Skip to content

Commit 0759d2d

Browse files
jshaDaniel McCarney
jsha
authored and
Daniel McCarney
committed
cmd: Split out config structs (letsencrypt#4200)
This follows up on some refactoring we had done previously but not completed. This removes various binary-specific config structs from the common cmd package, and moves them into their appropriate packages. In the case of CT configs, they had to be moved into their own package to avoid a dependency loop between RA and ctpolicy.
1 parent 4c420e2 commit 0759d2d

File tree

12 files changed

+288
-281
lines changed

12 files changed

+288
-281
lines changed

‎cmd/boulder-ra/main.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"github.com/letsencrypt/boulder/cmd"
1313
"github.com/letsencrypt/boulder/core"
1414
"github.com/letsencrypt/boulder/ctpolicy"
15+
"github.com/letsencrypt/boulder/ctpolicy/ctconfig"
1516
"github.com/letsencrypt/boulder/features"
1617
"github.com/letsencrypt/boulder/goodkey"
1718
bgrpc "github.com/letsencrypt/boulder/grpc"
@@ -70,12 +71,12 @@ type config struct {
7071
// in a group and the first SCT returned will be used. This allows
7172
// us to comply with Chrome CT policy which requires one SCT from a
7273
// Google log and one SCT from any other log included in their policy.
73-
CTLogGroups2 []cmd.CTGroup
74+
CTLogGroups2 []ctconfig.CTGroup
7475
// InformationalCTLogs are a set of CT logs we will always submit to
7576
// but won't ever use the SCTs from. This may be because we want to
7677
// test them or because they are not yet approved by a browser/root
7778
// program but we still want our certs to end up there.
78-
InformationalCTLogs []cmd.LogDescription
79+
InformationalCTLogs []ctconfig.LogDescription
7980

8081
// IssuerCertPath is the path to the intermediate used to issue certificates.
8182
// It is required if the RevokeAtRA feature is enabled and is used to

‎cmd/boulder-va/main.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,13 @@ type config struct {
2323

2424
PortConfig cmd.PortConfig
2525

26-
CAADistributedResolver *cmd.CAADistributedResolverConfig
26+
// CAADistributedResolverConfig specifies the HTTP client setup and interfaces
27+
// needed to resolve CAA addresses over multiple paths
28+
CAADistributedResolver struct {
29+
Timeout cmd.ConfigDuration
30+
MaxFailures int
31+
Proxies []string
32+
}
2733

2834
// The number of times to try a DNS query (that has a temporary error)
2935
// before giving up. May be short-circuited by deadlines. A zero value

‎cmd/cert-checker/main.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -319,8 +319,6 @@ type config struct {
319319

320320
PA cmd.PAConfig
321321

322-
Statsd cmd.StatsdConfig
323-
324322
Syslog cmd.SyslogConfig
325323
}
326324

‎cmd/config.go‎

Lines changed: 0 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -148,52 +148,12 @@ type RPCServerConfig struct {
148148
RPCTimeout ConfigDuration
149149
}
150150

151-
// OCSPUpdaterConfig provides the various window tick times and batch sizes needed
152-
// for the OCSP (and SCT) updater
153-
type OCSPUpdaterConfig struct {
154-
ServiceConfig
155-
DBConfig
156-
157-
OldOCSPWindow ConfigDuration
158-
RevokedCertificateWindow ConfigDuration
159-
160-
OldOCSPBatchSize int
161-
RevokedCertificateBatchSize int
162-
163-
OCSPMinTimeToExpiry ConfigDuration
164-
OCSPStaleMaxAge ConfigDuration
165-
ParallelGenerateOCSPRequests int
166-
167-
AkamaiBaseURL string
168-
AkamaiClientToken string
169-
AkamaiClientSecret string
170-
AkamaiAccessToken string
171-
AkamaiV3Network string
172-
AkamaiPurgeRetries int
173-
AkamaiPurgeRetryBackoff ConfigDuration
174-
175-
SignFailureBackoffFactor float64
176-
SignFailureBackoffMax ConfigDuration
177-
178-
SAService *GRPCClientConfig
179-
OCSPGeneratorService *GRPCClientConfig
180-
AkamaiPurgerService *GRPCClientConfig
181-
182-
Features map[string]bool
183-
}
184-
185151
// SyslogConfig defines the config for syslogging.
186152
type SyslogConfig struct {
187153
StdoutLevel int
188154
SyslogLevel int
189155
}
190156

191-
// StatsdConfig defines the config for Statsd.
192-
type StatsdConfig struct {
193-
Server string
194-
Prefix string
195-
}
196-
197157
// ConfigDuration is just an alias for time.Duration that allows
198158
// serialization to YAML as well as JSON.
199159
type ConfigDuration struct {
@@ -270,92 +230,3 @@ type PortConfig struct {
270230
HTTPSPort int
271231
TLSPort int
272232
}
273-
274-
// CAADistributedResolverConfig specifies the HTTP client setup and interfaces
275-
// needed to resolve CAA addresses over multiple paths
276-
type CAADistributedResolverConfig struct {
277-
Timeout ConfigDuration
278-
MaxFailures int
279-
Proxies []string
280-
}
281-
282-
// LogShard describes a single shard of a temporally sharded
283-
// CT log
284-
type LogShard struct {
285-
URI string
286-
Key string
287-
WindowStart time.Time
288-
WindowEnd time.Time
289-
}
290-
291-
// TemporalSet contains a set of temporal shards of a single log
292-
type TemporalSet struct {
293-
Name string
294-
Shards []LogShard
295-
}
296-
297-
// Setup initializes the TemporalSet by parsing the start and end dates
298-
// and verifying WindowEnd > WindowStart
299-
func (ts *TemporalSet) Setup() error {
300-
if ts.Name == "" {
301-
return errors.New("Name cannot be empty")
302-
}
303-
if len(ts.Shards) == 0 {
304-
return errors.New("temporal set contains no shards")
305-
}
306-
for i := range ts.Shards {
307-
if ts.Shards[i].WindowEnd.Before(ts.Shards[i].WindowStart) ||
308-
ts.Shards[i].WindowEnd.Equal(ts.Shards[i].WindowStart) {
309-
return errors.New("WindowStart must be before WindowEnd")
310-
}
311-
}
312-
return nil
313-
}
314-
315-
// pick chooses the correct shard from a TemporalSet to use for the given
316-
// expiration time. In the case where two shards have overlapping windows
317-
// the earlier of the two shards will be chosen.
318-
func (ts *TemporalSet) pick(exp time.Time) (*LogShard, error) {
319-
for _, shard := range ts.Shards {
320-
if exp.Before(shard.WindowStart) {
321-
continue
322-
}
323-
if !exp.Before(shard.WindowEnd) {
324-
continue
325-
}
326-
return &shard, nil
327-
}
328-
return nil, fmt.Errorf("no valid shard available for temporal set %q for expiration date %q", ts.Name, exp)
329-
}
330-
331-
// LogDescription contains the information needed to submit certificates
332-
// to a CT log and verify returned receipts. If TemporalSet is non-nil then
333-
// URI and Key should be empty.
334-
type LogDescription struct {
335-
URI string
336-
Key string
337-
SubmitFinalCert bool
338-
339-
*TemporalSet
340-
}
341-
342-
// Info returns the URI and key of the log, either from a plain log description
343-
// or from the earliest valid shard from a temporal log set
344-
func (ld LogDescription) Info(exp time.Time) (string, string, error) {
345-
if ld.TemporalSet == nil {
346-
return ld.URI, ld.Key, nil
347-
}
348-
shard, err := ld.TemporalSet.pick(exp)
349-
if err != nil {
350-
return "", "", err
351-
}
352-
return shard.URI, shard.Key, nil
353-
}
354-
355-
type CTGroup struct {
356-
Name string
357-
Logs []LogDescription
358-
// How long to wait for one log to accept a certificate before moving on to
359-
// the next.
360-
Stagger ConfigDuration
361-
}

‎cmd/config_test.go‎

Lines changed: 0 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@ import (
44
"regexp"
55
"strings"
66
"testing"
7-
"time"
87

9-
"github.com/jmhodges/clock"
108
"github.com/letsencrypt/boulder/test"
119
)
1210

@@ -100,110 +98,3 @@ func TestTLSConfigLoad(t *testing.T) {
10098
})
10199
}
102100
}
103-
104-
func TestTemporalSetup(t *testing.T) {
105-
for _, tc := range []struct {
106-
ts TemporalSet
107-
err string
108-
}{
109-
{
110-
ts: TemporalSet{},
111-
err: "Name cannot be empty",
112-
},
113-
{
114-
ts: TemporalSet{
115-
Name: "temporal set",
116-
},
117-
err: "temporal set contains no shards",
118-
},
119-
{
120-
ts: TemporalSet{
121-
Name: "temporal set",
122-
Shards: []LogShard{
123-
{
124-
WindowStart: time.Time{},
125-
WindowEnd: time.Time{},
126-
},
127-
},
128-
},
129-
err: "WindowStart must be before WindowEnd",
130-
},
131-
{
132-
ts: TemporalSet{
133-
Name: "temporal set",
134-
Shards: []LogShard{
135-
{
136-
WindowStart: time.Time{}.Add(time.Hour),
137-
WindowEnd: time.Time{},
138-
},
139-
},
140-
},
141-
err: "WindowStart must be before WindowEnd",
142-
},
143-
{
144-
ts: TemporalSet{
145-
Name: "temporal set",
146-
Shards: []LogShard{
147-
{
148-
WindowStart: time.Time{},
149-
WindowEnd: time.Time{}.Add(time.Hour),
150-
},
151-
},
152-
},
153-
err: "",
154-
},
155-
} {
156-
err := tc.ts.Setup()
157-
if err != nil && tc.err != err.Error() {
158-
t.Errorf("got error %q, wanted %q", err, tc.err)
159-
} else if err == nil && tc.err != "" {
160-
t.Errorf("unexpected error %q", err)
161-
}
162-
}
163-
}
164-
165-
func TestLogInfo(t *testing.T) {
166-
ld := LogDescription{
167-
URI: "basic-uri",
168-
Key: "basic-key",
169-
}
170-
uri, key, err := ld.Info(time.Time{})
171-
test.AssertNotError(t, err, "Info failed")
172-
test.AssertEquals(t, uri, ld.URI)
173-
test.AssertEquals(t, key, ld.Key)
174-
175-
fc := clock.NewFake()
176-
ld.TemporalSet = &TemporalSet{}
177-
_, _, err = ld.Info(fc.Now())
178-
test.AssertError(t, err, "Info should fail with a TemporalSet with no viable shards")
179-
ld.TemporalSet.Shards = []LogShard{{WindowStart: fc.Now().Add(time.Hour), WindowEnd: fc.Now().Add(time.Hour * 2)}}
180-
_, _, err = ld.Info(fc.Now())
181-
test.AssertError(t, err, "Info should fail with a TemporalSet with no viable shards")
182-
183-
fc.Add(time.Hour * 4)
184-
now := fc.Now()
185-
ld.TemporalSet.Shards = []LogShard{
186-
{
187-
WindowStart: now.Add(time.Hour * -4),
188-
WindowEnd: now.Add(time.Hour * -2),
189-
URI: "a",
190-
Key: "a",
191-
},
192-
{
193-
WindowStart: now.Add(time.Hour * -2),
194-
WindowEnd: now.Add(time.Hour * 2),
195-
URI: "b",
196-
Key: "b",
197-
},
198-
{
199-
WindowStart: now.Add(time.Hour * 2),
200-
WindowEnd: now.Add(time.Hour * 4),
201-
URI: "c",
202-
Key: "c",
203-
},
204-
}
205-
uri, key, err = ld.Info(now)
206-
test.AssertNotError(t, err, "Info failed")
207-
test.AssertEquals(t, uri, "b")
208-
test.AssertEquals(t, key, "b")
209-
}

‎cmd/ocsp-updater/main.go‎

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func newUpdater(
7070
ca core.CertificateAuthority,
7171
sac core.StorageAuthority,
7272
apc akamaipb.AkamaiPurgerClient,
73-
config cmd.OCSPUpdaterConfig,
73+
config OCSPUpdaterConfig,
7474
issuerPath string,
7575
log blog.Logger,
7676
) (*OCSPUpdater, error) {
@@ -495,9 +495,7 @@ func (l *looper) loop() error {
495495
}
496496

497497
type config struct {
498-
OCSPUpdater cmd.OCSPUpdaterConfig
499-
500-
Statsd cmd.StatsdConfig
498+
OCSPUpdater OCSPUpdaterConfig
501499

502500
Syslog cmd.SyslogConfig
503501

@@ -506,7 +504,41 @@ type config struct {
506504
}
507505
}
508506

509-
func setupClients(c cmd.OCSPUpdaterConfig, stats metrics.Scope, clk clock.Clock) (
507+
// OCSPUpdaterConfig provides the various window tick times and batch sizes needed
508+
// for the OCSP (and SCT) updater
509+
type OCSPUpdaterConfig struct {
510+
cmd.ServiceConfig
511+
cmd.DBConfig
512+
513+
OldOCSPWindow cmd.ConfigDuration
514+
RevokedCertificateWindow cmd.ConfigDuration
515+
516+
OldOCSPBatchSize int
517+
RevokedCertificateBatchSize int
518+
519+
OCSPMinTimeToExpiry cmd.ConfigDuration
520+
OCSPStaleMaxAge cmd.ConfigDuration
521+
ParallelGenerateOCSPRequests int
522+
523+
AkamaiBaseURL string
524+
AkamaiClientToken string
525+
AkamaiClientSecret string
526+
AkamaiAccessToken string
527+
AkamaiV3Network string
528+
AkamaiPurgeRetries int
529+
AkamaiPurgeRetryBackoff cmd.ConfigDuration
530+
531+
SignFailureBackoffFactor float64
532+
SignFailureBackoffMax cmd.ConfigDuration
533+
534+
SAService *cmd.GRPCClientConfig
535+
OCSPGeneratorService *cmd.GRPCClientConfig
536+
AkamaiPurgerService *cmd.GRPCClientConfig
537+
538+
Features map[string]bool
539+
}
540+
541+
func setupClients(c OCSPUpdaterConfig, stats metrics.Scope, clk clock.Clock) (
510542
core.CertificateAuthority,
511543
core.StorageAuthority,
512544
akamaipb.AkamaiPurgerClient,

‎cmd/ocsp-updater/main_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ func setup(t *testing.T) (*OCSPUpdater, core.StorageAuthority, *gorp.DbMap, cloc
7979
&mockCA{},
8080
sa,
8181
nil,
82-
cmd.OCSPUpdaterConfig{
82+
OCSPUpdaterConfig{
8383
OldOCSPBatchSize: 1,
8484
RevokedCertificateBatchSize: 1,
8585
OldOCSPWindow: cmd.ConfigDuration{Duration: time.Second},

0 commit comments

Comments
 (0)