storj/pkg/revocation/db.go
Egon Elbre 080ba47a06 all: fix dots
Change-Id: I6a419c62700c568254ff67ae5b73efed2fc98aa2
2020-07-16 14:58:28 +00:00

144 lines
3.5 KiB
Go

// Copyright (C) 2019 Storj Labs, Inc.
// See LICENSE for copying information.
package revocation
import (
"context"
"crypto/x509"
"crypto/x509/pkix"
"github.com/spacemonkeygo/monkit/v3"
"github.com/zeebo/errs"
"storj.io/common/identity"
"storj.io/common/peertls"
"storj.io/common/peertls/extensions"
"storj.io/storj/storage"
)
var (
mon = monkit.Package()
// Error is a pkg/revocation error
Error = errs.Class("revocation error")
)
// DB stores the most recently seen revocation for each nodeID
// (i.e. nodeID [CA certificate's public key hash] is the key, values is
// the most recently seen revocation).
type DB struct {
store storage.KeyValueStore
}
// Get attempts to retrieve the most recent revocation for the given cert chain
// (the key used in the underlying database is the nodeID of the certificate chain).
func (db *DB) Get(ctx context.Context, chain []*x509.Certificate) (_ *extensions.Revocation, err error) {
defer mon.Task()(&ctx)(&err)
if db.store == nil {
return nil, nil
}
nodeID, err := identity.NodeIDFromCert(chain[peertls.CAIndex])
if err != nil {
return nil, extensions.ErrRevocation.Wrap(err)
}
revBytes, err := db.store.Get(ctx, nodeID.Bytes())
if err != nil && !storage.ErrKeyNotFound.Has(err) {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
if revBytes == nil {
return nil, nil
}
rev := new(extensions.Revocation)
if err = rev.Unmarshal(revBytes); err != nil {
return rev, extensions.ErrRevocationDB.Wrap(err)
}
return rev, nil
}
// Put stores the most recent revocation for the given cert chain IF the timestamp
// is newer than the current value (the key used in the underlying database is
// the nodeID of the certificate chain).
func (db *DB) Put(ctx context.Context, chain []*x509.Certificate, revExt pkix.Extension) (err error) {
defer mon.Task()(&ctx)(&err)
if db.store == nil {
return extensions.ErrRevocationDB.New("not supported")
}
ca := chain[peertls.CAIndex]
var rev extensions.Revocation
if err := rev.Unmarshal(revExt.Value); err != nil {
return err
}
// TODO: do we care if cert/timestamp/sig is empty/garbage?
// TODO(bryanchriswhite): test empty/garbage cert/timestamp/sig
if err := rev.Verify(ca); err != nil {
return err
}
lastRev, err := db.Get(ctx, chain)
if err != nil {
return err
} else if lastRev != nil && lastRev.Timestamp >= rev.Timestamp {
return extensions.ErrRevocationTimestamp
}
nodeID, err := identity.NodeIDFromCert(ca)
if err != nil {
return extensions.ErrRevocationDB.Wrap(err)
}
if err := db.store.Put(ctx, nodeID.Bytes(), revExt.Value); err != nil {
return extensions.ErrRevocationDB.Wrap(err)
}
return nil
}
// List lists all revocations in the store.
func (db *DB) List(ctx context.Context) (revs []*extensions.Revocation, err error) {
defer mon.Task()(&ctx)(&err)
if db.store == nil {
return nil, nil
}
keys, err := db.store.List(ctx, []byte{}, 0)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
marshaledRevs, err := db.store.GetAll(ctx, keys)
if err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
for _, revBytes := range marshaledRevs {
rev := new(extensions.Revocation)
if err := rev.Unmarshal(revBytes); err != nil {
return nil, extensions.ErrRevocationDB.Wrap(err)
}
revs = append(revs, rev)
}
return revs, nil
}
// TestGetStore returns the internal store for testing.
func (db *DB) TestGetStore() storage.KeyValueStore {
return db.store
}
// Close closes the underlying store.
func (db *DB) Close() error {
if db.store == nil {
return nil
}
return db.store.Close()
}