NASP/rpki
75
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260716 澄清CA验证上下文摘要命名

Browse Source
This commit is contained in:
yuyr 2026-07-16 22:54:59 +08:00
parent 59623b449b
commit 4865d3698d
6 changed files with 79 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/storage.rs
View File

@ -603,7 +603,7 @@ pub struct VcirFailedFetchReuseIdentity {
pub ta_context_digest: [u8; 32], pub ta_context_digest: [u8; 32],
#[serde(rename = "p")] #[serde(rename = "p")]
#[serde(with = "serde_bytes_32")] #[serde(with = "serde_bytes_32")]
pub parent_context_digest: [u8; 32], pub ca_validation_context_digest: [u8; 32],
#[serde(rename = "f")] #[serde(rename = "f")]
#[serde(with = "serde_bytes_32")] #[serde(with = "serde_bytes_32")]
pub policy_fingerprint: [u8; 32], pub policy_fingerprint: [u8; 32],
@ -1125,7 +1125,7 @@ pub struct RoaCacheObjectMeta {
#[derive(Clone, Debug, PartialEq, Eq)] #[derive(Clone, Debug, PartialEq, Eq)]
pub struct RoaCacheProjectionContext { pub struct RoaCacheProjectionContext {
pub parent_context_digest: [u8; 32], pub ca_validation_context_digest: [u8; 32],
pub policy_fingerprint: [u8; 32], pub policy_fingerprint: [u8; 32],
pub object_meta: Vec<RoaCacheObjectMeta>, pub object_meta: Vec<RoaCacheObjectMeta>,
} }
@ -1266,7 +1266,7 @@ pub struct RoaCacheProjection {
pub issuer_ca_sha256_hex: Option<String>, pub issuer_ca_sha256_hex: Option<String>,
#[serde(rename = "p", default, skip_serializing_if = "Option::is_none")] #[serde(rename = "p", default, skip_serializing_if = "Option::is_none")]
#[serde(with = "serde_optional_bytes_32")] #[serde(with = "serde_optional_bytes_32")]
pub parent_context_digest: Option<[u8; 32]>, pub ca_validation_context_digest: Option<[u8; 32]>,
#[serde(rename = "f", default, skip_serializing_if = "Option::is_none")] #[serde(rename = "f", default, skip_serializing_if = "Option::is_none")]
#[serde(with = "serde_optional_bytes_32")] #[serde(with = "serde_optional_bytes_32")]
pub policy_fingerprint: Option<[u8; 32]>, pub policy_fingerprint: Option<[u8; 32]>,
@ -1408,7 +1408,7 @@ pub struct ChildCertificateCacheProjection {
pub issuer_crl_sha256_hex: String, pub issuer_crl_sha256_hex: String,
#[serde(rename = "pc")] #[serde(rename = "pc")]
#[serde(with = "serde_bytes_32")] #[serde(with = "serde_bytes_32")]
pub parent_context_digest: [u8; 32], pub ca_validation_context_digest: [u8; 32],
#[serde(rename = "pf")] #[serde(rename = "pf")]
#[serde(with = "serde_bytes_32")] #[serde(with = "serde_bytes_32")]
pub validation_policy_fingerprint: [u8; 32], pub validation_policy_fingerprint: [u8; 32],
@ -1715,7 +1715,7 @@ pub struct PublicationPointCacheProjection {
pub ta_context_digest: [u8; 32], pub ta_context_digest: [u8; 32],
#[serde(rename = "pc")] #[serde(rename = "pc")]
#[serde(with = "serde_bytes_32")] #[serde(with = "serde_bytes_32")]
pub parent_context_digest: [u8; 32], pub ca_validation_context_digest: [u8; 32],
#[serde(rename = "pf")] #[serde(rename = "pf")]
#[serde(with = "serde_bytes_32")] #[serde(with = "serde_bytes_32")]
pub validation_policy_fingerprint: [u8; 32], pub validation_policy_fingerprint: [u8; 32],
@ -1751,7 +1751,7 @@ impl PublicationPointCacheProjection {
ca_cert_sha256: [u8; 32], ca_cert_sha256: [u8; 32],
manifest_sha256: [u8; 32], manifest_sha256: [u8; 32],
ta_context_digest: [u8; 32], ta_context_digest: [u8; 32],
parent_context_digest: [u8; 32], ca_validation_context_digest: [u8; 32],
validation_policy_fingerprint: [u8; 32], validation_policy_fingerprint: [u8; 32],
) -> StorageResult<Self> { ) -> StorageResult<Self> {
let projection = Self { let projection = Self {
@ -1764,7 +1764,7 @@ impl PublicationPointCacheProjection {
manifest_sha256, manifest_sha256,
tal_id: vcir.tal_id.clone(), tal_id: vcir.tal_id.clone(),
ta_context_digest, ta_context_digest,
parent_context_digest, ca_validation_context_digest,
validation_policy_fingerprint, validation_policy_fingerprint,
instance_effective_not_before: vcir.last_successful_validation_time.clone(), instance_effective_not_before: vcir.last_successful_validation_time.clone(),
instance_effective_until: vcir.instance_gate.instance_effective_until.clone(), instance_effective_until: vcir.instance_gate.instance_effective_until.clone(),
@ -1819,7 +1819,7 @@ impl PublicationPointCacheProjection {
tal_id: self.tal_id.clone(), tal_id: self.tal_id.clone(),
ca_subject_name: String::from("publication-point-cache"), ca_subject_name: String::from("publication-point-cache"),
ca_ski: hex::encode(self.ca_cert_sha256), ca_ski: hex::encode(self.ca_cert_sha256),
issuer_ski: hex::encode(self.parent_context_digest), issuer_ski: hex::encode(self.ca_validation_context_digest),
last_successful_validation_time: validation_time.clone(), last_successful_validation_time: validation_time.clone(),
current_manifest_rsync_uri: self.manifest_rsync_uri.clone(), current_manifest_rsync_uri: self.manifest_rsync_uri.clone(),
current_crl_rsync_uri: self current_crl_rsync_uri: self
@ -2050,7 +2050,7 @@ impl RoaCacheProjection {
manifest_rsync_uri: vcir.manifest_rsync_uri.clone(), manifest_rsync_uri: vcir.manifest_rsync_uri.clone(),
instance_effective_until: vcir.instance_gate.instance_effective_until.clone(), instance_effective_until: vcir.instance_gate.instance_effective_until.clone(),
issuer_ca_sha256_hex, issuer_ca_sha256_hex,
parent_context_digest: Some(context.parent_context_digest), ca_validation_context_digest: Some(context.ca_validation_context_digest),
policy_fingerprint: Some(context.policy_fingerprint), policy_fingerprint: Some(context.policy_fingerprint),
crl_sha256_by_uri, crl_sha256_by_uri,
entries, entries,
@ -2071,10 +2071,10 @@ impl RoaCacheProjection {
if let Some(hash) = &self.issuer_ca_sha256_hex { if let Some(hash) = &self.issuer_ca_sha256_hex {
validate_sha256_hex("roa_cache_projection.issuer_ca_sha256_hex", hash)?; validate_sha256_hex("roa_cache_projection.issuer_ca_sha256_hex", hash)?;
} }
if self.parent_context_digest.is_some() != self.policy_fingerprint.is_some() { if self.ca_validation_context_digest.is_some() != self.policy_fingerprint.is_some() {
return Err(StorageError::InvalidData { return Err(StorageError::InvalidData {
entity: "roa_cache_projection.context", entity: "roa_cache_projection.context",
detail: "parent_context_digest and policy_fingerprint must be both present or both absent" detail: "ca_validation_context_digest and policy_fingerprint must be both present or both absent"
.to_string(), .to_string(),
}); });
} }

4
src/storage/tests.rs
View File

@ -29,7 +29,7 @@ fn sample_child_certificate_cache_projection(
issuer_ca_sha256_hex: sha256_hex(b"issuer-ca"), issuer_ca_sha256_hex: sha256_hex(b"issuer-ca"),
issuer_crl_uri: "rsync://example.test/repo/issuer.crl".to_string(), issuer_crl_uri: "rsync://example.test/repo/issuer.crl".to_string(),
issuer_crl_sha256_hex: sha256_hex(b"issuer-crl"), issuer_crl_sha256_hex: sha256_hex(b"issuer-crl"),
parent_context_digest: sha256_32(b"parent-context"), ca_validation_context_digest: sha256_32(b"parent-context"),
validation_policy_fingerprint: sha256_32(b"policy"), validation_policy_fingerprint: sha256_32(b"policy"),
effective_not_before: pack_time(0), effective_not_before: pack_time(0),
effective_until: pack_time(24), effective_until: pack_time(24),
@ -294,7 +294,7 @@ fn roa_cache_projection_context(vcir: &ValidatedCaInstanceResult) -> RoaCachePro
}) })
.expect("sample VCIR has a ROA output"); .expect("sample VCIR has a ROA output");
RoaCacheProjectionContext { RoaCacheProjectionContext {
parent_context_digest: [0x31; 32], ca_validation_context_digest: [0x31; 32],
policy_fingerprint: [0x32; 32], policy_fingerprint: [0x32; 32],
object_meta: vec![RoaCacheObjectMeta { object_meta: vec![RoaCacheObjectMeta {
source_object_uri: roa_output.source_object_uri.clone(), source_object_uri: roa_output.source_object_uri.clone(),

65
src/validation/objects.rs
View File

@ -180,7 +180,7 @@ pub struct RoaValidationCacheStats {
pub struct RoaValidationCacheInput<'a> { pub struct RoaValidationCacheInput<'a> {
enabled: bool, enabled: bool,
view: Option<&'a RoaValidationCacheView>, view: Option<&'a RoaValidationCacheView>,
parent_context_digest: Option<[u8; 32]>, ca_validation_context_digest: Option<[u8; 32]>,
policy_fingerprint: Option<[u8; 32]>, policy_fingerprint: Option<[u8; 32]>,
} }
@ -189,7 +189,7 @@ impl<'a> RoaValidationCacheInput<'a> {
Self { Self {
enabled: false, enabled: false,
view: None, view: None,
parent_context_digest: None, ca_validation_context_digest: None,
policy_fingerprint: None, policy_fingerprint: None,
} }
} }
@ -198,20 +198,20 @@ impl<'a> RoaValidationCacheInput<'a> {
Self { Self {
enabled: true, enabled: true,
view, view,
parent_context_digest: None, ca_validation_context_digest: None,
policy_fingerprint: None, policy_fingerprint: None,
} }
} }
pub fn enabled_with_context( pub fn enabled_with_context(
view: Option<&'a RoaValidationCacheView>, view: Option<&'a RoaValidationCacheView>,
parent_context_digest: [u8; 32], ca_validation_context_digest: [u8; 32],
policy_fingerprint: [u8; 32], policy_fingerprint: [u8; 32],
) -> Self { ) -> Self {
Self { Self {
enabled: true, enabled: true,
view, view,
parent_context_digest: Some(parent_context_digest), ca_validation_context_digest: Some(ca_validation_context_digest),
policy_fingerprint: Some(policy_fingerprint), policy_fingerprint: Some(policy_fingerprint),
} }
} }
@ -495,7 +495,7 @@ fn evaluate_roa_cache_crl_gate(
pub struct RoaValidationCacheView { pub struct RoaValidationCacheView {
entries_by_uri: HashMap<String, CachedRoaValidationResult>, entries_by_uri: HashMap<String, CachedRoaValidationResult>,
issuer_ca_sha256_hex: Option<String>, issuer_ca_sha256_hex: Option<String>,
parent_context_digest: Option<[u8; 32]>, ca_validation_context_digest: Option<[u8; 32]>,
policy_fingerprint: Option<[u8; 32]>, policy_fingerprint: Option<[u8; 32]>,
crl_sha256_by_uri: HashMap<String, String>, crl_sha256_by_uri: HashMap<String, String>,
blocked: bool, blocked: bool,
@ -519,7 +519,7 @@ impl RoaValidationCacheView {
let mut entries_by_uri: HashMap<String, CachedRoaValidationResult> = let mut entries_by_uri: HashMap<String, CachedRoaValidationResult> =
HashMap::with_capacity(projection.entries.len()); HashMap::with_capacity(projection.entries.len());
let issuer_ca_sha256_hex = projection.issuer_ca_sha256_hex.clone(); let issuer_ca_sha256_hex = projection.issuer_ca_sha256_hex.clone();
let parent_context_digest = projection.parent_context_digest; let ca_validation_context_digest = projection.ca_validation_context_digest;
let policy_fingerprint = projection.policy_fingerprint; let policy_fingerprint = projection.policy_fingerprint;
let crl_sha256_by_uri = projection let crl_sha256_by_uri = projection
.crl_sha256_by_uri .crl_sha256_by_uri
@ -536,7 +536,7 @@ impl RoaValidationCacheView {
return Self { return Self {
entries_by_uri, entries_by_uri,
issuer_ca_sha256_hex, issuer_ca_sha256_hex,
parent_context_digest, ca_validation_context_digest,
policy_fingerprint, policy_fingerprint,
crl_sha256_by_uri, crl_sha256_by_uri,
blocked, blocked,
@ -580,7 +580,7 @@ impl RoaValidationCacheView {
Self { Self {
entries_by_uri, entries_by_uri,
issuer_ca_sha256_hex, issuer_ca_sha256_hex,
parent_context_digest, ca_validation_context_digest,
policy_fingerprint, policy_fingerprint,
crl_sha256_by_uri, crl_sha256_by_uri,
blocked, blocked,
@ -590,7 +590,7 @@ impl RoaValidationCacheView {
fn matches_current_context( fn matches_current_context(
&self, &self,
issuer_ca_der: &[u8], issuer_ca_der: &[u8],
parent_context_digest: Option<[u8; 32]>, ca_validation_context_digest: Option<[u8; 32]>,
policy_fingerprint: Option<[u8; 32]>, policy_fingerprint: Option<[u8; 32]>,
) -> bool { ) -> bool {
if self.blocked { if self.blocked {
@ -604,8 +604,8 @@ impl RoaValidationCacheView {
return false; return false;
} }
if let Some(expected_parent_context) = self.parent_context_digest { if let Some(expected_ca_validation_context) = self.ca_validation_context_digest {
if Some(expected_parent_context) != parent_context_digest { if Some(expected_ca_validation_context) != ca_validation_context_digest {
return false; return false;
} }
} else { } else {
@ -797,7 +797,7 @@ fn active_roa_cache_view<'a>(
let gate_started = Instant::now(); let gate_started = Instant::now();
if view.matches_current_context( if view.matches_current_context(
issuer_ca_der, issuer_ca_der,
roa_cache.parent_context_digest, roa_cache.ca_validation_context_digest,
roa_cache.policy_fingerprint, roa_cache.policy_fingerprint,
) { ) {
stats.context_gate_nanos = stats stats.context_gate_nanos = stats
@ -3914,7 +3914,7 @@ mod tests {
OffsetDateTime::parse(value, &Rfc3339).expect("parse fixed test time") OffsetDateTime::parse(value, &Rfc3339).expect("parse fixed test time")
} }
const TEST_PARENT_CONTEXT: [u8; 32] = [0x70; 32]; const TEST_CA_VALIDATION_CONTEXT: [u8; 32] = [0x70; 32];
const TEST_POLICY_FINGERPRINT: [u8; 32] = [0x71; 32]; const TEST_POLICY_FINGERPRINT: [u8; 32] = [0x71; 32];
const TEST_CRL_URI: &str = "rsync://example.test/repo/current.crl"; const TEST_CRL_URI: &str = "rsync://example.test/repo/current.crl";
const TEST_ROA_URI: &str = "rsync://example.test/repo/a.roa"; const TEST_ROA_URI: &str = "rsync://example.test/repo/a.roa";
@ -3933,7 +3933,7 @@ mod tests {
RoaCacheProjection::from_vcir_with_context( RoaCacheProjection::from_vcir_with_context(
vcir, vcir,
Some(&RoaCacheProjectionContext { Some(&RoaCacheProjectionContext {
parent_context_digest: TEST_PARENT_CONTEXT, ca_validation_context_digest: TEST_CA_VALIDATION_CONTEXT,
policy_fingerprint: TEST_POLICY_FINGERPRINT, policy_fingerprint: TEST_POLICY_FINGERPRINT,
object_meta: vec![RoaCacheObjectMeta { object_meta: vec![RoaCacheObjectMeta {
source_object_uri: TEST_ROA_URI.to_string(), source_object_uri: TEST_ROA_URI.to_string(),
@ -4071,7 +4071,7 @@ mod tests {
assert!(view.matches_current_context( assert!(view.matches_current_context(
issuer_der, issuer_der,
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
let hit = view.lookup(&file, &mut crl_cache, issuer_der, validation_time); let hit = view.lookup(&file, &mut crl_cache, issuer_der, validation_time);
@ -4202,7 +4202,10 @@ mod tests {
fixed_time("2026-06-08T00:00:00Z"), fixed_time("2026-06-08T00:00:00Z"),
); );
let projection = sample_roa_cache_projection(&vcir, roa_hash); let projection = sample_roa_cache_projection(&vcir, roa_hash);
assert_eq!(projection.parent_context_digest, Some(TEST_PARENT_CONTEXT)); assert_eq!(
projection.ca_validation_context_digest,
Some(TEST_CA_VALIDATION_CONTEXT)
);
assert_eq!(projection.policy_fingerprint, Some(TEST_POLICY_FINGERPRINT)); assert_eq!(projection.policy_fingerprint, Some(TEST_POLICY_FINGERPRINT));
assert_eq!( assert_eq!(
projection.entries[0].outputs_effective_until_unix, projection.entries[0].outputs_effective_until_unix,
@ -4245,7 +4248,7 @@ mod tests {
let issuer_changed = RoaValidationCacheView::from_projection(&projection, validation_time); let issuer_changed = RoaValidationCacheView::from_projection(&projection, validation_time);
assert!(!issuer_changed.matches_current_context( assert!(!issuer_changed.matches_current_context(
issuer_der, issuer_der,
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
@ -4258,7 +4261,7 @@ mod tests {
)); ));
assert!(!parent_changed.matches_current_context( assert!(!parent_changed.matches_current_context(
issuer_der, issuer_der,
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some([0x98; 32]) Some([0x98; 32])
)); ));
@ -4283,7 +4286,7 @@ mod tests {
RoaValidationCacheView::from_projection(&expired_projection, validation_time); RoaValidationCacheView::from_projection(&expired_projection, validation_time);
assert!(!expired_view.matches_current_context( assert!(!expired_view.matches_current_context(
issuer_der, issuer_der,
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
let mut crl_cache = sample_crl_cache(b"current-crl".to_vec()); let mut crl_cache = sample_crl_cache(b"current-crl".to_vec());
@ -4563,7 +4566,7 @@ mod tests {
assert!(view.matches_current_context( assert!(view.matches_current_context(
issuer_der, issuer_der,
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
assert!(matches!( assert!(matches!(
@ -4595,43 +4598,43 @@ mod tests {
let mut view = RoaValidationCacheView { let mut view = RoaValidationCacheView {
entries_by_uri: HashMap::new(), entries_by_uri: HashMap::new(),
issuer_ca_sha256_hex: None, issuer_ca_sha256_hex: None,
parent_context_digest: Some(TEST_PARENT_CONTEXT), ca_validation_context_digest: Some(TEST_CA_VALIDATION_CONTEXT),
policy_fingerprint: Some(TEST_POLICY_FINGERPRINT), policy_fingerprint: Some(TEST_POLICY_FINGERPRINT),
crl_sha256_by_uri: HashMap::new(), crl_sha256_by_uri: HashMap::new(),
blocked: false, blocked: false,
}; };
assert!(!view.matches_current_context( assert!(!view.matches_current_context(
b"issuer-ca", b"issuer-ca",
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
view.issuer_ca_sha256_hex = Some("00".repeat(32)); view.issuer_ca_sha256_hex = Some("00".repeat(32));
assert!(!view.matches_current_context( assert!(!view.matches_current_context(
b"issuer-ca", b"issuer-ca",
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
view.issuer_ca_sha256_hex = Some(sha256_hex(b"issuer-ca")); view.issuer_ca_sha256_hex = Some(sha256_hex(b"issuer-ca"));
assert!(view.matches_current_context( assert!(view.matches_current_context(
b"issuer-ca", b"issuer-ca",
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
assert!(!view.matches_current_context(b"issuer-ca", None, Some(TEST_POLICY_FINGERPRINT))); assert!(!view.matches_current_context(b"issuer-ca", None, Some(TEST_POLICY_FINGERPRINT)));
view.parent_context_digest = None; view.ca_validation_context_digest = None;
assert!(!view.matches_current_context( assert!(!view.matches_current_context(
b"issuer-ca", b"issuer-ca",
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
view.parent_context_digest = Some(TEST_PARENT_CONTEXT); view.ca_validation_context_digest = Some(TEST_CA_VALIDATION_CONTEXT);
view.policy_fingerprint = None; view.policy_fingerprint = None;
assert!(!view.matches_current_context( assert!(!view.matches_current_context(
b"issuer-ca", b"issuer-ca",
Some(TEST_PARENT_CONTEXT), Some(TEST_CA_VALIDATION_CONTEXT),
Some(TEST_POLICY_FINGERPRINT) Some(TEST_POLICY_FINGERPRINT)
)); ));
} }
@ -4661,7 +4664,7 @@ mod tests {
let mut view = RoaValidationCacheView { let mut view = RoaValidationCacheView {
entries_by_uri: HashMap::new(), entries_by_uri: HashMap::new(),
issuer_ca_sha256_hex: Some(sha256_hex(issuer_der)), issuer_ca_sha256_hex: Some(sha256_hex(issuer_der)),
parent_context_digest: Some(TEST_PARENT_CONTEXT), ca_validation_context_digest: Some(TEST_CA_VALIDATION_CONTEXT),
policy_fingerprint: Some(TEST_POLICY_FINGERPRINT), policy_fingerprint: Some(TEST_POLICY_FINGERPRINT),
crl_sha256_by_uri: HashMap::from([(TEST_CRL_URI.to_string(), crl_hash_hex.clone())]), crl_sha256_by_uri: HashMap::from([(TEST_CRL_URI.to_string(), crl_hash_hex.clone())]),
blocked: false, blocked: false,
@ -4849,7 +4852,7 @@ mod tests {
false, false,
RoaValidationCacheInput::enabled_with_context( RoaValidationCacheInput::enabled_with_context(
Some(&view), Some(&view),
TEST_PARENT_CONTEXT, TEST_CA_VALIDATION_CONTEXT,
TEST_POLICY_FINGERPRINT, TEST_POLICY_FINGERPRINT,
), ),
) { ) {

2
src/validation/tree_parallel.rs
View File

@ -1178,7 +1178,7 @@ fn stage_ready_publication_point(
let roa_cache = if runner.enable_roa_validation_cache && has_roa { let roa_cache = if runner.enable_roa_validation_cache && has_roa {
RoaValidationCacheInput::enabled_with_context( RoaValidationCacheInput::enabled_with_context(
roa_cache_view.as_ref(), roa_cache_view.as_ref(),
crate::validation::tree_runner::parent_context_digest_for_ca(&ready.node.handle), crate::validation::tree_runner::ca_validation_context_digest_for_ca(&ready.node.handle),
crate::validation::tree_runner::publication_point_cache_policy_fingerprint( crate::validation::tree_runner::publication_point_cache_policy_fingerprint(
runner.policy, runner.policy,
), ),

42
src/validation/tree_runner.rs
View File

@ -304,7 +304,8 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
self.finish_publication_point_cache_miss(ca, "ta_context_mismatch", lookup_started); self.finish_publication_point_cache_miss(ca, "ta_context_mismatch", lookup_started);
return None; return None;
} }
if projection.parent_context_digest != current_identity.parent_context_digest { if projection.ca_validation_context_digest != current_identity.ca_validation_context_digest
{
self.finish_publication_point_cache_miss(ca, "parent_context_mismatch", lookup_started); self.finish_publication_point_cache_miss(ca, "parent_context_mismatch", lookup_started);
return None; return None;
} }
@ -505,7 +506,7 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
ca_cert_sha256, ca_cert_sha256,
manifest_sha256, manifest_sha256,
ta_context_digest: ta_context_digest_for_ca(ca), ta_context_digest: ta_context_digest_for_ca(ca),
parent_context_digest: parent_context_digest_for_ca(ca), ca_validation_context_digest: ca_validation_context_digest_for_ca(ca),
policy_fingerprint: publication_point_cache_policy_fingerprint(self.policy), policy_fingerprint: publication_point_cache_policy_fingerprint(self.policy),
}) })
} }
@ -938,7 +939,7 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
Some(ChildCertificateValidationCacheContext { Some(ChildCertificateValidationCacheContext {
store: self.store, store: self.store,
issuer_ca_sha256: sha256_digest_32(issuer_ca_der.as_ref()), issuer_ca_sha256: sha256_digest_32(issuer_ca_der.as_ref()),
parent_context_digest: parent_context_digest_for_ca(ca), ca_validation_context_digest: ca_validation_context_digest_for_ca(ca),
policy_fingerprint: publication_point_cache_policy_fingerprint(self.policy), policy_fingerprint: publication_point_cache_policy_fingerprint(self.policy),
}) })
} else { } else {
@ -1530,7 +1531,7 @@ impl<'a> PublicationPointRunner for Rpkiv1PublicationPointRunner<'a> {
let roa_cache = if self.enable_roa_validation_cache && has_roa { let roa_cache = if self.enable_roa_validation_cache && has_roa {
RoaValidationCacheInput::enabled_with_context( RoaValidationCacheInput::enabled_with_context(
roa_cache_view.as_ref(), roa_cache_view.as_ref(),
parent_context_digest_for_ca(ca), ca_validation_context_digest_for_ca(ca),
publication_point_cache_policy_fingerprint(self.policy), publication_point_cache_policy_fingerprint(self.policy),
) )
} else { } else {
@ -1946,7 +1947,7 @@ struct PublicationPointCacheIdentity {
ca_cert_sha256: [u8; 32], ca_cert_sha256: [u8; 32],
manifest_sha256: [u8; 32], manifest_sha256: [u8; 32],
ta_context_digest: [u8; 32], ta_context_digest: [u8; 32],
parent_context_digest: [u8; 32], ca_validation_context_digest: [u8; 32],
policy_fingerprint: [u8; 32], policy_fingerprint: [u8; 32],
} }
@ -1982,7 +1983,7 @@ fn ta_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] {
]) ])
} }
pub(crate) fn parent_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] { pub(crate) fn ca_validation_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] {
hash_serialized_parts(&[ hash_serialized_parts(&[
( (
"version", "version",
@ -2058,7 +2059,7 @@ fn pack_time_window_contains(
struct ChildCertificateValidationCacheContext<'a> { struct ChildCertificateValidationCacheContext<'a> {
store: &'a RocksStore, store: &'a RocksStore,
issuer_ca_sha256: [u8; 32], issuer_ca_sha256: [u8; 32],
parent_context_digest: [u8; 32], ca_validation_context_digest: [u8; 32],
policy_fingerprint: [u8; 32], policy_fingerprint: [u8; 32],
} }
@ -2066,7 +2067,7 @@ fn child_certificate_cache_key_sha256_hex(
child_cert_uri: &str, child_cert_uri: &str,
child_cert_sha256: &[u8; 32], child_cert_sha256: &[u8; 32],
issuer_ca_sha256: &[u8; 32], issuer_ca_sha256: &[u8; 32],
parent_context_digest: &[u8; 32], ca_validation_context_digest: &[u8; 32],
policy_fingerprint: &[u8; 32], policy_fingerprint: &[u8; 32],
) -> String { ) -> String {
let digest = hash_serialized_parts(&[ let digest = hash_serialized_parts(&[
@ -2074,7 +2075,11 @@ fn child_certificate_cache_key_sha256_hex(
("child_cert_uri", child_cert_uri.as_bytes().to_vec()), ("child_cert_uri", child_cert_uri.as_bytes().to_vec()),
("child_cert_sha256", child_cert_sha256.to_vec()), ("child_cert_sha256", child_cert_sha256.to_vec()),
("issuer_ca_sha256", issuer_ca_sha256.to_vec()), ("issuer_ca_sha256", issuer_ca_sha256.to_vec()),
("parent_context_digest", parent_context_digest.to_vec()), // Keep the persisted cache-key label stable; this change only renames Rust identifiers.
(
"parent_context_digest",
ca_validation_context_digest.to_vec(),
),
("policy_fingerprint", policy_fingerprint.to_vec()), ("policy_fingerprint", policy_fingerprint.to_vec()),
]); ]);
sha256_hex_from_32(&digest) sha256_hex_from_32(&digest)
@ -2469,7 +2474,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der<
&f.rsync_uri, &f.rsync_uri,
&f.sha256, &f.sha256,
&cache.issuer_ca_sha256, &cache.issuer_ca_sha256,
&cache.parent_context_digest, &cache.ca_validation_context_digest,
&cache.policy_fingerprint, &cache.policy_fingerprint,
)); ));
} }
@ -3022,7 +3027,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der<
&f.rsync_uri, &f.rsync_uri,
&f.sha256, &f.sha256,
&cache.issuer_ca_sha256, &cache.issuer_ca_sha256,
&cache.parent_context_digest, &cache.ca_validation_context_digest,
&cache.policy_fingerprint, &cache.policy_fingerprint,
); );
let projection = ChildCertificateCacheProjection { let projection = ChildCertificateCacheProjection {
@ -3040,7 +3045,8 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der<
), ),
issuer_crl_uri: issuer_crl_uri.clone(), issuer_crl_uri: issuer_crl_uri.clone(),
issuer_crl_sha256_hex: verified_crl.sha256_hex.clone(), issuer_crl_sha256_hex: verified_crl.sha256_hex.clone(),
parent_context_digest: cache.parent_context_digest, ca_validation_context_digest: cache
.ca_validation_context_digest,
validation_policy_fingerprint: cache.policy_fingerprint, validation_policy_fingerprint: cache.policy_fingerprint,
effective_not_before, effective_not_before,
effective_until, effective_until,
@ -3239,7 +3245,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der<
&f.rsync_uri, &f.rsync_uri,
&f.sha256, &f.sha256,
&cache.issuer_ca_sha256, &cache.issuer_ca_sha256,
&cache.parent_context_digest, &cache.ca_validation_context_digest,
&cache.policy_fingerprint, &cache.policy_fingerprint,
); );
let projection = ChildCertificateCacheProjection { let projection = ChildCertificateCacheProjection {
@ -3255,7 +3261,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der<
issuer_ca_sha256_hex: sha256_hex_from_32(&cache.issuer_ca_sha256), issuer_ca_sha256_hex: sha256_hex_from_32(&cache.issuer_ca_sha256),
issuer_crl_uri: issuer_crl_uri.clone(), issuer_crl_uri: issuer_crl_uri.clone(),
issuer_crl_sha256_hex: verified_crl.sha256_hex.clone(), issuer_crl_sha256_hex: verified_crl.sha256_hex.clone(),
parent_context_digest: cache.parent_context_digest, ca_validation_context_digest: cache.ca_validation_context_digest,
validation_policy_fingerprint: cache.policy_fingerprint, validation_policy_fingerprint: cache.policy_fingerprint,
effective_not_before, effective_not_before,
effective_until, effective_until,
@ -4395,7 +4401,7 @@ fn failed_fetch_reuse_identity_for_fresh_result(
let identity = VcirFailedFetchReuseIdentity { let identity = VcirFailedFetchReuseIdentity {
current_ca_sha256, current_ca_sha256,
ta_context_digest: ta_context_digest_for_ca(ca), ta_context_digest: ta_context_digest_for_ca(ca),
parent_context_digest: parent_context_digest_for_ca(ca), ca_validation_context_digest: ca_validation_context_digest_for_ca(ca),
policy_fingerprint: publication_point_cache_policy_fingerprint(policy), policy_fingerprint: publication_point_cache_policy_fingerprint(policy),
effective_not_before: PackTime::from_utc_offset_datetime(validation_time), effective_not_before: PackTime::from_utc_offset_datetime(validation_time),
effective_until, effective_until,
@ -4418,7 +4424,7 @@ fn failed_fetch_reuse_identity_matches_current(
}; };
cached.current_ca_sha256 == current_ca_sha256 cached.current_ca_sha256 == current_ca_sha256
&& cached.ta_context_digest == ta_context_digest_for_ca(ca) && cached.ta_context_digest == ta_context_digest_for_ca(ca)
&& cached.parent_context_digest == parent_context_digest_for_ca(ca) && cached.ca_validation_context_digest == ca_validation_context_digest_for_ca(ca)
&& cached.policy_fingerprint == publication_point_cache_policy_fingerprint(policy) && cached.policy_fingerprint == publication_point_cache_policy_fingerprint(policy)
&& cached.effective_until == vcir.instance_gate.instance_effective_until && cached.effective_until == vcir.instance_gate.instance_effective_until
&& cached.contains_validation_time(validation_time) && cached.contains_validation_time(validation_time)
@ -5347,7 +5353,7 @@ fn persist_vcir_for_fresh_result_with_timing(
.replace_vcir_manifest_replay_meta_and_projection_action_with_failed_fetch_reuse_identity( .replace_vcir_manifest_replay_meta_and_projection_action_with_failed_fetch_reuse_identity(
&vcir, &vcir,
Some(&RoaCacheProjectionContext { Some(&RoaCacheProjectionContext {
parent_context_digest: parent_context_digest_for_ca(ca), ca_validation_context_digest: ca_validation_context_digest_for_ca(ca),
policy_fingerprint: publication_point_cache_policy_fingerprint(policy), policy_fingerprint: publication_point_cache_policy_fingerprint(policy),
object_meta: objects.roa_cache_object_meta.clone(), object_meta: objects.roa_cache_object_meta.clone(),
}), }),
@ -5378,7 +5384,7 @@ fn build_publication_point_cache_projection_from_fresh(
ca_cert_sha256, ca_cert_sha256,
manifest_sha256, manifest_sha256,
ta_context_digest_for_ca(ca), ta_context_digest_for_ca(ca),
parent_context_digest_for_ca(ca), ca_validation_context_digest_for_ca(ca),
publication_point_cache_policy_fingerprint(policy), publication_point_cache_policy_fingerprint(policy),
) )
.map_err(|e| e.to_string()) .map_err(|e| e.to_string())

14
src/validation/tree_runner/tests.rs
View File

@ -1601,7 +1601,7 @@ fn discover_children_child_certificate_cache_reuses_successful_child_ca() {
let cache_context = ChildCertificateValidationCacheContext { let cache_context = ChildCertificateValidationCacheContext {
store: &store, store: &store,
issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(),
parent_context_digest: parent_context_digest_for_ca(&issuer), ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer),
policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy),
}; };
let validation_time = time::OffsetDateTime::now_utc(); let validation_time = time::OffsetDateTime::now_utc();
@ -1625,7 +1625,7 @@ fn discover_children_child_certificate_cache_reuses_successful_child_ca() {
&child_file.rsync_uri, &child_file.rsync_uri,
&child_file.sha256, &child_file.sha256,
&cache_context.issuer_ca_sha256, &cache_context.issuer_ca_sha256,
&cache_context.parent_context_digest, &cache_context.ca_validation_context_digest,
&cache_context.policy_fingerprint, &cache_context.policy_fingerprint,
); );
assert!( assert!(
@ -1724,7 +1724,7 @@ fn discover_children_child_certificate_cache_rechecks_changed_valid_crl() {
let cache_context = ChildCertificateValidationCacheContext { let cache_context = ChildCertificateValidationCacheContext {
store: &store, store: &store,
issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(),
parent_context_digest: parent_context_digest_for_ca(&issuer), ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer),
policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy),
}; };
let validation_time = time::OffsetDateTime::now_utc(); let validation_time = time::OffsetDateTime::now_utc();
@ -1745,7 +1745,7 @@ fn discover_children_child_certificate_cache_rechecks_changed_valid_crl() {
&child_file.rsync_uri, &child_file.rsync_uri,
&child_file.sha256, &child_file.sha256,
&cache_context.issuer_ca_sha256, &cache_context.issuer_ca_sha256,
&cache_context.parent_context_digest, &cache_context.ca_validation_context_digest,
&cache_context.policy_fingerprint, &cache_context.policy_fingerprint,
); );
let projection = store let projection = store
@ -1832,7 +1832,7 @@ fn discover_children_child_certificate_cache_misses_when_current_crl_invalid() {
let cache_context = ChildCertificateValidationCacheContext { let cache_context = ChildCertificateValidationCacheContext {
store: &store, store: &store,
issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(),
parent_context_digest: parent_context_digest_for_ca(&issuer), ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer),
policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy),
}; };
let validation_time = time::OffsetDateTime::now_utc(); let validation_time = time::OffsetDateTime::now_utc();
@ -1907,7 +1907,7 @@ fn discover_children_child_certificate_cache_misses_when_unchanged_crl_expired()
let cache_context = ChildCertificateValidationCacheContext { let cache_context = ChildCertificateValidationCacheContext {
store: &store, store: &store,
issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(),
parent_context_digest: parent_context_digest_for_ca(&issuer), ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer),
policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy),
}; };
let validation_time = time::OffsetDateTime::now_utc(); let validation_time = time::OffsetDateTime::now_utc();
@ -2436,7 +2436,7 @@ fn seed_publication_point_cache_projection(
ca.ca_certificate_sha256_32().unwrap(), ca.ca_certificate_sha256_32().unwrap(),
sha256_32(b"manifest-bytes"), sha256_32(b"manifest-bytes"),
ta_context_digest_for_ca(ca), ta_context_digest_for_ca(ca),
parent_context_digest_for_ca(ca), ca_validation_context_digest_for_ca(ca),
publication_point_cache_policy_fingerprint(policy), publication_point_cache_policy_fingerprint(policy),
) )
.expect("build publication point projection"); .expect("build publication point projection");