Skip to content

Commit 316c1a1

Browse files
AbdulboisAbdulbois
committed
#524 Enable revocation of NOC certificates
Signed-off-by: Abdulbois <abdulbois.tursunov@dsr-corporation.com> Signed-off-by: Abdulbois <abdulbois123@gmail.com>
1 parent 663e39a commit 316c1a1

File tree

24 files changed

+2315
-346
lines changed

24 files changed

+2315
-346
lines changed

‎integration_tests/cli/pki-noc-certs.sh

+81-2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ noc_cert_1_subject="MIGCMQswCQYDVQQGEwJVWjETMBEGA1UECAwKU29tZSBTdGF0ZTETMBEGA1UE
2727
noc_cert_1_subject_key_id="02:72:6E:BC:BB:EF:D6:BD:8D:9B:42:AE:D4:3C:C0:55:5F:66:3A:B3"
2828
noc_cert_1_serial_number="631388393741945881054190991612463928825155142122"
2929

30+
noc_cert_1_copy_path="integration_tests/constants/noc_cert_1_copy"
31+
noc_cert_1_copy_serial_number="169445068204646961882009388640343665944683778293"
32+
3033
noc_cert_2_path="integration_tests/constants/noc_cert_2"
3134
noc_cert_2_subject="MIGCMQswCQYDVQQGEwJVWjETMBEGA1UECAwKU29tZSBTdGF0ZTETMBEGA1UEBwwKU29tZSBTdGF0ZTEYMBYGA1UECgwPRXhhbXBsZSBDb21wYW55MRkwFwYDVQQLDBBUZXN0aW5nIERpdmlzaW9uMRQwEgYDVQQDDAtOT0MtY2hpbGQtMg=="
3235
noc_cert_2_subject_key_id="87:48:A2:33:12:1F:51:5C:93:E6:90:40:4A:2C:AB:9E:D6:19:E5:AD"
@@ -221,12 +224,17 @@ echo "Add second NOC certificate by vendor with VID = $vid"
221224
result=$(echo "$passphrase" | dcld tx pki add-noc-x509-cert --certificate="$noc_cert_2_path" --from $vendor_account --yes)
222225
check_response "$result" "\"code\": 0"
223226

227+
echo "Add third NOC certificate by vendor with VID = $vid"
228+
result=$(echo "$passphrase" | dcld tx pki add-noc-x509-cert --certificate="$noc_cert_1_copy_path" --from $vendor_account --yes)
229+
check_response "$result" "\"code\": 0"
230+
224231
echo "Request all NOC certificates"
225232
result=$(dcld query pki all-noc-x509-certs)
226233
echo $result | jq
227234
check_response "$result" "\"subject\": \"$noc_cert_1_subject\""
228235
check_response "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
229236
check_response "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
237+
check_response "$result" "\"serialNumber\": \"$noc_cert_1_copy_serial_number\""
230238
check_response "$result" "\"subject\": \"$noc_cert_2_subject\""
231239
check_response "$result" "\"subjectKeyId\": \"$noc_cert_2_subject_key_id\""
232240
check_response "$result" "\"serialNumber\": \"$noc_cert_2_serial_number\""
@@ -240,6 +248,7 @@ check_response "$result" "\"serialNumber\": \"$noc_root_cert_1_serial_number\""
240248
check_response "$result" "\"subject\": \"$noc_cert_1_subject\""
241249
check_response "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
242250
check_response "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
251+
check_response "$result" "\"serialNumber\": \"$noc_cert_1_copy_serial_number\""
243252
check_response "$result" "\"subject\": \"$noc_cert_2_subject\""
244253
check_response "$result" "\"subjectKeyId\": \"$noc_cert_2_subject_key_id\""
245254
check_response "$result" "\"serialNumber\": \"$noc_cert_2_serial_number\""
@@ -266,10 +275,11 @@ echo "Request all NOC certificates"
266275
result=$(dcld query pki all-noc-x509-certs)
267276
echo $result | jq
268277
check_response "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
278+
check_response "$result" "\"serialNumber\": \"$noc_cert_1_copy_serial_number\""
269279
check_response "$result" "\"serialNumber\": \"$noc_cert_2_serial_number\""
270280
check_response "$result" "\"serialNumber\": \"$noc_leaf_cert_1_serial_number\""
271281

272-
echo "Try to revoke intermediate with different VID = $vid_2"
282+
echo "Try to revoke NOC root certificate with different VID = $vid_2"
273283
result=$(echo "$passphrase" | dcld tx pki revoke-noc-x509-root-cert --subject="$noc_root_cert_1_subject" --subject-key-id="$noc_root_cert_1_subject_key_id" --from $vendor_account_2 --yes)
274284
check_response "$result" "\"code\": 439"
275285

@@ -347,13 +357,15 @@ check_response "$result" "\"subject\": \"$noc_leaf_cert_1_subject\""
347357
check_response "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
348358
check_response "$result" "\"subjectKeyId\": \"$noc_leaf_cert_1_subject_key_id\""
349359
check_response "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
360+
check_response "$result" "\"serialNumber\": \"$noc_cert_1_copy_serial_number\""
350361
check_response "$result" "\"serialNumber\": \"$noc_leaf_cert_1_serial_number\""
351362

352363
echo "Request all approved certificates should not contain revoked NOC root certificates"
353364
result=$(dcld query pki all-x509-certs)
354365
check_response "$result" "\"subject\": \"$noc_cert_1_subject\""
355366
check_response "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
356367
check_response "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
368+
check_response "$result" "\"serialNumber\": \"$noc_cert_1_copy_serial_number\""
357369
check_response "$result" "\"subject\": \"$noc_leaf_cert_1_subject\""
358370
check_response "$result" "\"subjectKeyId\": \"$noc_leaf_cert_1_subject_key_id\""
359371
check_response "$result" "\"serialNumber\": \"$noc_leaf_cert_1_serial_number\""
@@ -363,4 +375,71 @@ response_does_not_contain "$result" "\"serialNumber\": \"$noc_root_cert_1_serial
363375
response_does_not_contain "$result" "\"serialNumber\": \"$noc_root_cert_1_copy_serial_number\""
364376
echo $result | jq
365377

366-
test_divider
378+
test_divider
379+
380+
echo "REVOCATION OF NON-ROOT NOC CERTIFICATES"
381+
382+
echo "Try to revoke NOC certificate with different VID = $vid_2"
383+
result=$(echo "$passphrase" | dcld tx pki revoke-noc-x509-cert --subject="$noc_cert_1_subject" --subject-key-id="$noc_cert_1_subject_key_id" --from $vendor_account_2 --yes)
384+
check_response "$result" "\"code\": 439"
385+
386+
echo "$vendor_account Vendor revokes only NOC certificates, it should not revoke leaf certificates"
387+
result=$(echo "$passphrase" | dcld tx pki revoke-noc-x509-cert --subject="$noc_cert_1_subject" --subject-key-id="$noc_cert_1_subject_key_id" --from=$vendor_account --yes)
388+
check_response "$result" "\"code\": 0"
389+
390+
echo "Request all revoked certificates should not contain leaf certificate"
391+
result=$(dcld query pki all-revoked-x509-certs)
392+
echo $result | jq
393+
check_response "$result" "\"subject\": \"$noc_root_cert_1_subject"
394+
check_response "$result" "\"subjectKeyId\": \"$noc_root_cert_1_subject_key_id\""
395+
check_response "$result" "\"serialNumber\": \"$noc_root_cert_1_serial_number\""
396+
check_response "$result" "\"serialNumber\": \"$noc_root_cert_1_copy_serial_number\""
397+
check_response "$result" "\"subject\": \"$noc_cert_1_subject\""
398+
check_response "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
399+
check_response "$result" "\"serialNumber\": \"$noc_cert_1_serial_number"
400+
response_does_not_contain "$result" "\"subject\": \"$noc_leaf_cert_1_subject\""
401+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_leaf_cert_1_subject_key_id\""
402+
response_does_not_contain "$result" "\"serialNumber\": \"$noc_leaf_cert_1_serial_number"
403+
404+
echo "Request all revoked noc root certificates should not contain non-root NOC certificates"
405+
result=$(dcld query pki all-revoked-noc-x509-root-certs)
406+
echo $result | jq
407+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id"
408+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_leaf_cert_1_subject_key_id\""
409+
410+
echo "Request all certificates by subject must be empty"
411+
result=$(dcld query pki all-subject-x509-certs --subject="$noc_cert_1_subject")
412+
response_does_not_contain "$result" "\"subject\": \"$noc_cert_1_subject\""
413+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
414+
echo $result | jq
415+
416+
echo "Request all certificates by subjectKeyId must be empty"
417+
result=$(dcld query pki x509-cert --subject-key-id="$noc_cert_1_subject_key_id")
418+
check_response "$result" "Not Found"
419+
response_does_not_contain "$result" "\"subject\": \"$noc_cert_1_subject\""
420+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
421+
response_does_not_contain "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
422+
response_does_not_contain "$result" "\"serialNumber\": \"$noc_cert_1_copy_serial_number\""
423+
echo $result | jq
424+
425+
echo "Request NOC certificate by VID = $vid should contain ony leaf certificate"
426+
result=$(dcld query pki noc-x509-certs --vid="$vid")
427+
echo $result | jq
428+
check_response "$result" "\"subject\": \"$noc_leaf_cert_1_subject\""
429+
check_response "$result" "\"subjectKeyId\": \"$noc_leaf_cert_1_subject_key_id\""
430+
response_does_not_contain "$result" "\"subject\": \"$noc_cert_1_subject\""
431+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
432+
433+
echo "Request all approved certificates should not contain revoked NOC certificates"
434+
result=$(dcld query pki all-x509-certs)
435+
check_response "$result" "\"subject\": \"$noc_leaf_cert_1_subject\""
436+
check_response "$result" "\"subjectKeyId\": \"$noc_leaf_cert_1_subject_key_id\""
437+
check_response "$result" "\"serialNumber\": \"$noc_leaf_cert_1_serial_number\""
438+
response_does_not_contain "$result" "\"subject\": \"$noc_cert_1_subject\""
439+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_cert_1_subject_key_id\""
440+
response_does_not_contain "$result" "\"serialNumber\": \"$noc_cert_1_serial_number\""
441+
response_does_not_contain "$result" "\"subject\": \"$noc_root_cert_1_subject\""
442+
response_does_not_contain "$result" "\"subjectKeyId\": \"$noc_root_cert_1_subject_key_id\""
443+
response_does_not_contain "$result" "\"serialNumber\": \"$noc_root_cert_1_serial_number\""
444+
response_does_not_contain "$result" "\"serialNumber\": \"$noc_root_cert_1_copy_serial_number\""
445+
echo $result | jq

‎integration_tests/constants/noc_cert_1_copy

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICUTCCAfegAwIBAgIUHa4t/R+Gtf/22F5T6n+f6zfGkPUwCgYIKoZIzj0EAwIw
3+
ejELMAkGA1UEBhMCVVoxEzARBgNVBAgMClNvbWUgU3RhdGUxETAPBgNVBAcMCFRh
4+
c2hrZW50MRgwFgYDVQQKDA9FeGFtcGxlIENvbXBhbnkxGTAXBgNVBAsMEFRlc3Rp
5+
bmcgRGl2aXNpb24xDjAMBgNVBAMMBU5PQy0xMCAXDTI0MDMxMzE2NDIwM1oYDzMw
6+
MjMwNzE1MTY0MjAzWjCBgjELMAkGA1UEBhMCVVoxEzARBgNVBAgMClNvbWUgU3Rh
7+
dGUxEzARBgNVBAcMClNvbWUgU3RhdGUxGDAWBgNVBAoMD0V4YW1wbGUgQ29tcGFu
8+
eTEZMBcGA1UECwwQVGVzdGluZyBEaXZpc2lvbjEUMBIGA1UEAwwLTk9DLWNoaWxk
9+
LTEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATOPY6vbvv8no8NcIdfa/MbkJep
10+
FkUcfOYym0gajL2yph8a/wk0RpYqL+M+KJ4oja70oKK/igBmEitRD4VB3mXQo1Aw
11+
TjAdBgNVHQ4EFgQUAnJuvLvv1r2Nm0Ku1DzAVV9mOrMwHwYDVR0jBBgwFoAUROtM
12+
YmslSM2isxyHQVoI5yu5gyYwDAYDVR0TBAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
13+
AiEA7Z1xDQHO2B0kFC5rdVuXGzH150tJEoCwZMohKpnK+kUCIBzFXAoaURzHVyTG
14+
oB0TJHTlKONyyEXKnHf8pJedjOq4
15+
-----END CERTIFICATE-----

‎integration_tests/constants/noc_constants.go

+22
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,22 @@ TjAdBgNVHQ4EFgQUAnJuvLvv1r2Nm0Ku1DzAVV9mOrMwHwYDVR0jBBgwFoAUROtM
7979
YmslSM2isxyHQVoI5yu5gyYwDAYDVR0TBAUwAwEB/zAKBggqhkjOPQQDAgNJADBG
8080
AiEAzUSg9uY1+hn4Xe5ZyxmhEe5ycTtA7o94jA3x1ygGXcECIQD8mYhLsOss/API
8181
/xNPu7fcgPAwhltZAf6Cf9QVxRme/Q==
82+
-----END CERTIFICATE-----`
83+
84+
NocCert1Copy = `-----BEGIN CERTIFICATE-----
85+
MIICUTCCAfegAwIBAgIUHa4t/R+Gtf/22F5T6n+f6zfGkPUwCgYIKoZIzj0EAwIw
86+
ejELMAkGA1UEBhMCVVoxEzARBgNVBAgMClNvbWUgU3RhdGUxETAPBgNVBAcMCFRh
87+
c2hrZW50MRgwFgYDVQQKDA9FeGFtcGxlIENvbXBhbnkxGTAXBgNVBAsMEFRlc3Rp
88+
bmcgRGl2aXNpb24xDjAMBgNVBAMMBU5PQy0xMCAXDTI0MDMxMzE2NDIwM1oYDzMw
89+
MjMwNzE1MTY0MjAzWjCBgjELMAkGA1UEBhMCVVoxEzARBgNVBAgMClNvbWUgU3Rh
90+
dGUxEzARBgNVBAcMClNvbWUgU3RhdGUxGDAWBgNVBAoMD0V4YW1wbGUgQ29tcGFu
91+
eTEZMBcGA1UECwwQVGVzdGluZyBEaXZpc2lvbjEUMBIGA1UEAwwLTk9DLWNoaWxk
92+
LTEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATOPY6vbvv8no8NcIdfa/MbkJep
93+
FkUcfOYym0gajL2yph8a/wk0RpYqL+M+KJ4oja70oKK/igBmEitRD4VB3mXQo1Aw
94+
TjAdBgNVHQ4EFgQUAnJuvLvv1r2Nm0Ku1DzAVV9mOrMwHwYDVR0jBBgwFoAUROtM
95+
YmslSM2isxyHQVoI5yu5gyYwDAYDVR0TBAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
96+
AiEA7Z1xDQHO2B0kFC5rdVuXGzH150tJEoCwZMohKpnK+kUCIBzFXAoaURzHVyTG
97+
oB0TJHTlKONyyEXKnHf8pJedjOq4
8298
-----END CERTIFICATE-----`
8399

84100
NocCert2 = `-----BEGIN CERTIFICATE-----
@@ -139,6 +155,12 @@ zodhpBXZfzhHDvINejK8wzwWgf7Ds8wk3oENlmAj
139155
NocCert1SerialNumber = "631388393741945881054190991612463928825155142122"
140156
NocCert1SubjectAsText = "CN=NOC-child-1,OU=Testing Division,O=Example Company,L=Some State,ST=Some State,C=UZ"
141157

158+
NocCert1CopySubject = "MIGCMQswCQYDVQQGEwJVWjETMBEGA1UECAwKU29tZSBTdGF0ZTETMBEGA1UEBwwKU29tZSBTdGF0ZTEYMBYGA1UECgwPRXhhbXBsZSBDb21wYW55MRkwFwYDVQQLDBBUZXN0aW5nIERpdmlzaW9uMRQwEgYDVQQDDAtOT0MtY2hpbGQtMQ=="
159+
NocCert1CopyIssuer = NocRootCert1Subject
160+
NocCert1CopySubjectKeyID = "02:72:6E:BC:BB:EF:D6:BD:8D:9B:42:AE:D4:3C:C0:55:5F:66:3A:B3"
161+
NocCert1CopySerialNumber = "169445068204646961882009388640343665944683778293"
162+
NocCert1CopySubjectAsText = "CN=NOC-child-1,OU=Testing Division,O=Example Company,L=Some State,ST=Some State,C=UZ"
163+
142164
NocCert2Subject = "MIGCMQswCQYDVQQGEwJVWjETMBEGA1UECAwKU29tZSBTdGF0ZTETMBEGA1UEBwwKU29tZSBTdGF0ZTEYMBYGA1UECgwPRXhhbXBsZSBDb21wYW55MRkwFwYDVQQLDBBUZXN0aW5nIERpdmlzaW9uMRQwEgYDVQQDDAtOT0MtY2hpbGQtMg=="
143165
NocCert2Issuer = NocRootCert2Subject
144166
NocCert2SubjectKeyID = "87:48:A2:33:12:1F:51:5C:93:E6:90:40:4A:2C:AB:9E:D6:19:E5:AD"

‎proto/pki/tx.proto

+14
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ service Msg {
2525
rpc RemoveX509Cert(MsgRemoveX509Cert) returns (MsgRemoveX509CertResponse);
2626
rpc AddNocX509Cert(MsgAddNocX509Cert) returns (MsgAddNocX509CertResponse);
2727
rpc RevokeNocRootX509Cert(MsgRevokeNocRootX509Cert) returns (MsgRevokeNocRootX509CertResponse);
28+
rpc RevokeNocX509Cert(MsgRevokeNocX509Cert) returns (MsgRevokeNocX509CertResponse);
2829
// this line is used by starport scaffolding # proto/tx/rpc
2930
}
3031

@@ -201,4 +202,17 @@ message MsgRevokeNocRootX509Cert {
201202
message MsgRevokeNocRootX509CertResponse {
202203
}
203204

205+
message MsgRevokeNocX509Cert {
206+
string signer = 1 [(cosmos_proto.scalar) = "cosmos.AddressString", (gogoproto.moretags) = "validate:\"required\""];
207+
string subject = 2 [(gogoproto.moretags) = "validate:\"required,max=1024\""];
208+
string subjectKeyId = 3 [(gogoproto.moretags) = "validate:\"required,max=256\""];
209+
string serialNumber = 4;
210+
string info = 5 [(gogoproto.moretags) = "validate:\"max=4096\""];
211+
int64 time = 6;
212+
bool revokeChild = 7;
213+
}
214+
215+
message MsgRevokeNocX509CertResponse {
216+
}
217+
204218
// this line is used by starport scaffolding # proto/tx/message

‎scripts/starport/upgrade-0.44/07.pki_types.sh

+1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ starport scaffold --module pki message delete-pki-revocation-distribution-point
2020
starport scaffold --module pki message AddNocX509RootCert cert --signer signer
2121
starport scaffold --module pki message AddNocX509Cert cert --signer signer
2222
starport scaffold --module pki message RevokeNocRootX509Cert subject subjectKeyId serialNumber info time:uint revokeChild:bool --signer signer
23+
starport scaffold --module pki message RevokeNocX509Cert subject subjectKeyId serialNumber info time:uint revokeChild:bool --signer signer
2324

2425
# CRUD data types
2526
starport scaffold --module pki map ApprovedCertificates certs:strings --index subject,subjectKeyId --no-message

‎types/pki/errors.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@ func NewErrMessageVidNotEqualAccountVid(msgVid int32, accountVid int32) error {
351351
return sdkerrors.Wrapf(ErrMessageVidNotEqualAccountVid, "Message vid=%d is not equal to account vid=%d", msgVid, accountVid)
352352
}
353353

354-
func NewErrMessageRemoveRoot(subject string, subjectKeyID string) error {
354+
func NewErrMessageExpectedNonRoot(subject string, subjectKeyID string) error {
355355
return sdkerrors.Wrapf(ErrInappropriateCertificateType, "Inappropriate Certificate Type: Certificate with subject=%s and subjectKeyID=%s "+
356356
"is a root certificate.", subject, subjectKeyID,
357357
)

0 commit comments

Comments
 (0)