mirror of
https://github.com/chris2511/xca.git
synced 2026-09-12 19:51:05 +05:00
Put the database schema into a different file for documentation
This commit is contained in:
Christian Hohnstaedt
parent
add9f50e29
commit
03124f6f70
@ -3,6 +3,9 @@
|
|||||||
## __Release Notes__
|
## __Release Notes__
|
||||||
|
|
||||||
* Make a backup copy of your database!
|
* Make a backup copy of your database!
|
||||||
|
* This version completely changes the database format to SQL(ite)
|
||||||
|
* Don't try to open it with older versions of XCA (< 1.4.0). They will corrupt the database.
|
||||||
|
* The "Undelete" feature is currently not implemented. If an item gets deleted, it will be lost!
|
||||||
* Send bugs to christian@hohnstaedt.de
|
* Send bugs to christian@hohnstaedt.de
|
||||||
|
|
||||||
## __Changelog:__
|
## __Changelog:__
|
||||||
|
|||||||
@ -25,302 +25,9 @@
|
|||||||
|
|
||||||
QSqlError MainWindow::initSqlDB()
|
QSqlError MainWindow::initSqlDB()
|
||||||
{
|
{
|
||||||
QStringList schemas[5]; schemas[0]
|
QStringList schemas[5];
|
||||||
|
|
||||||
/* The "32bit hash" in public_keys, x509super, requests, certs and crls
|
#include "database_schema.cpp"
|
||||||
* is used to quickly find items in the DB by reference.
|
|
||||||
* It consists of the first 4 bytes of a SHA1 hash.
|
|
||||||
* Collisions are of course possible.
|
|
||||||
*
|
|
||||||
* All binaries are stored Base64 encoded in a column of type
|
|
||||||
* " B64_BLOB " It is defined here as "VARCHAR(10000)"
|
|
||||||
*/
|
|
||||||
|
|
||||||
#define B64_BLOB "VARCHAR(10000)"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* The B64(DER(something)) function means DER encode something
|
|
||||||
* and then Base64 encode that.
|
|
||||||
* So finally this is PEM without newlines, header and footer
|
|
||||||
*
|
|
||||||
* Dates are alway stored as 'CHAR(15)' in the
|
|
||||||
* ASN.1 Generalized time 'yyyyMMddHHmmssZ' format
|
|
||||||
*/
|
|
||||||
|
|
||||||
#define DB_DATE "CHAR(15)"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Configuration settings from
|
|
||||||
* the Options dialog, window size, last export directory,
|
|
||||||
* default key type and size,
|
|
||||||
* table column (position, sort order, visibility)
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE settings ("
|
|
||||||
"key_ CHAR(20) UNIQUE, " /* mySql does not like "key" or "option" */
|
|
||||||
"value VARCHAR(1024))"
|
|
||||||
<< "INSERT INTO settings (key_, value) VALUES ('schema', '1')"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* All items (keys, tokens, requests, certs, crls, templates)
|
|
||||||
* are stored here with the primary key and some common data
|
|
||||||
* The other tables containing the details reference the "id"
|
|
||||||
* as FOREIGN KEY.
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE items("
|
|
||||||
"id INTEGER PRIMARY KEY, "
|
|
||||||
"name VARCHAR(128), " /* Internal name of the item */
|
|
||||||
"type INTEGER, " /* enum pki_type */
|
|
||||||
"source INTEGER, " /* enum pki_source */
|
|
||||||
"date " DB_DATE ", " /* Time of insertion (creation/import) */
|
|
||||||
"comment VARCHAR(2048))"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Storage of public keys. Private keys and tokens also store
|
|
||||||
* their public part here.
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE public_keys ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"type CHAR(4), " /* RSA DSA EC (as text) */
|
|
||||||
"hash INTEGER, " /* 32 bit hash */
|
|
||||||
"len INTEGER, " /* key size in bits */
|
|
||||||
"public " B64_BLOB ", " /* B64(DER(public key)) */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id))"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* The private part of RSA, DSA, EC keys.
|
|
||||||
* references to "items" and "public_keys"
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE private_keys ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"ownPass INTEGER, " /* Encrypted by DB pwd or own pwd */
|
|
||||||
"private " B64_BLOB ", " /* B64(Encrypt(DER(private key))) */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id))"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Smart cards or other PKCS#11 tokens
|
|
||||||
* references to "items" and "public_keys"
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE tokens ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"card_manufacturer VARCHAR(64), " /* Card location data */
|
|
||||||
"card_serial VARCHAR(64), " /* as text */
|
|
||||||
"card_model VARCHAR(64), "
|
|
||||||
"card_label VARCHAR(64), "
|
|
||||||
"slot_label VARCHAR(64), "
|
|
||||||
"object_id VARCHAR(64), " /* Unique ID on the token */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id))"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Encryption and hash mechanisms supported by a token
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE token_mechanism ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"mechanism INTEGER, " /* PKCS#11: CK_MECHANISM_TYPE */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id))"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* An X509 Super class, consisting of a
|
|
||||||
* - Distinguishd name hash
|
|
||||||
* - Referenced key in the database
|
|
||||||
* - hash of the public key, used for lookups if there
|
|
||||||
* is no key to reference
|
|
||||||
* used by Requests and certificates and the use-counter of keys:
|
|
||||||
* "SELECT from x509super WHERE pkey=?"
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE x509super ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"subj_hash INTEGER, " /* 32 bit hash of the Distinguished name */
|
|
||||||
"pkey INTEGER, " /* reference to the key items(id) */
|
|
||||||
"key_hash INTEGER, " /* 32 bit hash of the public key */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id), "
|
|
||||||
"FOREIGN KEY (pkey) REFERENCES items (id)) "
|
|
||||||
|
|
||||||
/*
|
|
||||||
* PKCS#10 Certificate request details
|
|
||||||
* also takes information from the "x509super" table.
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE requests ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"hash INTEGER, " /* 32 bit hash of the request */
|
|
||||||
"signed INTEGER, " /* Whether it was once signed. */
|
|
||||||
"request " B64_BLOB ", " /* B64(DER(PKCS#10 request)) */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id)) "
|
|
||||||
|
|
||||||
/*
|
|
||||||
* X509 certificate details
|
|
||||||
* also takes information from the "x509super" table.
|
|
||||||
* The content of the columns: hash, iss_hash, serial, ca
|
|
||||||
* can also be retrieved directly from the certificate, but are good
|
|
||||||
* to lurk around for faster lookup
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE certs ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"hash INTEGER, " /* 32 bit hash of the cert */
|
|
||||||
"iss_hash INTEGER, " /* 32 bit hash of the issuer DN */
|
|
||||||
"serial VARCHAR(64), " /* Serial number of the certificate */
|
|
||||||
"issuer INTEGER, " /* The items(id) of the issuer or NULL */
|
|
||||||
"ca INTEGER, " /* CA: yes / no from BasicConstraints */
|
|
||||||
"cert " B64_BLOB ", " /* B64(DER(certificate)) */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id), "
|
|
||||||
"FOREIGN KEY (issuer) REFERENCES items (id)) "
|
|
||||||
|
|
||||||
/*
|
|
||||||
* X509 cartificate Authority data
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE authority ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"template INTEGER, " /* reference to items(id) of the default template*/
|
|
||||||
"crlExpire " DB_DATE ", " /* CRL expiry date */
|
|
||||||
"crlNo INTEGER, " /* Last CRL Number */
|
|
||||||
"crlDays INTEGER, " /* CRL days until renewal */
|
|
||||||
"dnPolicy VARCHAR(1024), " /* DistinguishedName policy (UNUSED) */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id), "
|
|
||||||
"FOREIGN KEY (template) REFERENCES items (id)) "
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Storage of CRLs
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE crls ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"hash INTEGER, " /* 32 bit hash of the CRL */
|
|
||||||
"num INTEGER, " /* Number of revoked certificates */
|
|
||||||
"iss_hash INTEGER, " /* 32 bit hash of the issuer DN */
|
|
||||||
"issuer INTEGER, " /* The items(id) of the issuer or NULL */
|
|
||||||
"crl " B64_BLOB ", " /* B64(DER(revocation list)) */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id), "
|
|
||||||
"FOREIGN KEY (issuer) REFERENCES items (id)) "
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Revocations (serial, date, reason, issuer) used to create new
|
|
||||||
* CRLs. "Manage revocations"
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE revocations ("
|
|
||||||
"caId INTEGER, " /* reference to certs(item) */
|
|
||||||
"serial VARCHAR(64), " /* Serial number of the revoked certificate */
|
|
||||||
"date " DB_DATE ", " /* Time of creating the revocation */
|
|
||||||
"invaldate " DB_DATE ", " /* Time of invalidation */
|
|
||||||
"crlNo INTEGER, " /* Crl Number of CRL of first appearance */
|
|
||||||
"reasonBit INTEGER, " /* Bit number of the revocation reason */
|
|
||||||
"FOREIGN KEY (caId) REFERENCES items (id))"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Templates
|
|
||||||
*/
|
|
||||||
<< "CREATE TABLE templates ("
|
|
||||||
"item INTEGER, " /* reference to items(id) */
|
|
||||||
"version INTEGER, " /* Version of the template format */
|
|
||||||
"template " B64_BLOB ", " /* The base64 encoded template */
|
|
||||||
"FOREIGN KEY (item) REFERENCES items (id))"
|
|
||||||
|
|
||||||
;
|
|
||||||
/* Schema Version 2: Views added to quickly load the data */
|
|
||||||
schemas[1]
|
|
||||||
|
|
||||||
/* Views */
|
|
||||||
<< "CREATE VIEW view_public_keys AS SELECT "
|
|
||||||
"items.id, items.name, items.type AS item_type, items.date, "
|
|
||||||
"items.source, items.comment, "
|
|
||||||
"public_keys.type as key_type, public_keys.len, public_keys.public, "
|
|
||||||
"private_keys.ownPass, "
|
|
||||||
"tokens.card_manufacturer, tokens.card_serial, tokens.card_model, "
|
|
||||||
"tokens.card_label, tokens.slot_label, tokens.object_id "
|
|
||||||
"FROM public_keys LEFT JOIN items ON public_keys.item = items.id "
|
|
||||||
"LEFT JOIN private_keys ON private_keys.item = public_keys.item "
|
|
||||||
"LEFT JOIN tokens ON public_keys.item = tokens.item"
|
|
||||||
|
|
||||||
<< "CREATE VIEW view_certs AS SELECT "
|
|
||||||
"items.id, items.name, items.type, items.date AS item_date, "
|
|
||||||
"items.source, items.comment, "
|
|
||||||
"x509super.pkey, "
|
|
||||||
"certs.serial AS certs_serial, certs.issuer, certs.ca, certs.cert, "
|
|
||||||
"authority.template, authority.crlExpire, "
|
|
||||||
"authority.crlNo AS auth_crlno, authority.crlDays, authority.dnPolicy, "
|
|
||||||
"revocations.serial, revocations.date, revocations.invaldate, "
|
|
||||||
"revocations.crlNo, revocations.reasonBit "
|
|
||||||
"FROM certs LEFT JOIN items ON certs.item = items.id "
|
|
||||||
"LEFT JOIN x509super ON x509super.item = certs.item "
|
|
||||||
"LEFT JOIN authority ON authority.item = certs.item "
|
|
||||||
"LEFT JOIN revocations ON revocations.caId = certs.issuer "
|
|
||||||
"AND revocations.serial = certs.serial"
|
|
||||||
|
|
||||||
<< "CREATE VIEW view_requests AS SELECT "
|
|
||||||
"items.id, items.name, items.type, items.date, "
|
|
||||||
"items.source, items.comment, "
|
|
||||||
"x509super.pkey, "
|
|
||||||
"requests.request, requests.signed "
|
|
||||||
"FROM requests LEFT JOIN items ON requests.item = items.id "
|
|
||||||
"LEFT JOIN x509super ON x509super.item = requests.item"
|
|
||||||
|
|
||||||
<< "CREATE VIEW view_crls AS SELECT "
|
|
||||||
"items.id, items.name, items.type, items.date, "
|
|
||||||
"items.source, items.comment, "
|
|
||||||
"crls.num, crls.issuer, crls.crl "
|
|
||||||
"FROM crls LEFT JOIN items ON crls.item = items.id "
|
|
||||||
|
|
||||||
<< "CREATE VIEW view_templates AS SELECT "
|
|
||||||
"items.id, items.name, items.type, items.date, "
|
|
||||||
"items.source, items.comment, "
|
|
||||||
"templates.version, templates.template "
|
|
||||||
"FROM templates LEFT JOIN items ON templates.item = items.id"
|
|
||||||
|
|
||||||
|
|
||||||
<< "UPDATE settings SET value='2' WHERE key_='schema'"
|
|
||||||
|
|
||||||
;
|
|
||||||
/* Schema Version 3: Add indexes over hashes and primary, foreign keys */
|
|
||||||
schemas[2]
|
|
||||||
|
|
||||||
<< "CREATE INDEX i_settings_key_ ON settings (key_)"
|
|
||||||
<< "CREATE INDEX i_items_id ON items (id)"
|
|
||||||
<< "CREATE INDEX i_public_keys_item ON public_keys (item)"
|
|
||||||
<< "CREATE INDEX i_public_keys_hash ON public_keys (hash)"
|
|
||||||
<< "CREATE INDEX i_private_keys_item ON private_keys (item)"
|
|
||||||
<< "CREATE INDEX i_tokens_item ON tokens (item)"
|
|
||||||
<< "CREATE INDEX i_token_mechanism_item ON token_mechanism (item)"
|
|
||||||
<< "CREATE INDEX i_x509super_item ON x509super (item)"
|
|
||||||
<< "CREATE INDEX i_x509super_subj_hash ON x509super (subj_hash)"
|
|
||||||
<< "CREATE INDEX i_x509super_key_hash ON x509super (key_hash)"
|
|
||||||
<< "CREATE INDEX i_x509super_pkey ON x509super (pkey)"
|
|
||||||
<< "CREATE INDEX i_requests_item ON requests (item)"
|
|
||||||
<< "CREATE INDEX i_requests_hash ON requests (hash)"
|
|
||||||
<< "CREATE INDEX i_certs_item ON certs (item)"
|
|
||||||
<< "CREATE INDEX i_certs_hash ON certs (hash)"
|
|
||||||
<< "CREATE INDEX i_certs_iss_hash ON certs (iss_hash)"
|
|
||||||
<< "CREATE INDEX i_certs_serial ON certs (serial)"
|
|
||||||
<< "CREATE INDEX i_certs_issuer ON certs (issuer)"
|
|
||||||
<< "CREATE INDEX i_certs_ca ON certs (ca)"
|
|
||||||
<< "CREATE INDEX i_authority_item ON authority (item)"
|
|
||||||
<< "CREATE INDEX i_crls_item ON crls (item)"
|
|
||||||
<< "CREATE INDEX i_crls_hash ON crls (hash)"
|
|
||||||
<< "CREATE INDEX i_crls_iss_hash ON crls (iss_hash)"
|
|
||||||
<< "CREATE INDEX i_crls_issuer ON crls (issuer)"
|
|
||||||
<< "CREATE INDEX i_revocations_caId_serial ON revocations (caId, serial)"
|
|
||||||
<< "CREATE INDEX i_templates_item ON templates (item)"
|
|
||||||
<< "UPDATE settings SET value='3' WHERE key_='schema'"
|
|
||||||
|
|
||||||
;
|
|
||||||
/* Schema Version 4: Add private key view to extract a private key with:
|
|
||||||
mysql: mysql -sNp -u xca xca_msq -e
|
|
||||||
or sqlite: sqlite3 ~/sqlxdb.xdb
|
|
||||||
or psql: psql -t -h 192.168.140.7 -U xca -d xca_pg -c
|
|
||||||
"SELECT private FROM view_private WHERE name='pk8key';" |\
|
|
||||||
base64 -d | openssl pkcs8 -inform DER
|
|
||||||
* First mysql/psql will ask for a password and then OpenSSL will ask for
|
|
||||||
* the database password.
|
|
||||||
*/
|
|
||||||
schemas[3]
|
|
||||||
|
|
||||||
<< "CREATE VIEW view_private AS SELECT "
|
|
||||||
"name, private FROM private_keys JOIN items ON "
|
|
||||||
"items.id = private_keys.item"
|
|
||||||
<< "UPDATE settings SET value='4' WHERE key_='schema'"
|
|
||||||
;
|
|
||||||
|
|
||||||
schemas[4]
|
|
||||||
<< "ALTER TABLE items ADD stamp INTEGER NOT NULL DEFAULT (0)"
|
|
||||||
<< "CREATE INDEX i_items_stamp ON items (stamp)"
|
|
||||||
<< "UPDATE settings SET value='5' WHERE key_='schema'"
|
|
||||||
;
|
|
||||||
|
|
||||||
XSqlQuery q;
|
XSqlQuery q;
|
||||||
QSqlDatabase db = QSqlDatabase::database();
|
QSqlDatabase db = QSqlDatabase::database();
|
||||||
|
|||||||
@ -149,8 +149,10 @@ void MainWindow::init_menu()
|
|||||||
SLOT(exportIndexHierarchy()));
|
SLOT(exportIndexHierarchy()));
|
||||||
acList += extra->addAction(tr("C&hange DataBase password"), this,
|
acList += extra->addAction(tr("C&hange DataBase password"), this,
|
||||||
SLOT(changeDbPass()));
|
SLOT(changeDbPass()));
|
||||||
|
#if 0
|
||||||
acList += extra->addAction(tr("&Undelete items"), this,
|
acList += extra->addAction(tr("&Undelete items"), this,
|
||||||
SLOT(undelete()))->setEnabled(false);
|
SLOT(undelete()));
|
||||||
|
#endif
|
||||||
extra->addAction(tr("Generate DH parameter"), this,
|
extra->addAction(tr("Generate DH parameter"), this,
|
||||||
SLOT(generateDHparam()));
|
SLOT(generateDHparam()));
|
||||||
extra->addAction(tr("OID Resolver"), resolver, SLOT(show()));
|
extra->addAction(tr("OID Resolver"), resolver, SLOT(show()));
|
||||||
|
|||||||
298
widgets/database_schema.cpp
Normal file
298
widgets/database_schema.cpp
Normal file
@ -0,0 +1,298 @@
|
|||||||
|
|
||||||
|
/* The "32bit hash" in public_keys, x509super, requests, certs and crls
|
||||||
|
* is used to quickly find items in the DB by reference.
|
||||||
|
* It consists of the first 4 bytes of a SHA1 hash.
|
||||||
|
* Collisions are of course possible.
|
||||||
|
*
|
||||||
|
* All binaries are stored Base64 encoded in a column of type
|
||||||
|
* " B64_BLOB " It is defined here as "VARCHAR(10000)"
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define B64_BLOB "VARCHAR(10000)"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The B64(DER(something)) function means DER encode something
|
||||||
|
* and then Base64 encode that.
|
||||||
|
* So finally this is PEM without newlines, header and footer
|
||||||
|
*
|
||||||
|
* Dates are alway stored as 'CHAR(15)' in the
|
||||||
|
* ASN.1 Generalized time 'yyyyMMddHHmmssZ' format
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define DB_DATE "CHAR(15)"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Configuration settings from
|
||||||
|
* the Options dialog, window size, last export directory,
|
||||||
|
* default key type and size,
|
||||||
|
* table column (position, sort order, visibility)
|
||||||
|
*/
|
||||||
|
schemas[0]
|
||||||
|
|
||||||
|
<< "CREATE TABLE settings ("
|
||||||
|
"key_ CHAR(20) UNIQUE, " /* mySql does not like "key" or "option" */
|
||||||
|
"value VARCHAR(1024))"
|
||||||
|
<< "INSERT INTO settings (key_, value) VALUES ('schema', '1')"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* All items (keys, tokens, requests, certs, crls, templates)
|
||||||
|
* are stored here with the primary key and some common data
|
||||||
|
* The other tables containing the details reference the "id"
|
||||||
|
* as FOREIGN KEY.
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE items("
|
||||||
|
"id INTEGER PRIMARY KEY, "
|
||||||
|
"name VARCHAR(128), " /* Internal name of the item */
|
||||||
|
"type INTEGER, " /* enum pki_type */
|
||||||
|
"source INTEGER, " /* enum pki_source */
|
||||||
|
"date " DB_DATE ", " /* Time of insertion (creation/import) */
|
||||||
|
"comment VARCHAR(2048))"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Storage of public keys. Private keys and tokens also store
|
||||||
|
* their public part here.
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE public_keys ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"type CHAR(4), " /* RSA DSA EC (as text) */
|
||||||
|
"hash INTEGER, " /* 32 bit hash */
|
||||||
|
"len INTEGER, " /* key size in bits */
|
||||||
|
"public " B64_BLOB ", " /* B64(DER(public key)) */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id))"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The private part of RSA, DSA, EC keys.
|
||||||
|
* references to "items" and "public_keys"
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE private_keys ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"ownPass INTEGER, " /* Encrypted by DB pwd or own pwd */
|
||||||
|
"private " B64_BLOB ", " /* B64(Encrypt(DER(private key))) */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id))"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Smart cards or other PKCS#11 tokens
|
||||||
|
* references to "items" and "public_keys"
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE tokens ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"card_manufacturer VARCHAR(64), " /* Card location data */
|
||||||
|
"card_serial VARCHAR(64), " /* as text */
|
||||||
|
"card_model VARCHAR(64), "
|
||||||
|
"card_label VARCHAR(64), "
|
||||||
|
"slot_label VARCHAR(64), "
|
||||||
|
"object_id VARCHAR(64), " /* Unique ID on the token */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id))"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Encryption and hash mechanisms supported by a token
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE token_mechanism ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"mechanism INTEGER, " /* PKCS#11: CK_MECHANISM_TYPE */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id))"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* An X509 Super class, consisting of a
|
||||||
|
* - Distinguishd name hash
|
||||||
|
* - Referenced key in the database
|
||||||
|
* - hash of the public key, used for lookups if there
|
||||||
|
* is no key to reference
|
||||||
|
* used by Requests and certificates and the use-counter of keys:
|
||||||
|
* "SELECT from x509super WHERE pkey=?"
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE x509super ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"subj_hash INTEGER, " /* 32 bit hash of the Distinguished name */
|
||||||
|
"pkey INTEGER, " /* reference to the key items(id) */
|
||||||
|
"key_hash INTEGER, " /* 32 bit hash of the public key */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id), "
|
||||||
|
"FOREIGN KEY (pkey) REFERENCES items (id)) "
|
||||||
|
|
||||||
|
/*
|
||||||
|
* PKCS#10 Certificate request details
|
||||||
|
* also takes information from the "x509super" table.
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE requests ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"hash INTEGER, " /* 32 bit hash of the request */
|
||||||
|
"signed INTEGER, " /* Whether it was once signed. */
|
||||||
|
"request " B64_BLOB ", " /* B64(DER(PKCS#10 request)) */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id)) "
|
||||||
|
|
||||||
|
/*
|
||||||
|
* X509 certificate details
|
||||||
|
* also takes information from the "x509super" table.
|
||||||
|
* The content of the columns: hash, iss_hash, serial, ca
|
||||||
|
* can also be retrieved directly from the certificate, but are good
|
||||||
|
* to lurk around for faster lookup
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE certs ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"hash INTEGER, " /* 32 bit hash of the cert */
|
||||||
|
"iss_hash INTEGER, " /* 32 bit hash of the issuer DN */
|
||||||
|
"serial VARCHAR(64), " /* Serial number of the certificate */
|
||||||
|
"issuer INTEGER, " /* The items(id) of the issuer or NULL */
|
||||||
|
"ca INTEGER, " /* CA: yes / no from BasicConstraints */
|
||||||
|
"cert " B64_BLOB ", " /* B64(DER(certificate)) */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id), "
|
||||||
|
"FOREIGN KEY (issuer) REFERENCES items (id)) "
|
||||||
|
|
||||||
|
/*
|
||||||
|
* X509 cartificate Authority data
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE authority ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"template INTEGER, " /* reference to items(id) of the default template*/
|
||||||
|
"crlExpire " DB_DATE ", " /* CRL expiry date */
|
||||||
|
"crlNo INTEGER, " /* Last CRL Number */
|
||||||
|
"crlDays INTEGER, " /* CRL days until renewal */
|
||||||
|
"dnPolicy VARCHAR(1024), " /* DistinguishedName policy (UNUSED) */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id), "
|
||||||
|
"FOREIGN KEY (template) REFERENCES items (id)) "
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Storage of CRLs
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE crls ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"hash INTEGER, " /* 32 bit hash of the CRL */
|
||||||
|
"num INTEGER, " /* Number of revoked certificates */
|
||||||
|
"iss_hash INTEGER, " /* 32 bit hash of the issuer DN */
|
||||||
|
"issuer INTEGER, " /* The items(id) of the issuer or NULL */
|
||||||
|
"crl " B64_BLOB ", " /* B64(DER(revocation list)) */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id), "
|
||||||
|
"FOREIGN KEY (issuer) REFERENCES items (id)) "
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Revocations (serial, date, reason, issuer) used to create new
|
||||||
|
* CRLs. "Manage revocations"
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE revocations ("
|
||||||
|
"caId INTEGER, " /* reference to certs(item) */
|
||||||
|
"serial VARCHAR(64), " /* Serial number of the revoked certificate */
|
||||||
|
"date " DB_DATE ", " /* Time of creating the revocation */
|
||||||
|
"invaldate " DB_DATE ", " /* Time of invalidation */
|
||||||
|
"crlNo INTEGER, " /* Crl Number of CRL of first appearance */
|
||||||
|
"reasonBit INTEGER, " /* Bit number of the revocation reason */
|
||||||
|
"FOREIGN KEY (caId) REFERENCES items (id))"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Templates
|
||||||
|
*/
|
||||||
|
<< "CREATE TABLE templates ("
|
||||||
|
"item INTEGER, " /* reference to items(id) */
|
||||||
|
"version INTEGER, " /* Version of the template format */
|
||||||
|
"template " B64_BLOB ", " /* The base64 encoded template */
|
||||||
|
"FOREIGN KEY (item) REFERENCES items (id))"
|
||||||
|
|
||||||
|
;
|
||||||
|
/* Schema Version 2: Views added to quickly load the data */
|
||||||
|
schemas[1]
|
||||||
|
|
||||||
|
/* Views */
|
||||||
|
<< "CREATE VIEW view_public_keys AS SELECT "
|
||||||
|
"items.id, items.name, items.type AS item_type, items.date, "
|
||||||
|
"items.source, items.comment, "
|
||||||
|
"public_keys.type as key_type, public_keys.len, public_keys.public, "
|
||||||
|
"private_keys.ownPass, "
|
||||||
|
"tokens.card_manufacturer, tokens.card_serial, tokens.card_model, "
|
||||||
|
"tokens.card_label, tokens.slot_label, tokens.object_id "
|
||||||
|
"FROM public_keys LEFT JOIN items ON public_keys.item = items.id "
|
||||||
|
"LEFT JOIN private_keys ON private_keys.item = public_keys.item "
|
||||||
|
"LEFT JOIN tokens ON public_keys.item = tokens.item"
|
||||||
|
|
||||||
|
<< "CREATE VIEW view_certs AS SELECT "
|
||||||
|
"items.id, items.name, items.type, items.date AS item_date, "
|
||||||
|
"items.source, items.comment, "
|
||||||
|
"x509super.pkey, "
|
||||||
|
"certs.serial AS certs_serial, certs.issuer, certs.ca, certs.cert, "
|
||||||
|
"authority.template, authority.crlExpire, "
|
||||||
|
"authority.crlNo AS auth_crlno, authority.crlDays, authority.dnPolicy, "
|
||||||
|
"revocations.serial, revocations.date, revocations.invaldate, "
|
||||||
|
"revocations.crlNo, revocations.reasonBit "
|
||||||
|
"FROM certs LEFT JOIN items ON certs.item = items.id "
|
||||||
|
"LEFT JOIN x509super ON x509super.item = certs.item "
|
||||||
|
"LEFT JOIN authority ON authority.item = certs.item "
|
||||||
|
"LEFT JOIN revocations ON revocations.caId = certs.issuer "
|
||||||
|
"AND revocations.serial = certs.serial"
|
||||||
|
|
||||||
|
<< "CREATE VIEW view_requests AS SELECT "
|
||||||
|
"items.id, items.name, items.type, items.date, "
|
||||||
|
"items.source, items.comment, "
|
||||||
|
"x509super.pkey, "
|
||||||
|
"requests.request, requests.signed "
|
||||||
|
"FROM requests LEFT JOIN items ON requests.item = items.id "
|
||||||
|
"LEFT JOIN x509super ON x509super.item = requests.item"
|
||||||
|
|
||||||
|
<< "CREATE VIEW view_crls AS SELECT "
|
||||||
|
"items.id, items.name, items.type, items.date, "
|
||||||
|
"items.source, items.comment, "
|
||||||
|
"crls.num, crls.issuer, crls.crl "
|
||||||
|
"FROM crls LEFT JOIN items ON crls.item = items.id "
|
||||||
|
|
||||||
|
<< "CREATE VIEW view_templates AS SELECT "
|
||||||
|
"items.id, items.name, items.type, items.date, "
|
||||||
|
"items.source, items.comment, "
|
||||||
|
"templates.version, templates.template "
|
||||||
|
"FROM templates LEFT JOIN items ON templates.item = items.id"
|
||||||
|
|
||||||
|
|
||||||
|
<< "UPDATE settings SET value='2' WHERE key_='schema'"
|
||||||
|
|
||||||
|
;
|
||||||
|
/* Schema Version 3: Add indexes over hashes and primary, foreign keys */
|
||||||
|
schemas[2]
|
||||||
|
|
||||||
|
<< "CREATE INDEX i_settings_key_ ON settings (key_)"
|
||||||
|
<< "CREATE INDEX i_items_id ON items (id)"
|
||||||
|
<< "CREATE INDEX i_public_keys_item ON public_keys (item)"
|
||||||
|
<< "CREATE INDEX i_public_keys_hash ON public_keys (hash)"
|
||||||
|
<< "CREATE INDEX i_private_keys_item ON private_keys (item)"
|
||||||
|
<< "CREATE INDEX i_tokens_item ON tokens (item)"
|
||||||
|
<< "CREATE INDEX i_token_mechanism_item ON token_mechanism (item)"
|
||||||
|
<< "CREATE INDEX i_x509super_item ON x509super (item)"
|
||||||
|
<< "CREATE INDEX i_x509super_subj_hash ON x509super (subj_hash)"
|
||||||
|
<< "CREATE INDEX i_x509super_key_hash ON x509super (key_hash)"
|
||||||
|
<< "CREATE INDEX i_x509super_pkey ON x509super (pkey)"
|
||||||
|
<< "CREATE INDEX i_requests_item ON requests (item)"
|
||||||
|
<< "CREATE INDEX i_requests_hash ON requests (hash)"
|
||||||
|
<< "CREATE INDEX i_certs_item ON certs (item)"
|
||||||
|
<< "CREATE INDEX i_certs_hash ON certs (hash)"
|
||||||
|
<< "CREATE INDEX i_certs_iss_hash ON certs (iss_hash)"
|
||||||
|
<< "CREATE INDEX i_certs_serial ON certs (serial)"
|
||||||
|
<< "CREATE INDEX i_certs_issuer ON certs (issuer)"
|
||||||
|
<< "CREATE INDEX i_certs_ca ON certs (ca)"
|
||||||
|
<< "CREATE INDEX i_authority_item ON authority (item)"
|
||||||
|
<< "CREATE INDEX i_crls_item ON crls (item)"
|
||||||
|
<< "CREATE INDEX i_crls_hash ON crls (hash)"
|
||||||
|
<< "CREATE INDEX i_crls_iss_hash ON crls (iss_hash)"
|
||||||
|
<< "CREATE INDEX i_crls_issuer ON crls (issuer)"
|
||||||
|
<< "CREATE INDEX i_revocations_caId_serial ON revocations (caId, serial)"
|
||||||
|
<< "CREATE INDEX i_templates_item ON templates (item)"
|
||||||
|
<< "UPDATE settings SET value='3' WHERE key_='schema'"
|
||||||
|
|
||||||
|
;
|
||||||
|
/* Schema Version 4: Add private key view to extract a private key with:
|
||||||
|
mysql: mysql -sNp -u xca xca_msq -e
|
||||||
|
or sqlite: sqlite3 ~/sqlxdb.xdb
|
||||||
|
or psql: psql -t -h 192.168.140.7 -U xca -d xca_pg -c
|
||||||
|
"SELECT private FROM view_private WHERE name='pk8key';" |\
|
||||||
|
base64 -d | openssl pkcs8 -inform DER
|
||||||
|
* First mysql/psql will ask for a password and then OpenSSL will ask for
|
||||||
|
* the database password.
|
||||||
|
*/
|
||||||
|
schemas[3]
|
||||||
|
|
||||||
|
<< "CREATE VIEW view_private AS SELECT "
|
||||||
|
"name, private FROM private_keys JOIN items ON "
|
||||||
|
"items.id = private_keys.item"
|
||||||
|
<< "UPDATE settings SET value='4' WHERE key_='schema'"
|
||||||
|
;
|
||||||
|
|
||||||
|
schemas[4]
|
||||||
|
<< "ALTER TABLE items ADD stamp INTEGER NOT NULL DEFAULT (0)"
|
||||||
|
<< "CREATE INDEX i_items_stamp ON items (stamp)"
|
||||||
|
<< "UPDATE settings SET value='5' WHERE key_='schema'"
|
||||||
|
;
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user