storj/pkg/identity/revocation_db.go

157 lines
4.1 KiB
Go
Raw Normal View History

2019-02-06 16:40:55 +00:00
// Copyright (C) 2019 Storj Labs, Inc.
// See LICENSE for copying information.
package identity
import (
"crypto/x509"
"crypto/x509/pkix"
"storj.io/storj/internal/dbutil"
2019-02-06 16:40:55 +00:00
"storj.io/storj/pkg/peertls"
"storj.io/storj/pkg/peertls/extensions"
2019-02-06 16:40:55 +00:00
"storj.io/storj/storage"
"storj.io/storj/storage/boltdb"
"storj.io/storj/storage/redis"
)
// RevocationDB stores the most recently seen revocation for each nodeID
// (i.e. nodeID [CA certificate's public key hash] is the key, values is
// the most recently seen revocation).
type RevocationDB struct {
DB storage.KeyValueStore
}
// NewRevocationDB returns a new revocation database given the URL
func NewRevocationDB(revocationDBURL string) (*RevocationDB, error) {
driver, source, err := dbutil.SplitConnstr(revocationDBURL)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
var db *RevocationDB
switch driver {
case "bolt":
db, err = newRevocationDBBolt(source)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
case "redis":
db, err = newRevocationDBRedis(revocationDBURL)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
default:
return nil, extensions.ErrRevocationDB.New("database scheme not supported: %s", driver)
}
return db, nil
}
// newRevocationDBBolt creates a bolt-backed RevocationDB
func newRevocationDBBolt(path string) (*RevocationDB, error) {
client, err := boltdb.New(path, extensions.RevocationBucket)
if err != nil {
return nil, err
}
return &RevocationDB{
DB: client,
}, nil
}
// newRevocationDBRedis creates a redis-backed RevocationDB.
func newRevocationDBRedis(address string) (*RevocationDB, error) {
client, err := redis.NewClientFrom(address)
if err != nil {
return nil, err
}
return &RevocationDB{
DB: client,
}, nil
}
2019-02-06 16:40:55 +00:00
// Get attempts to retrieve the most recent revocation for the given cert chain
// (the key used in the underlying database is the nodeID of the certificate chain).
func (r RevocationDB) Get(chain []*x509.Certificate) (*extensions.Revocation, error) {
2019-04-08 19:15:19 +01:00
nodeID, err := NodeIDFromCert(chain[peertls.CAIndex])
2019-02-06 16:40:55 +00:00
if err != nil {
return nil, extensions.ErrRevocation.Wrap(err)
2019-02-06 16:40:55 +00:00
}
revBytes, err := r.DB.Get(nodeID.Bytes())
if err != nil && !storage.ErrKeyNotFound.Has(err) {
return nil, extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
if revBytes == nil {
return nil, nil
}
rev := new(extensions.Revocation)
2019-02-06 16:40:55 +00:00
if err = rev.Unmarshal(revBytes); err != nil {
return rev, extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
return rev, nil
}
// Put stores the most recent revocation for the given cert chain IF the timestamp
// is newer than the current value (the key used in the underlying database is
// the nodeID of the certificate chain).
func (r RevocationDB) Put(chain []*x509.Certificate, revExt pkix.Extension) error {
ca := chain[peertls.CAIndex]
var rev extensions.Revocation
2019-02-06 16:40:55 +00:00
if err := rev.Unmarshal(revExt.Value); err != nil {
return err
}
// TODO: do we care if cert/timestamp/sig is empty/garbage?
// TODO(bryanchriswhite): test empty/garbage cert/timestamp/sig
if err := rev.Verify(ca); err != nil {
return err
}
lastRev, err := r.Get(chain)
if err != nil {
return err
} else if lastRev != nil && lastRev.Timestamp >= rev.Timestamp {
return extensions.ErrRevocationTimestamp
2019-02-06 16:40:55 +00:00
}
2019-04-08 19:15:19 +01:00
nodeID, err := NodeIDFromCert(ca)
2019-02-06 16:40:55 +00:00
if err != nil {
return extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
if err := r.DB.Put(nodeID.Bytes(), revExt.Value); err != nil {
return extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
return nil
}
// List lists all revocations in the store
func (r RevocationDB) List() (revs []*extensions.Revocation, err error) {
2019-02-06 16:40:55 +00:00
keys, err := r.DB.List([]byte{}, 0)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
marshaledRevs, err := r.DB.GetAll(keys)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
for _, revBytes := range marshaledRevs {
rev := new(extensions.Revocation)
2019-02-06 16:40:55 +00:00
if err := rev.Unmarshal(revBytes); err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
2019-02-06 16:40:55 +00:00
}
revs = append(revs, rev)
}
return revs, nil
}
// Close closes the underlying store
func (r RevocationDB) Close() error {
return r.DB.Close()
}