Manage targets and certificates based on their availability

Author: raviks789

application/clicommands/CleanupCommand.php

@@ -0,0 +1,82 @@
+<?php
+
+/* Icinga Web 2 X.509 Module | (c) 2023 Icinga GmbH | GPLv2 */
+
+namespace Icinga\Module\X509\Clicommands;
+
+use DateTime;
+use Exception;
+use Icinga\Application\Logger;
+use Icinga\Module\X509\CertificateUtils;
+use Icinga\Module\X509\Command;
+use InvalidArgumentException;
+use Throwable;
+
+class CleanupCommand extends Command
+{
+    /**
+     * Clean up certificates that aren't used by any host and targets whose last scan is older than a certain date/time
+     *
+     * This command purges by default all targets whose last scan is older than 1 month. The last_scan column is
+     * always updated when scanning a target, regardless of whether a successful connection to the host has been
+     * established or not. Additionally, it removes all untrusted certificates that aren't part of any chains.
+     *
+     * USAGE
+     *
+     *     icingacli x509 cleanup [OPTIONS]
+     *
+     * OPTIONS
+     *
+     * --since-last-scan=<datetime>
+     *     Clean up targets whose last scan is older than the specified date/time,
+     *     which can also be an English textual datetime description like "2 days".
+     *     Default "1 month".
+     *
+     * EXAMPLES
+     *
+     * Remove all targets that haven't been scanned for 2 months and all unused untrusted certificates:
+     *
+     *     icingacli x509 cleanup --since-last-scan="2 months"
+     *
+     */
+    public function indexAction()
+    {
+        $sinceLastScan = $this->params->get('since-last-scan', '-1 month');
+        $lastScan = $sinceLastScan;
+        if ($lastScan[0] !== '-') {
+            // When the user specified "2 days" as a threshold strtotime() will compute the
+            // timestamp NOW() + 2 days, but it has to be NOW() + (-2 days)
+            $lastScan = "-$lastScan";
+        }
+
+        try {
+            $sinceLastScan = new DateTime($lastScan);
+        } catch (Exception $_) {
+            throw new InvalidArgumentException(sprintf(
+                'The specified last scan time is in an unknown format: %s',
+                $sinceLastScan
+            ));
+        }
+
+        try {
+            $conn = $this->getDb();
+            $query = $conn->delete(
+                'x509_target',
+                ['last_scan < ?' => $sinceLastScan->format('Uv')]
+            );
+
+            if ($query->rowCount() > 0) {
+                Logger::info(
+                    'Removed %d targets matching since last scan filter: %s',
+                    $query->rowCount(),
+                    $sinceLastScan->format(DateTime::ATOM)
+                );
+
+                CertificateUtils::cleanupCertificateChains($conn);
+                CertificateUtils::cleanupCertificates($conn);
+            }
+        } catch (Throwable $err) {
+            Logger::error($err);
+        }
+    }
+}

library/X509/CertificateUtils.php

@@ -11,8 +11,10 @@
 use Icinga\Module\X509\Model\X509CertificateChain;
 use Icinga\Module\X509\Model\X509CertificateSubjectAltName;
 use Icinga\Module\X509\Model\X509Dn;
+use Icinga\Module\X509\Model\X509Target;
 use ipl\Sql\Connection;
 use ipl\Sql\Expression;
+use ipl\Sql\Select;
 use ipl\Stdlib\Filter;
 
 class CertificateUtils
@@ -365,6 +367,41 @@ private static function findOrInsertDn($db, $certInfo, $type)
         return $hash;
     }
 
+    /**
+     * Cleanup certificates that aren't currently part of any chains
+     *
+     * @param Connection $db
+     */
+    public static function cleanupCertificates(Connection $db)
+    {
+        $certsQuery = $db->delete('x509_certificate', [
+            'id NOT IN ?' => (new Select())
+                ->from('x509_certificate_chain_link ccl')
+                ->columns(['ccl.certificate_id'])
+                ->distinct(),
+            'trusted = ?' => 'n',
+        ]);
+
+        $rows = $certsQuery->rowCount();
+        if ($rows > 0) {
+            Logger::info('Removed %d certificates that are not part of any chains', $rows);
+        }
+    }
+
+    /**
+     * Cleanup certificate chains that aren't used by any targets
+     *
+     * @param Connection $db
+     */
+    public static function cleanupCertificateChains(Connection $db)
+    {
+        list($chainIdSelect, $_) = X509Target::on($db)
+            ->columns('latest_certificate_chain_id')
+            ->dump();
+
+        $db->delete('x509_certificate_chain', ['id NOT IN (?)' => $chainIdSelect]);
+    }
+
     /**
      * Verify certificates
      *