Skip to content

Commit 58c2a10

Browse files
joevanwanzeeleKFjoevanwanzeeleKF
committed
got revoke working, better logging
1 parent 32de94b commit 58c2a10

2 files changed

Lines changed: 39 additions & 49 deletions

File tree

‎cert_util.go‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -94,21 +94,26 @@ func (b *keyfactorBackend) submitCSR(ctx context.Context, req *logical.Request,
9494
Metadata: metadataMap,
9595
Timestamp: &time,
9696
Template: *v1.NewNullableString(&templateName),
97-
SANs: make(map[string][]string),
9897
}
9998

10099
// SANs parameter
101100
b.Logger().Debug(fmt.Sprintf("ip_sans = %s", ip_sans))
102101
b.Logger().Debug(fmt.Sprintf("dns_sans = %s", dns_sans))
103102

103+
sans := make(map[string][]string)
104+
104105
if len(ip_sans) > 0 {
105-
enrollmentRequest.SANs["ip"] = ip_sans
106+
sans["ip"] = ip_sans
106107
}
107108

108109
if len(dns_sans) > 0 {
109-
enrollmentRequest.SANs["dns"] = dns_sans
110+
sans["dns"] = dns_sans
110111
}
111112

113+
enrollmentRequest.SANs = sans
114+
115+
enrollmentRequest.SetSANs(sans)
116+
112117
reqMap := make(map[string]interface{})
113118
reqMap, err = enrollmentRequest.ToMap()
114119

@@ -117,6 +122,7 @@ func (b *keyfactorBackend) submitCSR(ctx context.Context, req *logical.Request,
117122
}
118123

119124
b.Logger().Debug(fmt.Sprintf("request body: %s", reqMap))
125+
b.Logger().Debug(fmt.Sprintf("sans parameter: %s", enrollmentRequest.GetSANs()))
120126

121127
// Send request and check status
122128

@@ -162,6 +168,7 @@ func (b *keyfactorBackend) submitCSR(ctx context.Context, req *logical.Request,
162168
// store the certificate
163169

164170
normalizedSerial := *serial.Get()
171+
normalizedSerial = strings.ToUpper(normalizedSerial)
165172

166173
key := "certs/" + normalizedSerial
167174

@@ -182,6 +189,8 @@ func (b *keyfactorBackend) submitCSR(ctx context.Context, req *logical.Request,
182189
return nil, "", err
183190
}
184191

192+
b.Logger().Debug(fmt.Sprintf("writing the Keyfactor ID to storage for future operations: key = %s, value = %s", kfIdEntry.Key, kfIdEntry.Value))
193+
185194
err = req.Storage.Put(ctx, kfIdEntry)
186195
if err != nil {
187196
return nil, "", fmt.Errorf("unable to store the keyfactor ID for the certificate locally: {{err}}", err)
@@ -392,14 +401,14 @@ func fetchCertIssuedByCA(ctx context.Context, req *logical.Request, b *keyfactor
392401
certs, httpResponse, err := apiRequest.ApiService.GetCertificatesExecute(getCertRequest)
393402

394403
if err != nil {
395-
b.Logger().Info("failed getting cert: {{err}}", err)
404+
b.Logger().Info(fmt.Sprintf("failed getting cert: %s", err.Error()))
396405
return nil, err
397406
}
398407

399408
if httpResponse.StatusCode != 200 {
400409
b.Logger().Error("request failed: server returned" + fmt.Sprint(httpResponse.StatusCode))
401410
b.Logger().Error("Error response = " + fmt.Sprint(httpResponse.Body))
402-
return nil, fmt.Errorf("error downloading certificate. returned status = %d\n ", httpResponse.StatusCode)
411+
return nil, fmt.Errorf("error downloading certificate. returned status = %d\n %s", httpResponse.StatusCode, httpResponse.Body)
403412
}
404413

405414
b.Logger().Debug("response = ", certs)
@@ -440,26 +449,24 @@ func fetchChainAndCAForCert(ctx context.Context, req *logical.Request, b *keyfac
440449
IncludeChain: &includeChain,
441450
}
442451

443-
apiRequest := client.V1.CertificateApi.NewCreateCertificatesDownloadRequest(ctx)
444-
apiRequest.CertificatesCertificateDownloadRequest(certDownloadRequest)
445-
apiRequest.XCertificateformat("P7B")
452+
apiRequest := client.V1.CertificateApi.NewCreateCertificatesDownloadRequest(ctx).CertificatesCertificateDownloadRequest(certDownloadRequest).XCertificateformat("P7B")
446453

447454
reqMap, _ := certDownloadRequest.ToMap()
448455

449456
// Send request and check status
450-
b.Logger().Debug("request parameters: %s", reqMap)
457+
b.Logger().Debug(fmt.Sprintf("request parameters: %s", reqMap))
451458
b.Logger().Debug("making request for cert retrieval")
452459

453460
response, httpResponse, err := apiRequest.Execute()
454461

455462
if err != nil {
456-
b.Logger().Info(fmt.Sprintf("failed getting cert: %s", err))
457-
return nil, "", err
463+
b.Logger().Info(fmt.Sprintf("failed getting cert: %s \n %s", err, httpResponse.Body))
464+
return nil, "", fmt.Errorf("failed to retreive CA Chain.\n http status code: %d \n %s", httpResponse.StatusCode, httpResponse.Body)
458465
}
459466
if httpResponse.StatusCode != 200 {
460467
b.Logger().Error("request failed: server returned" + fmt.Sprint(httpResponse.StatusCode))
461468
b.Logger().Error("Error response = " + fmt.Sprint(httpResponse.Body))
462-
return nil, "", fmt.Errorf("error downloading certificate. returned status = %d\n ", httpResponse.StatusCode)
469+
return nil, "", fmt.Errorf("error downloading certificate. returned status = %d\n %s", httpResponse.StatusCode, httpResponse.Body)
463470
}
464471

465472
// Read response and convert to x509 certificates
@@ -499,7 +506,7 @@ func fetchChainAndCAForCert(ctx context.Context, req *logical.Request, b *keyfac
499506
}
500507

501508
func normalizeSerial(serial string) string {
502-
return strings.Replace(strings.ToLower(serial), ":", "-", -1)
509+
return strings.Replace(strings.ToUpper(serial), ":", "-", -1)
503510
}
504511

505512
// ConvertBase64P7BtoCertificates takes a base64 encoded P7B certificate string and returns a slice of *x509.Certificate.

‎path_certs.go‎

Lines changed: 19 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -501,10 +501,6 @@ func (b *keyfactorBackend) pathIssueSignCert(ctx context.Context, req *logical.R
501501
}
502502

503503
func (b *keyfactorBackend) pathRevokeCert(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
504-
if b.System().ReplicationState().HasState(consts.ReplicationPerformanceStandby) {
505-
return nil, logical.ErrReadOnly
506-
}
507-
508504
serial := data.Get("serial").(string)
509505
b.Logger().Debug("serial = " + serial)
510506

@@ -525,30 +521,35 @@ func revokeCert(ctx context.Context, b *keyfactorBackend, req *logical.Request,
525521
return nil, nil
526522
}
527523

524+
serial = strings.ToUpper(serial)
525+
528526
// get client
529527
client, err := b.getClient(ctx, req.Storage)
530528
if err != nil {
531529
return nil, fmt.Errorf("error getting client: %w", err)
532530
}
533531

532+
b.Logger().Debug(fmt.Sprintf("retreiving the keyfactor ID for cert stored at path: %s", "kfId/"+serial))
533+
534534
kfId, err := req.Storage.Get(ctx, "kfId/"+serial) //retrieve the keyfactor certificate ID, keyed by sn here
535535
if err != nil {
536-
b.Logger().Error("Unable to retreive Keyfactor certificate ID for cert with serial: "+serial, err)
536+
b.Logger().Error("unable to retreive Keyfactor certificate ID for cert with serial: "+serial, err)
537537
return nil, err
538538
}
539-
540-
var keyfactorId int
539+
b.Logger().Debug(fmt.Sprintf("retreived the logical storage entry, decoding..."))
540+
var keyfactorId int32
541541
err = kfId.DecodeJSON(&keyfactorId)
542-
543542
if err != nil {
544543
b.Logger().Error("Unable to parse stored certificate ID for cert with serial: "+serial, err)
545544
return nil, err
546545
}
547546

547+
b.Logger().Debug(fmt.Sprintf("decoded keyfactor ID value: %d", keyfactorId))
548+
548549
// set up keyfactor api request
549550
//url := b.cachedConfig.KeyfactorUrl + "/" + b.cachedConfig.CommandAPIPath + kf_revoke_path
550551

551-
certIds := []int32{int32(keyfactorId)}
552+
certIds := []int32{keyfactorId}
552553
revokeReason := v1.KeyfactorPKIEnumsRevokeCode(0)
553554
effectiveDate := time.Now().UTC()
554555
revokeComment := "via Hashicorp Vault"
@@ -563,29 +564,30 @@ func revokeCert(ctx context.Context, b *keyfactorBackend, req *logical.Request,
563564
}
564565

565566
// create the api call wrapper object
566-
apiReq := client.V1.CertificateApi.NewCreateCertificatesRevokeRequest(ctx)
567-
568-
// apply the request parameters to the pending request
569-
apiReq.CertificatesRevokeCertificateRequest(revokeReq)
567+
apiReq := client.V1.CertificateApi.NewCreateCertificatesRevokeRequest(ctx).CertificatesRevokeCertificateRequest(revokeReq)
570568

571569
// execute request
572570

573571
_, httpResponse, err := apiReq.Execute()
574572

575573
if err != nil {
576-
b.Logger().Error("Revoke failed: {{err}}", err)
577-
return nil, err
574+
b.Logger().Error(fmt.Sprintf("revocation failed: %s \n %s", err, httpResponse.Body))
575+
return nil, fmt.Errorf("revocation failed. \n http status: %s \n response body: %s", httpResponse.Status, httpResponse.Body)
578576
}
579577

580578
if httpResponse.StatusCode != 204 && httpResponse.StatusCode != 200 {
581579
b.Logger().Info("revocation failed: server returned" + fmt.Sprint(httpResponse.StatusCode))
582580
b.Logger().Info("error response = " + fmt.Sprint(httpResponse.Body))
583-
return nil, fmt.Errorf("revocation failed: server returned %s\n ", httpResponse.Status)
581+
return nil, fmt.Errorf("revocation failed: server returned %s\n %s", httpResponse.Status, httpResponse.Body)
584582
}
585583

586584
alreadyRevoked := false
587585
var revInfo revocationInfo
588586

587+
b.Logger().Debug("revocation request was successful.")
588+
589+
b.Logger().Debug("updating values if previously revoked..")
590+
589591
revEntry, err := fetchCertBySerial(ctx, req, "revoked/", serial)
590592
if err != nil {
591593
switch err.(type) {
@@ -604,6 +606,7 @@ func revokeCert(ctx context.Context, b *keyfactorBackend, req *logical.Request,
604606
}
605607
}
606608

609+
b.Logger().Debug("updating local storage entry..")
607610
if !alreadyRevoked {
608611
certEntry, err := fetchCertBySerial(ctx, req, "certs/", serial)
609612
if err != nil {
@@ -615,13 +618,6 @@ func revokeCert(ctx context.Context, b *keyfactorBackend, req *logical.Request,
615618
}
616619
}
617620
if certEntry == nil {
618-
if fromLease {
619-
// We can't write to revoked/ or update the CRL anyway because we don't have the cert,
620-
// and there's no reason to expect this will work on a subsequent
621-
// retry. Just give up and let the lease get deleted.
622-
b.Logger().Warn("expired certificate revoke failed because not found in storage, treating as success", "serial", serial)
623-
return nil, nil
624-
}
625621
return logical.ErrorResponse(fmt.Sprintf("certificate with serial %s not found", serial)), nil
626622
}
627623
b.Logger().Debug("certEntry key = " + certEntry.Key)
@@ -693,19 +689,6 @@ func checkAllowedDomains(role *roleEntry, roleName string, domains []string) (bo
693689
return true, nil
694690
}
695691

696-
// func (b *keyfactorBackend) isValidJSON(str string) bool {
697-
// var js map[string]interface{}
698-
// err := json.Unmarshal([]byte(str), &js)
699-
700-
// if err != nil {
701-
// b.Logger().Debug(err.Error())
702-
// return false
703-
// } else {
704-
// b.Logger().Debug("the metadata was able to be parsed as valid JSON")
705-
// return true
706-
// }
707-
// }
708-
709692
const pathIssueHelpSyn = `
710693
Request a certificate using a certain role with the provided details.
711694
example: vault write keyfactor/issue/<role> common_name=<cn> dns_sans=<dns sans>

0 commit comments

Comments
 (0)