Skip to content

Commit b33bea8

Browse files
AbdulboisAbdulbois
committed
#535 Enable providing serial number while revoking x509 certs
Resolve MR comments Signed-off-by: Abdulbois <abdulbois.tursunov@dsr-corporation.com> Signed-off-by: Abdulbois <abdulbois123@gmail.com>
1 parent 2f8b273 commit b33bea8

5 files changed

+60
-67
lines changed

‎integration_tests/cli/pki-revocation-with-serial-number.sh

-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ trustee_account="jack"
1919
second_trustee_account="alice"
2020

2121
echo "Create a VendorAdmin Account"
22-
create_new_account vendor_admin_account "VendorAdmin"
2322

2423
test_divider
2524

‎x/pki/keeper/approved_certificates.go

+26-20
Original file line numberDiff line numberDiff line change
@@ -74,26 +74,6 @@ func (k Keeper) RemoveApprovedCertificates(
7474
))
7575
}
7676

77-
func (k Keeper) removeCertFromList(serialNumber string, certs *types.ApprovedCertificates) {
78-
certIndex := -1
79-
80-
for i, cert := range certs.Certs {
81-
if cert.SerialNumber == serialNumber {
82-
certIndex = i
83-
84-
break
85-
}
86-
}
87-
if certIndex == -1 {
88-
return
89-
}
90-
if certIndex == len(certs.Certs)-1 {
91-
certs.Certs = certs.Certs[:certIndex]
92-
} else {
93-
certs.Certs = append(certs.Certs[:certIndex], certs.Certs[certIndex+1:]...)
94-
}
95-
}
96-
9777
// GetAllApprovedCertificates returns all approvedCertificates.
9878
func (k Keeper) GetAllApprovedCertificates(ctx sdk.Context) (list []types.ApprovedCertificates) {
9979
store := prefix.NewStore(ctx.KVStore(k.storeKey), pkitypes.KeyPrefix(types.ApprovedCertificatesKeyPrefix))
@@ -195,3 +175,29 @@ func (k Keeper) verifyCertificate(ctx sdk.Context,
195175
fmt.Sprintf("Certificate verification failed for certificate with subject=%v and subjectKeyID=%v",
196176
x509Certificate.Subject, x509Certificate.SubjectKeyID))
197177
}
178+
179+
func (k Keeper) removeCertFromList(issuer string, serialNumber string, certs *types.ApprovedCertificates) {
180+
certIndex := -1
181+
182+
for i, cert := range certs.Certs {
183+
if cert.SerialNumber == serialNumber && cert.Issuer == issuer {
184+
certIndex = i
185+
186+
break
187+
}
188+
}
189+
if certIndex == -1 {
190+
return
191+
}
192+
certs.Certs = append(certs.Certs[:certIndex], certs.Certs[certIndex+1:]...)
193+
}
194+
195+
func findCertificate(serialNumber string, certificates *[]*types.Certificate) (*types.Certificate, bool) {
196+
for _, cert := range *certificates {
197+
if cert.SerialNumber == serialNumber {
198+
return cert, true
199+
}
200+
}
201+
202+
return nil, false
203+
}

‎x/pki/keeper/msg_server_approve_revoke_x_509_root_cert.go

+30-27
Original file line numberDiff line numberDiff line change
@@ -49,35 +49,24 @@ func (k msgServer) ApproveRevokeX509RootCert(goCtx context.Context, msg *types.M
4949
revocation.Approvals = append(revocation.Approvals, &grant)
5050

5151
// check if proposed certificate revocation has enough approvals
52-
if len(revocation.Approvals) >= k.CertificateApprovalsCount(ctx, k.dclauthKeeper) { //nolint:nestif
52+
if len(revocation.Approvals) >= k.CertificateApprovalsCount(ctx, k.dclauthKeeper) {
5353
certificates, found := k.GetApprovedCertificates(ctx, msg.Subject, msg.SubjectKeyId)
5454
if !found {
5555
return nil, pkitypes.NewErrCertificateDoesNotExist(msg.Subject, msg.SubjectKeyId)
5656
}
57-
58-
var certBySerialNumber *types.Certificate
59-
// Assign the approvals to the root certificate
60-
for _, cert := range certificates.Certs {
61-
if cert.IsRoot {
62-
cert.Approvals = revocation.Approvals
63-
}
64-
if msg.SerialNumber != "" && cert.SerialNumber == msg.SerialNumber {
65-
certBySerialNumber = cert
66-
67-
break
68-
}
69-
}
7057
certID := types.CertificateIdentifier{
7158
Subject: msg.Subject,
7259
SubjectKeyId: msg.SubjectKeyId,
7360
}
74-
k.RemoveProposedCertificateRevocation(ctx, msg.Subject, msg.SubjectKeyId, msg.SerialNumber)
7561
k.AddRevokedRootCertificate(ctx, certID)
62+
k.RemoveProposedCertificateRevocation(ctx, msg.Subject, msg.SubjectKeyId, msg.SerialNumber)
7663

64+
certBySerialNumber, _ := findCertificate(msg.SerialNumber, &certificates.Certs)
7765
if certBySerialNumber != nil {
78-
k._removeAndRevokeBySerialNumber(ctx, certBySerialNumber, certID, certificates)
66+
certBySerialNumber.Approvals = revocation.Approvals
67+
k._removeAndRevokeBySerialNumber(ctx, certBySerialNumber, certificates)
7968
} else {
80-
k._removeAndRevoke(ctx, certID, certificates)
69+
k._removeAndRevoke(ctx, revocation.Approvals, certificates)
8170
}
8271
} else {
8372
k.SetProposedCertificateRevocation(ctx, revocation)
@@ -86,30 +75,44 @@ func (k msgServer) ApproveRevokeX509RootCert(goCtx context.Context, msg *types.M
8675
return &types.MsgApproveRevokeX509RootCertResponse{}, nil
8776
}
8877

89-
func (k msgServer) _removeAndRevoke(ctx sdk.Context, certID types.CertificateIdentifier, certificates types.ApprovedCertificates) {
90-
k.AddRevokedCertificates(ctx, certificates)
91-
k.RemoveApprovedCertificates(ctx, certID.Subject, certID.SubjectKeyId)
92-
k.RevokeChildCertificates(ctx, certID.Subject, certID.SubjectKeyId)
93-
78+
func (k msgServer) _removeAndRevoke(ctx sdk.Context, approvals []*types.Grant, certificates types.ApprovedCertificates) {
79+
// Assign the approvals to the root certificate
80+
for _, cert := range certificates.Certs {
81+
if cert.IsRoot {
82+
cert.Approvals = approvals
83+
}
84+
}
85+
certID := types.CertificateIdentifier{
86+
Subject: certificates.Subject,
87+
SubjectKeyId: certificates.SubjectKeyId,
88+
}
9489
// remove from root certs index, add to revoked root certs
9590
k.RemoveApprovedRootCertificate(ctx, certID)
91+
k.AddRevokedCertificates(ctx, certificates)
92+
k.RemoveApprovedCertificates(ctx, certificates.Subject, certificates.SubjectKeyId)
93+
k.RevokeChildCertificates(ctx, certificates.Subject, certificates.SubjectKeyId)
9694
// remove from subject -> subject key ID map
97-
k.RemoveApprovedCertificateBySubject(ctx, certID.Subject, certID.SubjectKeyId)
95+
k.RemoveApprovedCertificateBySubject(ctx, certificates.Subject, certificates.SubjectKeyId)
9896
// remove from subject key ID -> certificates map
99-
k.RemoveApprovedCertificatesBySubjectKeyID(ctx, certID.Subject, certID.SubjectKeyId)
97+
k.RemoveApprovedCertificatesBySubjectKeyID(ctx, certificates.Subject, certificates.SubjectKeyId)
10098
}
101-
func (k msgServer) _removeAndRevokeBySerialNumber(ctx sdk.Context, cert *types.Certificate, certID types.CertificateIdentifier, certificates types.ApprovedCertificates) {
99+
func (k msgServer) _removeAndRevokeBySerialNumber(ctx sdk.Context, cert *types.Certificate, certificates types.ApprovedCertificates) {
102100
k.AddRevokedCertificates(ctx,
103101
types.ApprovedCertificates{
104102
Subject: cert.Subject,
105103
SubjectKeyId: cert.SubjectKeyId,
106104
Certs: []*types.Certificate{cert},
107105
})
108-
k.removeCertFromList(cert.SerialNumber, &certificates)
106+
k.removeCertFromList(cert.Issuer, cert.SerialNumber, &certificates)
109107
if len(certificates.Certs) == 0 {
110108
k.RemoveApprovedCertificates(ctx, cert.Subject, cert.SubjectKeyId)
111109
k.RevokeChildCertificates(ctx, cert.Subject, cert.SubjectKeyId)
112-
k.RemoveApprovedRootCertificate(ctx, certID)
110+
k.RemoveApprovedRootCertificate(ctx,
111+
types.CertificateIdentifier{
112+
Subject: certificates.Subject,
113+
SubjectKeyId: certificates.SubjectKeyId,
114+
},
115+
)
113116
k.RemoveApprovedCertificateBySubject(ctx, cert.Subject, cert.SubjectKeyId)
114117
k.RemoveApprovedCertificatesBySubjectKeyID(ctx, cert.Subject, cert.SubjectKeyId)
115118
} else {

‎x/pki/keeper/msg_server_propose_revoke_x_509_root_cert.go

+2-9
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func (k msgServer) ProposeRevokeX509RootCert(goCtx context.Context, msg *types.M
3333

3434
// get corresponding approved certificates
3535
certificates, found := k.GetApprovedCertificates(ctx, msg.Subject, msg.SubjectKeyId)
36-
if !found {
36+
if !found || len(certificates.Certs) == 0 {
3737
return nil, pkitypes.NewErrCertificateDoesNotExist(msg.Subject, msg.SubjectKeyId)
3838
}
3939

@@ -46,14 +46,7 @@ func (k msgServer) ProposeRevokeX509RootCert(goCtx context.Context, msg *types.M
4646
}
4747
// fail if cert with serial number does not exist
4848
if msg.SerialNumber != "" {
49-
found := false
50-
for _, cert := range certificates.Certs {
51-
if cert.SerialNumber == msg.SerialNumber {
52-
found = true
53-
54-
break
55-
}
56-
}
49+
_, found = findCertificate(msg.SerialNumber, &certificates.Certs)
5750
if !found {
5851
return nil, pkitypes.NewErrCertificateBySerialNumberDoesNotExist(
5952
msg.Subject, msg.SubjectKeyId, msg.SerialNumber,

‎x/pki/keeper/msg_server_revoke_x_509_cert.go

+2-10
Original file line numberDiff line numberDiff line change
@@ -39,15 +39,7 @@ func (k msgServer) RevokeX509Cert(goCtx context.Context, msg *types.MsgRevokeX50
3939
var certBySerialNumber *types.Certificate
4040

4141
if msg.SerialNumber != "" {
42-
found := false
43-
for _, cert := range certificates.Certs {
44-
if cert.SerialNumber == msg.SerialNumber {
45-
certBySerialNumber = cert
46-
found = true
47-
48-
break
49-
}
50-
}
42+
certBySerialNumber, found = findCertificate(msg.SerialNumber, &certificates.Certs)
5143
if !found {
5244
return nil, pkitypes.NewErrCertificateBySerialNumberDoesNotExist(msg.Subject, msg.SubjectKeyId, msg.SerialNumber)
5345
}
@@ -82,7 +74,7 @@ func (k msgServer) _removeAndRevokeX509CertBySerialNumber(ctx sdk.Context, cert
8274
SubjectKeyId: cert.SubjectKeyId,
8375
Certs: []*types.Certificate{cert},
8476
})
85-
k.removeCertFromList(cert.SerialNumber, &certificates)
77+
k.removeCertFromList(cert.Issuer, cert.SerialNumber, &certificates)
8678
if len(certificates.Certs) == 0 {
8779
k.RemoveApprovedCertificates(ctx, cert.Subject, cert.SubjectKeyId)
8880
// Remove certificate identifier from issuer's ChildCertificates record

0 commit comments

Comments
 (0)