Subject: Fix generation of new keys when no keys are available Origin: upstream, v9-1-g5482313 Upstream-Author: Sergio Correia Date: Fri Apr 30 11:12:06 2021 -0300 When no keys are available, tang creates a new pair of keys, however currently it checks the total number of keys, including rotated keys, to decide whether to create new keys. So not to have issues when all the keys have been rotated, let's check instead the total number of "regular" keys, the ones that will be advertised, and if there are none, then tang can create new keys. This fixes an issue when we do have all keys rotated. Tests added as well. --- a/src/keys.c +++ b/src/keys.c @@ -392,12 +392,15 @@ json_t* arr = tki->m_keys; if (d->d_name[0] == '.') { arr = tki->m_rotated_keys; + tki->m_rotated_keys_count++; + } else { + tki->m_keys_count++; } + if (json_array_append(arr, json) == -1) { fprintf(stderr, "Unable to append JSON (%s) to array; skipping\n", d->d_name); continue; } - tki->m_keys_count++; } } closedir(dir); --- a/src/keys.h +++ b/src/keys.h @@ -34,8 +34,8 @@ json_t* m_sign; /* Set of signing keys made from regular keys. */ - size_t m_keys_count; /* Number of keys (regular + rotated). */ - + size_t m_keys_count; /* Number of regular keys. */ + size_t m_rotated_keys_count; /* Number of rotated keys. */ }; void cleanup_tang_keys_info(struct tang_keys_info**); --- a/tests/adv +++ b/tests/adv @@ -83,3 +83,15 @@ -g 1 -Og protected -SyOg cty -Sq "jwk-set+json" -EUUUUU test "$(tang-show-keys $PORT)" == "$(jose jwk thp -i $TMP/db/sig.jwk)" + +# Check that new keys will be created if none exist. +rm -rf "${TMP}/db" && mkdir -p "${TMP}/db" +fetch /adv + +# Now let's rotate these keys and check if we still create new keys. +cd "${TMP}/db" +for k in *.jwk; do + mv -f -- "${k}" ".${k}" +done +cd - +fetch /adv --- a/tests/test-keys.c.in +++ b/tests/test-keys.c.in @@ -140,7 +140,7 @@ json_auto_t* keys = json_deep_copy(tki->m_keys); ASSERT(keys); ASSERT(json_array_extend(keys, tki->m_rotated_keys) == 0); - ASSERT(json_array_size(keys) == (size_t)tki->m_keys_count); + ASSERT(json_array_size(keys) == (size_t)(tki->m_keys_count + tki->m_rotated_keys_count)); for (int i = 0; hashes[i]; i++) { json_array_foreach(keys, idx, jwk) { @@ -203,7 +203,7 @@ json_auto_t* keys = json_deep_copy(tki->m_keys); ASSERT(keys); ASSERT(json_array_extend(keys, tki->m_rotated_keys) == 0); - ASSERT(json_array_size(keys) == (size_t)tki->m_keys_count); + ASSERT(json_array_size(keys) == (size_t)(tki->m_keys_count + tki->m_rotated_keys_count)); for (int i = 0; hashes[i]; i++) { json_array_foreach(keys, idx, jwk) { @@ -230,7 +230,8 @@ * - qgmqJSo6AEEuVQY7zVlklqdTMqY.jwk * - -bWkGaJi0Zdvxaj4DCp28umLcRA.jwk */ - ASSERT(tki->m_keys_count == 4); + ASSERT(tki->m_keys_count == 2); + ASSERT(tki->m_rotated_keys_count == 2); ASSERT(json_array_size(tki->m_keys) == 2); ASSERT(json_array_size(tki->m_rotated_keys) == 2);