From ec5f155f8d50c7db14c15878051fded895d4244f Mon Sep 17 00:00:00 2001 From: Mariano Cano Date: Mon, 20 Jul 2020 17:19:20 -0700 Subject: [PATCH] Add more tests and missing marshallers. --- x509util/certificate_test.go | 31 +++++++++-- x509util/marshal_utils.go | 103 +++++++++++++++++++++++------------ x509util/name.go | 19 ++++--- x509util/templates.go | 2 +- 4 files changed, 105 insertions(+), 50 deletions(-) diff --git a/x509util/certificate_test.go b/x509util/certificate_test.go index 140578ec..a84f6eeb 100644 --- a/x509util/certificate_test.go +++ b/x509util/certificate_test.go @@ -105,7 +105,7 @@ func (b *badSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) } func TestNewCertificate(t *testing.T) { - cr, priv := createCertificateRequest(t, "commonName", []string{"foo.com"}) + cr, priv := createCertificateRequest(t, "commonName", []string{"foo.com", "root@foo.com"}) crBadSignateure, _ := createCertificateRequest(t, "fail", []string{"foo.com"}) crBadSignateure.PublicKey = priv.Public() @@ -120,9 +120,10 @@ func TestNewCertificate(t *testing.T) { wantErr bool }{ {"okSimple", args{cr, nil}, &Certificate{ - Subject: Subject{CommonName: "commonName"}, - DNSNames: []string{"foo.com"}, - KeyUsage: KeyUsage(x509.KeyUsageDigitalSignature), + Subject: Subject{CommonName: "commonName"}, + DNSNames: []string{"foo.com"}, + EmailAddresses: []string{"root@foo.com"}, + KeyUsage: KeyUsage(x509.KeyUsageDigitalSignature), ExtKeyUsage: ExtKeyUsage([]x509.ExtKeyUsage{ x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth, @@ -142,8 +143,30 @@ func TestNewCertificate(t *testing.T) { PublicKey: priv.Public(), PublicKeyAlgorithm: x509.Ed25519, }, false}, + {"okExample", args{cr, []Option{WithTemplateFile("./testdata/example.tpl", TemplateData{ + SANsKey: []SubjectAlternativeName{ + {Type: "dns", Value: "foo.com"}, + }, + TokenKey: map[string]string{ + "Issuer": "https://iss", + "Subject": "sub", + }, + })}}, &Certificate{ + Subject: Subject{CommonName: "commonName"}, + SANs: []SubjectAlternativeName{{Type: DNSType, Value: "foo.com"}}, + EmailAddresses: []string{"root@foo.com"}, + URIs: []*url.URL{{Scheme: "https", Host: "iss", Fragment: "sub"}}, + KeyUsage: KeyUsage(x509.KeyUsageDigitalSignature), + ExtKeyUsage: ExtKeyUsage([]x509.ExtKeyUsage{ + x509.ExtKeyUsageServerAuth, + x509.ExtKeyUsageClientAuth, + }), + PublicKey: priv.Public(), + PublicKeyAlgorithm: x509.Ed25519, + }, false}, {"badSignature", args{crBadSignateure, nil}, nil, true}, {"failTemplate", args{cr, []Option{WithTemplate(`{{ fail "fatal error }}`, CreateTemplateData("commonName", []string{"foo.com"}))}}, nil, true}, + {"missingTemplate", args{cr, []Option{WithTemplateFile("./testdata/missing.tpl", CreateTemplateData("commonName", []string{"foo.com"}))}}, nil, true}, {"badJson", args{cr, []Option{WithTemplate(`"this is not a json object"`, CreateTemplateData("commonName", []string{"foo.com"}))}}, nil, true}, } for _, tt := range tests { diff --git a/x509util/marshal_utils.go b/x509util/marshal_utils.go index fedc0a1c..4408e41b 100644 --- a/x509util/marshal_utils.go +++ b/x509util/marshal_utils.go @@ -40,17 +40,18 @@ func (m *MultiIP) UnmarshalJSON(data []byte) error { if err != nil { return err } - - ips := make([]net.IP, len(ms)) - for i, s := range ms { - ip := net.ParseIP(s) - if ip == nil { - return errors.Errorf("error unmarshaling json: ip %s is not valid", s) + if ms != nil { + ips := make([]net.IP, len(ms)) + for i, s := range ms { + ip := net.ParseIP(s) + if ip == nil { + return errors.Errorf("error unmarshaling json: ip %s is not valid", s) + } + ips[i] = ip } - ips[i] = ip - } - *m = MultiIP(ips) + *m = MultiIP(ips) + } return nil } @@ -58,23 +59,36 @@ func (m *MultiIP) UnmarshalJSON(data []byte) error { // into a []*net.IPNet. type MultiIPNet []*net.IPNet +// MarshalJSON implements the json.Marshaler interface for MultiIPNet. +func (m MultiIPNet) MarshalJSON() ([]byte, error) { + if m == nil { + return []byte("null"), nil + } + ipNets := make([]string, len(m)) + for i, v := range m { + ipNets[i] = v.String() + } + return json.Marshal(ipNets) +} + // UnmarshalJSON implements the json.Unmarshaler interface for MultiIPNet. func (m *MultiIPNet) UnmarshalJSON(data []byte) error { ms, err := unmarshalMultiString(data) if err != nil { return err } - - ipNets := make([]*net.IPNet, len(ms)) - for i, s := range ms { - _, ipNet, err := net.ParseCIDR(s) - if err != nil { - return errors.Wrap(err, "error unmarshaling json") + if ms != nil { + ipNets := make([]*net.IPNet, len(ms)) + for i, s := range ms { + _, ipNet, err := net.ParseCIDR(s) + if err != nil { + return errors.Wrap(err, "error unmarshaling json") + } + ipNets[i] = ipNet } - ipNets[i] = ipNet - } - *m = MultiIPNet(ipNets) + *m = MultiIPNet(ipNets) + } return nil } @@ -84,6 +98,9 @@ type MultiURL []*url.URL // MarshalJSON implements the json.Marshaler interface for MultiURL. func (m MultiURL) MarshalJSON() ([]byte, error) { + if m == nil { + return []byte("null"), nil + } urls := make([]string, len(m)) for i, u := range m { urls[i] = u.String() @@ -97,17 +114,18 @@ func (m *MultiURL) UnmarshalJSON(data []byte) error { if err != nil { return err } - - urls := make([]*url.URL, len(ms)) - for i, s := range ms { - u, err := url.Parse(s) - if err != nil { - return errors.Wrap(err, "error unmarshaling json") + if ms != nil { + urls := make([]*url.URL, len(ms)) + for i, s := range ms { + u, err := url.Parse(s) + if err != nil { + return errors.Wrap(err, "error unmarshaling json") + } + urls[i] = u } - urls[i] = u - } - *m = MultiURL(urls) + *m = MultiURL(urls) + } return nil } @@ -115,6 +133,18 @@ func (m *MultiURL) UnmarshalJSON(data []byte) error { // of strings into a []asn1.ObjectIdentifier. type MultiObjectIdentifier []asn1.ObjectIdentifier +// MarshalJSON implements the json.Marshaler interface for MultiObjectIdentifier. +func (m MultiObjectIdentifier) MarshalJSON() ([]byte, error) { + if m == nil { + return []byte("null"), nil + } + oids := make([]string, len(m)) + for i, u := range m { + oids[i] = u.String() + } + return json.Marshal(oids) +} + // UnmarshalJSON implements the json.Unmarshaler interface for // MultiObjectIdentifier. func (m *MultiObjectIdentifier) UnmarshalJSON(data []byte) error { @@ -122,17 +152,18 @@ func (m *MultiObjectIdentifier) UnmarshalJSON(data []byte) error { if err != nil { return err } - - oids := make([]asn1.ObjectIdentifier, len(ms)) - for i, s := range ms { - oid, err := parseObjectIdentifier(s) - if err != nil { - return err + if ms != nil { + oids := make([]asn1.ObjectIdentifier, len(ms)) + for i, s := range ms { + oid, err := parseObjectIdentifier(s) + if err != nil { + return err + } + oids[i] = oid } - oids[i] = oid - } - *m = MultiObjectIdentifier(oids) + *m = MultiObjectIdentifier(oids) + } return nil } diff --git a/x509util/name.go b/x509util/name.go index 2c6e3dfc..abfdf29e 100644 --- a/x509util/name.go +++ b/x509util/name.go @@ -11,15 +11,15 @@ import ( // Name is the JSON representation of X.501 type Name, used in the X.509 subject // and issuer fields. type Name struct { - Country MultiString `json:"country"` - Organization MultiString `json:"organization"` - OrganizationalUnit MultiString `json:"organizationUnit"` - Locality MultiString `json:"locality"` - Province MultiString `json:"province"` - StreetAddress MultiString `json:"streetAddress"` - PostalCode MultiString `json:"postalCode"` - SerialNumber string `json:"serialNumber"` - CommonName string `json:"commonName"` + Country MultiString `json:"country,omitempty"` + Organization MultiString `json:"organization,omitempty"` + OrganizationalUnit MultiString `json:"organizationalUnit,omitempty"` + Locality MultiString `json:"locality,omitempty"` + Province MultiString `json:"province,omitempty"` + StreetAddress MultiString `json:"streetAddress,omitempty"` + PostalCode MultiString `json:"postalCode,omitempty"` + SerialNumber string `json:"serialNumber,omitempty"` + CommonName string `json:"commonName,omitempty"` } // UnmarshalJSON implements the json.Unmarshal interface and unmarshals a JSON @@ -74,6 +74,7 @@ func (s Subject) Set(c *x509.Certificate) { // Issuer is the JSON representation of the X.509 issuer field. type Issuer Name +// nolint:unused func newIssuer(n pkix.Name) Issuer { return Issuer{ Country: n.Country, diff --git a/x509util/templates.go b/x509util/templates.go index 12d516e9..7f82d159 100644 --- a/x509util/templates.go +++ b/x509util/templates.go @@ -101,7 +101,7 @@ const DefaultLeafTemplate = `{ // can be provided to force only the verified domains, if the option is true // `.SANs` will be set with the verified domains. const DefaultIIDLeafTemplate = `{ - "subject": {"commonName": "{{ .Insecure.CR.Subject.CommonName }}"}, + "subject": {"commonName":"{{ .Insecure.CR.Subject.CommonName }}"}, {{- if .SANs }} "sans": {{ toJson .SANs }}, {{- else }}