* Use PriorityQueue with time based Priority.
* Improve session sweep logging (make it less noisy)
* Update config file with new refresh settings - cap jitter at 50% of refresh
* Let api schedule repo sync tasks rather than execute it synchronously.
* Update version and readme for RC7
* Use the highest priority in case a task was already in the queue.
* Use consistent capitalization of Krill in config files.
* Update readme regarding ca-parent sync changes
* Update to Lagosta with updated dependencies
* Update developer documentation with new scheduler behaviour.
* Add hidden api end-point for scheduling suspend all - used in testing.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Support "prepare-upgrade" through "krillup" binary.
* Package the new `krillup` binary and man page into a separate DEB/RPM.
* Also switches to building in a Rocky Linux container due to repeated CentOS 8 vault repo timeouts.
* Mention correct config file location on CLI help.
* Remove incorrect reference to non-existent help subcommand for krillup.
* Add locking to upgrade process.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Adds support for PKCS#11 v2.20 and/or KMIP 1.2 compatible HSMs.
Includes backward compatible extensions to the krill.conf syntax.
Includes HSM related developer docs.
Excludes HSM specific API (REST, krillc, Prometheus) or UI extensions.
Support multiple signers of different types behind a HSM feature flag, and support in principle selecting which signer to use for which purpose. (#539)
* Encrypt session state using ChaCha20-Poly1305 instead of AES-GCM.
* Replace config file users login use of insecure unsalted SHA2 password hashing with secure scrypt salted password hashing.
* Log the start of the request before determining the actor.
* Allow sufficient time for password hashing delays during login with config file user based tests..
* Synced with Lagosta commit b49f23de.
* Move child_request API endpoint for conststency. (#330)
* Move get RFC 8183 Publisher Request API endpoints (#330)
* Accept XML and json to add/update parent on same endpoints (#330)
* Simplify the JSON to add a child and remove unused fields. (#330)
* Update path to child_request in openapi spec.
* Update path to publisher request.
* Update api spec and documentation.
* Fix update parent API documentation and call by CLI.
* CLI stability
* Update pubd OpenAPI spec t o match changes made to the Krill API.
* Update the e2e test client code to submit only the id_cert and not the whole RFC8183 request, as required by changes made to the Krill API.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Remove embedded repository contact option, migrate commands and events.
* Migrate old CA init events. Test upgrade from 0.6.0.
* Migrate embedded in CA history.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
- Various changes to support a grey policy in between black and white approach of permitting or denying access to CAs entirely, whereby a user can have a different role in one CA than in another.
- Introduces the NoResourceType for requests not relating to a specific "resource", e.g. CA, such as LOGIN. NoResourceType maps to `nil` in Oso policy language.
- Add support for Permission constants in Polar files. Build the Permission enum using a macro.
- Added CA_ADMIN (for bulk operations) and CA_DELETE permissions.
- Support loading more than one custom auth policy file.
- Checks were missing on some API calls if the user had the necessary permission *on the relevant resources*.
- Rename the team policy as a demo to indicate that it is educational only.
- Split a role-per-ca demo out of the team policy demo.
- Extend the with_ta Cypress test to cover the role-per-ca ca demo policy (as it creates the needed data).
- Don't misrepresent an external policy file in log statements as being internal.
- Better comments describing what the tests are doing.
- Remove unused role parameter in team access demo policy.
- Add disallow() in Oso policies as a way to define deny rules.
* Let users configure the AIA to use with TA certificates. Set 'ta_aia' in the config file. (#409)
* Use explicit configuration section for testbed, no longer rely on magic env variables.
Note: this will all be revised again if/when the Publication server and TA vs CA code is fully separated in future.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
This allows us to keep the full history of semantically important events, while not spamming the history and avoiding excessive use of disk space. See issues #370 and #423.
This is a substantial change. Highlights follow:
* Added a developer documentation section
* No longer using events for manifest/crl generation (#370)
* No longer using events for publication deltas (#423)
* Removed pre 0.6.0 migration code - people will have to upgrade to at least 0.6.0 first
* Added migration code for 0.6.0-0.8.1 to this
* Migrate repository by doing a keyroll. (#370)
* Remove archiving code for commands (no longer applicable)
Minor other fixes:
* Use a swap file when writing (avoid corrupt json if disk is full) (#370)
* Make removing publisher content idempotent for publishers already removed.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Co-authored-by: Jasper den Hertog <jasper@plainspace.com>
Note: Until merged to master this branch requires that a branch by the same name exists in the rpki-deploy repo with the corresponding changes to support these changes, which include:
- OpenAPI YML corrections.
- Support the new way to activate the TA.
- FIX: Include the correct ta.cer URI in the TAL.
- Use two seprarate Python libraries for Krill: one for CA REST SAPIs and one for PUB REST APIs.
- FIX: Test for the actual CAs and resources to create, as the presence of the testbed CA violates the previous check assumptions.
- FIX: Resource ASN, v4 and v6 values can no longer be assumed to have the same sort order as when given to Krill.
- Factor out test suite code into helper functions for better readability and maintainability.
- Retry RTR fetching (needed for ROAs obtained from Rcynic Lihttpd server served JSON as otherwise connecting too early results in SyncTimeout).
Known issues: on failure all RP tests will retry 3 times while actually only the Rcynic test should retry.
* Use strongly typed Permission checks instead of unrestricted String based checks.
* FIX: Don't include Permission:: in the message logged at WARN level about a user not having permission, only log the permission name, e.g. CA_CREATE.
* FIX: Also update the team policy demo polar file to use the new Permission type.
Tim Bruijnzeels