certificates/authority/authority_test.go

140 lines
3.7 KiB
Go
Raw Normal View History

2018-10-05 21:48:36 +00:00
package authority
import (
2018-10-09 04:48:44 +00:00
"crypto/sha256"
"encoding/hex"
2018-10-05 21:48:36 +00:00
"testing"
2018-10-09 04:48:44 +00:00
"github.com/pkg/errors"
2018-10-05 21:48:36 +00:00
"github.com/smallstep/assert"
2019-03-07 20:15:18 +00:00
"github.com/smallstep/certificates/authority/provisioner"
2018-10-05 21:48:36 +00:00
stepJOSE "github.com/smallstep/cli/jose"
)
func testAuthority(t *testing.T) *Authority {
maxjwk, err := stepJOSE.ParseKey("testdata/secrets/max_pub.jwk")
assert.FatalError(t, err)
clijwk, err := stepJOSE.ParseKey("testdata/secrets/step_cli_key_pub.jwk")
assert.FatalError(t, err)
disableRenewal := true
2019-03-07 20:15:18 +00:00
p := []*provisioner.Provisioner{
provisioner.New(&provisioner.JWK{
2018-10-30 01:00:30 +00:00
Name: "Max",
Type: "JWK",
Key: maxjwk,
2019-03-07 20:15:18 +00:00
}),
provisioner.New(&provisioner.JWK{
2018-10-30 01:00:30 +00:00
Name: "step-cli",
Type: "JWK",
Key: clijwk,
2019-03-07 20:15:18 +00:00
}),
provisioner.New(&provisioner.JWK{
Name: "dev",
Type: "JWK",
Key: maxjwk,
2019-03-07 20:15:18 +00:00
Claims: &provisioner.Claims{
DisableRenewal: &disableRenewal,
},
2019-03-07 20:15:18 +00:00
}),
2018-10-05 21:48:36 +00:00
}
c := &Config{
Address: "127.0.0.1:443",
2019-01-07 23:30:28 +00:00
Root: []string{"testdata/secrets/root_ca.crt"},
2018-10-05 21:48:36 +00:00
IntermediateCert: "testdata/secrets/intermediate_ca.crt",
IntermediateKey: "testdata/secrets/intermediate_ca_key",
DNSNames: []string{"test.ca.smallstep.com"},
2018-10-05 21:48:36 +00:00
Password: "pass",
AuthorityConfig: &AuthConfig{
Provisioners: p,
},
}
a, err := New(c)
assert.FatalError(t, err)
return a
}
2018-10-09 04:48:44 +00:00
func TestAuthorityNew(t *testing.T) {
type newTest struct {
config *Config
err error
}
tests := map[string]func(t *testing.T) *newTest{
"ok": func(t *testing.T) *newTest {
c, err := LoadConfiguration("../ca/testdata/ca.json")
assert.FatalError(t, err)
return &newTest{
config: c,
}
},
"fail bad root": func(t *testing.T) *newTest {
2018-10-09 04:48:44 +00:00
c, err := LoadConfiguration("../ca/testdata/ca.json")
assert.FatalError(t, err)
2019-01-07 23:30:28 +00:00
c.Root = []string{"foo"}
2018-10-09 04:48:44 +00:00
return &newTest{
config: c,
err: errors.New("open foo failed: no such file or directory"),
}
},
"fail bad password": func(t *testing.T) *newTest {
2018-10-09 04:48:44 +00:00
c, err := LoadConfiguration("../ca/testdata/ca.json")
assert.FatalError(t, err)
c.Password = "wrong"
return &newTest{
config: c,
err: errors.New("error decrypting ../ca/testdata/secrets/intermediate_ca_key: x509: decryption password incorrect"),
}
},
"fail loading CA cert": func(t *testing.T) *newTest {
2018-10-09 04:48:44 +00:00
c, err := LoadConfiguration("../ca/testdata/ca.json")
assert.FatalError(t, err)
c.IntermediateCert = "wrong"
return &newTest{
config: c,
err: errors.New("open wrong failed: no such file or directory"),
}
},
}
for name, genTestCase := range tests {
t.Run(name, func(t *testing.T) {
tc := genTestCase(t)
auth, err := New(tc.config)
if err != nil {
if assert.NotNil(t, tc.err) {
assert.HasPrefix(t, err.Error(), tc.err.Error())
}
} else {
if assert.Nil(t, tc.err) {
2019-01-07 23:30:28 +00:00
sum := sha256.Sum256(auth.rootX509Certs[0].Raw)
2018-10-09 04:48:44 +00:00
root, ok := auth.certificates.Load(hex.EncodeToString(sum[:]))
assert.Fatal(t, ok)
2019-01-07 23:30:28 +00:00
assert.Equals(t, auth.rootX509Certs[0], root)
2018-10-09 04:48:44 +00:00
assert.True(t, auth.initOnce)
assert.NotNil(t, auth.intermediateIdentity)
for _, p := range tc.config.AuthorityConfig.Provisioners {
2019-03-07 20:15:18 +00:00
_p, ok := auth.provisioners.Load(p.ID())
2018-10-09 04:48:44 +00:00
assert.True(t, ok)
assert.Equals(t, p, _p)
if len(p.EncryptedKey) > 0 {
2019-03-07 20:15:18 +00:00
key, ok := auth.provisioners.LoadEncryptedKey(p.Key.KeyID)
2018-10-09 04:48:44 +00:00
assert.True(t, ok)
assert.Equals(t, p.EncryptedKey, key)
}
}
// sanity check
_, ok = auth.provisionerIDIndex.Load("fooo")
assert.False(t, ok)
assert.Equals(t, auth.audiences, []string{
"step-certificate-authority",
"https://127.0.0.1/sign",
"https://127.0.0.1/1.0/sign",
})
2018-10-09 04:48:44 +00:00
}
}
})
}
}