letsencrypt / ct-woodpecker / 456

Committed 14 Sep 2018 06:10PM UTC coverage: 67.193%. Remained the same

Build # 456

Build Type

cron

travis-ci

Committed by

jsha

Commit Message

Fix golangci nits (#68)

This PR addresses the low hanging nits [flagged by GolangCI](https://golangci.com/r/github.com/letsencrypt/ct-woodpecker).

It leaves three "megacheck" findings yet to be addressed in the `cttestsrv`:
* signedLogRoot.TreeSize is deprecated: TreeSize moved to LogRoot.
* signedLogRoot.TimestampNanos is deprecated: TimestampNanos moved to LogRoot.
* signedLogRoot.RootHash is deprecated: RootHash moved to LogRoot.

All of the above are a result of https://github.com/google/trillian/commit/0c12c8487 - it looks like the `certificate-transparency-go` ctfe is still using the deprecated fields so I think we can ignore these for now. I _think_ fixing it will require unserializing the `log_root []byte` from the response and that's too fiddly for my low-hanging PR.

Run Details

3 of 3 new or added lines in 2 files covered. (100.0%)

766 of 1140 relevant lines covered (67.19%)

4.38 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

67.39

/monitor/cert_submitter.go

package monitor

import (
        "bytes"
        "context"
        "crypto/ecdsa"
        "crypto/x509"
        "database/sql"
        "errors"
        "fmt"
        "strconv"
        "time"

        "github.com/letsencrypt/ct-woodpecker/pki"
        "github.com/letsencrypt/ct-woodpecker/storage"

        ct "github.com/google/certificate-transparency-go"
        cttls "github.com/google/certificate-transparency-go/tls"
        ctx509 "github.com/google/certificate-transparency-go/x509"
        "github.com/prometheus/client_golang/prometheus"
        "github.com/prometheus/client_golang/prometheus/promauto"
)

// certSubmitterStats is a type to hold the prometheus metrics used by
// a certSubmitter
type certSubmitterStats struct {
        certSubmitLatency   *prometheus.HistogramVec
        certSubmitResults   *prometheus.CounterVec
        certStorageFailures *prometheus.CounterVec
        storedSCTs          prometheus.Counter
}

var (
        // requiredSCTFreshness indicates how fresh a timestamp in a returned SCT must
        // be for it to be considered valid.
        requiredSCTFreshness = time.Minute * 10

        // certStats is a certSubmitterStats instance with promauto registered
        // prometheus metrics
        certStats *certSubmitterStats = &certSubmitterStats{
                certSubmitLatency: promauto.NewHistogramVec(prometheus.HistogramOpts{
                        Name:    "cert_submit_latency",
                        Help:    "Latency submitting certificate chains to CT logs",
                        Buckets: internetFacingBuckets,
                }, []string{"uri", "precert"}),
                certSubmitResults: promauto.NewCounterVec(prometheus.CounterOpts{
                        Name: "cert_submit_results",
                        Help: "Count of results from submitting certificate chains to CT logs, sliced by status",
                }, []string{"uri", "status", "precert", "duplicate"}),
                certStorageFailures: promauto.NewCounterVec(prometheus.CounterOpts{
                        Name: "cert_storage_failures",
                        Help: "Count of failures to store submitted certificates and their SCTs",
                }, []string{"uri", "type"}),
                storedSCTs: promauto.NewCounter(prometheus.CounterOpts{
                        Name: "stored_scts",
                        Help: "Count of unique SCTs we have retrieved and stored in the database",
                }),
        }
)

// SubmitterOptions is a struct holding options related to issuing and
// submitting certificates to the monitored log periodically.
type SubmitterOptions struct {
        // Interval describes the duration that the monitor will sleep between
        // submitting certificates to the monitored log.
        Interval time.Duration
        // Timeout describes the timeout used for submitting precerts/certs to the
        // monitored log.
        Timeout time.Duration
        // IssuerKey is the ECDSA private key used to sign issued certificates
        IssuerKey *ecdsa.PrivateKey
        // IssuerCert is the issuer certificate used to issue certificates submitted
        // to the monitored log. Its public key must correspond to the private key in
        // IssuerKey
        IssuerCert *x509.Certificate
        // SubmitPreCert controls whether or not precertificates are submitted
        SubmitPreCert bool
        // SubmitCert controls whether or not final certificates are submitted
        SubmitCert bool
        // ResubmitIncluded controls whether or not already included duplicate
        // certificates are submitted
        ResubmitIncluded bool
}

// Valid checks that the SubmitterOptions has a valid positive interval and that
// the IssuerKey and IssuerCert are not nil.
func (o SubmitterOptions) Valid() error {
        if o.Interval <= 0 {
                return errors.New("Submitter interval must be > 0")
        }

        if o.Timeout <= 0 {
                return errors.New("Submitter timeout must be > 0")
        }

        if o.IssuerKey == nil {
                return errors.New("IssuerKey must not be nil")
        }

        if o.IssuerCert == nil {
                return errors.New("IssuerCert must not be nil")
        }

        return nil
}

// certSubmitter is a monitorCheck type for periodically issuing certificates
// and submitting them to a log's add-chain and add-pre-chain endpoints.
type certSubmitter struct {
        monitorCheck

        client monitorCTClient
        logID  int64
        stats  *certSubmitterStats
        db     storage.Storage

        stopChannel chan bool

        // How long to sleep between submitting certificates to the log
        certSubmitInterval time.Duration
        // Timeout for precert/cert submissions to the log
        certSubmitTimeout time.Duration
        // ECDSA private key used to issue certificates to submit to the log.
        certIssuerKey *ecdsa.PrivateKey
        // Certificate used as the issuer for certificates submitted to the log.
        certIssuer *x509.Certificate
        // Should a precert be submitted?
        submitPreCert bool
        // Should a final cert be submitted?
        submitCert bool
        // Should an already included duplicate cert be submitted
        resubmitIncluded bool
}

func newCertSubmitter(
        mc monitorCheck,
        opts *SubmitterOptions,
        client monitorCTClient,
        storage storage.Storage) *certSubmitter {
        return &certSubmitter{
                monitorCheck:       mc,
                client:             client,
                stats:              certStats,
                db:                 storage,
                stopChannel:        make(chan bool),
                certSubmitInterval: opts.Interval,
                certSubmitTimeout:  opts.Timeout,
                certIssuer:         opts.IssuerCert,
                certIssuerKey:      opts.IssuerKey,
                submitPreCert:      opts.SubmitPreCert,
                submitCert:         opts.SubmitCert,
                resubmitIncluded:   opts.ResubmitIncluded,
        }
}

// run starts a goroutine that calls submitCertificate, sleeps for
// certSubmitInterval and then repeats forever.
func (c *certSubmitter) run() {
        go func() {
                for {
                        c.submitCertificates()
                        c.logf("Sleeping for %s before next certificate submission\n",
                                c.certSubmitInterval)
                        select {
                        case <-c.stopChannel:
                                return
                        case <-time.After(c.certSubmitInterval):
                        }
                }
        }()
}

func (c *certSubmitter) stop() {
        c.log("Stopping")
        c.stopChannel <- true
}

// submitCertificates issues a pre-certificate and a matching certificate with
// the certSubmitter's certIssuer/certIssuerKey. If `submitPreCert` is enabled
// then a precert is submitted. If `submitCert` is enabled then a final cert is
// submitted. All submissions are done on their own goroutine.
func (c *certSubmitter) submitCertificates() {
        // a certSubmitter requires a non-nil certIssuerKey and certIssuer. If somehow
        // was one created with nil values then panic.
        if c.certIssuerKey == nil || c.certIssuer == nil {
                panic("certSubmitter created with nil certIssuerKey or certIssuer\n")
        }

        certPair, err := pki.IssueTestCertificate(c.certIssuerKey, c.certIssuer, c.clk)
        if err != nil {
                // This should not occur and if it does we should abort hard
                panic(fmt.Sprintf("!!! Error issuing certificate: %s\n", err.Error()))
        }

        if c.submitPreCert {
                go c.submitCertificate(certPair.PreCert, true)
        }

        if c.submitCert {
                go c.submitCertificate(certPair.Cert, false)
        }

        if c.resubmitIncluded {
                go func() {
                        if err := c.submitIncludedDupe(); err != nil {
                                c.logErrorf("Error submitting duplicate certificate: %s", err)
                        }
                }()
        }
}

func (c certSubmitter) submit(cert []byte, precert bool) (*ct.SignedCertificateTimestamp, error) {
        chain := []ct.ASN1Cert{
                {Data: cert},
        }

        // Precert submissions also need the issuer in the chain because the SCT for
        // for precerts can contain the issuer SPKI.
        if precert {
                chain = append(chain, ct.ASN1Cert{Data: c.certIssuer.Raw})
        }

        submissionMethod := c.client.AddChain
        certKind := "certificate"
        if precert {
                submissionMethod = c.client.AddPreChain
                certKind = "precertificate"
        }
        c.logf("Submitting %s\n", certKind)

        start := c.clk.Now()
        ctx, cancel := context.WithTimeout(context.Background(), c.certSubmitTimeout)
        defer cancel()
        sct, err := submissionMethod(ctx, chain)
        elapsed := c.clk.Since(start)
        latencyLabels := prometheus.Labels{"uri": c.logURI, "precert": strconv.FormatBool(precert)}
        c.stats.certSubmitLatency.With(latencyLabels).Observe(elapsed.Seconds())
        if err != nil {
                return nil, err
        }

        return sct, nil
}

// submitCertificate submits a single x509 Certificate to a log. If `precert`
// is true then the certificate is submitted via the log's add-pre-chain
// endpoint, otherwise the add-chain endpoint is used. The latency of the
// submission is tracked in the `cert_submit_latency` prometheus histogram. If
// the submission fails, or the returned SCT is invalid the
// `cert_submit_results` prometheus countervec is incremented with a "fail"
// status tag. If the submission succeeds the `cert_submit_results` prometheus
// countervec is incremented with a "ok" status tag. An SCT is considered
// invalid if the signature does not validate, or if the timestamp is too far in
// the future or the past (controlled by `requiredSCTFreshness`).
func (c certSubmitter) submitCertificate(cert *x509.Certificate, precert bool) {
        failLabels := prometheus.Labels{"uri": c.logURI, "status": "fail", "precert": strconv.FormatBool(precert), "duplicate": "false"}
        certKind := "certificate"
        if precert {
                certKind = "precertificate"
        }
        sct, err := c.submit(cert.Raw, precert)
        if err != nil {
                c.logErrorf("Error submitting %s : %s\n", certKind, err)
                c.stats.certSubmitResults.With(failLabels).Inc()
                return
        }

        if c.db != nil {
                sctBytes, err := cttls.Marshal(*sct)
                if err != nil {
                        c.logErrorf("Error serializing SCT: %s", err)
                        c.stats.certStorageFailures.WithLabelValues(c.logURI, "marshalling").Inc()
                        return
                }
                err = c.db.AddCert(c.logID, &storage.SubmittedCert{
                        Cert:      cert.Raw,
                        SCT:       sctBytes,
                        Timestamp: sct.Timestamp,
                })
                if err != nil {
                        c.logErrorf("Error saving submitted %s : %s", certKind, err)
                        c.stats.certStorageFailures.WithLabelValues(c.logURI, "storing").Inc()
                        return
                }
                c.stats.storedSCTs.Inc()
        }

        ts := time.Unix(0, int64(sct.Timestamp)*int64(time.Millisecond))
        sctAge := c.clk.Since(ts)

        // Check that the SCT's timestamp is within an allowable tolerance into the
        // future and the past. The SCT's signature & log ID have already been verified by
        // `m.client.AddChain()`
        if sctAge > requiredSCTFreshness {
                c.logErrorf("Error submitting : returned SCT timestamp signed %s in the future (expected <= %s)",
                        certKind, sctAge, requiredSCTFreshness)
                c.stats.certSubmitResults.With(failLabels).Inc()
                return
        } else if -sctAge > requiredSCTFreshness {
                c.logErrorf("Error submitting %s : returned SCT timestamp signed %s in the past (expected <= %s)",
                        certKind, -sctAge, requiredSCTFreshness)
                c.stats.certSubmitResults.With(failLabels).Inc()
                return
        }

        successLabels := prometheus.Labels{"uri": c.logURI, "status": "ok", "precert": strconv.FormatBool(precert), "duplicate": "false"}
        c.stats.certSubmitResults.With(successLabels).Inc()
        c.logf("%s submitted. SCT timestamp %s", certKind, ts)
}

// submitIncludedDupe resubmits certificates that have already been included in the log
// in order to determine how the log treats this situation. A certificate is randomly
// selected from the database of certificates that we've previously submitted and
// subsequently verified the inclusion of and then submitted to the same log. If the
// SCT that is returned does not match the SCT we were given after the first submission
// we add a new entry to the certificate table and track it for inclusion.
func (c certSubmitter) submitIncludedDupe() error {
        cert, err := c.db.GetRandSeen(c.logID)
        if err != nil {
                if err == sql.ErrNoRows {
                        return nil
                }
                return fmt.Errorf("failed to retrieve a random included entry: %s", err)
        }

        originalCert, err := ctx509.ParseCertificate(cert.Cert)
        if err != nil {
                return fmt.Errorf("failed to parse certificate: %s", err)
        }

        failLabels := prometheus.Labels{"uri": c.logURI, "status": "fail", "precert": strconv.FormatBool(originalCert.IsPrecertificate()), "duplicate": "true"}
        certKind := "certificate"
        if originalCert.IsPrecertificate() {
                certKind = "precertificate"
        }
        sct, err := c.submit(cert.Cert, originalCert.IsPrecertificate())
        if err != nil {
                c.stats.certSubmitResults.With(failLabels).Inc()
                return fmt.Errorf("%s submission to %q failed: %s", certKind, c.logURI, err)
        }
        c.stats.certSubmitResults.With(prometheus.Labels{"uri": c.logURI, "status": "ok", "precert": strconv.FormatBool(originalCert.IsPrecertificate()), "duplicate": "true"}).Inc()

        sctBytes, err := cttls.Marshal(*sct)
        if err != nil {
                c.stats.certStorageFailures.WithLabelValues(c.logURI, "marshalling").Inc()
                return fmt.Errorf("failed to parse returned SCT: %s", err)
        }
        if !bytes.Equal(sctBytes, cert.SCT) {
                // non-matching SCT, add to database for future inclusion checking
                err = c.db.AddCert(c.logID, &storage.SubmittedCert{
                        Cert:      cert.Cert,
                        SCT:       sctBytes,
                        Timestamp: sct.Timestamp,
                })
                if err != nil {
                        c.stats.certStorageFailures.WithLabelValues(c.logURI, "storing").Inc()
                        return fmt.Errorf("failed to store submitted %s: %s", certKind, err)
                }
                c.stats.storedSCTs.Inc()
        }

        return nil
}

1	package monitor
2
3	import (
4	"bytes"
5	"context"
6	"crypto/ecdsa"
7	"crypto/x509"
8	"database/sql"
9	"errors"
10	"fmt"
11	"strconv"
12	"time"
13
14	"github.com/letsencrypt/ct-woodpecker/pki"
15	"github.com/letsencrypt/ct-woodpecker/storage"
16
17	ct "github.com/google/certificate-transparency-go"
18	cttls "github.com/google/certificate-transparency-go/tls"
19	ctx509 "github.com/google/certificate-transparency-go/x509"
20	"github.com/prometheus/client_golang/prometheus"
21	"github.com/prometheus/client_golang/prometheus/promauto"
22	)
23
24	// certSubmitterStats is a type to hold the prometheus metrics used by
25	// a certSubmitter
26	type certSubmitterStats struct {
27	certSubmitLatency *prometheus.HistogramVec
28	certSubmitResults *prometheus.CounterVec
29	certStorageFailures *prometheus.CounterVec
30	storedSCTs prometheus.Counter
31	}
32
33	var (
34	// requiredSCTFreshness indicates how fresh a timestamp in a returned SCT must
35	// be for it to be considered valid.
36	requiredSCTFreshness = time.Minute * 10
37
38	// certStats is a certSubmitterStats instance with promauto registered
39	// prometheus metrics
40	certStats *certSubmitterStats = &certSubmitterStats{
41	certSubmitLatency: promauto.NewHistogramVec(prometheus.HistogramOpts{
42	Name: "cert_submit_latency",
43	Help: "Latency submitting certificate chains to CT logs",
44	Buckets: internetFacingBuckets,
45	}, []string{"uri", "precert"}),
46	certSubmitResults: promauto.NewCounterVec(prometheus.CounterOpts{
47	Name: "cert_submit_results",
48	Help: "Count of results from submitting certificate chains to CT logs, sliced by status",
49	}, []string{"uri", "status", "precert", "duplicate"}),
50	certStorageFailures: promauto.NewCounterVec(prometheus.CounterOpts{
51	Name: "cert_storage_failures",
52	Help: "Count of failures to store submitted certificates and their SCTs",
53	}, []string{"uri", "type"}),
54	storedSCTs: promauto.NewCounter(prometheus.CounterOpts{
55	Name: "stored_scts",
56	Help: "Count of unique SCTs we have retrieved and stored in the database",
57	}),
58	}
59	)
60
61	// SubmitterOptions is a struct holding options related to issuing and
62	// submitting certificates to the monitored log periodically.
63	type SubmitterOptions struct {
64	// Interval describes the duration that the monitor will sleep between
65	// submitting certificates to the monitored log.
66	Interval time.Duration
67	// Timeout describes the timeout used for submitting precerts/certs to the
68	// monitored log.
69	Timeout time.Duration
70	// IssuerKey is the ECDSA private key used to sign issued certificates
71	IssuerKey *ecdsa.PrivateKey
72	// IssuerCert is the issuer certificate used to issue certificates submitted
73	// to the monitored log. Its public key must correspond to the private key in
74	// IssuerKey
75	IssuerCert *x509.Certificate
76	// SubmitPreCert controls whether or not precertificates are submitted
77	SubmitPreCert bool
78	// SubmitCert controls whether or not final certificates are submitted
79	SubmitCert bool
80	// ResubmitIncluded controls whether or not already included duplicate
81	// certificates are submitted
82	ResubmitIncluded bool
83	}
84
85	// Valid checks that the SubmitterOptions has a valid positive interval and that
86	// the IssuerKey and IssuerCert are not nil.
87	func (o SubmitterOptions) Valid() error {	2✔
88	if o.Interval <= 0 {	2✔
89	return errors.New("Submitter interval must be > 0")	×
90	}	×
91
92	if o.Timeout <= 0 {	2✔
93	return errors.New("Submitter timeout must be > 0")	×
94	}	×
95
96	if o.IssuerKey == nil {	2✔
97	return errors.New("IssuerKey must not be nil")	×
98	}	×
99
100	if o.IssuerCert == nil {	2✔
101	return errors.New("IssuerCert must not be nil")	×
102	}	×
103
104	return nil	2✔
105	}
106
107	// certSubmitter is a monitorCheck type for periodically issuing certificates
108	// and submitting them to a log's add-chain and add-pre-chain endpoints.
109	type certSubmitter struct {
110	monitorCheck
111
112	client monitorCTClient
113	logID int64
114	stats *certSubmitterStats
115	db storage.Storage
116
117	stopChannel chan bool
118
119	// How long to sleep between submitting certificates to the log
120	certSubmitInterval time.Duration
121	// Timeout for precert/cert submissions to the log
122	certSubmitTimeout time.Duration
123	// ECDSA private key used to issue certificates to submit to the log.
124	certIssuerKey *ecdsa.PrivateKey
125	// Certificate used as the issuer for certificates submitted to the log.
126	certIssuer *x509.Certificate
127	// Should a precert be submitted?
128	submitPreCert bool
129	// Should a final cert be submitted?
130	submitCert bool
131	// Should an already included duplicate cert be submitted
132	resubmitIncluded bool
133	}
134
135	func newCertSubmitter(
136	mc monitorCheck,
137	opts *SubmitterOptions,
138	client monitorCTClient,
139	storage storage.Storage) *certSubmitter {	3✔
140	return &certSubmitter{	3✔
141	monitorCheck: mc,	3✔
142	client: client,	3✔
143	stats: certStats,	3✔
144	db: storage,	3✔
145	stopChannel: make(chan bool),	3✔
146	certSubmitInterval: opts.Interval,	3✔
147	certSubmitTimeout: opts.Timeout,	3✔
148	certIssuer: opts.IssuerCert,	3✔
149	certIssuerKey: opts.IssuerKey,	3✔
150	submitPreCert: opts.SubmitPreCert,	3✔
151	submitCert: opts.SubmitCert,	3✔
152	resubmitIncluded: opts.ResubmitIncluded,	3✔
153	}	3✔
154	}	3✔
155
156	// run starts a goroutine that calls submitCertificate, sleeps for
157	// certSubmitInterval and then repeats forever.
158	func (c *certSubmitter) run() {	×
159	go func() {	×
160	for {	×
161	c.submitCertificates()	×
162	c.logf("Sleeping for %s before next certificate submission\n",	×
163	c.certSubmitInterval)	×
164	select {	×
165	case <-c.stopChannel:	×
166	return	×
167	case <-time.After(c.certSubmitInterval):	×
168	}
169	}
170	}()
171	}
172
173	func (c *certSubmitter) stop() {	×
174	c.log("Stopping")	×
175	c.stopChannel <- true	×
176	}	×
177
178	// submitCertificates issues a pre-certificate and a matching certificate with
179	// the certSubmitter's certIssuer/certIssuerKey. If `submitPreCert` is enabled
180	// then a precert is submitted. If `submitCert` is enabled then a final cert is
181	// submitted. All submissions are done on their own goroutine.
182	func (c *certSubmitter) submitCertificates() {	4✔
183	// a certSubmitter requires a non-nil certIssuerKey and certIssuer. If somehow	4✔
184	// was one created with nil values then panic.	4✔
185	if c.certIssuerKey == nil \|\| c.certIssuer == nil {	4✔
186	panic("certSubmitter created with nil certIssuerKey or certIssuer\n")	×
187	}
188
189	certPair, err := pki.IssueTestCertificate(c.certIssuerKey, c.certIssuer, c.clk)	4✔
190	if err != nil {	4✔
191	// This should not occur and if it does we should abort hard	×
192	panic(fmt.Sprintf("!!! Error issuing certificate: %s\n", err.Error()))	×
193	}
194
195	if c.submitPreCert {	8✔
196	go c.submitCertificate(certPair.PreCert, true)	4✔
197	}	4✔
198
199	if c.submitCert {	8✔
200	go c.submitCertificate(certPair.Cert, false)	4✔
201	}	4✔
202
203	if c.resubmitIncluded {	4✔
204	go func() {	×
205	if err := c.submitIncludedDupe(); err != nil {	×
206	c.logErrorf("Error submitting duplicate certificate: %s", err)	×
207	}	×
208	}()
209	}
210	}
211
212	func (c certSubmitter) submit(cert []byte, precert bool) (*ct.SignedCertificateTimestamp, error) {	10✔
213	chain := []ct.ASN1Cert{	10✔
214	{Data: cert},	10✔
215	}	10✔
216		10✔
217	// Precert submissions also need the issuer in the chain because the SCT for	10✔
218	// for precerts can contain the issuer SPKI.	10✔
219	if precert {	14✔
220	chain = append(chain, ct.ASN1Cert{Data: c.certIssuer.Raw})	4✔
221	}	4✔
222
223	submissionMethod := c.client.AddChain	10✔
224	certKind := "certificate"	10✔
225	if precert {	14✔
226	submissionMethod = c.client.AddPreChain	4✔
227	certKind = "precertificate"	4✔
228	}	4✔
229	c.logf("Submitting %s\n", certKind)	10✔
230		10✔
231	start := c.clk.Now()	10✔
232	ctx, cancel := context.WithTimeout(context.Background(), c.certSubmitTimeout)	10✔
233	defer cancel()	10✔
234	sct, err := submissionMethod(ctx, chain)	10✔
235	elapsed := c.clk.Since(start)	10✔
236	latencyLabels := prometheus.Labels{"uri": c.logURI, "precert": strconv.FormatBool(precert)}	10✔
237	c.stats.certSubmitLatency.With(latencyLabels).Observe(elapsed.Seconds())	10✔
238	if err != nil {	12✔
239	return nil, err	2✔
240	}	2✔
241
242	return sct, nil	8✔
243	}
244
245	// submitCertificate submits a single x509 Certificate to a log. If `precert`
246	// is true then the certificate is submitted via the log's add-pre-chain
247	// endpoint, otherwise the add-chain endpoint is used. The latency of the
248	// submission is tracked in the `cert_submit_latency` prometheus histogram. If
249	// the submission fails, or the returned SCT is invalid the
250	// `cert_submit_results` prometheus countervec is incremented with a "fail"
251	// status tag. If the submission succeeds the `cert_submit_results` prometheus
252	// countervec is incremented with a "ok" status tag. An SCT is considered
253	// invalid if the signature does not validate, or if the timestamp is too far in
254	// the future or the past (controlled by `requiredSCTFreshness`).
255	func (c certSubmitter) submitCertificate(cert *x509.Certificate, precert bool) {	8✔
256	failLabels := prometheus.Labels{"uri": c.logURI, "status": "fail", "precert": strconv.FormatBool(precert), "duplicate": "false"}	8✔
257	certKind := "certificate"	8✔
258	if precert {	12✔
259	certKind = "precertificate"	4✔
260	}	4✔
261	sct, err := c.submit(cert.Raw, precert)	8✔
262	if err != nil {	10✔
263	c.logErrorf("Error submitting %s : %s\n", certKind, err)	2✔
264	c.stats.certSubmitResults.With(failLabels).Inc()	2✔
265	return	2✔
266	}	2✔
267
268	if c.db != nil {	6✔
269	sctBytes, err := cttls.Marshal(*sct)	×
270	if err != nil {	×
271	c.logErrorf("Error serializing SCT: %s", err)	×
272	c.stats.certStorageFailures.WithLabelValues(c.logURI, "marshalling").Inc()	×
273	return	×
274	}	×
275	err = c.db.AddCert(c.logID, &storage.SubmittedCert{	×
276	Cert: cert.Raw,	×
277	SCT: sctBytes,	×
278	Timestamp: sct.Timestamp,	×
279	})	×
280	if err != nil {	×
281	c.logErrorf("Error saving submitted %s : %s", certKind, err)	×
282	c.stats.certStorageFailures.WithLabelValues(c.logURI, "storing").Inc()	×
283	return	×
284	}	×
285	c.stats.storedSCTs.Inc()	×
286	}
287
288	ts := time.Unix(0, int64(sct.Timestamp)*int64(time.Millisecond))	6✔
289	sctAge := c.clk.Since(ts)	6✔
290		6✔
291	// Check that the SCT's timestamp is within an allowable tolerance into the	6✔
292	// future and the past. The SCT's signature & log ID have already been verified by	6✔
293	// `m.client.AddChain()`	6✔
294	if sctAge > requiredSCTFreshness {	8✔
295	c.logErrorf("Error submitting : returned SCT timestamp signed %s in the future (expected <= %s)",	2✔
296	certKind, sctAge, requiredSCTFreshness)	2✔
297	c.stats.certSubmitResults.With(failLabels).Inc()	2✔
298	return	2✔
299	} else if -sctAge > requiredSCTFreshness {	8✔
300	c.logErrorf("Error submitting %s : returned SCT timestamp signed %s in the past (expected <= %s)",	2✔
301	certKind, -sctAge, requiredSCTFreshness)	2✔
302	c.stats.certSubmitResults.With(failLabels).Inc()	2✔
303	return	2✔
304	}	2✔
305
306	successLabels := prometheus.Labels{"uri": c.logURI, "status": "ok", "precert": strconv.FormatBool(precert), "duplicate": "false"}	2✔
307	c.stats.certSubmitResults.With(successLabels).Inc()	2✔
308	c.logf("%s submitted. SCT timestamp %s", certKind, ts)	2✔
309	}
310
311	// submitIncludedDupe resubmits certificates that have already been included in the log
312	// in order to determine how the log treats this situation. A certificate is randomly
313	// selected from the database of certificates that we've previously submitted and
314	// subsequently verified the inclusion of and then submitted to the same log. If the
315	// SCT that is returned does not match the SCT we were given after the first submission
316	// we add a new entry to the certificate table and track it for inclusion.
317	func (c certSubmitter) submitIncludedDupe() error {	3✔
318	cert, err := c.db.GetRandSeen(c.logID)	3✔
319	if err != nil {	4✔
320	if err == sql.ErrNoRows {	2✔
321	return nil	1✔
322	}	1✔
323	return fmt.Errorf("failed to retrieve a random included entry: %s", err)	×
324	}
325
326	originalCert, err := ctx509.ParseCertificate(cert.Cert)	2✔
327	if err != nil {	2✔
328	return fmt.Errorf("failed to parse certificate: %s", err)	×
329	}	×
330
331	failLabels := prometheus.Labels{"uri": c.logURI, "status": "fail", "precert": strconv.FormatBool(originalCert.IsPrecertificate()), "duplicate": "true"}	2✔
332	certKind := "certificate"	2✔
333	if originalCert.IsPrecertificate() {	2✔
334	certKind = "precertificate"	×
335	}	×
336	sct, err := c.submit(cert.Cert, originalCert.IsPrecertificate())	2✔
337	if err != nil {	2✔
338	c.stats.certSubmitResults.With(failLabels).Inc()	×
339	return fmt.Errorf("%s submission to %q failed: %s", certKind, c.logURI, err)	×
340	}	×
341	c.stats.certSubmitResults.With(prometheus.Labels{"uri": c.logURI, "status": "ok", "precert": strconv.FormatBool(originalCert.IsPrecertificate()), "duplicate": "true"}).Inc()	2✔
342		2✔
343	sctBytes, err := cttls.Marshal(*sct)	2✔
344	if err != nil {	2✔
345	c.stats.certStorageFailures.WithLabelValues(c.logURI, "marshalling").Inc()	×
346	return fmt.Errorf("failed to parse returned SCT: %s", err)	×
347	}	×
348	if !bytes.Equal(sctBytes, cert.SCT) {	3✔
349	// non-matching SCT, add to database for future inclusion checking	1✔
350	err = c.db.AddCert(c.logID, &storage.SubmittedCert{	1✔
351	Cert: cert.Cert,	1✔
352	SCT: sctBytes,	1✔
353	Timestamp: sct.Timestamp,	1✔
354	})	1✔
355	if err != nil {	1✔
356	c.stats.certStorageFailures.WithLabelValues(c.logURI, "storing").Inc()	×
357	return fmt.Errorf("failed to store submitted %s: %s", certKind, err)	×
358	}	×
359	c.stats.storedSCTs.Inc()	1✔
360	}
361
362	return nil	2✔
363	}

letsencrypt / ct-woodpecker / 456

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous