2019-03-05 08:07:13 +00:00
|
|
|
package db
|
|
|
|
|
|
|
|
import (
|
2022-04-06 01:00:01 +00:00
|
|
|
"crypto/x509"
|
2019-03-05 08:07:13 +00:00
|
|
|
"errors"
|
2022-04-06 01:00:01 +00:00
|
|
|
"math/big"
|
2022-04-06 02:24:53 +00:00
|
|
|
"reflect"
|
2019-03-05 08:07:13 +00:00
|
|
|
"testing"
|
|
|
|
|
|
|
|
"github.com/smallstep/assert"
|
2022-04-06 01:00:01 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
|
|
|
"github.com/smallstep/nosql"
|
2019-04-25 00:42:14 +00:00
|
|
|
"github.com/smallstep/nosql/database"
|
2019-03-05 08:07:13 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func TestIsRevoked(t *testing.T) {
|
|
|
|
tests := map[string]struct {
|
|
|
|
key string
|
|
|
|
db *DB
|
|
|
|
isRevoked bool
|
|
|
|
err error
|
|
|
|
}{
|
|
|
|
"false/nil db": {
|
|
|
|
key: "sn",
|
|
|
|
},
|
|
|
|
"false/ErrNotFound": {
|
|
|
|
key: "sn",
|
2019-05-27 00:41:10 +00:00
|
|
|
db: &DB{&MockNoSQLDB{Err: database.ErrNotFound, Ret1: nil}, true},
|
2019-03-05 08:07:13 +00:00
|
|
|
},
|
|
|
|
"error/checking bucket": {
|
|
|
|
key: "sn",
|
2019-05-27 00:41:10 +00:00
|
|
|
db: &DB{&MockNoSQLDB{Err: errors.New("force"), Ret1: nil}, true},
|
2019-03-05 08:07:13 +00:00
|
|
|
err: errors.New("error checking revocation bucket: force"),
|
|
|
|
},
|
|
|
|
"true": {
|
|
|
|
key: "sn",
|
2019-05-27 00:41:10 +00:00
|
|
|
db: &DB{&MockNoSQLDB{Ret1: []byte("value")}, true},
|
2019-03-05 08:07:13 +00:00
|
|
|
isRevoked: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for name, tc := range tests {
|
|
|
|
t.Run(name, func(t *testing.T) {
|
|
|
|
isRevoked, err := tc.db.IsRevoked(tc.key)
|
|
|
|
if err != nil {
|
|
|
|
if assert.NotNil(t, tc.err) {
|
|
|
|
assert.HasPrefix(t, tc.err.Error(), err.Error())
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
assert.Nil(t, tc.err)
|
|
|
|
assert.Fatal(t, isRevoked == tc.isRevoked)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestRevoke(t *testing.T) {
|
|
|
|
tests := map[string]struct {
|
|
|
|
rci *RevokedCertificateInfo
|
|
|
|
db *DB
|
|
|
|
err error
|
|
|
|
}{
|
|
|
|
"error/force isRevoked": {
|
|
|
|
rci: &RevokedCertificateInfo{Serial: "sn"},
|
2019-04-25 19:37:25 +00:00
|
|
|
db: &DB{&MockNoSQLDB{
|
2019-05-27 00:41:10 +00:00
|
|
|
MCmpAndSwap: func(bucket, sn, old, newval []byte) ([]byte, bool, error) {
|
|
|
|
return nil, false, errors.New("force")
|
2019-03-05 08:07:13 +00:00
|
|
|
},
|
2019-04-25 19:37:25 +00:00
|
|
|
}, true},
|
2019-05-27 00:41:10 +00:00
|
|
|
err: errors.New("error AuthDB CmpAndSwap: force"),
|
2019-03-05 08:07:13 +00:00
|
|
|
},
|
|
|
|
"error/was already revoked": {
|
|
|
|
rci: &RevokedCertificateInfo{Serial: "sn"},
|
2019-04-25 19:37:25 +00:00
|
|
|
db: &DB{&MockNoSQLDB{
|
2019-05-27 00:41:10 +00:00
|
|
|
MCmpAndSwap: func(bucket, sn, old, newval []byte) ([]byte, bool, error) {
|
|
|
|
return []byte("foo"), false, nil
|
2019-03-05 08:07:13 +00:00
|
|
|
},
|
2019-04-25 19:37:25 +00:00
|
|
|
}, true},
|
2019-03-05 08:07:13 +00:00
|
|
|
err: ErrAlreadyExists,
|
|
|
|
},
|
|
|
|
"ok": {
|
|
|
|
rci: &RevokedCertificateInfo{Serial: "sn"},
|
2019-04-25 19:37:25 +00:00
|
|
|
db: &DB{&MockNoSQLDB{
|
2019-05-27 00:41:10 +00:00
|
|
|
MCmpAndSwap: func(bucket, sn, old, newval []byte) ([]byte, bool, error) {
|
|
|
|
return []byte("foo"), true, nil
|
2019-03-05 08:07:13 +00:00
|
|
|
},
|
2019-04-25 19:37:25 +00:00
|
|
|
}, true},
|
2019-03-05 08:07:13 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
for name, tc := range tests {
|
|
|
|
t.Run(name, func(t *testing.T) {
|
|
|
|
if err := tc.db.Revoke(tc.rci); err != nil {
|
|
|
|
if assert.NotNil(t, tc.err) {
|
|
|
|
assert.HasPrefix(t, tc.err.Error(), err.Error())
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
assert.Nil(t, tc.err)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2019-05-02 22:26:18 +00:00
|
|
|
|
|
|
|
func TestUseToken(t *testing.T) {
|
|
|
|
type result struct {
|
|
|
|
err error
|
|
|
|
ok bool
|
|
|
|
}
|
|
|
|
tests := map[string]struct {
|
|
|
|
id, tok string
|
|
|
|
db *DB
|
|
|
|
want result
|
|
|
|
}{
|
2019-06-10 20:21:06 +00:00
|
|
|
"fail/force-CmpAndSwap-error": {
|
2019-05-02 22:26:18 +00:00
|
|
|
id: "id",
|
|
|
|
tok: "token",
|
|
|
|
db: &DB{&MockNoSQLDB{
|
2019-05-27 00:41:10 +00:00
|
|
|
MCmpAndSwap: func(bucket, key, old, newval []byte) ([]byte, bool, error) {
|
2019-05-02 22:26:18 +00:00
|
|
|
return nil, false, errors.New("force")
|
|
|
|
},
|
|
|
|
}, true},
|
|
|
|
want: result{
|
|
|
|
ok: false,
|
2019-06-10 20:21:06 +00:00
|
|
|
err: errors.New("error storing used token used_ott/id"),
|
2019-05-02 22:26:18 +00:00
|
|
|
},
|
|
|
|
},
|
2019-06-10 20:21:06 +00:00
|
|
|
"fail/CmpAndSwap-already-exists": {
|
2019-05-02 22:26:18 +00:00
|
|
|
id: "id",
|
|
|
|
tok: "token",
|
|
|
|
db: &DB{&MockNoSQLDB{
|
2019-05-27 00:41:10 +00:00
|
|
|
MCmpAndSwap: func(bucket, key, old, newval []byte) ([]byte, bool, error) {
|
2019-06-10 20:21:06 +00:00
|
|
|
return []byte("foo"), false, nil
|
2019-05-02 22:26:18 +00:00
|
|
|
},
|
|
|
|
}, true},
|
|
|
|
want: result{
|
|
|
|
ok: false,
|
|
|
|
},
|
|
|
|
},
|
2019-06-10 20:21:06 +00:00
|
|
|
"ok/cmpAndSwap-success": {
|
2019-05-02 22:26:18 +00:00
|
|
|
id: "id",
|
|
|
|
tok: "token",
|
|
|
|
db: &DB{&MockNoSQLDB{
|
2019-05-27 00:41:10 +00:00
|
|
|
MCmpAndSwap: func(bucket, key, old, newval []byte) ([]byte, bool, error) {
|
2019-06-10 20:21:06 +00:00
|
|
|
return []byte("bar"), true, nil
|
2019-05-02 22:26:18 +00:00
|
|
|
},
|
|
|
|
}, true},
|
|
|
|
want: result{
|
|
|
|
ok: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for name, tc := range tests {
|
|
|
|
t.Run(name, func(t *testing.T) {
|
2021-10-08 18:59:57 +00:00
|
|
|
switch ok, err := tc.db.UseToken(tc.id, tc.tok); {
|
|
|
|
case err != nil:
|
2019-05-02 22:26:18 +00:00
|
|
|
if assert.NotNil(t, tc.want.err) {
|
2019-06-10 20:21:06 +00:00
|
|
|
assert.HasPrefix(t, err.Error(), tc.want.err.Error())
|
2019-05-02 22:26:18 +00:00
|
|
|
}
|
|
|
|
assert.False(t, ok)
|
2021-10-08 18:59:57 +00:00
|
|
|
case ok:
|
2019-06-10 20:21:06 +00:00
|
|
|
assert.True(t, tc.want.ok)
|
2021-10-08 18:59:57 +00:00
|
|
|
default:
|
2019-06-10 20:21:06 +00:00
|
|
|
assert.False(t, tc.want.ok)
|
2019-05-02 22:26:18 +00:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2022-04-06 01:00:01 +00:00
|
|
|
|
|
|
|
func TestDB_StoreCertificateChain(t *testing.T) {
|
|
|
|
p := &provisioner.JWK{
|
|
|
|
ID: "some-id",
|
|
|
|
Name: "admin",
|
|
|
|
Type: "JWK",
|
|
|
|
}
|
|
|
|
chain := []*x509.Certificate{
|
|
|
|
{Raw: []byte("the certificate"), SerialNumber: big.NewInt(1234)},
|
|
|
|
}
|
|
|
|
type fields struct {
|
|
|
|
DB nosql.DB
|
|
|
|
isUp bool
|
|
|
|
}
|
|
|
|
type args struct {
|
|
|
|
p provisioner.Interface
|
|
|
|
chain []*x509.Certificate
|
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
fields fields
|
|
|
|
args args
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{"ok", fields{&MockNoSQLDB{
|
|
|
|
MSet: func(bucket, key, value []byte) error {
|
|
|
|
switch string(bucket) {
|
|
|
|
case "x509_certs":
|
|
|
|
assert.Equals(t, key, []byte("1234"))
|
|
|
|
assert.Equals(t, value, []byte("the certificate"))
|
2022-04-06 02:24:53 +00:00
|
|
|
case "x509_certs_data":
|
2022-04-06 01:00:01 +00:00
|
|
|
assert.Equals(t, key, []byte("1234"))
|
2022-04-06 02:24:53 +00:00
|
|
|
assert.Equals(t, value, []byte(`{"provisioner":{"id":"some-id","name":"admin","type":"JWK"}}`))
|
2022-04-06 01:00:01 +00:00
|
|
|
default:
|
|
|
|
t.Errorf("unexpected bucket %s", bucket)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}, true}, args{p, chain}, false},
|
|
|
|
{"ok no provisioner", fields{&MockNoSQLDB{
|
|
|
|
MSet: func(bucket, key, value []byte) error {
|
|
|
|
switch string(bucket) {
|
|
|
|
case "x509_certs":
|
|
|
|
assert.Equals(t, key, []byte("1234"))
|
|
|
|
assert.Equals(t, value, []byte("the certificate"))
|
2022-04-06 02:24:53 +00:00
|
|
|
case "x509_certs_data":
|
|
|
|
assert.Equals(t, key, []byte("1234"))
|
|
|
|
assert.Equals(t, value, []byte(`{}`))
|
2022-04-06 01:00:01 +00:00
|
|
|
default:
|
|
|
|
t.Errorf("unexpected bucket %s", bucket)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}, true}, args{nil, chain}, false},
|
|
|
|
{"fail store certificate", fields{&MockNoSQLDB{
|
|
|
|
MSet: func(bucket, key, value []byte) error {
|
|
|
|
switch string(bucket) {
|
|
|
|
case "x509_certs":
|
|
|
|
return errors.New("test error")
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
},
|
|
|
|
}, true}, args{p, chain}, true},
|
|
|
|
{"fail store provisioner", fields{&MockNoSQLDB{
|
|
|
|
MSet: func(bucket, key, value []byte) error {
|
|
|
|
switch string(bucket) {
|
2022-04-06 02:24:53 +00:00
|
|
|
case "x509_certs_data":
|
2022-04-06 01:00:01 +00:00
|
|
|
return errors.New("test error")
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
},
|
|
|
|
}, true}, args{p, chain}, true},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
d := &DB{
|
|
|
|
DB: tt.fields.DB,
|
|
|
|
isUp: tt.fields.isUp,
|
|
|
|
}
|
|
|
|
if err := d.StoreCertificateChain(tt.args.p, tt.args.chain...); (err != nil) != tt.wantErr {
|
|
|
|
t.Errorf("DB.StoreCertificateChain() error = %v, wantErr %v", err, tt.wantErr)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2022-04-06 02:24:53 +00:00
|
|
|
|
|
|
|
func TestDB_GetCertificateData(t *testing.T) {
|
|
|
|
type fields struct {
|
|
|
|
DB nosql.DB
|
|
|
|
isUp bool
|
|
|
|
}
|
|
|
|
type args struct {
|
|
|
|
serialNumber string
|
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
fields fields
|
|
|
|
args args
|
|
|
|
want *CertificateData
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{"ok", fields{&MockNoSQLDB{
|
|
|
|
MGet: func(bucket, key []byte) ([]byte, error) {
|
|
|
|
assert.Equals(t, bucket, []byte("x509_certs_data"))
|
|
|
|
assert.Equals(t, key, []byte("1234"))
|
|
|
|
return []byte(`{"provisioner":{"id":"some-id","name":"admin","type":"JWK"}}`), nil
|
|
|
|
},
|
|
|
|
}, true}, args{"1234"}, &CertificateData{
|
|
|
|
Provisioner: &ProvisionerData{
|
|
|
|
ID: "some-id", Name: "admin", Type: "JWK",
|
|
|
|
},
|
|
|
|
}, false},
|
|
|
|
{"fail not found", fields{&MockNoSQLDB{
|
|
|
|
MGet: func(bucket, key []byte) ([]byte, error) {
|
|
|
|
return nil, database.ErrNotFound
|
|
|
|
},
|
|
|
|
}, true}, args{"1234"}, nil, true},
|
|
|
|
{"fail db", fields{&MockNoSQLDB{
|
|
|
|
MGet: func(bucket, key []byte) ([]byte, error) {
|
|
|
|
return nil, errors.New("an error")
|
|
|
|
},
|
|
|
|
}, true}, args{"1234"}, nil, true},
|
|
|
|
{"fail unmarshal", fields{&MockNoSQLDB{
|
|
|
|
MGet: func(bucket, key []byte) ([]byte, error) {
|
|
|
|
return []byte(`{"bad-json"}`), nil
|
|
|
|
},
|
|
|
|
}, true}, args{"1234"}, nil, true},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
db := &DB{
|
|
|
|
DB: tt.fields.DB,
|
|
|
|
isUp: tt.fields.isUp,
|
|
|
|
}
|
|
|
|
got, err := db.GetCertificateData(tt.args.serialNumber)
|
|
|
|
if (err != nil) != tt.wantErr {
|
|
|
|
t.Errorf("DB.GetCertificateData() error = %v, wantErr %v", err, tt.wantErr)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if !reflect.DeepEqual(got, tt.want) {
|
|
|
|
t.Errorf("DB.GetCertificateData() = %v, want %v", got, tt.want)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|