-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: create worker to periodically CRL (WPB-3243) (#2397)
* feat(MLS): check revocation list * feat(MLS): cover CheckRevocationListUseCase with unit test * chore: detekt * chore: apply new changes from CC * feat: store urls with expiration time * feat: pass url as param to the use case * chore: detekt * chore: unit test * chore: cleanup * feat: observe current client certificate * feat: unit test * chore: remove ObserveCertificateForCurrentClientUseCase * feat: create worker to periodically check CRL * chore: detekt * chore: cleanup * chore: cleanup * chore: cover CrlRepository with unit test * chore: cover CheckCrlWorker with unit test * chore: address comments
- Loading branch information
Showing
8 changed files
with
467 additions
and
17 deletions.
There are no files selected for viewing
96 changes: 96 additions & 0 deletions
96
.../commonMain/kotlin/com/wire/kalium/logic/data/e2ei/CertificateRevocationListRepository.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| /* | ||
| * Wire | ||
| * Copyright (C) 2024 Wire Swiss GmbH | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU General Public License as published by | ||
| * the Free Software Foundation, either version 3 of the License, or | ||
| * (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU General Public License | ||
| * along with this program. If not, see http://www.gnu.org/licenses/. | ||
| */ | ||
| package com.wire.kalium.logic.data.e2ei | ||
|
|
||
| import com.wire.kalium.logic.CoreFailure | ||
| import com.wire.kalium.logic.configuration.UserConfigRepository | ||
| import com.wire.kalium.logic.functional.Either | ||
| import com.wire.kalium.logic.functional.map | ||
| import com.wire.kalium.logic.wrapApiRequest | ||
| import com.wire.kalium.network.api.base.unbound.acme.ACMEApi | ||
| import com.wire.kalium.persistence.config.CRLUrlExpirationList | ||
| import com.wire.kalium.persistence.config.CRLWithExpiration | ||
| import com.wire.kalium.persistence.dao.MetadataDAO | ||
| import io.ktor.http.Url | ||
| import io.ktor.http.protocolWithAuthority | ||
|
|
||
| interface CertificateRevocationListRepository { | ||
|
|
||
| /** | ||
| * Returns CRLs with expiration time. | ||
| * | ||
| * @return the [CRLUrlExpirationList] representing a list of CRLs with expiration time. | ||
| */ | ||
| suspend fun getCRLs(): CRLUrlExpirationList? | ||
| suspend fun addOrUpdateCRL(url: String, timestamp: ULong) | ||
| suspend fun getCurrentClientCrlUrl(): Either<CoreFailure, String> | ||
| suspend fun getClientDomainCRL(url: String): Either<CoreFailure, ByteArray> | ||
| } | ||
|
|
||
| internal class CertificateRevocationListRepositoryDataSource( | ||
| private val acmeApi: ACMEApi, | ||
| private val metadataDAO: MetadataDAO, | ||
| private val userConfigRepository: UserConfigRepository | ||
| ) : CertificateRevocationListRepository { | ||
| override suspend fun getCRLs(): CRLUrlExpirationList? = | ||
| metadataDAO.getSerializable(CRL_LIST_KEY, CRLUrlExpirationList.serializer()) | ||
|
|
||
| override suspend fun addOrUpdateCRL(url: String, timestamp: ULong) { | ||
|
|
||
| metadataDAO.getSerializable(CRL_LIST_KEY, CRLUrlExpirationList.serializer()) | ||
| ?.let { crlExpirationList -> | ||
| val crlWithExpiration = crlExpirationList.cRLWithExpirationList.find { | ||
| it.url == url | ||
| } | ||
| val newCRLs = crlWithExpiration?.let { item -> | ||
| crlExpirationList.cRLWithExpirationList.map { current -> | ||
| if (current.url == url) { | ||
| return@map item.copy(expiration = timestamp) | ||
| } else { | ||
| return@map current | ||
| } | ||
| } | ||
| } ?: run { | ||
| // add new CRL | ||
| crlExpirationList.cRLWithExpirationList.plus( | ||
| CRLWithExpiration(url, timestamp) | ||
| ) | ||
| } | ||
|
|
||
| metadataDAO.putSerializable( | ||
| CRL_LIST_KEY, | ||
| CRLUrlExpirationList(newCRLs), | ||
| CRLUrlExpirationList.serializer() | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| override suspend fun getCurrentClientCrlUrl(): Either<CoreFailure, String> = | ||
| userConfigRepository.getE2EISettings().map { | ||
| (Url(it.discoverUrl).protocolWithAuthority) | ||
| } | ||
|
|
||
| override suspend fun getClientDomainCRL(url: String): Either<CoreFailure, ByteArray> = | ||
| wrapApiRequest { | ||
| acmeApi.getClientDomainCRL(url) | ||
| } | ||
|
|
||
| companion object { | ||
| const val CRL_LIST_KEY = "crl_list_key" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
66 changes: 66 additions & 0 deletions
66
...monMain/kotlin/com/wire/kalium/logic/feature/e2ei/CertificateRevocationListCheckWorker.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| /* | ||
| * Wire | ||
| * Copyright (C) 2024 Wire Swiss GmbH | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU General Public License as published by | ||
| * the Free Software Foundation, either version 3 of the License, or | ||
| * (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU General Public License | ||
| * along with this program. If not, see http://www.gnu.org/licenses/. | ||
| */ | ||
| package com.wire.kalium.logic.feature.e2ei | ||
|
|
||
| import com.wire.kalium.logic.data.e2ei.CertificateRevocationListRepository | ||
| import com.wire.kalium.logic.data.sync.IncrementalSyncRepository | ||
| import com.wire.kalium.logic.data.sync.IncrementalSyncStatus | ||
| import com.wire.kalium.logic.feature.e2ei.usecase.CheckRevocationListUseCase | ||
| import com.wire.kalium.logic.functional.map | ||
| import com.wire.kalium.logic.kaliumLogger | ||
| import kotlinx.coroutines.flow.filter | ||
| import kotlinx.datetime.Clock | ||
|
|
||
| /** | ||
| * This worker will wait until the sync is done and then check the CRLs if needed. | ||
| * | ||
| */ | ||
| internal interface CertificateRevocationListCheckWorker { | ||
| suspend fun execute() | ||
| } | ||
|
|
||
| /** | ||
| * Base implementation of [CertificateRevocationListCheckWorker]. | ||
| * @param certificateRevocationListRepository The CRL repository. | ||
| * @param incrementalSyncRepository The incremental sync repository. | ||
| * @param checkRevocationList The check revocation list use case. | ||
| * | ||
| */ | ||
| internal class CertificateRevocationListCheckWorkerImpl( | ||
| private val certificateRevocationListRepository: CertificateRevocationListRepository, | ||
| private val incrementalSyncRepository: IncrementalSyncRepository, | ||
| private val checkRevocationList: CheckRevocationListUseCase | ||
| ) : CertificateRevocationListCheckWorker { | ||
|
|
||
| override suspend fun execute() { | ||
| incrementalSyncRepository.incrementalSyncState | ||
| .filter { it is IncrementalSyncStatus.Live } | ||
| .collect { | ||
| kaliumLogger.i("Checking certificate revocation list (CRL)..") | ||
| certificateRevocationListRepository.getCRLs()?.cRLWithExpirationList?.forEach { crl -> | ||
| if (crl.expiration < Clock.System.now().epochSeconds.toULong()) { | ||
| checkRevocationList(crl.url).map { newExpirationTime -> | ||
| newExpirationTime?.let { | ||
| certificateRevocationListRepository.addOrUpdateCRL(crl.url, it) | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
131 changes: 131 additions & 0 deletions
131
...monTest/kotlin/com/wire/kalium/logic/data/e2ei/CertificateRevocationListRepositoryTest.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| /* | ||
| * Wire | ||
| * Copyright (C) 2024 Wire Swiss GmbH | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU General Public License as published by | ||
| * the Free Software Foundation, either version 3 of the License, or | ||
| * (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU General Public License | ||
| * along with this program. If not, see http://www.gnu.org/licenses/. | ||
| */ | ||
| package com.wire.kalium.logic.data.e2ei | ||
|
|
||
| import com.wire.kalium.logic.configuration.UserConfigRepository | ||
| import com.wire.kalium.logic.data.e2ei.CertificateRevocationListRepositoryDataSource.Companion.CRL_LIST_KEY | ||
| import com.wire.kalium.network.api.base.unbound.acme.ACMEApi | ||
| import com.wire.kalium.persistence.config.CRLWithExpiration | ||
| import com.wire.kalium.persistence.config.CRLUrlExpirationList | ||
| import com.wire.kalium.persistence.dao.MetadataDAO | ||
| import io.mockative.Mock | ||
| import io.mockative.classOf | ||
| import io.mockative.given | ||
| import io.mockative.mock | ||
| import io.mockative.once | ||
| import io.mockative.verify | ||
| import kotlinx.coroutines.test.runTest | ||
| import kotlin.test.Test | ||
|
|
||
| class CertificateRevocationListRepositoryTest { | ||
|
|
||
| @Test | ||
| fun givenAnEmptyStoredList_whenUpdatingCRLs_thenAddNewCRL() = runTest { | ||
| val (arrangement, crlRepository) = Arrangement() | ||
| .withEmptyList() | ||
| .arrange() | ||
|
|
||
| crlRepository.addOrUpdateCRL(DUMMY_URL, TIMESTAMP) | ||
|
|
||
| verify(arrangement.metadataDAO).coroutine { | ||
| putSerializable( | ||
| CRL_LIST_KEY, | ||
| CRLUrlExpirationList(listOf(CRLWithExpiration(DUMMY_URL, TIMESTAMP))), | ||
| CRLUrlExpirationList.serializer() | ||
| ) | ||
| }.wasInvoked(once) | ||
| } | ||
|
|
||
| @Test | ||
| fun givenPassedCRLExistsInStoredList_whenUpdatingCRLs_thenUpdateCurrentCRL() = runTest { | ||
| val (arrangement, crlRepository) = Arrangement() | ||
| .withCRLs() | ||
| .arrange() | ||
|
|
||
| crlRepository.addOrUpdateCRL(DUMMY_URL, TIMESTAMP2) | ||
|
|
||
| verify(arrangement.metadataDAO).coroutine { | ||
| putSerializable( | ||
| CRL_LIST_KEY, | ||
| CRLUrlExpirationList(listOf(CRLWithExpiration(DUMMY_URL, TIMESTAMP2))), | ||
| CRLUrlExpirationList.serializer() | ||
| ) | ||
| }.wasInvoked(once) | ||
| } | ||
|
|
||
| @Test | ||
| fun givenNewCRLUrl_whenUpdatingCRLs_thenAddNewCRL() = runTest { | ||
| val (arrangement, crlRepository) = Arrangement() | ||
| .withCRLs() | ||
| .arrange() | ||
|
|
||
| crlRepository.addOrUpdateCRL(DUMMY_URL2, TIMESTAMP) | ||
|
|
||
| verify(arrangement.metadataDAO).coroutine { | ||
| putSerializable( | ||
| CRL_LIST_KEY, | ||
| CRLUrlExpirationList( | ||
| listOf( | ||
| CRLWithExpiration(DUMMY_URL, TIMESTAMP), | ||
| CRLWithExpiration(DUMMY_URL2, TIMESTAMP) | ||
| ) | ||
| ), | ||
| CRLUrlExpirationList.serializer() | ||
| ) | ||
| }.wasInvoked(once) | ||
| } | ||
|
|
||
| private class Arrangement { | ||
|
|
||
| @Mock | ||
| val acmeApi = mock(classOf<ACMEApi>()) | ||
|
|
||
| @Mock | ||
| val metadataDAO = mock(classOf<MetadataDAO>()) | ||
|
|
||
| @Mock | ||
| val userConfigRepository = mock(classOf<UserConfigRepository>()) | ||
|
|
||
| fun arrange() = this to CertificateRevocationListRepositoryDataSource(acmeApi, metadataDAO, userConfigRepository) | ||
|
|
||
| suspend fun withEmptyList() = apply { | ||
| given(metadataDAO).coroutine { | ||
| metadataDAO.getSerializable( | ||
| CRL_LIST_KEY, | ||
| CRLUrlExpirationList.serializer() | ||
| ) | ||
| }.thenReturn(CRLUrlExpirationList(listOf())) | ||
| } | ||
|
|
||
| suspend fun withCRLs() = apply { | ||
| given(metadataDAO).coroutine { | ||
| metadataDAO.getSerializable( | ||
| CRL_LIST_KEY, | ||
| CRLUrlExpirationList.serializer() | ||
| ) | ||
| }.thenReturn(CRLUrlExpirationList(listOf(CRLWithExpiration(DUMMY_URL, TIMESTAMP)))) | ||
| } | ||
| } | ||
|
|
||
| companion object { | ||
| private const val DUMMY_URL = "https://dummy.url" | ||
| private const val DUMMY_URL2 = "https://dummy-2.url" | ||
| private val TIMESTAMP = 1234567890.toULong() | ||
| private val TIMESTAMP2 = 5453222.toULong() | ||
| } | ||
| } |
Oops, something went wrong.