-
Notifications
You must be signed in to change notification settings - Fork 0
/
servergencrl.go
156 lines (133 loc) · 4.73 KB
/
servergencrl.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
/*
Copyright IBM Corp. All Rights Reserved.
SPDX-License-Identifier: Apache-2.0
*/
package lib
import (
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"fmt"
"io/ioutil"
"math/big"
"time"
"github.com/cloudflare/cfssl/crl"
"github.com/cloudflare/cfssl/log"
"github.com/hyperledger/fabric-ca/api"
"github.com/hyperledger/fabric-ca/lib/caerrors"
"github.com/hyperledger/fabric-ca/util"
"github.com/pkg/errors"
)
const (
crlPemType = "X509 CRL"
)
// The response to the POST /gencrl request
type genCRLResponseNet struct {
// Base64 encoding of PEM-encoded CRL
CRL string
}
func newGenCRLEndpoint(s *Server) *serverEndpoint {
return &serverEndpoint{
Methods: []string{"POST"},
Handler: genCRLHandler,
Server: s,
}
}
// Handle an generate CRL request
func genCRLHandler(ctx *serverRequestContextImpl) (interface{}, error) {
var req api.GenCRLRequest
err := ctx.ReadBody(&req)
if err != nil {
return nil, err
}
// Authenticate the invoker
id, err := ctx.TokenAuthentication()
if err != nil {
return nil, err
}
log.Debugf("Received gencrl request from %s: %+v", id, util.StructToString(&req))
// Get targeted CA
ca, err := ctx.GetCA()
if err != nil {
return nil, err
}
// Make sure that the user has the "hf.GenCRL" attribute in order to be authorized
// to generate CRL. This attribute comes from the user registry, which
// is either in the DB if LDAP is not configured, or comes from LDAP if LDAP is
// configured.
err = ca.attributeIsTrue(id, "hf.GenCRL")
if err != nil {
return nil, caerrors.NewAuthorizationErr(caerrors.ErrNoGenCRLAuth, "The identity '%s' does not have authority to generate a CRL", id)
}
crl, err := genCRL(ca, req)
if err != nil {
return nil, err
}
log.Debugf("Successfully generated CRL")
resp := &genCRLResponseNet{CRL: util.B64Encode(crl)}
return resp, nil
}
// GenCRL will generate CRL
func genCRL(ca *CA, req api.GenCRLRequest) ([]byte, error) {
var err error
if !req.RevokedBefore.IsZero() && req.RevokedAfter.After(req.RevokedBefore) {
return nil, caerrors.NewHTTPErr(400, caerrors.ErrInvalidRevokedAfter,
"Invalid 'revokedafter' value. It must not be a timestamp greater than 'revokedbefore'")
}
if !req.ExpireBefore.IsZero() && req.ExpireAfter.After(req.ExpireBefore) {
return nil, caerrors.NewHTTPErr(400, caerrors.ErrInvalidExpiredAfter,
"Invalid 'expireafter' value. It must not be a timestamp greater than 'expirebefore'")
}
// Get revoked certificates from the database
certs, err := ca.certDBAccessor.GetRevokedCertificates(req.ExpireAfter, req.ExpireBefore, req.RevokedAfter, req.RevokedBefore)
if err != nil {
log.Errorf("Failed to get revoked certificates from the database: %s", err)
return nil, caerrors.NewHTTPErr(500, caerrors.ErrRevokedCertsFromDB, "Failed to get revoked certificates")
}
caCert, err := getCACert(ca)
if err != nil {
log.Errorf("Failed to get certficate for CA '%s': %s", ca.HomeDir, err)
return nil, caerrors.NewHTTPErr(500, caerrors.ErrGetCACert, "Failed to get certficate for CA '%s'", ca.HomeDir)
}
if !canSignCRL(caCert) {
return nil, caerrors.NewHTTPErr(500, caerrors.ErrNoCrlSignAuth,
"The CA does not have authority to generate a CRL. Its certificate does not have 'crl sign' key usage")
}
// Get the signer for the CA
_, signer, err := util.GetSignerFromCert(caCert, ca.csp)
if err != nil {
log.Errorf("Failed to get signer for CA '%s': %s", ca.HomeDir, err)
return nil, caerrors.NewHTTPErr(500, caerrors.ErrGetCASigner, "Failed to get signer for CA '%s'", ca.HomeDir)
}
expiry := time.Now().UTC().Add(ca.Config.CRL.Expiry)
var revokedCerts []pkix.RevokedCertificate
// For every record, create a new revokedCertificate and add it to slice
for _, certRecord := range certs {
serialInt := new(big.Int)
serialInt.SetString(certRecord.Serial, 16)
revokedCert := pkix.RevokedCertificate{
SerialNumber: serialInt,
RevocationTime: certRecord.RevokedAt,
}
revokedCerts = append(revokedCerts, revokedCert)
}
crl, err := crl.CreateGenericCRL(revokedCerts, signer, caCert, expiry)
if err != nil {
log.Errorf("Failed to generate CRL for CA '%s': %s", ca.HomeDir, err)
return nil, caerrors.NewHTTPErr(500, caerrors.ErrGenCRL, "Failed to generate CRL for CA '%s'", ca.HomeDir)
}
blk := &pem.Block{Bytes: crl, Type: crlPemType}
return pem.EncodeToMemory(blk), nil
}
func getCACert(ca *CA) (*x509.Certificate, error) {
// Get CA certificate
caCertBytes, err := ioutil.ReadFile(ca.Config.CA.Certfile)
if err != nil {
return nil, errors.WithMessage(err, fmt.Sprintf("Failed to read certificate for the CA '%s'", ca.HomeDir))
}
caCert, err := BytesToX509Cert(caCertBytes)
if err != nil {
return nil, errors.WithMessage(err, fmt.Sprintf("Failed to get certificate for the CA '%s'", ca.HomeDir))
}
return caCert, nil
}