10BC0 Merge pull request #1249 from cloudflare/nicky/new-db-accessor · cloudflare/cfssl@079aed0 · GitHub
[go: up one dir, main page]
Skip to content

Commit 079aed0

Browse files
nickysemenzanickysemenza
authored
Merge pull request #1249 from cloudflare/nicky/new-db-accessor
add db accessor to get unexpired certs by labels, add DB tests back to CI
2 parents d4be5f5 + e0c522a commit 079aed0

File tree

6 files changed

+81
-11
lines changed

6 files changed

+81
-11
lines changed

‎.github/workflows/go.yml‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,45 @@ jobs:
1111
strategy:
1212
matrix:
1313
go: ["1.18", "1.19"]
14+
services:
15+
# Label used to access the service container
16+
postgres:
17+
# Docker Hub image
18+
image: postgres
19+
# Provide the password for postgres
20+
env:
21+
POSTGRES_DB: postgres_db
22+
POSTGRES_PASSWORD: ""
23+
POSTGRES_HOST_AUTH_METHOD: trust # allow no password
24+
POSTGRES_PORT: 5432
25+
POSTGRES_USER: postgres
26+
# Set health checks to wait until postgres has started
27+
options: >-
28+
--health-cmd pg_isready
29+
--health-interval 10s
30+
--health-timeout 5s
31+
--health-retries 5
32+
ports:
33+
- 5432:5432
34+
mysql:
35+
image: mysql
36+
env:
37+
MYSQL_ALLOW_EMPTY_PASSWORD: yes
38+
MYSQL_ROOT_PASSWORD: ""
39+
ports:
40+
- 3306:3306
41+
options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
42+
1443
env:
1544
GOFLAGS: "-mod=vendor"
1645
GODEBUG: "x509sha1=1"
46+
BUILD_TAGS: "postgresql"
47+
PGHOST: localhost
48+
MYSQL_HOST: 127.0.0.1
1749
steps:
50+
- run: psql -c 'create database certdb_development;' -U postgres;
51+
- run: mysql -e 'create database certdb_development;' -u root;
52+
- run: mysql -e 'SET global sql_mode = 0;' -u root;
1853
- uses: actions/checkout@v2
1954

2055
- name: Set up Go
@@ -24,11 +59,11 @@ jobs:
2459

2560
- name: Build
2661
run: go build -v ./...
27-
62+
- run: make bin/goose;
63+
- run: ./bin/goose -path certdb/pg up;
64+
- run: ./bin/goose -path certdb/mysql up;
2865
- name: Test
2966
run: ./test.sh
30-
# todo: these Actions tests still need to be updated to run the database tests
31-
# that used to run in travis
3267
- uses: codecov/codecov-action@v3
3368

3469
golangci:

‎certdb/certdb.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ type Accessor interface {
7676
GetCertificate(serial, aki string) ([]CertificateRecord, error)
7777
GetUnexpiredCertificates() ([]CertificateRecord, error)
7878
GetRevokedAndUnexpiredCertificates() ([]CertificateRecord, error)
79+
GetUnexpiredCertificatesByLabel(labels []string) (crs []CertificateRecord, err error)
7980
GetRevokedAndUnexpiredCertificatesByLabel(label string) ([]CertificateRecord, error)
8081
GetRevokedAndUnexpiredCertificatesByLabelSelectColumns(label string) ([]CertificateRecord, error)
8182
RevokeCertificate(serial, aki string, reasonCode int) error

‎certdb/pg/dbconf.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
development:
22
driver: postgres
3-
open: dbname=certdb_development sslmode=disable
3+
open: dbname=certdb_development sslmode=disable user=postgres
44

55
test:
66
driver: postgres

‎certdb/sql/database_accessor.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ type Accessor struct {
7272
db *sqlx.DB
7373
}
7474

75+
var _ certdb.Accessor = &Accessor{}
76+
7577
func wrapSQLError(err error) error {
7678
if err != nil {
7779
return cferr.Wrap(cferr.CertStoreError, cferr.Unknown, err)
@@ -176,6 +178,29 @@ func (d *Accessor) GetUnexpiredCertificates() (crs []certdb.CertificateRecord, e
176178
return crs, nil
177179
}
178180

181+
// GetUnexpiredCertificatesByLabel gets all unexpired certificate from db that have the provided label.
182+
func (d *Accessor) GetUnexpiredCertificatesByLabel(labels []string) (crs []certdb.CertificateRecord, err error) {
183+
err = d.checkDB()
184+
if err != nil {
185+
return nil, err
186+
}
187+
188+
query, args, err := sqlx.In(
189+
fmt.Sprintf(`SELECT %s FROM certificates WHERE CURRENT_TIMESTAMP < expiry AND ca_label IN (?)`,
190+
sqlstruct.Columns(certdb.CertificateRecord{}),
191+
), labels)
192+
if err != nil {
193+
return nil, wrapSQLError(err)
194+
}
195+
196+
err = d.db.Select(&crs, d.db.Rebind(query), args...)
197+
if err != nil {
198+
return nil, wrapSQLError(err)
199+
}
200+
201+
return crs, nil
202+
}
203+
179204
// GetRevokedAndUnexpiredCertificates gets all revoked and unexpired certificate from db (for CRLs).
180205
func (d *Accessor) GetRevokedAndUnexpiredCertificates() (crs []certdb.CertificateRecord, err error) {
181206
err = d.checkDB()

‎certdb/sql/sql_test.go‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -114,12 +114,13 @@ func testInsertCertificateAndGetUnexpiredCertificate(ta TestAccessor, t *testing
114114

115115
expiry := time.Now().Add(time.Minute)
116116
want := certdb.CertificateRecord{
117-
PEM: "fake cert data",
118-
Serial: "fake serial 2",
119-
AKI: fakeAKI,
120-
Status: "good",
121-
Reason: 0,
122-
Expiry: expiry,
117+
PEM: "fake cert data",
118+
Serial: "fake serial 2",
119+
AKI: fakeAKI,
120+
Status: "good",
121+
Reason: 0,
122+
Expiry: expiry,
123+
CALabel: "foo",
123124
}
124125

125126
if err := ta.Accessor.InsertCertificate(want); err != nil {
@@ -153,6 +154,14 @@ func testInsertCertificateAndGetUnexpiredCertificate(ta TestAccessor, t *testing
153154
if len(unexpired) != 1 {
154155
t.Error("Should have 1 unexpired certificate record:", len(unexpired))
155156
}
157+
158+
unexpiredFiltered, err := ta.Accessor.GetUnexpiredCertificatesByLabel([]string{"foo"})
159+
require.NoError(t, err)
160+
require.Len(t, unexpiredFiltered, 1)
161+
unexpiredFiltered, err = ta.Accessor.GetUnexpiredCertificatesByLabel([]string{"bar"})
162+
require.NoError(t, err)
163+
require.Len(t, unexpiredFiltered, 0)
164+
156165
}
157166
func testInsertCertificateAndGetUnexpiredCertificateNullCommonName(ta TestAccessor, t *testing.T) {
158167
ta.Truncate()

‎certdb/testdb/testdb.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ func MySQLDB() *sqlx.DB {
6060

6161
// PostgreSQLDB returns a PostgreSQL db instance for certdb testing.
6262
func PostgreSQLDB() *sqlx.DB {
63-
connStr := "dbname=certdb_development sslmode=disable"
63+
connStr := "dbname=certdb_development sslmode=disable user=postgres"
6464

6565
if dbURL := os.Getenv("DATABASE_URL"); dbURL != "" {
6666
connStr = dbURL

0 commit comments

Comments
 (0)
0