Merge pull request #681 from cego/ca-expire

Update CA status to expired, and only provide agent with non expired

Author: SlyngDK

server/agent-service.go

@@ -128,7 +128,7 @@ func (a *agentService) GetEnrollStatus(ctx context.Context, _ *emptypb.Empty) (*
 			res.AssignedIP = ip.String()
 		}
 
-		cas, err := a.store.ListCAByNetwork([]string{agent.NetworkName})
+		cas, err := a.store.ListCAByNetworkNotExpired([]string{agent.NetworkName})
 		if err != nil {
 			return nil, status.Error(codes.Internal, "Failed to get certificate authorities for network")
 		}
@@ -153,7 +153,7 @@ func (a *agentService) GetCertificateAuthorityByNetwork(ctx context.Context, req
 		return nil, status.Error(codes.PermissionDenied, "")
 	}
 
-	cas, err := a.store.ListCAByNetwork(request.NetworkNames)
+	cas, err := a.store.ListCAByNetworkNotExpired(request.NetworkNames)
 	if err != nil {
 		a.l.WithError(err)
 		return nil, status.Error(codes.Internal, fmt.Sprintf("%s", err))

server/store/ca.go

@@ -72,6 +72,25 @@ func (s *Store) ListCAByNetwork(networks []string) ([]*CA, error) {
 	return cas, nil
 }
 
+func (s *Store) ListCAByNetworkNotExpired(networks []string) ([]*CA, error) {
+	txn := s.db.NewTransaction(false)
+	defer txn.Discard()
+
+	cas, err := s.listCAByNetwork(txn, networks)
+	if err != nil {
+		return nil, err
+	}
+
+	validCas := make([]*CA, 0)
+	for _, ca := range cas {
+		if ca.Status != CA_Expired {
+			validCas = append(validCas, ca)
+		}
+	}
+
+	return validCas, nil
+}
+
 func (s *Store) ListCRLByNetwork(networks []string) ([]*protocol.NetworkCRL, error) {
 	txn := s.db.NewTransaction(false)
 	defer txn.Discard()
@@ -296,6 +315,37 @@ func (s *Store) RenewCAs() error {
 	return nil
 }
 
+func (s *Store) UpdateExpiredCAs() error {
+	txn := s.db.NewTransaction(true)
+	defer txn.Discard()
+
+	networks, err := s.listNetworks(txn)
+	if err != nil {
+		return fmt.Errorf("failed to get networks %s", err)
+	}
+
+	for _, network := range networks {
+		cas, err := s.listCAByNetwork(txn, []string{network.Name})
+		if err != nil {
+			return fmt.Errorf("failed to get CA` for network: %s", network)
+		}
+
+		for _, ca := range cas {
+			_, err := s.expireCA(txn, ca)
+			if err != nil {
+				return fmt.Errorf("failed to expire CA: %s", err)
+			}
+		}
+	}
+
+	err = txn.Commit()
+	if err != nil {
+		return fmt.Errorf("failed to commit UpdateExpiredCAs: %v", err)
+	}
+
+	return nil
+}
+
 func (s *Store) expireCA(txn *badger.Txn, ca *CA) (bool, error) {
 	publicKey, _, err := cert.UnmarshalNebulaCertificateFromPEM(ca.PublicKey)
 	if err != nil {

server/tasks.go

@@ -34,6 +34,7 @@ func (t *tasks) Start() {
 				t.renewCerts()
 			case <-renewCATicker.C:
 				t.renewCAs()
+				t.expireCAs()
 			case <-dbGCTicker.C:
 				t.dbGC()
 			case <-t.quit:
@@ -65,6 +66,14 @@ func (t *tasks) renewCAs() {
 	}
 }
 
+func (t *tasks) expireCAs() {
+	t.l.Infoln("Task: update status for expired ca certificates")
+	err := t.store.UpdateExpiredCAs()
+	if err != nil {
+		t.l.WithError(err).Errorln("error when updating expire for ca certificates")
+	}
+}
+
 func (t *tasks) dbGC() {
 	t.l.Debugln("Task: db garbage collection")
 	t.store.GC()