Skip to content

Commit 1844e3d

Browse files
AbdulboisAbdulbois
committed
#535 Add new txn to remove non-root certificates
Resolve MR's comments Signed-off-by: Abdulbois <abdulbois.tursunov@dsr-corporation.com> Signed-off-by: Abdulbois <abdulbois123@gmail.com>
1 parent 0bb16cc commit 1844e3d

File tree

3 files changed

+109
-49
lines changed

3 files changed

+109
-49
lines changed

‎integration_tests/cli/pki-remove-x509-certificates.sh

+12-12
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,18 @@ check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number
5555
check_response "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
5656
check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
5757

58+
echo "Revoke an intermediate certificate with serialNumber 3"
59+
result=$(echo "$passphrase" | dcld tx pki revoke-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --serial-number="$intermediate_cert_1_serial_number" --from=$trustee_account --yes)
60+
check_response "$result" "\"code\": 0"
61+
62+
echo "Request all revoked certificates should contain only one intermediate certificate with serialNumber 3"
63+
result=$(dcld query pki all-revoked-x509-certs)
64+
echo $result | jq
65+
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
66+
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
67+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
68+
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
69+
5870
echo "Remove intermediate certificate with invalid serialNumber"
5971
result=$(echo "$passphrase" | dcld tx pki remove-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --serial-number="invalid" --from=$trustee_account --yes)
6072
check_response "$result" "\"code\": 404"
@@ -84,18 +96,6 @@ check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\
8496
check_response "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
8597
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
8698

87-
echo "Revoke an intermediate certificate with serialNumber 3"
88-
result=$(echo "$passphrase" | dcld tx pki revoke-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --serial-number="$intermediate_cert_1_serial_number" --from=$trustee_account --yes)
89-
check_response "$result" "\"code\": 0"
90-
91-
echo "Request all revoked certificates should contain only one intermediate certificate with serialNumber 3"
92-
result=$(dcld query pki all-revoked-x509-certs)
93-
echo $result | jq
94-
check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
95-
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
96-
check_response "$result" "\"serialNumber\": \"$intermediate_cert_1_serial_number\""
97-
response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_2_serial_number\""
98-
9999
echo "Remove an intermediate certificate with subject and subjectKeyId"
100100
result=$(echo "$passphrase" | dcld tx pki remove-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --from=$trustee_account --yes)
101101
check_response "$result" "\"code\": 0"

‎x/pki/handler_test.go

+64
Original file line numberDiff line numberDiff line change
@@ -1800,6 +1800,70 @@ func TestHandler_RemoveX509Cert_BySerialNumber(t *testing.T) {
18001800
require.Equal(t, 1, len(leafCerts.Certs))
18011801
}
18021802

1803+
func TestHandler_RemoveX509Cert_RevokedAndApprovedCertificate(t *testing.T) {
1804+
setup := Setup(t)
1805+
// propose and approve x509 root certificate
1806+
rootCertOptions := &rootCertOptions{
1807+
pemCert: testconstants.RootCertWithSameSubjectAndSKID1,
1808+
subject: testconstants.RootCertWithSameSubjectAndSKIDSubject,
1809+
subjectKeyID: testconstants.RootCertWithSameSubjectAndSKIDSubjectKeyID,
1810+
info: testconstants.Info,
1811+
vid: 65521,
1812+
}
1813+
proposeAndApproveRootCertificate(setup, setup.Trustee1, rootCertOptions)
1814+
1815+
// Add an intermediate certificate
1816+
addIntermediateX509Cert := types.NewMsgAddX509Cert(setup.Trustee1.String(), testconstants.IntermediateWithSameSubjectAndSKID1)
1817+
_, err := setup.Handler(setup.Ctx, addIntermediateX509Cert)
1818+
require.NoError(t, err)
1819+
1820+
// get certificates for further comparison
1821+
allCerts := setup.Keeper.GetAllApprovedCertificates(setup.Ctx)
1822+
require.NotNil(t, allCerts)
1823+
require.Equal(t, 2, len(allCerts))
1824+
require.Equal(t, 2, len(allCerts[0].Certs)+len(allCerts[1].Certs))
1825+
1826+
// revoke an intermediate certificate
1827+
revokeX509Cert := types.NewMsgRemoveX509Cert(
1828+
setup.Trustee1.String(),
1829+
testconstants.IntermediateCertWithSameSubjectAndSKIDSubject,
1830+
testconstants.IntermediateCertWithSameSubjectAndSKIDSubjectKeyID,
1831+
testconstants.IntermediateCertWithSameSubjectAndSKID1SerialNumber,
1832+
)
1833+
_, err = setup.Handler(setup.Ctx, revokeX509Cert)
1834+
require.NoError(t, err)
1835+
1836+
// Add an intermediate certificate with new serial number
1837+
addIntermediateX509Cert = types.NewMsgAddX509Cert(setup.Trustee1.String(), testconstants.IntermediateWithSameSubjectAndSKID2)
1838+
_, err = setup.Handler(setup.Ctx, addIntermediateX509Cert)
1839+
require.NoError(t, err)
1840+
1841+
intermediateCerts, _ := queryApprovedCertificates(setup, testconstants.IntermediateCertWithSameSubjectAndSKIDSubject, testconstants.IntermediateCertWithSameSubjectAndSKIDSubjectKeyID)
1842+
require.Equal(t, 1, len(intermediateCerts.Certs))
1843+
require.Equal(t, testconstants.IntermediateCertWithSameSubjectAndSKIDSubject, intermediateCerts.Certs[0].Subject)
1844+
require.Equal(t, testconstants.IntermediateCertWithSameSubjectAndSKIDSubjectKeyID, intermediateCerts.Certs[0].SubjectKeyId)
1845+
require.Equal(t, testconstants.IntermediateCertWithSameSubjectAndSKID2SerialNumber, intermediateCerts.Certs[0].SerialNumber)
1846+
1847+
// remove an intermediate certificate
1848+
removeX509Cert := types.NewMsgRemoveX509Cert(
1849+
setup.Trustee1.String(),
1850+
testconstants.IntermediateCertWithSameSubjectAndSKIDSubject,
1851+
testconstants.IntermediateCertWithSameSubjectAndSKIDSubjectKeyID,
1852+
testconstants.IntermediateCertWithSameSubjectAndSKID2SerialNumber,
1853+
)
1854+
_, err = setup.Handler(setup.Ctx, removeX509Cert)
1855+
require.NoError(t, err)
1856+
1857+
// check that only root and leaf certificates exists
1858+
allCerts, _ = queryAllApprovedCertificates(setup)
1859+
require.Equal(t, 1, len(allCerts))
1860+
require.Equal(t, true, allCerts[0].Certs[0].IsRoot)
1861+
_, err = queryApprovedCertificates(setup, testconstants.IntermediateCertWithSameSubjectAndSKIDSubject, testconstants.IntermediateCertWithSameSubjectAndSKIDSubjectKeyID)
1862+
require.Equal(t, codes.NotFound, status.Code(err))
1863+
_, err = queryRevokedCertificates(setup, testconstants.IntermediateCertWithSameSubjectAndSKIDSubject, testconstants.IntermediateCertWithSameSubjectAndSKIDSubjectKeyID)
1864+
require.Equal(t, codes.NotFound, status.Code(err))
1865+
}
1866+
18031867
func TestHandler_RemoveX509Cert_RevokedCertificate(t *testing.T) {
18041868
setup := Setup(t)
18051869
// propose and approve x509 root certificate

‎x/pki/keeper/msg_server_remove_x_509_cert.go

+33-37
Original file line numberDiff line numberDiff line change
@@ -14,17 +14,7 @@ func (k msgServer) RemoveX509Cert(goCtx context.Context, msg *types.MsgRemoveX50
1414

1515
aprCerts, foundApproved := k.GetApprovedCertificates(ctx, msg.Subject, msg.SubjectKeyId)
1616
revCerts, foundRevoked := k.GetRevokedCertificates(ctx, msg.Subject, msg.SubjectKeyId)
17-
if !foundApproved && !foundRevoked {
18-
return nil, pkitypes.NewErrCertificateDoesNotExist(msg.Subject, msg.SubjectKeyId)
19-
}
20-
21-
var certificates []*types.Certificate
22-
if foundApproved {
23-
certificates = aprCerts.Certs
24-
} else {
25-
certificates = revCerts.Certs
26-
}
27-
17+
certificates := append(aprCerts.Certs, revCerts.Certs...)
2818
if len(certificates) == 0 {
2919
return nil, pkitypes.NewErrCertificateDoesNotExist(msg.Subject, msg.SubjectKeyId)
3020
}
@@ -57,7 +47,13 @@ func (k msgServer) RemoveX509Cert(goCtx context.Context, msg *types.MsgRemoveX50
5747
Certs: certificates,
5848
}
5949
k.removeCertFromList(certBySerialNumber.Issuer, certBySerialNumber.SerialNumber, &certs)
60-
k._removeX509Cert(ctx, certID, certs, foundRevoked)
50+
51+
if foundApproved {
52+
k._removeApprovedX509Cert(ctx, certID, certs)
53+
}
54+
if foundRevoked {
55+
k._removeRevokedX509Cert(ctx, certID, certs)
56+
}
6157
} else {
6258
k.RemoveApprovedCertificates(ctx, certID.Subject, certID.SubjectKeyId)
6359
// remove from subject -> subject key ID map
@@ -75,31 +71,31 @@ func (k msgServer) RemoveX509Cert(goCtx context.Context, msg *types.MsgRemoveX50
7571
return &types.MsgRemoveX509CertResponse{}, nil
7672
}
7773

78-
func (k msgServer) _removeX509Cert(ctx sdk.Context, certID types.CertificateIdentifier, certificates types.ApprovedCertificates, isRevoked bool) {
79-
if isRevoked { //nolint:nestif
80-
if len(certificates.Certs) == 0 {
81-
k.RemoveRevokedCertificates(ctx, certID.Subject, certID.SubjectKeyId)
82-
} else {
83-
k.SetRevokedCertificates(
84-
ctx,
85-
types.RevokedCertificates{
86-
Subject: certID.Subject,
87-
SubjectKeyId: certID.SubjectKeyId,
88-
Certs: certificates.Certs,
89-
},
90-
)
91-
}
74+
func (k msgServer) _removeApprovedX509Cert(ctx sdk.Context, certID types.CertificateIdentifier, certificates types.ApprovedCertificates) {
75+
if len(certificates.Certs) == 0 {
76+
k.RemoveApprovedCertificates(ctx, certID.Subject, certID.SubjectKeyId)
77+
k.RemoveApprovedCertificateBySubject(ctx, certID.Subject, certID.SubjectKeyId)
78+
k.RemoveApprovedCertificatesBySubjectKeyID(ctx, certID.Subject, certID.SubjectKeyId)
9279
} else {
93-
if len(certificates.Certs) == 0 {
94-
k.RemoveApprovedCertificates(ctx, certID.Subject, certID.SubjectKeyId)
95-
k.RemoveApprovedCertificateBySubject(ctx, certID.Subject, certID.SubjectKeyId)
96-
k.RemoveApprovedCertificatesBySubjectKeyID(ctx, certID.Subject, certID.SubjectKeyId)
97-
} else {
98-
k.SetApprovedCertificates(ctx, certificates)
99-
k.SetApprovedCertificatesBySubjectKeyID(
100-
ctx,
101-
types.ApprovedCertificatesBySubjectKeyId{SubjectKeyId: certID.SubjectKeyId, Certs: certificates.Certs},
102-
)
103-
}
80+
k.SetApprovedCertificates(ctx, certificates)
81+
k.SetApprovedCertificatesBySubjectKeyID(
82+
ctx,
83+
types.ApprovedCertificatesBySubjectKeyId{SubjectKeyId: certID.SubjectKeyId, Certs: certificates.Certs},
84+
)
85+
}
86+
}
87+
88+
func (k msgServer) _removeRevokedX509Cert(ctx sdk.Context, certID types.CertificateIdentifier, certificates types.ApprovedCertificates) {
89+
if len(certificates.Certs) == 0 {
90+
k.RemoveRevokedCertificates(ctx, certID.Subject, certID.SubjectKeyId)
91+
} else {
92+
k.SetRevokedCertificates(
93+
ctx,
94+
types.RevokedCertificates{
95+
Subject: certID.Subject,
96+
SubjectKeyId: certID.SubjectKeyId,
97+
Certs: certificates.Certs,
98+
},
99+
)
104100
}
105101
}

0 commit comments

Comments
 (0)