upd: split revoking command into add-serial and revoke

diff --git a/src/apps/client.cpp b/src/apps/client.cpp
index 9423cb85a0d87b580047e744e35ef6fee65b8777..5258b9abad9b887e48b966cf1a46e35c3b2a895e 100644 (file)
--- a/src/apps/client.cpp
+++ b/src/apps/client.cpp
@@ -144,7 +144,9 @@ int main( int argc, const char* argv[] ) {
         } else if( job->task == "revoke" ) {
             try {
                 auto data = jp->getRevocationInfo( job );
-                std::pair<std::shared_ptr<CRL>, std::string> rev = sign->revoke( CAs.at( data.second ), data.first );
+                std::vector<std::string> serials;
+                serials.push_back( data.first );
+                std::pair<std::shared_ptr<CRL>, std::string> rev = sign->revoke( CAs.at( data.second ), serials );
                 std::string date = rev.second;
                 const unsigned char* pos = ( const unsigned char* ) date.data();
                 std::shared_ptr<ASN1_TIME> time( d2i_ASN1_TIME( NULL, &pos, date.size() ), ASN1_TIME_free );

diff --git a/src/crypto/remoteSigner.cpp b/src/crypto/remoteSigner.cpp
index 1f0c07a87041f886ba9250b3d58ff68e286e4818..6c842d4a6fd08b5db87689427a7b86537f310fcb 100644 (file)
--- a/src/crypto/remoteSigner.cpp
+++ b/src/crypto/remoteSigner.cpp
@@ -147,7 +147,7 @@ std::shared_ptr<SignedCertificate> RemoteSigner::sign( std::shared_ptr<TBSCertif
     return result;
 }
 
-std::pair<std::shared_ptr<CRL>, std::string> RemoteSigner::revoke( std::shared_ptr<CAConfig> ca, std::string serial ) {
+std::pair<std::shared_ptr<CRL>, std::string> RemoteSigner::revoke( std::shared_ptr<CAConfig> ca, std::vector<std::string> serials ) {
     ( void )BIO_reset( target.get() );
 
     std::shared_ptr<SSL> ssl( SSL_new( ctx.get() ), SSL_free );
@@ -161,7 +161,11 @@ std::pair<std::shared_ptr<CRL>, std::string> RemoteSigner::revoke( std::shared_p
     head.flags = 0;
     head.sessid = 13;
 
-    std::string payload = ca->name + std::string( "\0", 1 ) + serial;
+    for( std::string serial : serials ) {
+        send( conn, head, RecordHeader::SignerCommand::ADD_SERIAL, serial );
+    }
+
+    std::string payload = ca->name;
     send( conn, head, RecordHeader::SignerCommand::REVOKE, payload );
 
     std::vector<char> buffer( 2048 * 4 );
@@ -186,7 +190,11 @@ std::pair<std::shared_ptr<CRL>, std::string> RemoteSigner::revoke( std::shared_p
     ASN1_TIME_free( time );
     date = payload.substr( 0, pos - buffer2 );
     std::string rest = payload.substr( pos - buffer2 );
-    crl->revoke( serial, date );
+
+    for( std::string serial : serials ) {
+        crl->revoke( serial, date );
+    }
+
     crl->setSignature( rest );
     bool ok = crl->verify( ca );
 

diff --git a/src/crypto/remoteSigner.h b/src/crypto/remoteSigner.h
index f08eae6a77b13c9263ece20b3c66ed54cd183027..525bbd0123632e3eddbd48a98204a21d52dd770c 100644 (file)
--- a/src/crypto/remoteSigner.h
+++ b/src/crypto/remoteSigner.h
@@ -20,7 +20,7 @@ public:
     RemoteSigner( std::shared_ptr<BIO> target, std::shared_ptr<SSL_CTX> ctx );
     ~RemoteSigner();
     std::shared_ptr<SignedCertificate> sign( std::shared_ptr<TBSCertificate> cert );
-    std::pair<std::shared_ptr<CRL>, std::string> revoke( std::shared_ptr<CAConfig> ca, std::string serial );
+    std::pair<std::shared_ptr<CRL>, std::string> revoke( std::shared_ptr<CAConfig> ca, std::vector<std::string> serial );
 
     void setLog( std::shared_ptr<std::ostream> target );
 };

diff --git a/src/crypto/signer.h b/src/crypto/signer.h
index 582308daf6a0e7325f03a687596344e646dd47a7..bb13ddd3b121de7bab4021730ae4d30463f6998d 100644 (file)
--- a/src/crypto/signer.h
+++ b/src/crypto/signer.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <memory>
+#include <vector>
 
 #include "db/database.h"
 #include "crypto/sslUtil.h"
@@ -9,5 +10,5 @@
 class Signer {
 public:
     virtual std::shared_ptr<SignedCertificate> sign( std::shared_ptr<TBSCertificate> cert ) = 0;
-    virtual std::pair<std::shared_ptr<CRL>, std::string> revoke( std::shared_ptr<CAConfig> ca, std::string serial ) = 0;
+    virtual std::pair<std::shared_ptr<CRL>, std::string> revoke( std::shared_ptr<CAConfig> ca, std::vector<std::string> serial ) = 0;
 };

diff --git a/src/crypto/simpleOpensslSigner.cpp b/src/crypto/simpleOpensslSigner.cpp
index 1ea12441d67a3d3c638e82ea474b147209c730ef..b0925ccdeea5c757f65f653480c040c36d4bd4b9 100644 (file)
--- a/src/crypto/simpleOpensslSigner.cpp
+++ b/src/crypto/simpleOpensslSigner.cpp
@@ -162,11 +162,16 @@ std::shared_ptr<SignedCertificate> SimpleOpensslSigner::sign( std::shared_ptr<TB
     return output;
 }
 
-std::pair<std::shared_ptr<CRL>, std::string> SimpleOpensslSigner::revoke( std::shared_ptr<CAConfig> ca, std::string serial ) {
+std::pair<std::shared_ptr<CRL>, std::string> SimpleOpensslSigner::revoke( std::shared_ptr<CAConfig> ca, std::vector<std::string> serials ) {
     std::string crlpath = ca->path + "/ca.crl";
 
     std::shared_ptr<CRL> crl( new CRL( crlpath ) );
-    std::string date = crl->revoke( serial, "" );
+    std::string date = "";
+
+    for( std::string serial : serials ) {
+        date = crl->revoke( serial, "" );
+    }
+
     crl->sign( ca );
     writeFile( crlpath, crl->toString() );
     return std::pair<std::shared_ptr<CRL>, std::string>( crl, date );

diff --git a/src/crypto/simpleOpensslSigner.h b/src/crypto/simpleOpensslSigner.h
index 1c848e5e69c2d17d9a411842f742d8921a70fc03..3d9ce5259c6385674b7178d3e38eff9e0c31efea 100644 (file)
--- a/src/crypto/simpleOpensslSigner.h
+++ b/src/crypto/simpleOpensslSigner.h
@@ -15,5 +15,5 @@ public:
     SimpleOpensslSigner();
     ~SimpleOpensslSigner();
     std::shared_ptr<SignedCertificate> sign( std::shared_ptr<TBSCertificate> cert );
-    std::pair<std::shared_ptr<CRL>, std::string> revoke( std::shared_ptr<CAConfig> ca, std::string serial );
+    std::pair<std::shared_ptr<CRL>, std::string> revoke( std::shared_ptr<CAConfig> ca, std::vector<std::string> serial );
 };

diff --git a/src/io/record.h b/src/io/record.h
index b08411353f57188c1c1dd2313bb73f4b2ca4f9d5..bcfc831c7b2206cd3a8faf81a8febf943d997048 100644 (file)
--- a/src/io/record.h
+++ b/src/io/record.h
@@ -23,6 +23,7 @@ public:
         LOG_SAVED = 0x81,
         REVOKE = 0x100,
         GET_FULL_CRL = 0x101,
+        ADD_SERIAL = 0x102,
         GET_TIMESTAMP = 0xC0,
         GET_STATUS_REPORT = 0xD0
     };

diff --git a/src/io/recordHandler.cpp b/src/io/recordHandler.cpp
index b79d3cc144b96d2c70d210306e989c7846e9792e..56ebd29c30af6d6506f7e2b61aa985f12892e411 100644 (file)
--- a/src/io/recordHandler.cpp
+++ b/src/io/recordHandler.cpp
@@ -35,6 +35,7 @@ public:
     std::shared_ptr<Signer> signer;
 
     std::shared_ptr<std::ofstream> log;
+    std::vector<std::string> serials;
 
     RecordHandlerSession( DefaultRecordHandler* parent, std::shared_ptr<Signer> signer, std::shared_ptr<SSL_CTX> ctx, std::shared_ptr<BIO> output ) :
         tbs( new TBSCertificate() ) {
@@ -177,34 +178,17 @@ public:
 
             break;
 
-        case RecordHeader::SignerCommand::REVOKE: {
-            ( *log ) << "got revoking command: " << data.size() << std::endl;
-            std::string nullstr( "\0", 1 );
-            size_t t = data.find( nullstr );
-
-            if( t == std::string::npos ) {
-                // error
-                ( *log ) << "error while parsing revoking command." << data << std::endl;
-                break;
-            }
-
-            std::string ca = data.substr( 0, t );
-            std::string serial = data.substr( t + 1 );
-            ( *log ) << "revoking " << ca << "<->" << serial << std::endl;
-
-            ( *log ) << "[";
-
-            for( auto x : CAs ) {
-                ( *log ) << x.first << ", ";
-            }
-
-            ( *log ) << "]" << std::endl;
+        case RecordHeader::SignerCommand::ADD_SERIAL:
+            serials.push_back( data );
+            break;
 
+        case RecordHeader::SignerCommand::REVOKE: {
+            std::string ca = data;
             auto reqCA = CAs.at( ca );
             ( *log ) << "CA found" << std::endl;
             std::shared_ptr<CRL> crl;
             std::string date;
-            std::tie<std::shared_ptr<CRL>, std::string>( crl, date ) = signer->revoke( reqCA, serial );
+            std::tie<std::shared_ptr<CRL>, std::string>( crl, date ) = signer->revoke( reqCA, serials );
 
             respondCommand( RecordHeader::SignerResult::REVOKED, date + crl->getSignature() );