From 0af508633ae6cd7b3847610728ffbc6b7697ce0e Mon Sep 17 00:00:00 2001 From: Jeremy Rand Date: Mon, 15 Sep 2025 02:56:12 +0000 Subject: [PATCH 1/3] (WIP) Add CRL handler TODO: Use actual blockchain data instead of synthetic test data. --- server/server.go | 71 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/server/server.go b/server/server.go index b7559c7..f32f51e 100644 --- a/server/server.go +++ b/server/server.go @@ -57,6 +57,9 @@ type Server struct { tldCertPem []byte tldCertPemString string + crlPriv interface{} + crlIssuer *x509.Certificate + // These caches don't yet support stream isolation; see // https://github.com/namecoin/encaya/issues/8 domainCertCache map[string][]cachedCert @@ -119,6 +122,7 @@ func New(cfg *Config) (*Server, error) { http.HandleFunc("/", srv.indexHandler) http.HandleFunc("/lookup", srv.lookupHandler) http.HandleFunc("/aia", srv.aiaHandler) + http.HandleFunc("/crl", srv.crlHandler) http.HandleFunc("/get-new-negative-ca", srv.getNewNegativeCAHandler) http.HandleFunc("/cross-sign-ca", srv.crossSignCAHandler) http.HandleFunc("/original-from-serial", srv.originalFromSerialHandler) @@ -209,6 +213,30 @@ func (srv *Server) initCerts() { Bytes: srv.tldCert, }) srv.tldCertPemString = string(srv.tldCertPem) + + srv.crlPriv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + if err != nil { + log.Fatale(err, "Unable to generate CRL key") + } + + srv.crlIssuer := &x509.Certificate{ + // TODO: pick a better SerialNumber + SerialNumber: big.NewInt(1), + Subject: pkix.Name{ + // TODO: pick a better CommonName + CommonName: "Encaya CRL Signer", + SerialNumber: "Namecoin TLS Certificate", + }, + NotBefore: time.Now().Add(-1 * safetlsa.ValidityShortTerm()), + NotAfter: time.Now().Add(43800 * time.Hour), + + IsCA: false, + KeyUsage: x509.KeyUsageCRLSign, + BasicConstraintsValid: true, + + // TODO: pick a better SubjectKeyId + SubjectKeyId: []byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31}, + } } func (s *Server) Start() error { @@ -740,6 +768,49 @@ func (s *Server) aiaHandler(writer http.ResponseWriter, req *http.Request) { } } +func (s *Server) crlHandler(writer http.ResponseWriter, req *http.Request) { + writer.Header().Set("Content-Type", "application/pkix-crl") + + commonName := req.FormValue("domain") + + log.Debugf("CRL lookup: %s", commonName) + + startTime := time.Now().Add(-1 * safetlsa.ValidityShortTerm()) + endTime := time.Now().Add(2 * safetlsa.ValidityShortTerm()) + + entries := []x509.RevocationListEntry{} + + // BEGIN DUMMY DATA + entry := x509.RevocationListEntry{ + SerialNumber: big.NewInt(0x7DA660BF9103563747F13C697B3AE90D), + RevocationTime: startTime, + } + // END DUMMY DATA + + entries = append(entries, entry) + + crlTemplate := &x509.RevocationList{ + Issuer: *s.crlIssuer, + RevokedCertificateEntries: entries, + + Number: big.NewInt(startTime.Unix()), + ThisUpdate: startTime, + NextUpdate: endTime, + } + + crlDER, err := x509.CreateRevocationList(rand.Reader, crlTemplate, s.crlIssuer, s.crlPriv) + if err != nil { + log.Debuge(err, "failed to sign CRL") + writer.WriteHeader(http.StatusInternalServerError) + return + } + + _, err = io.WriteString(writer, string(crlDER)) + if err != nil { + log.Debuge(err, "write error") + } +} + func (s *Server) getNewNegativeCAHandler(writer http.ResponseWriter, req *http.Request) { restrictCert, restrictPriv, err := safetlsa.GenerateTLDExclusionCA("bit", s.rootCert, s.rootPriv) if err != nil { From 17cc60a213abbb2a2e9d0afea578bdafa3a0c1d7 Mon Sep 17 00:00:00 2001 From: Jeremy Rand Date: Mon, 13 Oct 2025 03:20:58 +0000 Subject: [PATCH 2/3] FIXUP some build errors --- server/server.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/server/server.go b/server/server.go index f32f51e..1c654ab 100644 --- a/server/server.go +++ b/server/server.go @@ -57,7 +57,7 @@ type Server struct { tldCertPem []byte tldCertPemString string - crlPriv interface{} + crlPriv crypto.Signer crlIssuer *x509.Certificate // These caches don't yet support stream isolation; see @@ -219,7 +219,7 @@ func (srv *Server) initCerts() { log.Fatale(err, "Unable to generate CRL key") } - srv.crlIssuer := &x509.Certificate{ + srv.crlIssuer = &x509.Certificate{ // TODO: pick a better SerialNumber SerialNumber: big.NewInt(1), Subject: pkix.Name{ @@ -781,8 +781,10 @@ func (s *Server) crlHandler(writer http.ResponseWriter, req *http.Request) { entries := []x509.RevocationListEntry{} // BEGIN DUMMY DATA + serial := new(big.Int) + serial.SetString("7DA660BF9103563747F13C697B3AE90D", 16) entry := x509.RevocationListEntry{ - SerialNumber: big.NewInt(0x7DA660BF9103563747F13C697B3AE90D), + SerialNumber: serial, RevocationTime: startTime, } // END DUMMY DATA @@ -790,7 +792,7 @@ func (s *Server) crlHandler(writer http.ResponseWriter, req *http.Request) { entries = append(entries, entry) crlTemplate := &x509.RevocationList{ - Issuer: *s.crlIssuer, + Issuer: *s.crlIssuer.Subject, RevokedCertificateEntries: entries, Number: big.NewInt(startTime.Unix()), From 98cc8bbde5bb8f0dae289ed07666ca5077d3e35d Mon Sep 17 00:00:00 2001 From: Jeremy Rand Date: Mon, 13 Oct 2025 03:29:07 +0000 Subject: [PATCH 3/3] FIXUP more build fails --- server/server.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/server.go b/server/server.go index 1c654ab..44c56a4 100644 --- a/server/server.go +++ b/server/server.go @@ -2,6 +2,7 @@ package server import ( "bytes" + "crypto" "crypto/ecdsa" "crypto/elliptic" "crypto/rand" @@ -792,7 +793,7 @@ func (s *Server) crlHandler(writer http.ResponseWriter, req *http.Request) { entries = append(entries, entry) crlTemplate := &x509.RevocationList{ - Issuer: *s.crlIssuer.Subject, + Issuer: s.crlIssuer.Subject, RevokedCertificateEntries: entries, Number: big.NewInt(startTime.Unix()),