Examples with RpkiRepository net.ripe.rpki.validator3.domain.RpkiRepository used on opensource projects

Example 11 with RpkiRepository

use of net.ripe.rpki.validator3.domain.RpkiRepository in project rpki-validator-3 by RIPE-NCC.

the class RrdpServiceTest method should_parse_notification_use_delta_the_last_delta_serial_is_not_matching_fallback_to_snapshot.

@Test
public void should_parse_notification_use_delta_the_last_delta_serial_is_not_matching_fallback_to_snapshot() {
    final byte[] certificate = Objects.aParseableCertificate();
    final String sessionId = UUID.randomUUID().toString();
    final Objects.Publish crl = new Objects.Publish("rsync://host/path/crl1.crl", Objects.aParseableCrl());
    rrdpClient.add(crl.uri, crl.content);
    final byte[] snapshotXml = Objects.snapshotXml(4, sessionId, crl);
    final Objects.SnapshotInfo emptySnapshot = new Objects.SnapshotInfo("https://host/path/snapshot.xml", Sha256.hash(snapshotXml));
    rrdpClient.add(emptySnapshot.uri, snapshotXml);
    final Objects.DeltaPublish publishCert = new Objects.DeltaPublish("rsync://host/path/cert.cer", certificate);
    final byte[] deltaXml1 = Objects.deltaXml(2, sessionId, publishCert);
    final Objects.DeltaPublish republishCert = new Objects.DeltaPublish("rsync://host/path/cert.cer", Sha256.hash(publishCert.content), certificate);
    final byte[] deltaXml2 = Objects.deltaXml(3, sessionId, republishCert);
    final Objects.DeltaInfo deltaInfo1 = new Objects.DeltaInfo("https://host/path/delta1.xml", Sha256.hash(deltaXml1), 2);
    final Objects.DeltaInfo deltaInfo2 = new Objects.DeltaInfo("https://host/path/delta2.xml", Sha256.hash(deltaXml2), 3);
    rrdpClient.add(deltaInfo1.uri, deltaXml1);
    rrdpClient.add(deltaInfo2.uri, deltaXml2);
    final String notificationUri = "https://rrdp.ripe.net/notification.xml";
    rrdpClient.add(notificationUri, Objects.notificationXml(4, sessionId, emptySnapshot, deltaInfo1, deltaInfo2));
    final TrustAnchor trustAnchor = TestObjects.newTrustAnchor();
    entityManager.persist(trustAnchor);
    // make current serial lower to trigger delta download
    final RpkiRepository rpkiRepository = makeRpkiRepository(sessionId, notificationUri, trustAnchor);
    // do the first run to get the snapshot
    final RrdpRepositoryValidationRun validationRun = new RrdpRepositoryValidationRun(rpkiRepository);
    subject.storeRepository(rpkiRepository, validationRun);
    assertEquals(1, validationRun.getValidationChecks().size());
    final ValidationCheck validationCheck = validationRun.getValidationChecks().get(0);
    assertEquals(ErrorCodes.RRDP_FETCH_DELTAS, validationCheck.getKey());
    assertEquals(ValidationCheck.Status.WARNING, validationCheck.getStatus());
    assertEquals(rpkiRepository.getRrdpNotifyUri(), validationCheck.getLocation());
    assertEquals("The last delta serial is 3, notification file serial is 4", validationCheck.getParameters().get(0));
    final List<RpkiObject> objects = rpkiObjects.all().collect(Collectors.toList());
    assertEquals(1, objects.size());
    final RpkiObject rpkiObject = objects.get(0);
    assertEquals(RpkiObject.Type.CRL, rpkiObject.getType());
    assertEquals(Sets.newHashSet("rsync://host/path/crl1.crl"), rpkiObject.getLocations());
}

Example 12 with RpkiRepository

use of net.ripe.rpki.validator3.domain.RpkiRepository in project rpki-validator-3 by RIPE-NCC.

the class CertificateTreeValidationService method validate.

@Transactional(Transactional.TxType.REQUIRED)
public void validate(long trustAnchorId) {
    Map<URI, RpkiRepository> registeredRepositories = new HashMap<>();
    entityManager.setFlushMode(FlushModeType.COMMIT);
    TrustAnchor trustAnchor = trustAnchors.get(trustAnchorId);
    log.info("starting tree validation for {}", trustAnchor);
    CertificateTreeValidationRun validationRun = new CertificateTreeValidationRun(trustAnchor);
    validationRuns.add(validationRun);
    String trustAnchorLocation = trustAnchor.getLocations().get(0);
    ValidationResult validationResult = ValidationResult.withLocation(trustAnchorLocation);
    try {
        X509ResourceCertificate certificate = trustAnchor.getCertificate();
        validationResult.rejectIfNull(certificate, VALIDATOR_TRUST_ANCHOR_CERTIFICATE_AVAILABLE);
        if (certificate == null) {
            return;
        }
        CertificateRepositoryObjectValidationContext context = new CertificateRepositoryObjectValidationContext(URI.create(trustAnchorLocation), certificate);
        certificate.validate(trustAnchorLocation, context, null, null, VALIDATION_OPTIONS, validationResult);
        if (validationResult.hasFailureForCurrentLocation()) {
            return;
        }
        URI locationUri = Objects.firstNonNull(certificate.getRrdpNotifyUri(), certificate.getRepositoryUri());
        validationResult.warnIfNull(locationUri, VALIDATOR_TRUST_ANCHOR_CERTIFICATE_RRDP_NOTIFY_URI_OR_REPOSITORY_URI_PRESENT);
        if (locationUri == null) {
            return;
        }
        validationRun.getValidatedObjects().addAll(validateCertificateAuthority(trustAnchor, registeredRepositories, context, validationResult));
        entityManager.setFlushMode(FlushModeType.AUTO);
        if (isValidationRunCompleted(validationResult)) {
            trustAnchor.markInitialCertificateTreeValidationRunCompleted();
            if (!settings.isInitialValidationRunCompleted() && trustAnchors.allInitialCertificateTreeValidationRunsCompleted()) {
                settings.markInitialValidationRunCompleted();
                log.info("All trust anchors have completed their initial certificate tree validation run, validator is now ready");
            }
        }
        validatedRpkiObjects.update(trustAnchor, validationRun.getValidatedObjects());
    } finally {
        validationRun.completeWith(validationResult);
        log.info("tree validation {} for {}", validationRun.getStatus(), trustAnchor);
    }
}

Example 13 with RpkiRepository

use of net.ripe.rpki.validator3.domain.RpkiRepository in project rpki-validator-3 by RIPE-NCC.

the class RpkiRepositoriesController method list.

@GetMapping
public ResponseEntity<ApiResponse<Stream<RpkiRepositoryResource>>> list(@RequestParam(name = "status", required = false) RpkiRepository.Status status, @RequestParam(name = "ta", required = false) Long taId, @RequestParam(name = "startFrom", defaultValue = "0") int startFrom, @RequestParam(name = "pageSize", defaultValue = "20") int pageSize, @RequestParam(name = "search", defaultValue = "", required = false) String searchString, @RequestParam(name = "sortBy", defaultValue = "location") String sortBy, @RequestParam(name = "sortDirection", defaultValue = "asc") String sortDirection, @RequestParam(name = "hideChildrenOfDownloadedParent", defaultValue = "true") boolean hideChildrenOfDownloadedParent) {
    final SearchTerm searchTerm = StringUtils.isNotBlank(searchString) ? new SearchTerm(searchString) : null;
    final Sorting sorting = Sorting.parse(sortBy, sortDirection);
    final Paging paging = Paging.of(startFrom, pageSize);
    final Stream<RpkiRepository> repositories = rpkiRepositories.findAll(status, taId, hideChildrenOfDownloadedParent, searchTerm, sorting, paging);
    final int totalSize = (int) rpkiRepositories.countAll(status, taId, hideChildrenOfDownloadedParent, searchTerm);
    final Links links = Paging.links(startFrom, pageSize, totalSize, (sf, ps) -> methodOn(RpkiRepositoriesController.class).list(status, taId, sf, ps, searchString, sortBy, sortDirection, hideChildrenOfDownloadedParent));
    final Stream<RpkiRepositoryResource> data = repositories.map(RpkiRepositoryResource::of);
    return ResponseEntity.ok(ApiResponse.<Stream<RpkiRepositoryResource>>builder().data(data).links(links).metadata(Metadata.of(totalSize)).build());
}

Example 14 with RpkiRepository

use of net.ripe.rpki.validator3.domain.RpkiRepository in project rpki-validator-3 by RIPE-NCC.

the class RpkiRepositoryValidationService method findDownloadedParentRepository.

private RpkiRepository findDownloadedParentRepository(Map<URI, RpkiRepository> fetchedLocations, RpkiRepository repository) {
    URI location = URI.create(repository.getRsyncRepositoryUri());
    for (URI parentLocation : RsyncUtils.generateCandidateParentUris(location)) {
        RpkiRepository parentRepository = fetchedLocations.get(parentLocation);
        if (parentRepository != null) {
            repository.setParentRepository(parentRepository);
            if (parentRepository != null && parentRepository.isDownloaded()) {
                log.debug("Already fetched {} as part of {}, skipping", repository.getLocationUri(), location);
                repository.setDownloaded(parentRepository.getLastDownloadedAt());
                return parentRepository;
            }
        }
    }
    return null;
}

Example 15 with RpkiRepository

use of net.ripe.rpki.validator3.domain.RpkiRepository in project rpki-validator-3 by RIPE-NCC.

the class JPARpkiRepositories method removeAllForTrustAnchor.

@Override
public void removeAllForTrustAnchor(TrustAnchor trustAnchor) {
    for (RpkiRepository repository : select().where(rpkiRepository.trustAnchors.contains(trustAnchor)).fetch()) {
        repository.removeTrustAnchor(trustAnchor);
        if (repository.getTrustAnchors().isEmpty()) {
            if (repository.getType() == RpkiRepository.Type.RRDP) {
                quartzValidationScheduler.removeRpkiRepository(repository);
            }
            validationRuns.removeAllForRpkiRepository(repository);
            entityManager.remove(repository);
        }
    }
}