri(); + + let ta_aia = format!("{}ta/ta.cer", config.rsync_base.to_string()); + let ta_aia = uri::Rsync::from_string(ta_aia).unwrap(); + let token = caserver.random_token(); + + // Add publisher + let req = PublisherRequest::new( + ta_handle.clone(), + token.clone(), + repo_info.base_uri().clone(), + ); + + pubserver.create_publisher(req).map_err(Error::PubServer)?; + + // Add TA + caserver + .init_ta(repo_info, ta_aia, vec![ta_uri]) + .map_err(Error::CaServerError)?; + + // Force initial publication + caserver.republish(&ta_handle)?; + + info!("Created embedded Trust Anchor"); + } + } + let scheduler = Scheduler::build( event_queue, caserver.clone(), @@ -260,49 +290,20 @@ impl KrillServer { } } -/// # Admin Trust Anchor +/// # Admin CA as parent /// impl KrillServer { - pub fn ta_info(&self) -> Option { - match self.caserver.get_trust_anchor() { - Ok(ta) => ta.as_ta_info().ok(), - _ => None, + pub fn ta(&self) -> KrillRes { + let ta = self.caserver.get_ca(&ta_handle())?; + if let ParentCaContact::Ta(ta) = ta.parent(&ta_handle()).unwrap() { + Ok(ta.clone()) + } else { + panic!("Found TA which was not initialized as TA.") } } - pub fn trust_anchor_cert(&self) -> Option { - self.ta_info().map(|ta| ta.cert().clone()) - } - - pub fn ta_init(&mut self) -> EmptyRes { - let ta_handle = ta_handle(); - - let repo_info = self.pubserver.repo_info_for(&ta_handle)?; - - let ta_uri = format!("{}{}", self.service_uri.to_string(), "ta/ta.cer"); - let ta_uri = uri::Https::from_string(ta_uri).unwrap(); - - let ta_aia = self.pubserver.ta_aia(); - - let token = self.caserver.random_token(); - - // Add publisher - let req = PublisherRequest::new( - ta_handle.clone(), - token.clone(), - repo_info.base_uri().clone(), - ); - self.add_publisher(req)?; - - // Add TA - self.caserver - .init_ta(repo_info, ta_aia, vec![ta_uri]) - .map_err(Error::CaServerError)?; - - // Force initial publication - self.caserver.republish(&ta_handle)?; - - Ok(()) + pub fn trust_anchor_cert(&self) -> Option { + self.ta().ok().map(|details| details.cert().clone()) } /// Adds a child to a CA and returns the ParentCaInfo that the child diff --git a/daemon/src/test.rs b/daemon/src/test.rs index 7871ed53..77a512de 100644 --- a/daemon/src/test.rs +++ b/daemon/src/test.rs @@ -5,7 +5,7 @@ use std::{thread, time}; use rpki::uri::Rsync; -use krill_client::options::{CaCommand, Command, Options, PublishersCommand, TrustAnchorCommand}; +use krill_client::options::{CaCommand, Command, Options, PublishersCommand}; use krill_client::report::{ApiResponse, ReportFormat}; use krill_client::{Error, KrillClient}; @@ -95,10 +95,6 @@ pub fn krill_admin_expect_error(command: Command) -> Error { } } -pub fn init_ta() { - krill_admin(Command::TrustAnchor(TrustAnchorCommand::Init)); -} - pub fn init_child(handle: &Handle, token: &Token) { let init = CertAuthInit::new(handle.clone(), token.clone(), CertAuthPubMode::Embedded); krill_admin(Command::CertAuth(CaCommand::Init(init))); @@ -114,7 +110,7 @@ pub fn child_request(handle: &Handle) -> rfc8183::ChildRequest { pub fn add_child_to_ta_embedded(handle: &Handle, resources: ResourceSet) -> ParentCaContact { let auth = ChildAuthRequest::Embedded; let req = AddChildRequest::new(handle.clone(), resources, auth); - let res = krill_admin(Command::TrustAnchor(TrustAnchorCommand::AddChild(req))); + let res = krill_admin(Command::CertAuth(CaCommand::AddChild(ta_handle(), req))); match res { ApiResponse::ParentCaContact(info) => info, @@ -129,7 +125,7 @@ pub fn add_child_to_ta_rfc6492( ) -> ParentCaContact { let auth = ChildAuthRequest::Rfc8183(req); let req = AddChildRequest::new(handle.clone(), resources, auth); - let res = krill_admin(Command::TrustAnchor(TrustAnchorCommand::AddChild(req))); + let res = krill_admin(Command::CertAuth(CaCommand::AddChild(ta_handle(), req))); match res { ApiResponse::ParentCaContact(info) => info, @@ -155,7 +151,8 @@ pub fn add_child_rfc6492( pub fn update_child(handle: &Handle, resources: &ResourceSet) { let req = UpdateChildRequest::graceful(None, Some(resources.clone())); - match krill_admin(Command::TrustAnchor(TrustAnchorCommand::UpdateChild( + match krill_admin(Command::CertAuth(CaCommand::UpdateChild( + ta_handle(), handle.clone(), req, ))) { @@ -166,7 +163,8 @@ pub fn update_child(handle: &Handle, resources: &ResourceSet) { pub fn force_update_child(handle: &Handle, resources: &ResourceSet) { let req = UpdateChildRequest::force(None, Some(resources.clone())); - match krill_admin(Command::TrustAnchor(TrustAnchorCommand::UpdateChild( + match krill_admin(Command::CertAuth(CaCommand::UpdateChild( + ta_handle(), handle.clone(), req, ))) { diff --git a/daemon/tests/admin_publishers.rs b/daemon/tests/admin_publishers.rs index 69a65d28..46e923ef 100644 --- a/daemon/tests/admin_publishers.rs +++ b/daemon/tests/admin_publishers.rs @@ -48,12 +48,11 @@ fn admin_publishers() { // Find "alice" in list let res = list_publishers(); match res { - ApiResponse::PublisherList(list) => { - // there should be one and it should be alice - assert_eq!(1, list.publishers().len()); - let alice = &list.publishers().get(0).unwrap(); - assert_eq!("alice", alice.id()); - } + ApiResponse::PublisherList(list) => assert!(list + .publishers() + .iter() + .find(|p| { p.id() == "alice" }) + .is_some()), _ => panic!("Expected publisher list"), } diff --git a/daemon/tests/ca_keyroll_under_rfc6492_ta.rs b/daemon/tests/ca_keyroll_under_rfc6492_ta.rs index 9d5cfb45..c89a7ed9 100644 --- a/daemon/tests/ca_keyroll_under_rfc6492_ta.rs +++ b/daemon/tests/ca_keyroll_under_rfc6492_ta.rs @@ -11,7 +11,6 @@ use krill_daemon::test::*; fn ca_keyroll_under_rfc6492_ta() { test_with_krill_server(|_d| { let ta_handle = ta_handle(); - init_ta(); let child = Handle::from("rfc6492"); let child_token = Token::from("rfc6492"); diff --git a/daemon/tests/ca_roas.rs b/daemon/tests/ca_roas.rs index 931320ea..87a9ddd9 100644 --- a/daemon/tests/ca_roas.rs +++ b/daemon/tests/ca_roas.rs @@ -26,7 +26,6 @@ fn ca_roas() { // Set up under parent ---------------------------------------------------------------- { - init_ta(); let parent = { let parent_contact = add_child_to_ta_embedded(&child, child_resources.clone()); AddParentRequest::new(ta_handle(), parent_contact) diff --git a/daemon/tests/ca_under_embedded_ta.rs b/daemon/tests/ca_under_embedded_ta.rs index 49333947..9997f4ff 100644 --- a/daemon/tests/ca_under_embedded_ta.rs +++ b/daemon/tests/ca_under_embedded_ta.rs @@ -12,8 +12,6 @@ fn ca_under_embedded_ta() { test_with_krill_server(|_d| { let ta_handle = ta_handle(); - init_ta(); - let child = Handle::from("child"); let child_token = Token::from("child"); let child_resources = ResourceSet::from_strs("", "10.0.0.0/16", "").unwrap(); diff --git a/daemon/tests/ca_under_rfc6492_ta.rs b/daemon/tests/ca_under_rfc6492_ta.rs index 7de57e72..2c2d7ab2 100644 --- a/daemon/tests/ca_under_rfc6492_ta.rs +++ b/daemon/tests/ca_under_rfc6492_ta.rs @@ -11,7 +11,6 @@ use krill_daemon::test::*; fn ca_under_rfc6492_ta() { test_with_krill_server(|_d| { let ta_handle = ta_handle(); - init_ta(); let child = Handle::from("rfc6492"); let child_token = Token::from("rfc6492"); diff --git a/daemon/tests/embedded_trust_anchor.rs b/daemon/tests/embedded_trust_anchor.rs deleted file mode 100644 index 1432a696..00000000 --- a/daemon/tests/embedded_trust_anchor.rs +++ /dev/null @@ -1,20 +0,0 @@ -extern crate krill_client; -extern crate krill_commons; -extern crate krill_daemon; - -use krill_client::options::{Command, TrustAnchorCommand}; -use krill_daemon::test::{krill_admin, test_with_krill_server}; - -#[test] -fn embedded_trust_anchor() { - test_with_krill_server(|_d| { - let command = Command::TrustAnchor(TrustAnchorCommand::Init); - krill_admin(command); - - let command = Command::TrustAnchor(TrustAnchorCommand::Show); - krill_admin(command); - - // let command = Command::TrustAnchor(TrustAnchorCommand::Publish); - // let _res = execute_krillc_command(command); - }); -} diff --git a/daemon/tests/grand_children.rs b/daemon/tests/grand_children.rs index 322a5ed4..d7e1e9aa 100644 --- a/daemon/tests/grand_children.rs +++ b/daemon/tests/grand_children.rs @@ -30,7 +30,6 @@ fn grand_children() { // -------------------- TA ----------------------------------------------- let ta_handle = ta_handle(); - init_ta(); let ta_key = ca_key_for_rcn(&ta_handle, &rcn_0); let ta_mft_file = ta_key.incoming_cert().mft_name().to_string(); diff --git a/pubd/src/pubserver.rs b/pubd/src/pubserver.rs index c1252864..bb5e6955 100644 --- a/pubd/src/pubserver.rs +++ b/pubd/src/pubserver.rs @@ -76,11 +76,6 @@ impl PubServer { let rpki_notify = self.rrdp_server()?.notification_uri(); Ok(RepoInfo::new(base_uri, rpki_notify)) } - - pub fn ta_aia(&self) -> uri::Rsync { - let uri = format!("{}ta.cer", self.base_rsync_uri.to_string()); - uri::Rsync::from_string(uri).unwrap() - } } /// # Publication Protocol support