75 lines
3.3 KiB
Go
75 lines
3.3 KiB
Go
package wfe2
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/letsencrypt/boulder/core"
|
|
corepb "github.com/letsencrypt/boulder/core/proto"
|
|
"github.com/letsencrypt/boulder/probs"
|
|
"github.com/letsencrypt/boulder/web"
|
|
)
|
|
|
|
// requiredStale checks if a request is a GET request with a logEvent indicating
|
|
// the endpoint starts with getAPIPrefix. If true then the caller is expected to
|
|
// apply staleness requirements via staleEnoughToGETOrder, staleEnoughToGETCert
|
|
// and staleEnoughToGETAuthz.
|
|
func requiredStale(req *http.Request, logEvent *web.RequestEvent) bool {
|
|
return req.Method == http.MethodGet && strings.HasPrefix(logEvent.Endpoint, getAPIPrefix)
|
|
}
|
|
|
|
// staleEnoughToGETOrder checks if the given order was created long enough ago
|
|
// in the past to be acceptably stale for accessing via the Boulder specific GET
|
|
// API.
|
|
func (wfe *WebFrontEndImpl) staleEnoughToGETOrder(order *corepb.Order) *probs.ProblemDetails {
|
|
return wfe.staleEnoughToGET("Order", order.Created.AsTime())
|
|
}
|
|
|
|
// staleEnoughToGETCert checks if the given cert was issued long enough in the
|
|
// past to be acceptably stale for accessing via the Boulder specific GET API.
|
|
func (wfe *WebFrontEndImpl) staleEnoughToGETCert(cert *corepb.Certificate) *probs.ProblemDetails {
|
|
return wfe.staleEnoughToGET("Certificate", cert.Issued.AsTime())
|
|
}
|
|
|
|
// staleEnoughToGETAuthz checks if the given authorization was created long
|
|
// enough ago in the past to be acceptably stale for accessing via the Boulder
|
|
// specific GET API. Since authorization creation date is not tracked directly
|
|
// the appropriate lifetime for the authz is subtracted from the expiry to find
|
|
// the creation date.
|
|
func (wfe *WebFrontEndImpl) staleEnoughToGETAuthz(authzPB *corepb.Authorization) *probs.ProblemDetails {
|
|
// If the authorization was deactivated we cannot reliably tell what the creation date was
|
|
// because we can't easily tell if it was pending or finalized before deactivation.
|
|
// As these authorizations can no longer be used for anything, just make them immediately
|
|
// available for access.
|
|
if core.AcmeStatus(authzPB.Status) == core.StatusDeactivated {
|
|
return nil
|
|
}
|
|
// We don't directly track authorization creation time. Instead subtract the
|
|
// pendingAuthorization lifetime from the expiry. This will be inaccurate if
|
|
// we change the pendingAuthorizationLifetime but is sufficient for the weak
|
|
// staleness requirements of the GET API.
|
|
createdTime := authzPB.Expires.AsTime().Add(-wfe.pendingAuthorizationLifetime)
|
|
// if the authz is valid then we need to subtract the authorizationLifetime
|
|
// instead of the pendingAuthorizationLifetime.
|
|
if core.AcmeStatus(authzPB.Status) == core.StatusValid {
|
|
createdTime = authzPB.Expires.AsTime().Add(-wfe.authorizationLifetime)
|
|
}
|
|
return wfe.staleEnoughToGET("Authorization", createdTime)
|
|
}
|
|
|
|
// staleEnoughToGET checks that the createDate for the given resource is at
|
|
// least wfe.staleTimeout in the past. If the resource is newer than the
|
|
// wfe.staleTimeout then an unauthorized problem is returned.
|
|
func (wfe *WebFrontEndImpl) staleEnoughToGET(resourceType string, createDate time.Time) *probs.ProblemDetails {
|
|
if wfe.clk.Since(createDate) < wfe.staleTimeout {
|
|
return probs.Unauthorized(fmt.Sprintf(
|
|
"%s is too new for GET API. "+
|
|
"You should only use this non-standard API to access resources created more than %s ago",
|
|
resourceType,
|
|
wfe.staleTimeout))
|
|
}
|
|
return nil
|
|
}
|