Fix deletion of issuers, CRLs

builtin/logical/pki/backend.go

@@ -81,7 +81,7 @@ func Backend(conf *logical.BackendConfig) *backend {
 
 			LocalStorage: []string{
 				"revoked/",
-				"crl",
+				legacyCRLPath,
 				"crls/",
 				"certs/",
 			},

builtin/logical/pki/cert_util.go

@@ -171,7 +171,7 @@ func fetchCertBySerial(ctx context.Context, b *backend, req *logical.Request, pr
 	case strings.HasPrefix(prefix, "revoked/"):
 		legacyPath = "revoked/" + colonSerial
 		path = "revoked/" + hyphenSerial
-	case serial == "crl":
+	case serial == legacyCRLPath:
 		if err = b.crlBuilder.rebuildIfForced(ctx, b, req); err != nil {
 			return nil, err
 		}

builtin/logical/pki/crl_util.go

@@ -360,6 +360,40 @@ func buildCRLs(ctx context.Context, b *backend, req *logical.Request, forceNew b
 		}
 	}
 
+	// Before persisting our updated CRL config, check to see if we have
+	// any dangling references. If we have any issuers that don't exist,
+	// remove them, remembering their CRLs IDs. If we've completely removed
+	// all issuers pointing to that CRL number, we can remove it from the
+	// number map and from storage.
+	for mapIssuerId := range crlConfig.IssuerIDCRLMap {
+		stillHaveIssuer := false
+		for _, listedIssuerId := range issuers {
+			if mapIssuerId == listedIssuerId {
+				stillHaveIssuer = true
+				break
+			}
+		}
+
+		if !stillHaveIssuer {
+			delete(crlConfig.IssuerIDCRLMap, mapIssuerId)
+		}
+	}
+	for crlId := range crlConfig.CRLNumberMap {
+		stillHaveIssuerForID := false
+		for _, remainingCRL := range crlConfig.IssuerIDCRLMap {
+			if remainingCRL == crlId {
+				stillHaveIssuerForID = true
+				break
+			}
+		}
+
+		if !stillHaveIssuerForID {
+			if err := req.Storage.Delete(ctx, "crls/"+crlId.String()); err != nil {
+				return fmt.Errorf("error building CRLs: unable to clean up deleted issuers' CRL: %v", err)
+			}
+		}
+	}
+
 	// Finally, persist our potentially updated local CRL config
 	if err := setLocalCRLConfig(ctx, req.Storage, crlConfig); err != nil {
 		return fmt.Errorf("error building CRLs: unable to persist updated cluster-local CRL config: %v", err)

builtin/logical/pki/path_fetch.go

@@ -179,14 +179,14 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data
 			contentType = "application/pkix-cert"
 		}
 	case req.Path == "crl" || req.Path == "crl/pem":
-		serial = "crl"
+		serial = legacyCRLPath
 		contentType = "application/pkix-crl"
 		if req.Path == "crl/pem" {
 			pemType = "X509 CRL"
 			contentType = "application/x-pem-file"
 		}
 	case req.Path == "cert/crl":
-		serial = "crl"
+		serial = legacyCRLPath
 		pemType = "X509 CRL"
 	case strings.HasSuffix(req.Path, "/pem") || strings.HasSuffix(req.Path, "/raw"):
 		serial = data.Get("serial").(string)

builtin/logical/pki/path_fetch_issuers.go

@@ -378,6 +378,15 @@ func (b *backend) pathDeleteIssuer(ctx context.Context, req *logical.Request, da
 		response.AddWarning(fmt.Sprintf("Deleted issuer %v (via issuer_ref %v); this was configured as the default issuer. Operations without an explicit issuer will not work until a new default is configured.", ref, issuerName))
 	}
 
+	// Since we've deleted an issuer, the chains might've changed. Call the
+	// rebuild code. We shouldn't technically err (as the issuer was deleted
+	// successfully), but log a warning (and to the response) if this fails.
+	if err := rebuildIssuersChains(ctx, req.Storage, nil); err != nil {
+		msg := fmt.Sprintf("Failed to rebuild remaining issuers' chains: %v", err)
+		b.Logger().Error(msg)
+		response.AddWarning(msg)
+	}
+
 	return response, nil
 }
 

builtin/logical/pki/path_root.go

@@ -79,11 +79,16 @@ func (b *backend) pathCADeleteRoot(ctx context.Context, req *logical.Request, _
 		}
 	}
 
-	// Delete legacy CA bundle; but don't error if it doesn't exist.
+	// Delete legacy CA bundle.
 	if err := req.Storage.Delete(ctx, legacyCertBundlePath); err != nil {
 		return nil, err
 	}
 
+	// Delete legacy CRL bundle.
+	if err := req.Storage.Delete(ctx, legacyCRLPath); err != nil {
+		return nil, err
+	}
+
 	// Return a warning about preferring to delete issuers and keys
 	// explicitly versus deleting everything.
 	resp := &logical.Response{}

builtin/logical/pki/storage.go

@@ -23,6 +23,7 @@ const (
 
 	legacyMigrationBundleLogKey = "config/legacyMigrationBundleLog"
 	legacyCertBundlePath        = "config/ca_bundle"
+	legacyCRLPath               = "crl"
 )
 
 type keyID string
@@ -650,19 +651,19 @@ func resolveIssuerCRLPath(ctx context.Context, b *backend, s logical.Storage, re
 
 	issuer, err := resolveIssuerReference(ctx, s, reference)
 	if err != nil {
-		return "crl", err
+		return legacyCRLPath, err
 	}
 
 	crlConfig, err := getLocalCRLConfig(ctx, s)
 	if err != nil {
-		return "crl", err
+		return legacyCRLPath, err
 	}
 
 	if crlId, ok := crlConfig.IssuerIDCRLMap[issuer]; ok && len(crlId) > 0 {
 		return fmt.Sprintf("crls/%v", crlId), nil
 	}
 
-	return "crl", fmt.Errorf("unable to find CRL for issuer: id:%v/ref:%v", issuer, reference)
+	return legacyCRLPath, fmt.Errorf("unable to find CRL for issuer: id:%v/ref:%v", issuer, reference)
 }
 
 // Builds a certutil.CertBundle from the specified issuer identifier,