Commit Graph

54 Commits

Author SHA1 Message Date
Jacob Hoffman-Andrews 9423467142 Switch to our own fork of go-jose.
This is the result of `godep save -r ./...` and
`git rm -r -f Godeps/_workspace/src/github.com/square`

Our fork is currently at the head of go-jose when Richard made the local nonce
changes, with the nonce changes added on top. In other words, the newly created
files are exactly equal to the deleted files.

In a separate commit I will bring our own go-jose fork up to the remote head,
then update our deps.

Also note: Square's go-jose repo contains a `cipher` package. Since we don't
make any changes to that package, we leave it imported as-is.
2015-07-24 14:39:00 -07:00
Jacob Hoffman-Andrews 620a012c62 Rewrite go-jose dependencies to our fork. 2015-07-24 14:16:01 -07:00
Roland Shoemaker 31f0674f03 Replace net.LookupMX with core.LookupMX using defined resolver 2015-07-21 22:36:29 -07:00
Roland Shoemaker a767daed4d Rebase on #438 and cleanup 2015-07-08 22:07:21 +01:00
Roland Shoemaker 624581518d Consistent domain usage, DNSResolver comment, and empty CAA test 2015-07-07 22:31:44 +01:00
Roland Shoemaker f6248ef279 Flesh out DNS mock methods, and move them to their own sub-module instead of under test/ to avoid import loop, Add Loopback DNS resolver for core/dns_test.go 2015-07-07 22:31:44 +01:00
J.C. Jones 41f5788c77 Correct most `go lint` warnings. (274 -> 5) 2015-06-16 22:18:28 -05:00
Jacob Hoffman-Andrews 80d5e50e42 Enable revocation by account key.
In addition to cert private key. This required modifying the GetCertificate*
functions to return core.Certificate instead of certificate bytes.
2015-06-15 12:33:50 -07:00
J.C. Jones 2ad15a4a85 Issue #309: Produce OCSP Responses immediately upon issuance, if at all possible.
This approach performs a best-effort generation of the first OCSP response during
certificate issuance. In the event that OCSP generation fails, it logs a warning at
the Boulder-CA console, but returns successfully since the Certificate was itself
issued.
2015-06-11 11:31:04 -05:00
Roland Shoemaker 0265b6f5d0 Merge upstream/master and fix conflicts 2015-06-10 12:43:11 -07:00
J.C. Jones 27f5aebbcd Updates per review 2015-06-03 21:57:01 -07:00
J.C. Jones abdc174be8 Issue #296: Fix erroneous transaction handling in CA
- Moved the transaction handling up to the `certificate-authority.go` file
- Simplified `certificate-authority-data.go`
- Created a mocks file in `test/` and reworked RA and CA to use it
- More audit logging to CA
2015-06-03 19:23:24 -07:00
Jacob Hoffman-Andrews 026cb424fc Revert "Replace RevokeCertficate with something more in line with the spec"
This reverts commit b1bad40fe6.

Conflicts:
	wfe/web-front-end.go
2015-06-02 10:45:54 -07:00
Richard Barnes b1bad40fe6 Replace RevokeCertficate with something more in line with the spec 2015-06-01 02:11:10 -04:00
Richard Barnes c3c52eda17 Merge branch 'master' into check-validity2 2015-05-31 13:32:44 -04:00
Roland Shoemaker 8846fd2c90 Merge upstream/master 2015-05-29 09:36:46 +01:00
J.C. Jones 4518f0bf17 Migrate CADB to using GORP. 2015-05-28 23:11:03 -07:00
Richard Barnes 68fc8a8f4f More rebase 2015-05-28 20:35:29 -07:00
Richard Barnes 0d7555b7af Rebase on master 2015-05-28 20:34:47 -07:00
Richard Barnes b59682cb91 Add validity interval checking 2015-05-28 20:30:46 -07:00
J.C. Jones d1321f2d78 More RPC fixes for Issue #202
- NewPendingAuthorization now uses a core.Authorization object, so
  that foreign key constraints are followed
- core.Authorization now serializes RegistrationID to JSON, so it has to get
  blanked out in WFE before transmission to client.
- Remove ParsedCertificate from core.Certificate, as type x509.Certificate cannot
  be marshaled.
- Added AssertDeepEquals and AssertMarhsaledEquals to test-tools.go
- Caught several overloaded and misleadingly named errors in WFE
2015-05-28 11:05:55 -07:00
Roland Shoemaker 81c7466e97 add rpc-wrapper and interface code 2015-05-28 09:58:16 +01:00
J.C. Jones af0f8446eb Issue #202, Periodic OCSP Signer Tool
- Move dbMap construction and type converter into individual files in the sa package.
- Add DB configuration for the OCSP tool to the boulder config:
  - left to the user if they want to use different boulder-config.json files
    for different purposes.
- Added updater to Makefile
- Fix trailing ',' in the Boulder config, add more panic logging
- Ignore .pem files produced by the integration test
- Change RPC to use per-instance named reply-to queues.
- Finish OCSP Updater logic
- Rework RPC for OCSP to use a transfer object (due to serialization problems of x509.Certificate)
2015-05-27 22:01:29 -07:00
J.C. Jones 343920cfe3 Fix integration test while running with MySQL
- Add SQL configuration options
- Increase the width of the authz and pending_authz tables' challenges field
- Make it configurable whether CREATE TABLE commands should run
2015-05-27 13:39:18 -07:00
Jacob Hoffman-Andrews 6c6199023d Merge pull request #231 from letsencrypt/230-unknown-key-type
Resolved Issue #230
2015-05-26 15:05:34 -07:00
J.C. Jones bc3acca096 Resolved Issue #230
- Move setting the core.Registration.Key field from RA.NewRegistration to
  WFE.NewRegistration to avoid a chicken-and-egg problem.
- Note: I kept the RPC wrapper object even though it now only has one field.
  Seems like it's a good practice to use wrapper objects, even though we don't
  everywhere.
2015-05-26 14:44:15 -07:00
Jacob Hoffman-Andrews 19fd285859 Merge pull request #223 from rolandshoemaker/revoker
admin-revoker tool
2015-05-26 14:37:33 -07:00
Roland Shoemaker e1eeebce52 Only run validations against updated challenges (instead of everything) 2015-05-26 17:08:49 +01:00
Roland Shoemaker d184862427 gofmt and move deniedCSR table creation back to SA 2015-05-25 01:17:28 +01:00
Roland Shoemaker 0ab71bed62 initial revoker work 2015-05-23 12:46:56 +01:00
Richard Barnes c3b312118e Add audit logging
- Auditing for general errors in executables
- Auditing for improper messages received by WFE
- Automatic audit wlogging of software errors
- Audit logging for mis-routed messages
- Audit logging for certificate requests
- Auditing for improper messages received by WFE
- Add audit events table
- Expect more details in TestRegistration in web-front-end_test.go
- Remove "extra" debug details from web-front-end.go per Issue #174
- Improve test coverage of web-front-end.go
- WFE audit updates for revocation support rebase
- Add audit messages to RPC for Improper Messages and Error Conditions
- Also note misrouted messages
2015-05-18 18:23:08 -07:00
Roland Shoemaker e1ba291019 Store registration ID with certificate 2015-05-16 13:47:51 -07:00
Roland Shoemaker faa1d5ac45 review cleanups 2015-05-16 13:25:36 -07:00
Roland Shoemaker e233fdaa61 switch authz and pending_authz to store registration ID instead of key (and update all the random stuff they touched) 2015-05-14 14:14:36 -07:00
James 'J.C.' Jones 6be5c4910e Merge pull request #185 from rolandshoemaker/deny-store
Store and check previously denied CSRs
2015-05-14 09:03:06 -07:00
Roland Shoemaker b9745cf894 check key is assosiated with existing registration in verifyPOST 2015-05-13 19:16:20 -07:00
Jacob Hoffman-Andrews 3eed9e3f7c Move to Square's go-jose library. 2015-05-13 17:36:38 -07:00
Roland Shoemaker 5d5eea7071 switch to only store dns names 2015-05-13 12:08:50 -07:00
Roland Shoemaker 07182500eb add missing rpc methods 2015-05-12 00:08:48 -07:00
Roland Shoemaker d95c552ab4 add denied csr table and AddDeniedCSR + AlreadyDeniedCSR methods for checking, added AddDeniedCSR to ra.NewCertificate 2015-05-11 23:02:39 -07:00
Jacob Hoffman-Andrews 7352757086 Add test 2015-05-01 16:01:50 -07:00
Jacob Hoffman-Andrews 79b548ad37 Add interface for RevokeCertificate. 2015-04-30 12:44:17 -07:00
Jacob Hoffman-Andrews 73603c95cf Add reason code and fix index. 2015-04-30 11:31:36 -07:00
Jacob Hoffman-Andrews 8e30ff81fb Partly done implementation of revoke. 2015-04-29 18:36:26 -07:00
Jacob Hoffman-Andrews 1d2c6a5d7c Split out GetCertificate / GetCertificateByShortSerial.
Also stub out some initial revocation code.
2015-04-29 11:48:08 -07:00
J.C. Jones e389f98ba2 Fixes for golint 2015-04-13 16:24:35 -07:00
J.C. Jones e972647b5e Serial number get-and-increment method
Add stubs for integration with Issue #83.
2015-04-12 08:10:28 -07:00
J.C. Jones 97b356fcd4 Add a Certificate Authority Database stub
* A few tests, but they don't all pass
* needs actual DB code
2015-04-12 08:10:28 -07:00
Richard Barnes 752e91d8eb Initial policy authority 2015-03-16 12:55:05 -04:00
Richard Barnes 568bad588a Identifier checking (syntax,blacklist,PSL) 2015-03-16 12:17:31 -04:00