Skip to content

Commit 5d4f0fe

Browse files
DenisRybasDenisRybas
authored
vid for PAIs (#585)
VID field for VID scoped PAI certificates
1 parent 9861853 commit 5d4f0fe

8 files changed

+50
-12
lines changed

‎integration_tests/cli/pki-add-vendor-x509-certificates.sh

+6
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,12 @@ check_response "$result" "\"subject\": \"$intermediate_cert_with_vid_65521_subje
5555
check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_with_vid_65521_subject_key_id\""
5656
check_response "$result" "\"serialNumber\": \"$intermediate_cert_with_vid_65521_serial_number\""
5757

58+
echo "Request intermediate certificate by subject=$intermediate_cert_with_vid_65521_subject and skid=$intermediate_cert_with_vid_65521_subject_key_id."
59+
result=$(dcld query pki x509-cert --subject="$intermediate_cert_with_vid_65521_subject" --subject-key-id="$intermediate_cert_with_vid_65521_subject_key_id")
60+
echo $result | jq
61+
check_response "$result" "\"serialNumber\": \"$intermediate_cert_with_vid_65521_serial_number\""
62+
check_response "$result" "\"vid\": $intermediate_cert_with_vid_65521_vid"
63+
5864
echo "Try to add an intermediate certificate with vid=$intermediate_cert_with_vid_65522_vid by $vendor_account_65521 with vid=$vendor_vid_65521"
5965
result=$(echo "$passphrase" | dcld tx pki add-x509-cert --certificate="$intermediate_cert_with_vid_65522_path" --from $vendor_account_65521 --yes)
6066
result=$(get_txn_result "$result")

‎integration_tests/constants/constants.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -356,7 +356,7 @@ FGE90Ic1XvCLrgHkxpqPxz2sjH39MB8GA1UdIwQYMBaAFHhc5wW4a49Ob8eTqmDL
356356
Q+ppaILVMAoGCCqGSM49BAMCA0gAMEUCIQDfwJ3oS/qVbWDW/vTirREL3iIqMogw
357357
pn4/F7keUYUaeAIgce2XGOSIsrjPlUQ1zj/zLqUFVhQ8TyycBaIK8z7Uytk=
358358
-----END CERTIFICATE-----`
359-
359+
PAICertWithNumericVidVid = 65522
360360
PAICertWithNumericVidSubject = "MDAxGDAWBgNVBAMMD01hdHRlciBUZXN0IFBBSTEUMBIGCisGAQQBgqJ8AgEMBEZGRjI="
361361
PAICertWithNumericVidSubjectKeyID = "61:3D:D0:87:35:5E:F0:8B:AE:01:E4:C6:9A:8F:C7:3D:AC:8C:7D:FD"
362362

‎integration_tests/grpc_rest/pki/helpers.go

+1
Original file line numberDiff line numberDiff line change
@@ -2151,4 +2151,5 @@ func Demo(suite *utils.TestSuite) {
21512151
// Check there is only one approved intermediate certificate
21522152
certs, _ = GetX509Cert(suite, testconstants.PAICertWithNumericVidSubject, testconstants.PAICertWithNumericVidSubjectKeyID)
21532153
require.Equal(suite.T, 1, len(certs.Certs))
2154+
require.Equal(suite.T, int32(testconstants.PAICertWithNumericVidVid), certs.Certs[0].Vid)
21542155
}

‎x/pki/handler_add_non_root_cert_test.go

+30-7
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ func TestHandler_AddX509Cert(t *testing.T) {
3131
// query certificate
3232
certificate, _ := querySingleApprovedCertificate(
3333
setup, testconstants.IntermediateSubject, testconstants.IntermediateSubjectKeyID)
34-
require.Equal(t, intermediateCertificate(accAddress), *certificate)
34+
require.Equal(t, intermediateCertificateNoVid(accAddress), *certificate)
3535

3636
certificateBySubjectKeyID, _ := queryAllApprovedCertificatesBySubjectKeyID(setup, testconstants.IntermediateSubjectKeyID)
3737
require.Equal(t, 1, len(certificateBySubjectKeyID))
@@ -130,7 +130,7 @@ func TestHandler_AddX509Cert_ForExistingNocCertificate(t *testing.T) {
130130
setup.AddAccount(vendorAccAddress, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.Vid)
131131

132132
// Store the NOC certificate
133-
nocCertificate := intermediateCertificate(vendorAccAddress)
133+
nocCertificate := intermediateCertificateNoVid(vendorAccAddress)
134134
nocCertificate.SerialNumber = testconstants.TestSerialNumber
135135
nocCertificate.IsNoc = true
136136

@@ -156,7 +156,7 @@ func TestHandler_AddX509Cert_NoRootCert(t *testing.T) {
156156
setup.AddAccount(vendorAccAddress, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.Vid)
157157

158158
// add intermediate certificate
159-
intermediateCertificate := intermediateCertificate(vendorAccAddress)
159+
intermediateCertificate := intermediateCertificateNoVid(vendorAccAddress)
160160
setup.Keeper.AddApprovedCertificate(setup.Ctx, intermediateCertificate)
161161

162162
// add leaf x509 certificate
@@ -182,6 +182,29 @@ func TestHandler_AddX509Cert_RootIsNoc(t *testing.T) {
182182
require.ErrorIs(t, err, pkitypes.ErrInappropriateCertificateType)
183183
}
184184

185+
func TestHandler_AddX509Cert_VIDScoped(t *testing.T) {
186+
setup := Setup(t)
187+
188+
// // store root certificate
189+
rootCertOptions := createPAACertWithNumericVidOptions()
190+
proposeAndApproveRootCertificate(setup, setup.Trustee1, rootCertOptions)
191+
192+
accAddress := GenerateAccAddress()
193+
setup.AddAccount(accAddress, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.PAACertWithNumericVidVid)
194+
195+
// add x509 certificate
196+
addX509Cert := types.NewMsgAddX509Cert(accAddress.String(), testconstants.PAICertWithNumericPidVid, testconstants.CertSchemaVersion)
197+
_, err := setup.Handler(setup.Ctx, addX509Cert)
198+
require.NoError(t, err)
199+
200+
// query certificate
201+
intermediateCerts, _ := queryApprovedCertificates(setup, testconstants.PAICertWithNumericPidVidSubject, testconstants.PAICertWithNumericPidVidSubjectKeyID)
202+
require.Equal(t, 1, len(intermediateCerts.Certs))
203+
require.Equal(t, testconstants.PAICertWithNumericPidVidSubject, intermediateCerts.Certs[0].Subject)
204+
require.Equal(t, testconstants.PAICertWithNumericPidVidSubjectKeyID, intermediateCerts.Certs[0].SubjectKeyId)
205+
require.Equal(t, int32(testconstants.PAICertWithNumericPidVidVid), intermediateCerts.Certs[0].Vid)
206+
}
207+
185208
func TestHandler_AddX509Cert_ForDifferentSerialNumber(t *testing.T) {
186209
setup := Setup(t)
187210

@@ -193,7 +216,7 @@ func TestHandler_AddX509Cert_ForDifferentSerialNumber(t *testing.T) {
193216
setup.AddAccount(vendorAccAddress, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.Vid)
194217

195218
// store intermediate certificate with different serial number
196-
intermediateCertificate := intermediateCertificate(vendorAccAddress)
219+
intermediateCertificate := intermediateCertificateNoVid(vendorAccAddress)
197220
intermediateCertificate.SerialNumber = SerialNumber
198221
setup.Keeper.SetUniqueCertificate(
199222
setup.Ctx,
@@ -333,7 +356,7 @@ func TestHandler_AddX509Cert_EachChildCertRefersToTwoParentCerts(t *testing.T) {
333356
setup.AddAccount(vendorAccAddress, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.Vid)
334357

335358
// store intermediate certificate (it refers to two parent certificates)
336-
intermediateCertificate := intermediateCertificate(vendorAccAddress)
359+
intermediateCertificate := intermediateCertificateNoVid(vendorAccAddress)
337360
intermediateCertificate.SerialNumber = SerialNumber
338361

339362
setup.Keeper.AddApprovedCertificate(setup.Ctx, intermediateCertificate)
@@ -409,7 +432,7 @@ func TestHandler_AddX509Cert_ByNotOwnerButSameVendor(t *testing.T) {
409432
setup.AddAccount(vendorAccAddress1, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.Vid)
410433

411434
// Store an intermediate certificate with the first vendor account as the owner
412-
intermediateCertificate := intermediateCertificate(vendorAccAddress1)
435+
intermediateCertificate := intermediateCertificateNoVid(vendorAccAddress1)
413436
intermediateCertificate.SerialNumber = SerialNumber
414437
setup.Keeper.AddApprovedCertificate(setup.Ctx, intermediateCertificate)
415438
setup.Keeper.AddApprovedCertificateBySubjectKeyID(setup.Ctx, intermediateCertificate)
@@ -440,7 +463,7 @@ func TestHandler_AddX509Cert_ByOtherVendor(t *testing.T) {
440463
setup.AddAccount(vendorAccAddress1, []dclauthtypes.AccountRole{dclauthtypes.Vendor}, testconstants.Vid)
441464

442465
// Store an intermediate certificate with the first vendor account as the owner
443-
intermediateCertificate := intermediateCertificate(vendorAccAddress1)
466+
intermediateCertificate := intermediateCertificateNoVid(vendorAccAddress1)
444467
intermediateCertificate.SerialNumber = SerialNumber
445468
setup.Keeper.AddApprovedCertificate(setup.Ctx, intermediateCertificate)
446469
setup.Keeper.AddApprovedCertificateBySubjectKeyID(setup.Ctx, intermediateCertificate)

‎x/pki/handler_revoke_non_root_cert_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ func TestHandler_RevokeX509Cert_ByNotOwnerButSameVendor(t *testing.T) {
212212
require.Equal(t, testconstants.IntermediateSubject, revokedCertificates.Subject)
213213
require.Equal(t, testconstants.IntermediateSubjectKeyID, revokedCertificates.SubjectKeyId)
214214
require.Equal(t, 1, len(revokedCertificates.Certs))
215-
require.Equal(t, intermediateCertificate(vendorAccAddress1), *revokedCertificates.Certs[0])
215+
require.Equal(t, intermediateCertificateNoVid(vendorAccAddress1), *revokedCertificates.Certs[0])
216216

217217
// check that revoked certificate removed from approved certificates list
218218
_, err = queryApprovedCertificates(setup, testconstants.IntermediateSubject, testconstants.IntermediateSubjectKeyID)
@@ -380,7 +380,7 @@ func TestHandler_RevokeX509Cert_BySerialNumber(t *testing.T) {
380380
addIntermediateX509Cert := types.NewMsgAddX509Cert(vendorAccAddress.String(), testconstants.IntermediateCertPem, testconstants.CertSchemaVersion)
381381
_, err := setup.Handler(setup.Ctx, addIntermediateX509Cert)
382382
require.NoError(t, err)
383-
intermediateCertificate := intermediateCertificate(vendorAccAddress)
383+
intermediateCertificate := intermediateCertificateNoVid(vendorAccAddress)
384384
intermediateCertificate.SerialNumber = SerialNumber
385385
setup.Keeper.AddApprovedCertificate(setup.Ctx, intermediateCertificate)
386386
setup.Keeper.AddApprovedCertificateBySubjectKeyID(setup.Ctx, intermediateCertificate)

‎x/pki/handler_test.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -2308,7 +2308,7 @@ func rootCertificate(address sdk.AccAddress) types.Certificate {
23082308
)
23092309
}
23102310

2311-
func intermediateCertificate(address sdk.AccAddress) types.Certificate {
2311+
func intermediateCertificateNoVid(address sdk.AccAddress) types.Certificate {
23122312
return types.NewNonRootCertificate(
23132313
testconstants.IntermediateCertPem,
23142314
testconstants.IntermediateSubject,
@@ -2320,6 +2320,7 @@ func intermediateCertificate(address sdk.AccAddress) types.Certificate {
23202320
testconstants.RootSubject,
23212321
testconstants.RootSubjectKeyID,
23222322
address.String(),
2323+
0,
23232324
testconstants.SchemaVersion,
23242325
)
23252326
}

‎x/pki/keeper/msg_server_add_x_509_cert.go

+6
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,11 @@ func (k msgServer) AddX509Cert(goCtx context.Context, msg *types.MsgAddX509Cert)
8686
return nil, err
8787
}
8888

89+
subjectVid, err := x509.GetVidFromSubject(x509Certificate.SubjectAsText)
90+
if err != nil {
91+
return nil, pkitypes.NewErrInvalidCertificate(err)
92+
}
93+
8994
// create new certificate
9095
certificate := types.NewNonRootCertificate(
9196
msg.Cert,
@@ -98,6 +103,7 @@ func (k msgServer) AddX509Cert(goCtx context.Context, msg *types.MsgAddX509Cert)
98103
rootCert.Subject,
99104
rootCert.SubjectKeyId,
100105
msg.Signer,
106+
subjectVid,
101107
msg.CertSchemaVersion,
102108
)
103109

‎x/pki/types/certificate.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ func NewRootCertificate(pemCert string, subject string, subjectAsText string, su
2121
func NewNonRootCertificate(pemCert string, subject string, subjectAsText string, subjectKeyID string, serialNumber string,
2222
issuer string, authorityKeyID string,
2323
rootSubject string, rootSubjectKeyID string,
24-
owner string,
24+
owner string, vid int32,
2525
schemaVersion uint32,
2626
) Certificate {
2727
return Certificate{
@@ -36,6 +36,7 @@ func NewNonRootCertificate(pemCert string, subject string, subjectAsText string,
3636
RootSubjectKeyId: rootSubjectKeyID,
3737
IsRoot: false,
3838
Owner: owner,
39+
Vid: vid,
3940
SchemaVersion: schemaVersion,
4041
}
4142
}

0 commit comments

Comments
 (0)