mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-08-26 17:42:32 +02:00
Martin HoffmannandGitHub
4acdd84ab9
This PR refactors and reorganizes a lot of code. It attempts to organize things in a way that allows to keep more things private. Conversely, it made the fields of many data-only structs pub and removed the creator, accessor, and unpack methods for those. The PR deliberately avoid any functional code changes given that due to its sheer size, it is essentially unreviewable. This is also why it stopped short of re-organizing the structure of the actual server, ie., the Krillserver and the daemon::http module which currently have a rather blurry distinction. A follow-up PR will create a more clear separation but this requires code changes.
116 lines
4.0 KiB
Rust
116 lines
4.0 KiB
Rust
//! Tests manipulating BGPsec router keys.
|
|
|
|
use rpki::ca::csr::BgpsecCsr;
|
|
use rpki::ca::idexchange::CaHandle;
|
|
use rpki::ca::provisioning::ResourceClassName;
|
|
use rpki::repository::resources::{Asn, ResourceSet};
|
|
use krill::api::admin::UpdateChildRequest;
|
|
use krill::api::bgpsec::BgpSecCsrInfo;
|
|
|
|
mod common;
|
|
|
|
|
|
//------------ Test Function -------------------------------------------------
|
|
|
|
/// Tests sdding, updating, and deleting router keys.
|
|
///
|
|
/// Uses the following layout:
|
|
///
|
|
/// ```text
|
|
/// TA
|
|
/// |
|
|
/// testbed
|
|
/// |
|
|
/// CA
|
|
/// ```
|
|
#[tokio::test]
|
|
async fn functional_bgpsec() {
|
|
let (server, _tempdir) = common::KrillServer::start_with_testbed().await;
|
|
|
|
let testbed = common::ca_handle("testbed");
|
|
let ca = common::ca_handle("CA");
|
|
let ca_res = common::resources("AS65000", "10.0.0.0/16", "");
|
|
let ca_res_shrunk = common::resources("", "10.0.0.0/16", "");
|
|
|
|
// Wait for the *testbed* CA to get its certificate, this means
|
|
// that all CAs which are set up as part of krill_start under the
|
|
// testbed config have been set up.
|
|
assert!(
|
|
server.wait_for_ca_resources(&testbed, &ResourceSet::all()).await
|
|
);
|
|
|
|
eprintln!(">>>> Set up 'CA' under 'testbed'.");
|
|
server.create_ca_with_repo(&ca).await;
|
|
server.register_ca_with_parent(&ca, &testbed, &ca_res).await;
|
|
|
|
let csr = BgpsecCsr::decode(
|
|
include_bytes!("../test-resources/bgpsec/router-csr.der").as_ref()
|
|
).unwrap();
|
|
|
|
let asn_owned = Asn::from_u32(65000);
|
|
let asn_not_owned = Asn::from_u32(65001);
|
|
|
|
eprintln!(">>>> Reject BGPsec definition for ASN not held.");
|
|
assert!(common::check_bad_request(
|
|
server.client().bgpsec_add_single(
|
|
&ca, asn_not_owned, csr.clone()
|
|
).await
|
|
));
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
|
|
eprintln!(">>>> Add BGPsec definition.");
|
|
server.client().bgpsec_add_single(
|
|
&ca, asn_owned, csr.clone()
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 1);
|
|
assert_eq!(definitions.as_slice().first().unwrap().asn, asn_owned);
|
|
assert!(server.wait_for_objects(&ca, definitions.as_slice()).await);
|
|
|
|
eprintln!(">>>> Shrink resources: definition but no certificate.");
|
|
server.client().child_update(
|
|
&testbed, &ca.convert(),
|
|
UpdateChildRequest::resources(ca_res_shrunk.clone())
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 1);
|
|
assert_eq!(definitions.as_slice().first().unwrap().asn, asn_owned);
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
|
|
eprintln!(">>>> Grow resources: certificate comes back.");
|
|
server.client().child_update(
|
|
&testbed, &ca.convert(),
|
|
UpdateChildRequest::resources(ca_res.clone())
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 1);
|
|
assert_eq!(definitions.as_slice().first().unwrap().asn, asn_owned);
|
|
assert!(server.wait_for_objects(&ca, definitions.as_slice()).await);
|
|
|
|
eprintln!(">>>> Remove BGPsec definition.");
|
|
server.client().bgpsec_delete_single(
|
|
&ca, asn_owned, csr.public_key().key_identifier()
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 0);
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
}
|
|
|
|
|
|
//------------ Extend KrillServer --------------------------------------------
|
|
|
|
impl common::KrillServer {
|
|
/// Checks that the given CA has the given ASPA definitions.
|
|
async fn wait_for_objects(
|
|
&self, ca: &CaHandle, definitions: &[BgpSecCsrInfo]
|
|
) -> bool {
|
|
let mut files = self.expected_objects(ca);
|
|
files.push_mft_and_crl(&ResourceClassName::from(0)).await;
|
|
files.extend(definitions.iter().map(|csr_info| {
|
|
csr_info.object_name().to_string()
|
|
}));
|
|
files.wait_for_published().await
|
|
}
|
|
}
|
|
|