@ -15,6 +15,7 @@ import (
"fmt"
"fmt"
"net/http"
"net/http"
"reflect"
"reflect"
"strings"
"testing"
"testing"
"time"
"time"
@ -24,15 +25,17 @@ import (
"go.step.sm/crypto/pemutil"
"go.step.sm/crypto/pemutil"
"go.step.sm/crypto/x509util"
"go.step.sm/crypto/x509util"
"github.com/smallstep/assert"
"github.com/smallstep/certificates/api/render"
"github.com/smallstep/certificates/api/render"
"github.com/smallstep/certificates/authority/config"
"github.com/smallstep/certificates/authority/config"
"github.com/smallstep/certificates/authority/policy"
"github.com/smallstep/certificates/authority/policy"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/certificates/cas/apiv1"
"github.com/smallstep/certificates/cas/softcas"
"github.com/smallstep/certificates/cas/softcas"
"github.com/smallstep/certificates/db"
"github.com/smallstep/certificates/db"
"github.com/smallstep/certificates/errs"
"github.com/smallstep/certificates/errs"
"github.com/smallstep/nosql/database"
"github.com/smallstep/nosql/database"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
) )
var ( var (
@ -80,25 +83,25 @@ func generateCertificate(t *testing.T, commonName string, sans []string, opts ..
t . Helper ( )
t . Helper ( )
priv , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader )
priv , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader )
assert. Fatal Error( t , err )
require. No Error( t , err )
cr , err := x509util . CreateCertificateRequest ( commonName , sans , priv )
cr , err := x509util . CreateCertificateRequest ( commonName , sans , priv )
assert. Fatal Error( t , err )
require. No Error( t , err )
template , err := x509util . NewCertificate ( cr )
template , err := x509util . NewCertificate ( cr )
assert. Fatal Error( t , err )
require. No Error( t , err )
cert := template . GetCertificate ( )
cert := template . GetCertificate ( )
for _ , m := range opts {
for _ , m := range opts {
switch m := m . ( type ) {
switch m := m . ( type ) {
case provisioner . CertificateModifierFunc :
case provisioner . CertificateModifierFunc :
err = m . Modify ( cert , provisioner . SignOptions { } )
err = m . Modify ( cert , provisioner . SignOptions { } )
assert. Fatal Error( t , err )
require. No Error( t , err )
case signerFunc :
case signerFunc :
cert , err = m ( cert , priv . Public ( ) )
cert , err = m ( cert , priv . Public ( ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
default :
default :
t. Fatalf ( "unknown type %T" , m )
require. Fail ( t , "" , "unknown type %T" , m )
}
}
}
}
@ -108,36 +111,36 @@ func generateCertificate(t *testing.T, commonName string, sans []string, opts ..
func generateRootCertificate ( t * testing . T ) ( * x509 . Certificate , crypto . Signer ) { func generateRootCertificate ( t * testing . T ) ( * x509 . Certificate , crypto . Signer ) {
t . Helper ( )
t . Helper ( )
priv , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader )
priv , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader )
assert. Fatal Error( t , err )
require. No Error( t , err )
cr , err := x509util . CreateCertificateRequest ( "TestRootCA" , nil , priv )
cr , err := x509util . CreateCertificateRequest ( "TestRootCA" , nil , priv )
assert. Fatal Error( t , err )
require. No Error( t , err )
data := x509util . CreateTemplateData ( "TestRootCA" , nil )
data := x509util . CreateTemplateData ( "TestRootCA" , nil )
template , err := x509util . NewCertificate ( cr , x509util . WithTemplate ( x509util . DefaultRootTemplate , data ) )
template , err := x509util . NewCertificate ( cr , x509util . WithTemplate ( x509util . DefaultRootTemplate , data ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
cert := template . GetCertificate ( )
cert := template . GetCertificate ( )
cert , err = x509util . CreateCertificate ( cert , cert , priv . Public ( ) , priv )
cert , err = x509util . CreateCertificate ( cert , cert , priv . Public ( ) , priv )
assert. Fatal Error( t , err )
require. No Error( t , err )
return cert , priv
return cert , priv
} }
func generateIntermidiateCertificate ( t * testing . T , issuer * x509 . Certificate , signer crypto . Signer ) ( * x509 . Certificate , crypto . Signer ) { func generateIntermidiateCertificate ( t * testing . T , issuer * x509 . Certificate , signer crypto . Signer ) ( * x509 . Certificate , crypto . Signer ) {
t . Helper ( )
t . Helper ( )
priv , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader )
priv , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader )
assert. Fatal Error( t , err )
require. No Error( t , err )
cr , err := x509util . CreateCertificateRequest ( "TestIntermediateCA" , nil , priv )
cr , err := x509util . CreateCertificateRequest ( "TestIntermediateCA" , nil , priv )
assert. Fatal Error( t , err )
require. No Error( t , err )
data := x509util . CreateTemplateData ( "TestIntermediateCA" , nil )
data := x509util . CreateTemplateData ( "TestIntermediateCA" , nil )
template , err := x509util . NewCertificate ( cr , x509util . WithTemplate ( x509util . DefaultRootTemplate , data ) )
template , err := x509util . NewCertificate ( cr , x509util . WithTemplate ( x509util . DefaultRootTemplate , data ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
cert := template . GetCertificate ( )
cert := template . GetCertificate ( )
cert , err = x509util . CreateCertificate ( cert , issuer , priv . Public ( ) , signer )
cert , err = x509util . CreateCertificate ( cert , issuer , priv . Public ( ) , signer )
assert. Fatal Error( t , err )
require. No Error( t , err )
return cert , priv
return cert , priv
} }
@ -192,9 +195,9 @@ func getCSR(t *testing.T, priv interface{}, opts ...func(*x509.CertificateReques
opt ( _csr )
opt ( _csr )
}
}
csrBytes , err := x509 . CreateCertificateRequest ( rand . Reader , _csr , priv )
csrBytes , err := x509 . CreateCertificateRequest ( rand . Reader , _csr , priv )
assert. Fatal Error( t , err )
require. No Error( t , err )
csr , err := x509 . ParseCertificateRequest ( csrBytes )
csr , err := x509 . ParseCertificateRequest ( csrBytes )
assert. Fatal Error( t , err )
require. No Error( t , err )
return csr
return csr
} }
@ -221,6 +224,15 @@ func generateSubjectKeyID(pub crypto.PublicKey) ([]byte, error) {
return hash [ : ] , nil
return hash [ : ] , nil
} }
func assertHasPrefix ( t * testing . T , s , p string ) bool {
if strings . HasPrefix ( s , p ) {
return true
}
t . Helper ( )
t . Errorf ( "%q is not a prefix of %q" , p , s )
return false
}
type basicConstraints struct { type basicConstraints struct {
IsCA bool ` asn1:"optional" `
IsCA bool ` asn1:"optional" `
MaxPathLen int ` asn1:"optional,default:-1" `
MaxPathLen int ` asn1:"optional,default:-1" `
@ -237,12 +249,12 @@ func (e *testEnforcer) Enforce(cert *x509.Certificate) error {
return nil
return nil
} }
func TestAuthority_Sign ( t * testing . T ) { func TestAuthority_Sign WithContext ( t * testing . T ) {
pub , priv , err := keyutil . GenerateDefaultKeyPair ( )
pub , priv , err := keyutil . GenerateDefaultKeyPair ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
a := testAuthority ( t )
a := testAuthority ( t )
assert. Fatal Error( t , err )
require. No Error( t , err )
a . config . AuthorityConfig . Template = & ASN1DN {
a . config . AuthorityConfig . Template = & ASN1DN {
Country : "Tazmania" ,
Country : "Tazmania" ,
Organization : "Acme Co" ,
Organization : "Acme Co" ,
@ -262,12 +274,12 @@ func TestAuthority_Sign(t *testing.T) {
// Create a token to get test extra opts.
// Create a token to get test extra opts.
p := a . config . AuthorityConfig . Provisioners [ 1 ] . ( * provisioner . JWK )
p := a . config . AuthorityConfig . Provisioners [ 1 ] . ( * provisioner . JWK )
key , err := jose . ReadKey ( "testdata/secrets/step_cli_key_priv.jwk" , jose . WithPassword ( [ ] byte ( "pass" ) ) )
key , err := jose . ReadKey ( "testdata/secrets/step_cli_key_priv.jwk" , jose . WithPassword ( [ ] byte ( "pass" ) ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
token , err := generateToken ( "smallstep test" , "step-cli" , testAudiences . Sign [ 0 ] , [ ] string { "test.smallstep.com" } , time . Now ( ) , key )
token , err := generateToken ( "smallstep test" , "step-cli" , testAudiences . Sign [ 0 ] , [ ] string { "test.smallstep.com" } , time . Now ( ) , key )
assert. Fatal Error( t , err )
require. No Error( t , err )
ctx := provisioner . NewContextWithMethod ( context . Background ( ) , provisioner . SignMethod )
ctx := provisioner . NewContextWithMethod ( context . Background ( ) , provisioner . SignMethod )
extraOpts , err := a . Authorize ( ctx , token )
extraOpts , err := a . Authorize ( ctx , token )
assert. Fatal Error( t , err )
require. No Error( t , err )
type signTest struct {
type signTest struct {
auth * Authority
auth * Authority
@ -372,9 +384,9 @@ W5kR63lNVHBHgQmv5mA8YFsfrJHstaz5k727v2LMHEYIf5/3i16d5zhuxUoaPTYr
ZYtQ9Ot36qc = ZYtQ9Ot36qc =
-- -- - END CERTIFICATE REQUEST -- -- - ` -- -- - END CERTIFICATE REQUEST -- -- - `
block , _ := pem . Decode ( [ ] byte ( shortRSAKeyPEM ) )
block , _ := pem . Decode ( [ ] byte ( shortRSAKeyPEM ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
csr , err := x509 . ParseCertificateRequest ( block . Bytes )
csr , err := x509 . ParseCertificateRequest ( block . Bytes )
assert. Fatal Error( t , err )
require. No Error( t , err )
return & signTest {
return & signTest {
auth : a ,
auth : a ,
@ -413,10 +425,10 @@ ZYtQ9Ot36qc=
X509 : & provisioner . X509Options { Template : ` {{ fail "fail message" }} ` } ,
X509 : & provisioner . X509Options { Template : ` {{ fail "fail message" }} ` } ,
}
}
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
assert. Fatal Error( t , err )
require. No Error( t , err )
testAuthority . db = & db . MockAuthDB {
testAuthority . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -442,10 +454,10 @@ ZYtQ9Ot36qc=
} ,
} ,
}
}
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
assert. Fatal Error( t , err )
require. No Error( t , err )
testAuthority . db = & db . MockAuthDB {
testAuthority . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -471,10 +483,10 @@ ZYtQ9Ot36qc=
} ,
} ,
}
}
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
assert. Fatal Error( t , err )
require. No Error( t , err )
testAuthority . db = & db . MockAuthDB {
testAuthority . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -492,7 +504,7 @@ ZYtQ9Ot36qc=
aa := testAuthority ( t )
aa := testAuthority ( t )
aa . db = & db . MockAuthDB {
aa . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -517,7 +529,7 @@ ZYtQ9Ot36qc=
} ) )
} ) )
aa . db = & db . MockAuthDB {
aa . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -537,7 +549,7 @@ ZYtQ9Ot36qc=
aa . db = & db . MockAuthDB {
aa . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
fmt . Println ( crt . Subject )
fmt . Println ( crt . Subject )
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -549,7 +561,7 @@ ZYtQ9Ot36qc=
} ,
} ,
}
}
engine , err := policy . New ( options )
engine , err := policy . New ( options )
assert. Fatal Error( t , err )
require. No Error( t , err )
aa . policyEngine = engine
aa . policyEngine = engine
return & signTest {
return & signTest {
auth : aa ,
auth : aa ,
@ -598,7 +610,7 @@ ZYtQ9Ot36qc=
_a := testAuthority ( t )
_a := testAuthority ( t )
_a . db = & db . MockAuthDB {
_a . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -617,7 +629,7 @@ ZYtQ9Ot36qc=
bcExt . Id = asn1 . ObjectIdentifier { 2 , 5 , 29 , 19 }
bcExt . Id = asn1 . ObjectIdentifier { 2 , 5 , 29 , 19 }
bcExt . Critical = false
bcExt . Critical = false
bcExt . Value , err = asn1 . Marshal ( basicConstraints { IsCA : true , MaxPathLen : 4 } )
bcExt . Value , err = asn1 . Marshal ( basicConstraints { IsCA : true , MaxPathLen : 4 } )
assert. Fatal Error( t , err )
require. No Error( t , err )
csr := getCSR ( t , priv , setExtraExtsCSR ( [ ] pkix . Extension {
csr := getCSR ( t , priv , setExtraExtsCSR ( [ ] pkix . Extension {
bcExt ,
bcExt ,
@ -632,7 +644,7 @@ ZYtQ9Ot36qc=
_a := testAuthority ( t )
_a := testAuthority ( t )
_a . db = & db . MockAuthDB {
_a . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -663,10 +675,10 @@ ZYtQ9Ot36qc=
} ` } ,
} ` } ,
}
}
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
assert. Fatal Error( t , err )
require. No Error( t , err )
testAuthority . db = & db . MockAuthDB {
testAuthority . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -697,10 +709,10 @@ ZYtQ9Ot36qc=
} ` } ,
} ` } ,
}
}
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
testExtraOpts , err := testAuthority . Authorize ( ctx , token )
assert. Fatal Error( t , err )
require. No Error( t , err )
testAuthority . db = & db . MockAuthDB {
testAuthority . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
return nil
return nil
} ,
} ,
}
}
@ -737,7 +749,7 @@ ZYtQ9Ot36qc=
_a . config . AuthorityConfig . Template = & ASN1DN { }
_a . config . AuthorityConfig . Template = & ASN1DN { }
_a . db = & db . MockAuthDB {
_a . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t, crt . Subjec t, pkix . Name { } )
assert . Equal ( , pkix . Name { } , crt . Subject )
return nil
return nil
} ,
} ,
}
}
@ -762,8 +774,8 @@ ZYtQ9Ot36qc=
aa . config . AuthorityConfig . Template = a . config . AuthorityConfig . Template
aa . config . AuthorityConfig . Template = a . config . AuthorityConfig . Template
aa . db = & db . MockAuthDB {
aa . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , crt . Subject . CommonName )
assert . Equal s ( t , crt . CRLDistributionPoints , [ ] string { "http://ca.example.org/leaf.crl" } )
assert . Equal ( t , [ ] string { "http://ca.example.org/leaf.crl" } , crt . CRLDistributionPoints )
return nil
return nil
} ,
} ,
}
}
@ -783,7 +795,7 @@ ZYtQ9Ot36qc=
aa . config . AuthorityConfig . Template = a . config . AuthorityConfig . Template
aa . config . AuthorityConfig . Template = a . config . AuthorityConfig . Template
aa . db = & db . MockAuthDB {
aa . db = & db . MockAuthDB {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
MStoreCertificate : func ( crt * x509 . Certificate ) error {
assert . Equal s ( t , crt . Subject . CommonName , "smallstep test" )
assert . Equal ( t , crt . Subject . CommonName , "smallstep test" )
return nil
return nil
} ,
} ,
}
}
@ -796,7 +808,7 @@ ZYtQ9Ot36qc=
} ,
} ,
}
}
engine , err := policy . New ( options )
engine , err := policy . New ( options )
assert. Fatal Error( t , err )
require. No Error( t , err )
aa . policyEngine = engine
aa . policyEngine = engine
return & signTest {
return & signTest {
auth : aa ,
auth : aa ,
@ -816,13 +828,13 @@ ZYtQ9Ot36qc=
MStoreCertificateChain : func ( prov provisioner . Interface , certs ... * x509 . Certificate ) error {
MStoreCertificateChain : func ( prov provisioner . Interface , certs ... * x509 . Certificate ) error {
p , ok := prov . ( attProvisioner )
p , ok := prov . ( attProvisioner )
if assert . True ( t , ok ) {
if assert . True ( t , ok ) {
assert . Equal s ( t , & provisioner . AttestationData {
assert . Equal ( t , & provisioner . AttestationData {
PermanentIdentifier : "1234567890" ,
PermanentIdentifier : "1234567890" ,
} , p . AttestationData ( ) )
} , p . AttestationData ( ) )
}
}
if assert . Len ( t , 2 , certs ) {
if assert . Len ( t , certs , 2 ) {
assert . Equal s ( t , certs [ 0 ] . Subject . CommonName , "smallstep test" )
assert . Equal ( t , "smallstep test" , certs [ 0 ] . Subject . CommonName )
assert . Equal s ( t , certs [ 1 ] . Subject . CommonName , "smallstep Intermediate CA" )
assert . Equal ( t , "smallstep Intermediate CA" , certs [ 1 ] . Subject . CommonName )
}
}
return nil
return nil
} ,
} ,
@ -846,51 +858,50 @@ ZYtQ9Ot36qc=
t . Run ( name , func ( t * testing . T ) {
t . Run ( name , func ( t * testing . T ) {
tc := genTestCase ( t )
tc := genTestCase ( t )
certChain , err := tc . auth . Sign ( tc . csr , tc . signOpts , tc . extraOpts ... )
certChain , err := tc . auth . Sign WithContext ( context . Background ( ) , tc . csr , tc . signOpts , tc . extraOpts ... )
if err != nil {
if err != nil {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
assert . Nil ( t , certChain )
assert . Nil ( t , certChain )
var sc render . StatusCodedError
var sc render . StatusCodedError
assert. Fatal ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
require. True ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
assert . Equal s ( t , sc . StatusCode ( ) , tc . code )
assert . Equal ( t , tc . code , sc . StatusCode ( ) )
assert . ( t , err . Error ( ) , tc . err . Error ( ) )
assert ( t , err . Error ( ) , tc . err . Error ( ) )
var ctxErr * errs . Error
var ctxErr * errs . Error
assert. Fatal ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
require. True ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
assert . Equal s ( t , ctxErr . Details [ "csr" ] , tc . csr )
assert . Equal ( t , tc . csr , ctxErr . Details [ "csr" ] )
assert . Equal s ( t , ctxErr . Details [ "signOptions" ] , tc . signOpts )
assert . Equal ( t , tc . signOpts , ctxErr . Details [ "signOptions" ] )
}
}
} else {
} else {
leaf := certChain [ 0 ]
leaf := certChain [ 0 ]
intermediate := certChain [ 1 ]
intermediate := certChain [ 1 ]
if assert . Nil ( t , tc . err ) {
if assert . Nil ( t , tc . err ) {
assert . Equal s( t , leaf . NotBefore , tc . n otBefore)
assert . Equal ( t , tc . notBefore , leaf . N )
assert . Equal s( t , leaf . NotAfter , tc . n otAfter)
assert . Equal ( t , tc . notAfter , leaf . N )
tmplt := a . config . AuthorityConfig . Template
tmplt := a . config . AuthorityConfig . Template
if tc . csr . Subject . CommonName == "" {
if tc . csr . Subject . CommonName == "" {
assert . Equal s ( t, leaf . Subjec t, pkix . Name { } )
assert . Equal ( , pkix . Name { } , leaf . Subject )
} else {
} else {
assert . Equals ( t , leaf . Subject . String ( ) ,
assert . Equal ( t , pkix . Name {
pkix . Name {
Country : [ ] string { tmplt . Country } ,
Country : [ ] string { tmplt . Country } ,
Organization : [ ] string { tmplt . Organization } ,
Organization : [ ] string { tmplt . Organization } ,
Locality : [ ] string { tmplt . Locality } ,
Locality : [ ] string { tmplt . Locality } ,
StreetAddress : [ ] string { tmplt . StreetAddress } ,
StreetAddress : [ ] string { tmplt . StreetAddress } ,
Province : [ ] string { tmplt . Province } ,
Province : [ ] string { tmplt . Province } ,
CommonName : "smallstep test" ,
CommonName : "smallstep test" ,
} . String ( ) , leaf . Subject . String ( ) )
} . String ( ) )
assert . Equal ( t , [ ] string { "test.smallstep.com" } , leaf . DNSNames )
assert . Equals ( t , leaf . DNSNames , [ ] string { "test.smallstep.com" } )
}
}
assert . Equal s ( t , leaf . Issuer , intermediate . Subject )
assert . Equal ( t , intermediate . Subject , leaf . Issuer )
assert . Equal s ( t , leaf . SignatureAlgorithm , x509 . ECDSAWithSHA256 )
assert . Equal ( t , x509 . ECDSAWithSHA256 , leaf . SignatureAlgorithm )
assert . Equal s ( t , leaf . PublicKeyAlgorithm , x509 . ECDSA )
assert . Equal ( t , x509 . ECDSA , leaf . PublicKeyAlgorithm )
assert . Equal s ( t , leaf . ExtKeyUsage , [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth , x509 . ExtKeyUsageClientAuth } )
assert . Equal ( t , [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth , x509 . ExtKeyUsageClientAuth } , leaf . ExtKeyUsage )
issuer := getDefaultIssuer ( a )
issuer := getDefaultIssuer ( a )
subjectKeyID , err := generateSubjectKeyID ( pub )
subjectKeyID , err := generateSubjectKeyID ( pub )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s ( t , leaf . SubjectKeyId , subjectKeyID )
assert . Equal ( t , subjectKeyID , leaf . SubjectKeyId )
assert . Equal s( t , leaf . AuthorityKeyId , issuer . Subject KeyId)
assert . Equal ( t , issuer . SubjectKeyId , leaf . Authority )
// Verify Provisioner OID
// Verify Provisioner OID
found := 0
found := 0
@ -900,18 +911,18 @@ ZYtQ9Ot36qc=
found ++
found ++
val := stepProvisionerASN1 { }
val := stepProvisionerASN1 { }
_ , err := asn1 . Unmarshal ( ext . Value , & val )
_ , err := asn1 . Unmarshal ( ext . Value , & val )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s ( t , val . Type , provisionerTypeJWK )
assert . Equal ( t , provisionerTypeJWK , val . Type )
assert . Equal s ( t , val . Name , [ ] byte ( p . Name ) )
assert . Equal ( t , [ ] byte ( p . Name ) , val . Name )
assert . Equal s ( t , val . CredentialID , [ ] byte ( p . Key . KeyID ) )
assert . Equal ( t , [ ] byte ( p . Key . KeyID ) , val . CredentialID )
// Basic Constraints
// Basic Constraints
case ext . Id . Equal ( asn1 . ObjectIdentifier ( [ ] int { 2 , 5 , 29 , 19 } ) ) :
case ext . Id . Equal ( asn1 . ObjectIdentifier ( [ ] int { 2 , 5 , 29 , 19 } ) ) :
val := basicConstraints { }
val := basicConstraints { }
_ , err := asn1 . Unmarshal ( ext . Value , & val )
_ , err := asn1 . Unmarshal ( ext . Value , & val )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . False ( t , val . IsCA , false )
assert . False ( t , val . IsCA , false )
assert . Equal s ( t , val . MaxPathLen , 0 )
assert . Equal ( t , val . MaxPathLen , 0 )
// SAN extension
// SAN extension
case ext . Id . Equal ( asn1 . ObjectIdentifier ( [ ] int { 2 , 5 , 29 , 17 } ) ) :
case ext . Id . Equal ( asn1 . ObjectIdentifier ( [ ] int { 2 , 5 , 29 , 17 } ) ) :
@ -922,11 +933,11 @@ ZYtQ9Ot36qc=
}
}
}
}
}
}
assert . Equal s ( t , found , 1 )
assert . Equal ( t , found , 1 )
realIntermediate , err := x509 . ParseCertificate ( issuer . Raw )
realIntermediate , err := x509 . ParseCertificate ( issuer . Raw )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s( t , intermediate , realI ntermediate)
assert . Equal ( t , realIntermediate , i )
assert . Len ( t , tc. extensionsCount , leaf . Extensions )
assert . Len ( t , leaf. Extensions , tc . extensionsCount )
}
}
}
}
} )
} )
@ -1056,7 +1067,7 @@ func TestAuthority_Renew(t *testing.T) {
for name , genTestCase := range tests {
for name , genTestCase := range tests {
t . Run ( name , func ( t * testing . T ) {
t . Run ( name , func ( t * testing . T ) {
tc , err := genTestCase ( )
tc , err := genTestCase ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
var certChain [ ] * x509 . Certificate
var certChain [ ] * x509 . Certificate
if tc . auth != nil {
if tc . auth != nil {
@ -1068,19 +1079,19 @@ func TestAuthority_Renew(t *testing.T) {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
assert . Nil ( t , certChain )
assert . Nil ( t , certChain )
var sc render . StatusCodedError
var sc render . StatusCodedError
assert. Fatal ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
require. True ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
assert . Equal s ( t , sc . StatusCode ( ) , tc . code )
assert . Equal ( t , tc . code , sc . StatusCode ( ) )
assert . ( t , err . Error ( ) , tc . err . Error ( ) )
assert ( t , err . Error ( ) , tc . err . Error ( ) )
var ctxErr * errs . Error
var ctxErr * errs . Error
assert. Fatal ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
require. True ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
assert . Equal s( t , ctxErr . Details [ "serialNumber" ] , tc . cert . SerialNumber . String ( ) )
assert . Equal ( t , tc . cert . SerialNumber . String ( ) , ctxErr . Details [ "serialNumber" ] )
}
}
} else {
} else {
leaf := certChain [ 0 ]
leaf := certChain [ 0 ]
intermediate := certChain [ 1 ]
intermediate := certChain [ 1 ]
if assert . Nil ( t , tc . err ) {
if assert . Nil ( t , tc . err ) {
assert . Equal s( t , leaf . NotAfter . Sub ( leaf . NotBefore ) , tc . cert . NotAfter . Sub ( cert . NotBefore ) )
assert . Equal ( t , tc . cert . NotAfter . Sub ( cert . NotBefore ) , leaf . NotAfter . Sub ( leaf . NotBefore ) )
assert . True ( t , leaf . NotBefore . After ( now . Add ( - 2 * time . Minute ) ) )
assert . True ( t , leaf . NotBefore . After ( now . Add ( - 2 * time . Minute ) ) )
assert . True ( t , leaf . NotBefore . Before ( now . Add ( time . Minute ) ) )
assert . True ( t , leaf . NotBefore . Before ( now . Add ( time . Minute ) ) )
@ -1090,30 +1101,29 @@ func TestAuthority_Renew(t *testing.T) {
assert . True ( t , leaf . NotAfter . Before ( expiry . Add ( time . Hour ) ) )
assert . True ( t , leaf . NotAfter . Before ( expiry . Add ( time . Hour ) ) )
tmplt := a . config . AuthorityConfig . Template
tmplt := a . config . AuthorityConfig . Template
assert . Equals ( t , leaf . RawSubject , tc . cert . RawSubject )
assert . Equal ( t , tc . cert . RawSubject , leaf . RawSubject )
assert . Equals ( t , leaf . Subject . Country , [ ] string { tmplt . Country } )
assert . Equal ( t , [ ] string { tmplt . Country } , leaf . Subject . Country )
assert . Equals ( t , leaf . Subject . Organization , [ ] string { tmplt . Organization } )
assert . Equal ( t , [ ] string { tmplt . Organization } , leaf . Subject . Organization )
assert . Equals ( t , leaf . Subject . Locality , [ ] string { tmplt . Locality } )
assert . Equal ( t , [ ] string { tmplt . Locality } , leaf . Subject . Locality )
assert . Equals ( t , leaf . Subject . StreetAddress , [ ] string { tmplt . StreetAddress } )
assert . Equal ( t , [ ] string { tmplt . StreetAddress } , leaf . Subject . StreetAddress )
assert . Equals ( t , leaf . Subject . Province , [ ] string { tmplt . Province } )
assert . Equal ( t , [ ] string { tmplt . Province } , leaf . Subject . Province )
assert . Equals ( t , leaf . Subject . CommonName , tmplt . CommonName )
assert . Equal ( t , tmplt . CommonName , leaf . Subject . CommonName )
assert . Equals ( t , leaf . Issuer , intermediate . Subject )
assert . Equal ( t , intermediate . Subject , leaf . Issuer )
assert . Equals ( t , leaf . SignatureAlgorithm , x509 . ECDSAWithSHA256 )
assert . Equal ( t , x509 . ECDSAWithSHA256 , leaf . SignatureAlgorithm )
assert . Equals ( t , leaf . PublicKeyAlgorithm , x509 . ECDSA )
assert . Equal ( t , x509 . ECDSA , leaf . PublicKeyAlgorithm )
assert . Equals ( t , leaf . ExtKeyUsage ,
assert . Equal ( t , [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth , x509 . ExtKeyUsageClientAuth } , leaf . ExtKeyUsage )
[ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth , x509 . ExtKeyUsageClientAuth } )
assert . Equal ( t , [ ] string { "test.smallstep.com" , "test" } , leaf . DNSNames )
assert . Equals ( t , leaf . DNSNames , [ ] string { "test.smallstep.com" , "test" } )
subjectKeyID , err := generateSubjectKeyID ( leaf . PublicKey )
subjectKeyID , err := generateSubjectKeyID ( leaf . PublicKey )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s ( t , leaf . SubjectKeyId , subjectKeyID )
assert . Equal ( t , subjectKeyID , leaf . SubjectKeyId )
// We did not change the intermediate before renewing.
// We did not change the intermediate before renewing.
authIssuer := getDefaultIssuer ( tc . auth )
authIssuer := getDefaultIssuer ( tc . auth )
if issuer . SerialNumber == authIssuer . SerialNumber {
if issuer . SerialNumber == authIssuer . SerialNumber {
assert . Equal s( t , leaf . AuthorityKeyId , issuer . Subject KeyId)
assert . Equal ( t , issuer . SubjectKeyId , leaf . Authority )
// Compare extensions: they can be in a different order
// Compare extensions: they can be in a different order
for _ , ext1 := range tc . cert . Extensions {
for _ , ext1 := range tc . cert . Extensions {
//skip SubjectKeyIdentifier
//skip SubjectKeyIdentifier
@ -1133,7 +1143,7 @@ func TestAuthority_Renew(t *testing.T) {
}
}
} else {
} else {
// We did change the intermediate before renewing.
// We did change the intermediate before renewing.
assert . Equal s( t , leaf . AuthorityKeyId , authIssuer . Subject KeyId)
assert . Equal ( t , authIssuer . SubjectKeyId , leaf . Authority )
// Compare extensions: they can be in a different order
// Compare extensions: they can be in a different order
for _ , ext1 := range tc . cert . Extensions {
for _ , ext1 := range tc . cert . Extensions {
//skip SubjectKeyIdentifier
//skip SubjectKeyIdentifier
@ -1161,8 +1171,8 @@ func TestAuthority_Renew(t *testing.T) {
}
}
realIntermediate , err := x509 . ParseCertificate ( authIssuer . Raw )
realIntermediate , err := x509 . ParseCertificate ( authIssuer . Raw )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s( t , intermediate , realI ntermediate)
assert . Equal ( t , realIntermediate , i )
}
}
}
}
} )
} )
@ -1171,7 +1181,7 @@ func TestAuthority_Renew(t *testing.T) {
func TestAuthority_Rekey ( t * testing . T ) { func TestAuthority_Rekey ( t * testing . T ) {
pub , _ , err := keyutil . GenerateDefaultKeyPair ( )
pub , _ , err := keyutil . GenerateDefaultKeyPair ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
a := testAuthority ( t )
a := testAuthority ( t )
a . config . AuthorityConfig . Template = & ASN1DN {
a . config . AuthorityConfig . Template = & ASN1DN {
@ -1261,7 +1271,7 @@ func TestAuthority_Rekey(t *testing.T) {
for name , genTestCase := range tests {
for name , genTestCase := range tests {
t . Run ( name , func ( t * testing . T ) {
t . Run ( name , func ( t * testing . T ) {
tc , err := genTestCase ( )
tc , err := genTestCase ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
var certChain [ ] * x509 . Certificate
var certChain [ ] * x509 . Certificate
if tc . auth != nil {
if tc . auth != nil {
@ -1273,19 +1283,19 @@ func TestAuthority_Rekey(t *testing.T) {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
assert . Nil ( t , certChain )
assert . Nil ( t , certChain )
var sc render . StatusCodedError
var sc render . StatusCodedError
assert. Fatal ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
require. True ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
assert . Equal s ( t , sc . StatusCode ( ) , tc . code )
assert . Equal ( t , tc . code , sc . StatusCode ( ) )
assert . ( t , err . Error ( ) , tc . err . Error ( ) )
assert ( t , err . Error ( ) , tc . err . Error ( ) )
var ctxErr * errs . Error
var ctxErr * errs . Error
assert. Fatal ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
require. True ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
assert . Equal s( t , ctxErr . Details [ "serialNumber" ] , tc . cert . SerialNumber . String ( ) )
assert . Equal ( t , tc . cert . SerialNumber . String ( ) , ctxErr . Details [ "serialNumber" ] )
}
}
} else {
} else {
leaf := certChain [ 0 ]
leaf := certChain [ 0 ]
intermediate := certChain [ 1 ]
intermediate := certChain [ 1 ]
if assert . Nil ( t , tc . err ) {
if assert . Nil ( t , tc . err ) {
assert . Equal s( t , leaf . NotAfter . Sub ( leaf . NotBefore ) , tc . cert . NotAfter . Sub ( cert . NotBefore ) )
assert . Equal ( t , tc . cert . NotAfter . Sub ( cert . NotBefore ) , leaf . NotAfter . Sub ( leaf . NotBefore ) )
assert . True ( t , leaf . NotBefore . After ( now . Add ( - 2 * time . Minute ) ) )
assert . True ( t , leaf . NotBefore . After ( now . Add ( - 2 * time . Minute ) ) )
assert . True ( t , leaf . NotBefore . Before ( now . Add ( time . Minute ) ) )
assert . True ( t , leaf . NotBefore . Before ( now . Add ( time . Minute ) ) )
@ -1295,41 +1305,39 @@ func TestAuthority_Rekey(t *testing.T) {
assert . True ( t , leaf . NotAfter . Before ( expiry . Add ( time . Hour ) ) )
assert . True ( t , leaf . NotAfter . Before ( expiry . Add ( time . Hour ) ) )
tmplt := a . config . AuthorityConfig . Template
tmplt := a . config . AuthorityConfig . Template
assert . Equals ( t , leaf . Subject . String ( ) ,
assert . Equal ( t , pkix . Name {
pkix . Name {
Country : [ ] string { tmplt . Country } ,
Country : [ ] string { tmplt . Country } ,
Organization : [ ] string { tmplt . Organization } ,
Organization : [ ] string { tmplt . Organization } ,
Locality : [ ] string { tmplt . Locality } ,
Locality : [ ] string { tmplt . Locality } ,
StreetAddress : [ ] string { tmplt . StreetAddress } ,
StreetAddress : [ ] string { tmplt . StreetAddress } ,
Province : [ ] string { tmplt . Province } ,
Province : [ ] string { tmplt . Province } ,
CommonName : tmplt . CommonName ,
CommonName : tmplt . CommonName ,
} . String ( ) , leaf . Subject . String ( ) )
} . String ( ) )
assert . Equal ( t , intermediate . Subject , leaf . Issuer )
assert . Equals ( t , leaf . Issuer , intermediate . Subject )
assert . Equal ( t , x509 . ECDSAWithSHA256 , leaf . SignatureAlgorithm )
assert . Equals ( t , leaf . SignatureAlgorithm , x509 . ECDSAWithSHA256 )
assert . Equal ( t , x509 . ECDSA , leaf . PublicKeyAlgorithm )
assert . Equals ( t , leaf . PublicKeyAlgorithm , x509 . ECDSA )
assert . Equal ( t , [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth , x509 . ExtKeyUsageClientAuth } , leaf . ExtKeyUsage )
assert . Equals ( t , leaf . ExtKeyUsage ,
assert . Equal ( t , [ ] string { "test.smallstep.com" , "test" } , leaf . DNSNames )
[ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth , x509 . ExtKeyUsageClientAuth } )
assert . Equals ( t , leaf . DNSNames , [ ] string { "test.smallstep.com" , "test" } )
// Test Public Key and SubjectKeyId
// Test Public Key and SubjectKeyId
expectedPK := tc . pk
expectedPK := tc . pk
if tc . pk == nil {
if tc . pk == nil {
expectedPK = cert . PublicKey
expectedPK = cert . PublicKey
}
}
assert . Equal s ( t , leaf . PublicKey , expectedPK )
assert . Equal ( t , expectedPK , leaf . PublicKey )
subjectKeyID , err := generateSubjectKeyID ( expectedPK )
subjectKeyID , err := generateSubjectKeyID ( expectedPK )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s ( t , leaf . SubjectKeyId , subjectKeyID )
assert . Equal ( t , subjectKeyID , leaf . SubjectKeyId )
if tc . pk == nil {
if tc . pk == nil {
assert . Equal s( t , leaf . SubjectKeyId , cert . SubjectKeyId )
assert . Equal ( t , cert . SubjectKeyId , leaf . SubjectKeyId )
}
}
// We did not change the intermediate before renewing.
// We did not change the intermediate before renewing.
authIssuer := getDefaultIssuer ( tc . auth )
authIssuer := getDefaultIssuer ( tc . auth )
if issuer . SerialNumber == authIssuer . SerialNumber {
if issuer . SerialNumber == authIssuer . SerialNumber {
assert . Equal s( t , leaf . AuthorityKeyId , issuer . Subject KeyId)
assert . Equal ( t , issuer . SubjectKeyId , leaf . Authority )
// Compare extensions: they can be in a different order
// Compare extensions: they can be in a different order
for _ , ext1 := range tc . cert . Extensions {
for _ , ext1 := range tc . cert . Extensions {
//skip SubjectKeyIdentifier
//skip SubjectKeyIdentifier
@ -1349,7 +1357,7 @@ func TestAuthority_Rekey(t *testing.T) {
}
}
} else {
} else {
// We did change the intermediate before renewing.
// We did change the intermediate before renewing.
assert . Equal s( t , leaf . AuthorityKeyId , authIssuer . Subject KeyId)
assert . Equal ( t , authIssuer . SubjectKeyId , leaf . Authority )
// Compare extensions: they can be in a different order
// Compare extensions: they can be in a different order
for _ , ext1 := range tc . cert . Extensions {
for _ , ext1 := range tc . cert . Extensions {
//skip SubjectKeyIdentifier
//skip SubjectKeyIdentifier
@ -1377,8 +1385,8 @@ func TestAuthority_Rekey(t *testing.T) {
}
}
realIntermediate , err := x509 . ParseCertificate ( authIssuer . Raw )
realIntermediate , err := x509 . ParseCertificate ( authIssuer . Raw )
assert. Fatal Error( t , err )
require. No Error( t , err )
assert . Equal s( t , intermediate , realI ntermediate)
assert . Equal ( t , realIntermediate , i )
}
}
}
}
} )
} )
@ -1413,10 +1421,10 @@ func TestAuthority_GetTLSOptions(t *testing.T) {
for name , genTestCase := range tests {
for name , genTestCase := range tests {
t . Run ( name , func ( t * testing . T ) {
t . Run ( name , func ( t * testing . T ) {
tc , err := genTestCase ( )
tc , err := genTestCase ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
opts := tc . auth . GetTLSOptions ( )
opts := tc . auth . GetTLSOptions ( )
assert . Equal s ( t , opts , tc . opts )
assert . Equal ( t , tc . opts , opts )
} )
} )
}
}
} }
@ -1429,11 +1437,11 @@ func TestAuthority_Revoke(t *testing.T) {
now := time . Now ( ) . UTC ( )
now := time . Now ( ) . UTC ( )
jwk , err := jose . ReadKey ( "testdata/secrets/step_cli_key_priv.jwk" , jose . WithPassword ( [ ] byte ( "pass" ) ) )
jwk , err := jose . ReadKey ( "testdata/secrets/step_cli_key_priv.jwk" , jose . WithPassword ( [ ] byte ( "pass" ) ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
sig , err := jose . NewSigner ( jose . SigningKey { Algorithm : jose . ES256 , Key : jwk . Key } ,
sig , err := jose . NewSigner ( jose . SigningKey { Algorithm : jose . ES256 , Key : jwk . Key } ,
( & jose . SignerOptions { } ) . WithType ( "JWT" ) . WithHeader ( "kid" , jwk . KeyID ) )
( & jose . SignerOptions { } ) . WithType ( "JWT" ) . WithHeader ( "kid" , jwk . KeyID ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
a := testAuthority ( t )
a := testAuthority ( t )
@ -1472,7 +1480,7 @@ func TestAuthority_Revoke(t *testing.T) {
ID : "44" ,
ID : "44" ,
}
}
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : a ,
auth : a ,
@ -1486,9 +1494,9 @@ func TestAuthority_Revoke(t *testing.T) {
err : errors . New ( "authority.Revoke; no persistence layer configured" ) ,
err : errors . New ( "authority.Revoke; no persistence layer configured" ) ,
code : http . StatusNotImplemented ,
code : http . StatusNotImplemented ,
checkErrDetails : func ( err * errs . Error ) {
checkErrDetails : func ( err * errs . Error ) {
assert . Equal s ( t , err . Details [ "token" ] , raw )
assert . Equal ( t , raw , err . Details [ "token" ] )
assert . Equal s ( t , err . Details [ "tokenID" ] , "44" )
assert . Equal ( t , "44" , err . Details [ "tokenID" ] )
assert . Equal s ( t , err . Details [ "provisionerID" ] , "step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc" )
assert . Equal ( t , "step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc" , err . Details [ "provisionerID" ] )
} ,
} ,
}
}
} ,
} ,
@ -1512,7 +1520,7 @@ func TestAuthority_Revoke(t *testing.T) {
ID : "44" ,
ID : "44" ,
}
}
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : _a ,
auth : _a ,
@ -1526,9 +1534,9 @@ func TestAuthority_Revoke(t *testing.T) {
err : errors . New ( "authority.Revoke: force" ) ,
err : errors . New ( "authority.Revoke: force" ) ,
code : http . StatusInternalServerError ,
code : http . StatusInternalServerError ,
checkErrDetails : func ( err * errs . Error ) {
checkErrDetails : func ( err * errs . Error ) {
assert . Equal s ( t , err . Details [ "token" ] , raw )
assert . Equal ( t , raw , err . Details [ "token" ] )
assert . Equal s ( t , err . Details [ "tokenID" ] , "44" )
assert . Equal ( t , "44" , err . Details [ "tokenID" ] )
assert . Equal s ( t , err . Details [ "provisionerID" ] , "step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc" )
assert . Equal ( t , "step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc" , err . Details [ "provisionerID" ] )
} ,
} ,
}
}
} ,
} ,
@ -1552,7 +1560,7 @@ func TestAuthority_Revoke(t *testing.T) {
ID : "44" ,
ID : "44" ,
}
}
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : _a ,
auth : _a ,
@ -1566,9 +1574,9 @@ func TestAuthority_Revoke(t *testing.T) {
err : errors . New ( "certificate with serial number 'sn' is already revoked" ) ,
err : errors . New ( "certificate with serial number 'sn' is already revoked" ) ,
code : http . StatusBadRequest ,
code : http . StatusBadRequest ,
checkErrDetails : func ( err * errs . Error ) {
checkErrDetails : func ( err * errs . Error ) {
assert . Equal s ( t , err . Details [ "token" ] , raw )
assert . Equal ( t , raw , err . Details [ "token" ] )
assert . Equal s ( t , err . Details [ "tokenID" ] , "44" )
assert . Equal ( t , "44" , err . Details [ "tokenID" ] )
assert . Equal s ( t , err . Details [ "provisionerID" ] , "step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc" )
assert . Equal ( t , "step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc" , err . Details [ "provisionerID" ] )
} ,
} ,
}
}
} ,
} ,
@ -1591,7 +1599,7 @@ func TestAuthority_Revoke(t *testing.T) {
ID : "44" ,
ID : "44" ,
}
}
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : _a ,
auth : _a ,
ctx : tlsRevokeCtx ,
ctx : tlsRevokeCtx ,
@ -1607,7 +1615,7 @@ func TestAuthority_Revoke(t *testing.T) {
_a := testAuthority ( t , WithDatabase ( & db . MockAuthDB { } ) )
_a := testAuthority ( t , WithDatabase ( & db . MockAuthDB { } ) )
crt , err := pemutil . ReadCertificate ( "./testdata/certs/foo.crt" )
crt , err := pemutil . ReadCertificate ( "./testdata/certs/foo.crt" )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : _a ,
auth : _a ,
@ -1625,7 +1633,7 @@ func TestAuthority_Revoke(t *testing.T) {
_a := testAuthority ( t , WithDatabase ( & db . MockAuthDB { } ) )
_a := testAuthority ( t , WithDatabase ( & db . MockAuthDB { } ) )
crt , err := pemutil . ReadCertificate ( "./testdata/certs/foo.crt" )
crt , err := pemutil . ReadCertificate ( "./testdata/certs/foo.crt" )
assert. Fatal Error( t , err )
require. No Error( t , err )
// Filter out provisioner extension.
// Filter out provisioner extension.
for i , ext := range crt . Extensions {
for i , ext := range crt . Extensions {
if ext . Id . Equal ( asn1 . ObjectIdentifier { 1 , 3 , 6 , 1 , 4 , 1 , 37476 , 9000 , 64 , 1 } ) {
if ext . Id . Equal ( asn1 . ObjectIdentifier { 1 , 3 , 6 , 1 , 4 , 1 , 37476 , 9000 , 64 , 1 } ) {
@ -1650,7 +1658,7 @@ func TestAuthority_Revoke(t *testing.T) {
_a := testAuthority ( t , WithDatabase ( & db . MockAuthDB { } ) )
_a := testAuthority ( t , WithDatabase ( & db . MockAuthDB { } ) )
crt , err := pemutil . ReadCertificate ( "./testdata/certs/foo.crt" )
crt , err := pemutil . ReadCertificate ( "./testdata/certs/foo.crt" )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : _a ,
auth : _a ,
@ -1683,7 +1691,7 @@ func TestAuthority_Revoke(t *testing.T) {
ID : "44" ,
ID : "44" ,
}
}
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
return test {
return test {
auth : a ,
auth : a ,
ctx : provisioner . NewContextWithMethod ( context . Background ( ) , provisioner . SSHRevokeMethod ) ,
ctx : provisioner . NewContextWithMethod ( context . Background ( ) , provisioner . SSHRevokeMethod ) ,
@ -1702,17 +1710,17 @@ func TestAuthority_Revoke(t *testing.T) {
if err := tc . auth . Revoke ( tc . ctx , tc . opts ) ; err != nil {
if err := tc . auth . Revoke ( tc . ctx , tc . opts ) ; err != nil {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
if assert . NotNil ( t , tc . err , fmt . Sprintf ( "unexpected error: %s" , err ) ) {
var sc render . StatusCodedError
var sc render . StatusCodedError
assert. Fatal ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
require. True ( t , errors . As ( err , & sc ) , "error does not implement StatusCodedError interface" )
assert . Equal s ( t , sc . StatusCode ( ) , tc . code )
assert . Equal ( t , tc . code , sc . StatusCode ( ) )
assert . ( t , err . Error ( ) , tc . err . Error ( ) )
assert ( t , err . Error ( ) , tc . err . Error ( ) )
var ctxErr * errs . Error
var ctxErr * errs . Error
assert. Fatal ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
require. True ( t , errors . As ( err , & ctxErr ) , "error is not of type *errs.Error" )
assert . Equal s ( t , ctxErr . Details [ "serialNumber" ] , tc . opts . Serial )
assert . Equal ( t , tc . opts . Serial , ctxErr . Details [ "serialNumber" ] )
assert . Equal s ( t , ctxErr . Details [ "reasonCode" ] , tc . opts . ReasonCode )
assert . Equal ( t , tc . opts . ReasonCode , ctxErr . Details [ "reasonCode" ] )
assert . Equal s ( t , ctxErr . Details [ "reason" ] , tc . opts . Reason )
assert . Equal ( t , tc . opts . Reason , ctxErr . Details [ "reason" ] )
assert . Equal s ( t , ctxErr . Details [ "MTLS" ] , tc . opts . MTLS )
assert . Equal ( t , tc . opts . MTLS , ctxErr . Details [ "MTLS" ] )
assert . Equal s ( t , ctxErr . Details [ "context" ] , provisioner . RevokeMethod . String ( ) )
assert . Equal ( t , provisioner . RevokeMethod . String ( ) , ctxErr . Details [ "context" ] )
if tc . checkErrDetails != nil {
if tc . checkErrDetails != nil {
tc . checkErrDetails ( ctxErr )
tc . checkErrDetails ( ctxErr )
@ -1795,9 +1803,9 @@ func TestAuthority_constraints(t *testing.T) {
t . Fatal ( err )
t . Fatal ( err )
}
}
_ , err = auth . Sign ( csr , provisioner . SignOptions { } , templateOption )
_ , err = auth . Sign WithContext ( context . Background ( ) , csr , provisioner . SignOptions { } , templateOption )
if ( err != nil ) != tt . wantErr {
if ( err != nil ) != tt . wantErr {
t . Errorf ( "Authority.Sign () error = %v, wantErr %v", err , tt . wantErr )
t . Errorf ( "Authority.Sign WithContext () error = %v, wantErr %v", err , tt . wantErr )
}
}
_ , err = auth . Renew ( cert )
_ , err = auth . Renew ( cert )
@ -1814,13 +1822,11 @@ func TestAuthority_CRL(t *testing.T) {
validIssuer := "step-cli"
validIssuer := "step-cli"
validAudience := testAudiences . Revoke
validAudience := testAudiences . Revoke
now := time . Now ( ) . UTC ( )
now := time . Now ( ) . UTC ( )
//
jwk , err := jose . ReadKey ( "testdata/secrets/step_cli_key_priv.jwk" , jose . WithPassword ( [ ] byte ( "pass" ) ) )
jwk , err := jose . ReadKey ( "testdata/secrets/step_cli_key_priv.jwk" , jose . WithPassword ( [ ] byte ( "pass" ) ) )
assert . FatalError ( t , err )
require . NoError ( t , err )
//
sig , err := jose . NewSigner ( jose . SigningKey { Algorithm : jose . ES256 , Key : jwk . Key } ,
sig , err := jose . NewSigner ( jose . SigningKey { Algorithm : jose . ES256 , Key : jwk . Key } ,
( & jose . SignerOptions { } ) . WithType ( "JWT" ) . WithHeader ( "kid" , jwk . KeyID ) )
( & jose . SignerOptions { } ) . WithType ( "JWT" ) . WithHeader ( "kid" , jwk . KeyID ) )
assert. Fatal Error( t , err )
require. No Error( t , err )
crlCtx := provisioner . NewContextWithMethod ( context . Background ( ) , provisioner . RevokeMethod )
crlCtx := provisioner . NewContextWithMethod ( context . Background ( ) , provisioner . RevokeMethod )
@ -1865,7 +1871,7 @@ func TestAuthority_CRL(t *testing.T) {
auth : a ,
auth : a ,
ctx : crlCtx ,
ctx : crlCtx ,
expected : nil ,
expected : nil ,
err : database. ErrNotFound ,
err : errors. New ( "authority.GetCertificateRevocationList: not found" ) ,
}
}
} ,
} ,
"ok/crl-full" : func ( ) test {
"ok/crl-full" : func ( ) test {
@ -1910,7 +1916,7 @@ func TestAuthority_CRL(t *testing.T) {
ID : sn ,
ID : sn ,
}
}
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
raw , err := jose . Signed ( sig ) . Claims ( cl ) . CompactSerialize ( )
assert. Fatal Error( t , err )
require. No Error( t , err )
err = a . Revoke ( crlCtx , & RevokeOptions {
err = a . Revoke ( crlCtx , & RevokeOptions {
Serial : sn ,
Serial : sn ,
ReasonCode : reasonCode ,
ReasonCode : reasonCode ,
@ -1918,7 +1924,7 @@ func TestAuthority_CRL(t *testing.T) {
OTT : raw ,
OTT : raw ,
} )
} )
assert. Fatal Error( t , err )
require. No Error( t , err )
ex = append ( ex , sn )
ex = append ( ex , sn )
}
}
@ -1933,22 +1939,58 @@ func TestAuthority_CRL(t *testing.T) {
for name , f := range tests {
for name , f := range tests {
tc := f ( )
tc := f ( )
t . Run ( name , func ( t * testing . T ) {
t . Run ( name , func ( t * testing . T ) {
if crlBytes , err := tc . auth . GetCertificateRevocationList ( ) ; err == nil {
crlInfo , err := tc . auth . GetCertificateRevocationList ( )
crl , parseErr := x509 . ParseRevocationList ( crlBytes )
if tc . err != nil {
if parseErr != nil {
assert . EqualError ( t , err , tc . err . Error ( ) )
t . Errorf ( "x509.ParseCertificateRequest() error = %v, wantErr %v" , parseErr , nil )
assert . Nil ( t , crlInfo )
return
return
}
}
var cmpList [ ] string
crl , parseErr := x509 . ParseRevocationList ( crlInfo . Data )
for _ , c := range crl . RevokedCertificates {
require . NoError ( t , parseErr )
cmpList = append ( cmpList , c . SerialNumber . String ( ) )
}
assert . Equals ( t , cmpList , tc . expected )
var cmpList [ ] string
} else {
for _ , c := range crl . RevokedCertificateEntries {
assert. NotNil ( t , tc . err , err . Error ( ) )
cmpList = append ( cmpList , c . SerialNumber . String ( ) )
}
}
assert . Equal ( t , tc . expected , cmpList )
} )
}
}
type notImplementedCAS struct { }
func ( notImplementedCAS ) CreateCertificate ( req * apiv1 . CreateCertificateRequest ) ( * apiv1 . CreateCertificateResponse , error ) {
return nil , apiv1 . NotImplementedError { }
}
func ( notImplementedCAS ) RenewCertificate ( req * apiv1 . RenewCertificateRequest ) ( * apiv1 . RenewCertificateResponse , error ) {
return nil , apiv1 . NotImplementedError { }
}
func ( notImplementedCAS ) RevokeCertificate ( req * apiv1 . RevokeCertificateRequest ) ( * apiv1 . RevokeCertificateResponse , error ) {
return nil , apiv1 . NotImplementedError { }
}
func TestAuthority_GetX509Signer ( t * testing . T ) {
auth := testAuthority ( t )
require . IsType ( t , & softcas . SoftCAS { } , auth . x509CAService )
signer := auth . x509CAService . ( * softcas . SoftCAS ) . Signer
require . NotNil ( t , signer )
tests := [ ] struct {
name string
authority * Authority
want crypto . Signer
assertion assert . ErrorAssertionFunc
} {
{ "ok" , auth , signer , assert . NoError } ,
{ "fail" , testAuthority ( t , WithX509CAService ( notImplementedCAS { } ) ) , nil , assert . Error } ,
}
for _ , tt := range tests {
t . Run ( tt . name , func ( t * testing . T ) {
got , err := tt . authority . GetX509Signer ( )
tt . assertion ( t , err )
assert . Equal ( t , tt . want , got )
} )
} )
}
}
} }
github-actions[bot]
dependabot[bot]
Max
Mariano Cano
Mariano Cano
Herman Slatman
findnature
Jeremy Doupe
Herman Slatman
Jeremy Doupe
verytrap
Carl Tashian
Joe Doss
Joe Doss
Panagiotis Siatras
Anton Patsev
Remi Vichery
Venky Gopal