mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
c0a12b29d0
Use a static Mockito server instead of creating multiple on-the-fly during testing. Add the `mockito_server_available` test to quickly verify that the mockito server could be constructed. Relocate the verifier API test to the test folder as it tests the public API. Also, make the Debug impl for CertVerifier public. The test relocation requires this. Before, there could be a test local implementation of the Debug impl as it was in the same crate. While at it, get rid of the lazy_static crate in favor of the once_cell crate. As the new std lib implementation is very near to the one from once cell. The project will switch to the std impl when v1.70 is available in all supported distros. See: https://doc.rust-lang.org/std/sync/struct.OnceLock.html Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
121 lines
3.7 KiB
Rust
121 lines
3.7 KiB
Rust
// SPDX-License-Identifier: MIT
|
|
//
|
|
// Copyright IBM Corp. 2023
|
|
|
|
use pv::request::CertVerifier;
|
|
use pv::test_utils::*;
|
|
use pv::{Error, HkdVerifyErrorType::*};
|
|
use std::ffi::c_int;
|
|
|
|
#[track_caller]
|
|
fn verify_sign_error(exp_raw: c_int, obs: Error) {
|
|
verify_sign_error_slice(&[exp_raw], obs)
|
|
}
|
|
fn verify_sign_error_slice(exp_raw: &[c_int], obs: Error) {
|
|
if exp_raw
|
|
.iter()
|
|
.filter(|e| match &obs {
|
|
Error::HkdVerify(ty) => match ty {
|
|
IbmSignInvalid(err, _d) => &&err.as_raw() == e,
|
|
_ => false,
|
|
},
|
|
e => panic!("Unexpected error type: {e:?}"),
|
|
})
|
|
.count()
|
|
== 0
|
|
{
|
|
panic!("Error {obs:?} did not match one of the expected {exp_raw:?}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn verifier_new() {
|
|
let root_chn_crt = get_cert_asset_path_string("root_ca.chained.crt");
|
|
let root_crt = get_cert_asset_path_string("root_ca.crt");
|
|
let inter_crt = get_cert_asset_path_string("inter_ca.crt");
|
|
let inter_fake_crt = get_cert_asset_path_string("fake_inter_ca.crt");
|
|
let inter_fake_crl = get_cert_asset_path_string("fake_inter_ca.crl");
|
|
let inter_crl = get_cert_asset_path_string("inter_ca.crl");
|
|
let ibm_crt = get_cert_asset_path_string("ibm.crt");
|
|
let ibm_early_crt = get_cert_asset_path_string("ibm_outdated_early.crl");
|
|
let ibm_late_crt = get_cert_asset_path_string("ibm_outdated_late.crl");
|
|
let ibm_rev_crt = get_cert_asset_path_string("ibm_rev.crt");
|
|
|
|
// Too many signing keys
|
|
let verifier = CertVerifier::new(&[ibm_crt.clone(), ibm_rev_crt.clone()], &[], &None, true);
|
|
assert!(matches!(verifier, Err(Error::HkdVerify(ManyIbmSignKeys))));
|
|
|
|
// No CRL for each X509
|
|
let verifier = CertVerifier::new(
|
|
&[inter_crt.clone(), ibm_crt.clone()],
|
|
&[inter_crl.clone()],
|
|
&Some(root_crt),
|
|
false,
|
|
);
|
|
verify_sign_error(3, verifier.unwrap_err());
|
|
let verifier = CertVerifier::new(
|
|
&[inter_crt.clone(), ibm_crt.clone()],
|
|
&[],
|
|
&Some(root_chn_crt.clone()),
|
|
false,
|
|
);
|
|
verify_sign_error(3, verifier.unwrap_err());
|
|
|
|
// Wrong intermediate (or ibm key)
|
|
let verifier = CertVerifier::new(
|
|
&[inter_fake_crt, ibm_crt.clone()],
|
|
&[inter_fake_crl],
|
|
&Some(root_chn_crt.clone()),
|
|
true,
|
|
);
|
|
// Depending on the OpenSSL version different error codes can appear
|
|
verify_sign_error_slice(&[20, 30], verifier.unwrap_err());
|
|
|
|
// Wrong root ca
|
|
let verifier = CertVerifier::new(
|
|
&[inter_crt.clone(), ibm_crt.clone()],
|
|
&[inter_crl.clone()],
|
|
&None,
|
|
true,
|
|
);
|
|
verify_sign_error(20, verifier.unwrap_err());
|
|
|
|
// Correct signing key + intermediate cert
|
|
let _verifier = CertVerifier::new(
|
|
&[inter_crt.clone(), ibm_crt.clone()],
|
|
&[inter_crl.clone()],
|
|
&Some(root_chn_crt.clone()),
|
|
false,
|
|
)
|
|
.unwrap();
|
|
|
|
// No intermediate key
|
|
let verifier = CertVerifier::new(&[ibm_crt], &[], &Some(root_chn_crt.clone()), false);
|
|
verify_sign_error(20, verifier.unwrap_err());
|
|
|
|
// IBM Sign outdated
|
|
let verifier = CertVerifier::new(
|
|
&[inter_crt.clone(), ibm_early_crt],
|
|
&[inter_crl.clone()],
|
|
&Some(root_chn_crt.clone()),
|
|
false,
|
|
);
|
|
assert!(matches!(verifier, Err(Error::HkdVerify(NoIbmSignKey))));
|
|
let verifier = CertVerifier::new(
|
|
&[inter_crt.clone(), ibm_late_crt],
|
|
&[inter_crl.clone()],
|
|
&Some(root_chn_crt.clone()),
|
|
false,
|
|
);
|
|
assert!(matches!(verifier, Err(Error::HkdVerify(NoIbmSignKey))));
|
|
|
|
// Revoked
|
|
let verifier = CertVerifier::new(
|
|
&[inter_crt, ibm_rev_crt],
|
|
&[inter_crl],
|
|
&Some(root_chn_crt),
|
|
false,
|
|
);
|
|
verify_sign_error(23, verifier.unwrap_err());
|
|
}
|