Struct CaManager 

pub struct CaManager { /* private fields */ }

Manages access to all CAs.

Implementations

impl CaManager

pub async fn build( config: Arc<Config>, tasks: Arc<TaskQueue>, signer: Arc<KrillSigner>, system_actor: Actor, ) -> KrillResult<Self>

Builds a new CA manager.

Return an error if any of the various stores cannot be initialized.

pub fn testbed_enabled(&self) -> bool

Returns whether testbed mode is enabled.

pub fn republish_all(&self, force: bool) -> KrillResult<Vec<CaHandle>>

Republish the embedded TA and CAs if needed.

If force is true, everything will be republished, otherwise only those objects that are close to expiring.

Returns all CAs for which objects were republished.

impl CaManager

Trust Anchor Support

pub fn get_trust_anchor_proxy(&self) -> KrillResult<Arc<TrustAnchorProxy>>

Returns the TA proxy.

Returns an error if the TA proxy support is not nabled or the TA proxy is uninitialized.

pub fn get_trust_anchor_signer(&self) -> KrillResult<Arc<TrustAnchorSigner>>

Returns the TA signer.

Returns an error if the TA signer support is not nabled or the TA signer is uninitialized.

pub fn ta_proxy_init(&self) -> KrillResult<()>

Initialises the Trust Anchor proxy.

Returns an error if TA proxy support is not enabled or the proxy is alreay initialized.

pub fn ta_signer_init( &self, tal_https: Vec<Https>, tal_rsync: Rsync, private_key_pem: Option<String>, ) -> KrillResult<()>

Initialises the embedded TA signer (for testbed).

This assumes that the local TA proxy exists and is to be associated with this signer.

pub fn ta_proxy_id(&self) -> KrillResult<IdCertInfo>

Returns the ID certificate used by the TA proxy.

pub fn ta_proxy_publisher_request(&self) -> KrillResult<PublisherRequest>

Returns the publisher request for the TA proxy.

Returns an error if the proxy is not initialised.

pub fn ta_proxy_repository_update( &self, contact: RepositoryContact, actor: &Actor, ) -> KrillResult<()>

Adds a repository to Trust Anchor proxy.

Returns an error if the proxy is not enabled or already has a repository.

pub fn ta_proxy_repository_contact(&self) -> KrillResult<RepositoryContact>

Returns the repository contact for the proxy.

Returns an error if there is no proxy, or no repository configured for it.

pub fn ta_proxy_signer_add( &self, info: TrustAnchorSignerInfo, actor: &Actor, ) -> KrillResult<()>

Adds the associated signer to the proxy.

Errors if there is no proxy or the proxy already has a signer.

pub fn ta_proxy_signer_update( &self, info: TrustAnchorSignerInfo, actor: &Actor, ) -> KrillResult<()>

Updates the associated signer to the proxy.

Errors if there is no proxy or the proxy has no or a different signer

pub fn ta_proxy_signer_make_request( &self, actor: &Actor, ) -> KrillResult<ApiTrustAnchorSignedRequest>

Creates a new request for the signer.

Errors if there is no proxy or the proxy already has a request.

pub fn ta_proxy_signer_get_request( &self, ) -> KrillResult<ApiTrustAnchorSignedRequest>

Returns the current request for the signer.

pub fn ta_proxy_signer_process_response( &self, response: TrustAnchorSignedResponse, actor: &Actor, ) -> KrillResult<()>

Processes a sign response from the signer.

pub async fn ta_init_fully_embedded( &self, ta_aia: Rsync, ta_uris: Vec<Https>, ta_key_pem: Option<String>, repo_manager: &Arc<RepositoryManager>, actor: &Actor, ) -> KrillResult<()>

Initializes an embedded trust anchor with all resources.

pub fn ta_renew_testbed_ta(&self) -> KrillResult<()>

Renews the embedded testbed TA;

impl CaManager

CA instances and identity

pub fn init_ca(&self, handle: CaHandle) -> KrillResult<()>

Initializes a CA without a repo, no parents, no children, no nothing

pub fn ca_update_id(&self, handle: CaHandle, actor: &Actor) -> KrillResult<()>

Updates the self-signed ID certificate for a CA.

Use this with care as RFC 8183 only talks about initial ID exchanges in the form of XML files. It does not talk about updating identity certificates and keys. Krill supports that a new ID key pair and certificate is generated, and has functions to update this for a parent, a child, a repo and a publisher, but other implementations may not support that identities are updated after initialization.

pub fn ca_handles(&self) -> KrillResult<Vec<CaHandle>>

Returns all known CA handles.

pub fn ca_list(&self, auth: &AuthInfo) -> KrillResult<CertAuthList>

Returns the CAs that the given policy allows read access to.

pub fn get_ca(&self, handle: &CaHandle) -> KrillResult<Arc<CertAuth>>

Returns the CA by the given handle.

Returns an error if the CA does not exist.

pub fn has_ca(&self, handle: &CaHandle) -> KrillResult<bool>

Returns whether a CA by the given handle exists.

pub fn get_ca_status(&self, ca: &CaHandle) -> KrillResult<CaStatus>

Returns the status of the given CA.

pub fn get_repo_status(&self, ca: &CaHandle) -> KrillResult<RepoStatus>

Returns the repository status of the given CA.

pub fn get_parent_statuses(&self, ca: &CaHandle) -> KrillResult<ParentStatuses>

Returns the parent statuses of the given CA.

pub fn get_ca_issues(&self, ca: &CaHandle) -> KrillResult<CertAuthIssues>

Returns the issues detected for the given CA.

pub async fn delete_ca( &self, repo_manager: &RepositoryManager, ca_handle: &CaHandle, actor: &Actor, ) -> KrillResult<()>

Deletes a CA.

Does best effort revocation requests and withdraws all its objects first. Note that any children of this CA will be left orphaned, and they will only learn of this sad fact when they choose to call home.

impl CaManager

CA History

pub fn ca_history( &self, handle: &CaHandle, crit: CommandHistoryCriteria, ) -> KrillResult<CommandHistory>

Returns the history for a CA.

pub fn ca_command_details( &self, handle: &CaHandle, version: u64, ) -> KrillResult<CommandDetails>

Returns the details for a CA command.

impl CaManager

CAs as parents

pub fn ca_add_child( &self, ca: &CaHandle, req: AddChildRequest, service_uri: &Https, actor: &Actor, ) -> KrillResult<ParentResponse>

Adds a child under a CA.

Returns the response to be sent back to the child.

If the add child request contains resources not held by this CA, an error is returned.

pub fn ca_show_child( &self, ca: &CaHandle, child: &ChildHandle, ) -> KrillResult<ChildCaInfo>

Returns details for a child under the CA.

pub fn ca_child_export( &self, ca: &CaHandle, child_handle: &ChildHandle, ) -> KrillResult<ImportChild>

Exports a child.

Returns all information to import the child again elsewhere.

Fails if:

• the child does not exist,
• the child has no received certificate, or
• the child has more than one received certificate or resource class

This is primarily meant for testing that the child import function works.

pub fn ca_child_import( &self, ca: &CaHandle, import_child: ImportChild, actor: &Actor, ) -> KrillResult<()>

Imports a child under the given CA.

Fails if:

• the ca does not exist,
• the ca has less than, or more than one resource class,
• the ca does not hold the resources for the child, or
• the child already exists

pub fn ca_parent_contact( &self, ca_handle: &CaHandle, child_handle: ChildHandle, service_uri: &Https, ) -> KrillResult<ParentCaContact>

Returns the contact information for a child.

pub fn ca_parent_response( &self, ca_handle: &CaHandle, child_handle: ChildHandle, service_uri: &Https, ) -> KrillResult<ParentResponse>

Returns an RFC8183 Parent Response for the child.

pub fn ca_child_update( &self, ca: &CaHandle, child: ChildHandle, req: UpdateChildRequest, actor: &Actor, ) -> KrillResult<()>

Updates a child under this CA.

The submitted update child request can contain a new ID certificate or resource set, or both. When resources are updated, the existing resource entitlements are replaced by the new value - i.e. this is not a delta and it affects all resource types (IPv4, IPV6, ASN). Setting resource entitlements beyond the resources held by the parent CA will return an error.

pub fn ca_child_remove( &self, ca: &CaHandle, child: ChildHandle, actor: &Actor, ) -> KrillResult<()>

Removes a child from this CA.

This will also ensure that certificates issued to the child are revoked and withdrawn.

pub fn rfc6492( &self, ca_handle: &CaHandle, msg_bytes: Bytes, user_agent: Option<String>, actor: &Actor, ) -> KrillResult<Bytes>

Processes an provisioning protocol request sent by a child CA.

Parses, validates, and processes the request and creates, signs, and returns a response to be sent back to the client.

impl CaManager

CAs as children

pub fn ca_parent_add_or_update( &self, handle: CaHandle, parent_req: ParentCaReq, actor: &Actor, ) -> KrillResult<()>

Adds a new parent, or updates an existing parent of a CA.

Adding a parent will trigger that the CA connects to this new parent in order to learn its resource entitlements and set up the resource class(es) under it, and request certificate(s).

pub async fn ca_parent_remove( &self, handle: CaHandle, parent: ParentHandle, actor: &Actor, ) -> KrillResult<()>

Removes a parent from a CA.

This will trigger that best effort revocations of existing keys under this parent are requested. Any resource classes under the parent will be removed and all relevant content will be withdrawn from the repository.

pub fn cas_schedule_refresh_all(&self) -> KrillResult<()>

Schedules refreshing all CAs as soon as possible:

Note: this function can be called manually through the API, but normally the CA refresh process is replanned on the task queue automatically.

pub fn cas_schedule_refresh_single( &self, ca_handle: CaHandle, ) -> KrillResult<()>

Refresh a single CA with its parents.

This possibly also suspend inactive children.

pub fn cas_schedule_suspend_all(&self) -> KrillResult<()>

Schedules an immediate check suspending all inactive children.

This check will suspend all children of all CAs that have not been contacting the CA for a certain time if suspension is enabled.

While this function can be called manually through the API, it is normally replanned on the task queue automatically if suspension is enabled.

pub fn ca_suspend_inactive_children( &self, ca_handle: &CaHandle, started: Timestamp, actor: &Actor, )

Suspends inactive child CAs of the given CA.

This method is called by the scheduler in response to the scheduled event.

pub async fn ca_sync_parent( &self, handle: &CaHandle, min_ca_version: u64, parent: &ParentHandle, actor: &Actor, ) -> KrillResult<bool>

Synchronizes a CA with one of its parents.

Send pending requests if present; otherwise gets and processes updated entitlements.

The min_ca_version argument allows syncing only if the CA has reached this version yet. If it hasn’t, the method returns Ok(false). To sync in any case, request version 0.

If a sync has successfully happened, returns Ok(true).

Note that if new request events are generated as a result of processing updated entitlements they will trigger that this synchronization is called again so that the pending requests can be sent.

This method is called by the scheduler in response to the scheduled sync as well as KrillServer when importing a CA.

pub fn sync_ta_proxy_signer_if_possible(&self) -> KrillResult<()>

Synchronizes the TA proxy with a local TA signer.

If the TA signer is remote, logs a warning suggesting doing a manual synchronization, assuming that this method is only ever called if the TA proxy requires synchronization.

pub async fn send_revoke_requests( &self, handle: &CaHandle, parent: &ParentHandle, revoke_requests: HashMap<ResourceClassName, Vec<RevocationRequest>>, ) -> KrillResult<HashMap<ResourceClassName, Vec<RevocationResponse>>>

Sends the given revoke requests to a parent.

Returns the responses for the requests.

pub async fn send_revoke_unexpected_key( &self, handle: &CaHandle, rcn: ResourceClassName, revocation: RevocationRequest, ) -> KrillResult<HashMap<ResourceClassName, Vec<RevocationResponse>>>

Sends a revoke request for an unexpected key.

pub async fn get_entitlements_from_contact( &self, ca: &CaHandle, parent: &ParentHandle, contact: &ParentCaContact, existing_parent: bool, ) -> KrillResult<ResourceClassListResponse>

Requests the entitlements from the parent.

pub fn local_parent( service_uri: &ServiceUri, base_uri: &Https, ) -> Option<ParentHandle>

Returns the handle for the parent if it is local.

A parent is local if its service_uri is under base_uri and follows the format Krill is using.

impl CaManager

Publishing

pub fn cas_schedule_repo_sync_all(&self) -> KrillResult<()>

Schedules synchronizing all CAs with their repositories.

pub fn cas_schedule_repo_sync(&self, ca_handle: CaHandle) -> KrillResult<()>

Schedules synchronizing a CA with its repositories.

pub async fn cas_repo_sync_single( &self, repo_manager: &RepositoryManager, ca_handle: &CaHandle, ca_version: u64, ) -> KrillResult<bool>

Synchronizes a CA with its repositories.

Returns Ok(true) in case the synchronization was successful, Ok(false) in case it was premature wrt to given CA version, and an error in case of any issues.

Note typically a CA will have only one active repository, but in case there are multiple during a migration, this function will ensure that they are all synchronized.

In case the CA had deprecated repositories, then a clean up will be attempted. I.e. the CA will try to withdraw all objects from the deprecated repository. If this clean up fails then the number of clean-up attempts for the repository in question is incremented, and this function will fail. When there have been 5 failed attempts, then the old repository is assumed to be unreachable and it will be dropped - i.e. the CA will no longer try to clean up objects.

pub fn ca_deprecated_repo_remove( &self, ca: &CaHandle, to_remove: &RepositoryContact, ) -> KrillResult<()>

Removes a deprecated repo

pub fn ca_deprecated_repo_increment_clean_attempts( &self, ca: &CaHandle, contact: &RepositoryContact, ) -> KrillResult<()>

Increases the clean attempt counter for a deprecated repository

pub async fn update_repo( &self, repo_manager: &RepositoryManager, ca_handle: CaHandle, new_contact: RepositoryContact, check_repo: bool, actor: &Actor, ) -> KrillResult<()>

Updates the repository where a CA publishes.

If check_repo is true, checks that the repository can be reached and returns an error if not.

impl CaManager

ASPA

pub fn ca_aspas_definitions_show( &self, ca: &CaHandle, ) -> KrillResult<AspaDefinitionList>

Returns the current ASPA definitions for this CA.

pub fn ca_aspas_definitions_update( &self, ca: CaHandle, updates: AspaDefinitionUpdates, actor: &Actor, ) -> KrillResult<()>

Adds a new ASPA definition for this CA.

pub fn ca_aspas_update_aspa_providers( &self, ca: CaHandle, customer: CustomerAsn, update: AspaProvidersUpdate, actor: &Actor, ) -> KrillResult<()>

Updates the ASPA providers for a given customer ASN in a CA.

impl CaManager

BGPSec functions

pub fn ca_bgpsec_definitions_show( &self, ca: &CaHandle, ) -> KrillResult<BgpSecCsrInfoList>

Returns the BGPsec definitions for a CA.

pub fn ca_bgpsec_definitions_update( &self, ca: CaHandle, updates: BgpSecDefinitionUpdates, actor: &Actor, ) -> KrillResult<()>

Updates the BGPsec definitions for a CA.

impl CaManager

ROAs

pub fn ca_routes_update( &self, ca: CaHandle, updates: RoaConfigurationUpdates, actor: &Actor, ) -> KrillResult<()>

Updates the ROA configuratoin for a CA.

This will trigger that ROAs are made in the resource classes that contain the prefixes. If the update is rejected, e.g. because the CA does not have the necessary prefixes then an error will be returned. If the update is successful, new manifest(s) and CRL(s) will be created, and resynchronization between the CA and its repository will be triggered. Finally note that ROAs may be issues on a per prefix basis, or aggregated by ASN based on the defaults or values configured.

pub fn renew_objects_all(&self, actor: &Actor) -> KrillResult<()>

Re-issues objects of all CAs that are about to expire.

This is a no-op in case no object needs re-issuance. If new objects are created they will also be published. An event will trigger that manifests and CRL are also made and the CA in question synchronizes with its repository.

Note that this does not re-issue issued CA certificates, because child CAs are expected to note extended validity eligibility and request updated certificates themselves.

pub fn force_renew_roas_all(&self, actor: &Actor) -> KrillResult<()>

Forces the re-issuance of all ROAs in all CAs.

This function was added because we need to re-issue ROAs in Krill 0.9.3 to force that a short subject CN is used for the EE certificate: i.e. the SKI rather than the full public key. But there may also be other cases in future where forcing to re-issue ROAs may be useful.

impl CaManager

RTA

pub fn rta_sign( &self, ca: CaHandle, name: RtaName, request: RtaContentRequest, actor: &Actor, ) -> KrillResult<()>

Sign a one-off single-signed RTA

pub fn rta_multi_prep( &self, ca: &CaHandle, name: RtaName, request: RtaPrepareRequest, actor: &Actor, ) -> KrillResult<()>

Prepare a multi-singed RTA

pub fn rta_multi_cosign( &self, ca: CaHandle, name: RtaName, rta: ResourceTaggedAttestation, actor: &Actor, ) -> KrillResult<()>

Co-sign an existing RTA

impl CaManager

CA Key Roll

pub fn ca_keyroll_init( &self, handle: CaHandle, max_age: Duration, actor: &Actor, ) -> KrillResult<()>

Initiates an key roll for all old active keys in a CA.

A key roll is started for all keys in the given CA that are older than max_age.

pub fn ca_keyroll_activate( &self, handle: CaHandle, staging: Duration, actor: &Actor, ) -> KrillResult<()>

Activates a new key, as part of the key roll process.

Only new keys that have an age equal to or greater than the staging period are promoted. The RFC mandates a staging period of 24 hours, but we may use a shorter period for testing and/or emergency manual key rolls.