Struct CertAuth 

pub struct CertAuth { /* private fields */ }

The aggregate for an RPKI Certification Authority (CA).

It represents an “organizational” CA: It can have multiple parents and multiple keys under each. For each of them, it will have a resource class that represents the actual published CA.

Configurations for published objects such as ROAs or ASPA objects are kept at the level of the CA, and actual RPKI objects are then issued under the resource class that has matching resources.

Implementations

impl CertAuth

Data presentation

pub fn handle(&self) -> &CaHandle

Returns the handle of this CA.

pub fn as_ca_info(&self) -> CertAuthInfo

Returns the CA information for use in the API.

pub fn configured_roas(&self) -> Vec<ConfiguredRoa>

Returns a list of the currently configured ROAs.

pub fn configured_roas_for_configs( &self, roa_configurations: Vec<RoaConfiguration>, ) -> Vec<ConfiguredRoa>

Returns a list of ROAs matching the given ROA configurations.

pub fn child_request(&self) -> ChildRequest

Returns an RFC 8183 Child Request.

This request can be presented as XML to a parent of this CA.

pub fn publisher_request(&self) -> PublisherRequest

Returns an RFC 8183 Publisher Request.

This request can be presented as XML to the repository for this CA.

pub fn id_cert(&self) -> &IdCertInfo

Returns the ID certificate used by this CA.

pub fn all_resources(&self) -> ResourceSet

Returns the complete set of all currently received resources, under all parents, for this CertAuth

impl CertAuth

Publishing

pub fn repository_contact(&self) -> KrillResult<&RepositoryContact>

Returns the repository contact information for this CA.

If the CA does not yet have a repository assigned, returns an error.

impl CertAuth

Child CAs of this CA.

pub fn child_export( &self, child_handle: &ChildHandle, ) -> KrillResult<ImportChild>

Export a child under this CA, if possible.

pub fn verify_rfc6492(&self, cms: ProvisioningCms) -> KrillResult<Message>

Verifies a received provisioning protocol CMS message.

If the message is for a known child and validates against the ID certificate stored for that child, returns the message. Otherwise returns an error.

pub fn sign_rfc6492_response( &self, message: Message, signer: &KrillSigner, ) -> KrillResult<Bytes>

Signs a provisioning protocol message for sending towards the child.

pub fn list( &self, child_handle: &ChildHandle, issuance_timing: &IssuanceTimingConfig, ) -> KrillResult<ResourceClassListResponse>

Creates a “resource class list response” for a child CA.

This response is part of the provisioning protocol and contains all entitlements assigned to a child CA.

The method returns an error if the child CA is not authorized or unknown.

pub fn issuance_response( &self, child_handle: &ChildHandle, my_rcn: &ResourceClassName, pub_key: &PublicKey, issuance_timing: &IssuanceTimingConfig, ) -> KrillResult<IssuanceResponse>

Creates a “issuance response” for specific resource class of a child.

This response is part of the provisioning protocol and contains a single certificate issued to the child CA in a specific resource class.

pub fn get_child(&self, child: &ChildHandle) -> KrillResult<&ChildDetails>

Returns a child, or an error if the child is unknown.

pub fn children(&self) -> impl Iterator<Item = &ChildHandle>

Returns an iterator for the handles of all children under this CA.

impl CertAuth

Parent CAs of this CA

pub fn parents(&self) -> impl Iterator<Item = &ParentHandle>

Returns an iterator over the handles of all parent CAs.

pub fn nr_parents(&self) -> usize

Returns the number parents of the CA.

pub fn has_parent(&self, parent: &ParentHandle) -> bool

Returns whether the given parent is a parent of this CA.

pub fn parent(&self, parent: &ParentHandle) -> KrillResult<&ParentCaContact>

Gets the ParentCaContact for this ParentHandle. Returns an Err when the parent does not exist.

pub fn parent_for_rc( &self, rcn: &ResourceClassName, ) -> KrillResult<&ParentHandle>

Returns the parent handle for the given resource class.

Returns an error if the resource class is not known to this CA.

pub fn cert_requests( &self, parent_handle: &ParentHandle, ) -> HashMap<ResourceClassName, Vec<IssuanceRequest>>

Returns all currently open certificate requests for a parent.

Returns an empty map if the parent is not found.

pub fn has_pending_requests(&self, parent: &ParentHandle) -> bool

Returns whether the CA has any pending requests for a parent

pub fn revoke_requests( &self, parent: &ParentHandle, ) -> HashMap<ResourceClassName, Vec<RevocationRequest>>

Returns the open revocation requests for the given parent.

pub fn revoke_under_parent( &self, parent: &ParentHandle, signer: &KrillSigner, ) -> KrillResult<HashMap<ResourceClassName, Vec<RevocationRequest>>>

Returns new revocation requests for all resource class under a parent.

impl CertAuth

Publishing

pub fn process_update_repo( &self, contact: RepositoryContact, signer: &KrillSigner, ) -> KrillResult<Vec<CertAuthEvent>>

Processes the “update repository” command.

Currently, this only allows initially setting the repository. In the future, we will support migrating to a new repository using a key roll. See issue #480.

The command assumes that the repository can be reached. This is checked by the CA manager before issuing the command.

impl CertAuth

ROAs

pub fn get_updated_authorizations( &self, updates: &RoaConfigurationUpdates, ) -> KrillResult<Routes>

Returns the ROA configuration resulting from applying the updates.

Does not change the current configuration. Returns the resulting configuration or the reasons why the updates cannot be applied.

pub fn process_route_authorizations_renew( &self, force: bool, config: &Config, signer: &KrillSigner, ) -> KrillResult<Vec<CertAuthEvent>>

Processes the “route origin authorization renew“ commands.

If force is true, all authorizations are renewed, otherwise only those that are close to expiring.

impl CertAuth

ASPA

pub fn aspas_definitions_show(&self) -> AspaDefinitionList

Returns the list of current ASPA definitions.

impl CertAuth

BGPsec router keys

pub fn bgpsec_definitions_show(&self) -> BgpSecCsrInfoList

Returns all current BGPsec router key definitions.

impl CertAuth

RTAs

pub fn rta_list(&self) -> RtaList

Returns a list of all currently defined RTAs.

pub fn rta_show(&self, name: &str) -> KrillResult<ResourceTaggedAttestation>

Returns the RTA with the given name.

pub fn rta_prep_response(&self, name: &str) -> KrillResult<RtaPrepResponse>

Returns the RTA preparation response for the given RTA.

Trait Implementations

impl Aggregate for CertAuth

type Command = SentCommand<CertAuthCommandDetails>

The type representing consecutive commands.

type StorableCommandDetails = CertAuthStorableCommand

The type representing the details of a command to be stored.

type Event = CertAuthEvent

The type representing consecutive events.

type InitCommand = SentInitCommand<CertAuthInitCommandDetails>

The type representing the initial command.

type InitEvent = CertAuthInitEvent

The type representing the initial event.

type Error = Error

The type returned when processing a command fails.

fn init(handle: &MyHandle, event: CertAuthInitEvent) -> Self

Creates a new instance.

fn process_init_command( command: SentInitCommand<CertAuthInitCommandDetails>, ) -> Result<CertAuthInitEvent, Error>

Tries to initialise a new InitEvent for a new instance.

fn version(&self) -> u64

Returns the current version of the aggregate.

fn increment_version(&mut self)

Increments current version of the aggregate.

fn process_command( &self, command: SentCommand<CertAuthCommandDetails>, ) -> Result<Vec<CertAuthEvent>, Error>

Processes a command.

fn apply(&mut self, event: CertAuthEvent)

Applies an event to the aggregate.

fn apply_command(&mut self, command: StoredCommand<Self>)

Applies a stored command.

impl Clone for CertAuth

fn clone(&self) -> CertAuth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CertAuth

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CertAuth

impl PartialEq for CertAuth

fn eq(&self, other: &CertAuth) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PostSaveEventListener<CertAuth> for TaskQueue

Implement post-save listening for CertAuth events.

Used for best effort signaling to local child CAs that a sync with their parent is needed.

fn listen(&self, ca: &CertAuth, events: &[CertAuthEvent])

impl PreSaveEventListener<CertAuth> for CaObjectsStore

React to any events on a CA that cause the set of object to change.

fn listen(&self, ca: &CertAuth, events: &[CertAuthEvent]) -> KrillResult<()>

impl PreSaveEventListener<CertAuth> for TaskQueue

Implement pre-save listening for CertAuth events.

fn listen(&self, ca: &CertAuth, events: &[CertAuthEvent]) -> KrillResult<()>

impl Serialize for CertAuth

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CertAuth