mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-20 16:37:43 +02:00
Martin HoffmannandGitHub
6d253c22da
This PR changes how the clients -- krillc, krillta, as well as the integration tests -- work to better fit the derive model provided by clap. This results in basically everything in the cli module and all the integration tests being different now. The PR slightly changes the options for both krillc and krillta. For krillc, the --server, --token, --format, and --api options are now before the first subcommand (since they affect all commands). For krillta, those options are now after krillta proxy but before the next subcommand, while --format is now after krillta signer. This PR also removes client support and integration tests for RTA. This is a breaking change.
115 lines
3.9 KiB
Rust
115 lines
3.9 KiB
Rust
//! Tests manipulating BGPsec router keys.
|
|
|
|
use rpki::ca::csr::BgpsecCsr;
|
|
use rpki::ca::idexchange::CaHandle;
|
|
use rpki::ca::provisioning::ResourceClassName;
|
|
use rpki::repository::resources::{Asn, ResourceSet};
|
|
use krill::commons::api::{BgpSecCsrInfo, UpdateChildRequest};
|
|
|
|
mod common;
|
|
|
|
|
|
//------------ Test Function -------------------------------------------------
|
|
|
|
/// Tests sdding, updating, and deleting router keys.
|
|
///
|
|
/// Uses the following layout:
|
|
///
|
|
/// ```text
|
|
/// TA
|
|
/// |
|
|
/// testbed
|
|
/// |
|
|
/// CA
|
|
/// ```
|
|
#[tokio::test]
|
|
async fn functional_bgpsec() {
|
|
let (server, _tempdir) = common::KrillServer::start_with_testbed().await;
|
|
|
|
let testbed = common::ca_handle("testbed");
|
|
let ca = common::ca_handle("CA");
|
|
let ca_res = common::resources("AS65000", "10.0.0.0/16", "");
|
|
let ca_res_shrunk = common::resources("", "10.0.0.0/16", "");
|
|
|
|
// Wait for the *testbed* CA to get its certificate, this means
|
|
// that all CAs which are set up as part of krill_start under the
|
|
// testbed config have been set up.
|
|
assert!(
|
|
server.wait_for_ca_resources(&testbed, &ResourceSet::all()).await
|
|
);
|
|
|
|
eprintln!(">>>> Set up 'CA' under 'testbed'.");
|
|
server.create_ca_with_repo(&ca).await;
|
|
server.register_ca_with_parent(&ca, &testbed, &ca_res).await;
|
|
|
|
let csr = BgpsecCsr::decode(
|
|
include_bytes!("../test-resources/bgpsec/router-csr.der").as_ref()
|
|
).unwrap();
|
|
|
|
let asn_owned = Asn::from_u32(65000);
|
|
let asn_not_owned = Asn::from_u32(65001);
|
|
|
|
eprintln!(">>>> Reject BGPsec definition for ASN not held.");
|
|
assert!(common::check_bad_request(
|
|
server.client().bgpsec_add_single(
|
|
&ca, asn_not_owned, csr.clone()
|
|
).await
|
|
));
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
|
|
eprintln!(">>>> Add BGPsec definition.");
|
|
server.client().bgpsec_add_single(
|
|
&ca, asn_owned, csr.clone()
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap().unpack();
|
|
assert_eq!(definitions.len(), 1);
|
|
assert_eq!(definitions.first().unwrap().asn(), asn_owned);
|
|
assert!(server.wait_for_objects(&ca, &definitions).await);
|
|
|
|
eprintln!(">>>> Shrink resources: definition but no certificate.");
|
|
server.client().child_update(
|
|
&testbed, &ca.convert(),
|
|
UpdateChildRequest::resources(ca_res_shrunk.clone())
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap().unpack();
|
|
assert_eq!(definitions.len(), 1);
|
|
assert_eq!(definitions.first().unwrap().asn(), asn_owned);
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
|
|
eprintln!(">>>> Grow resources: certificate comes back.");
|
|
server.client().child_update(
|
|
&testbed, &ca.convert(),
|
|
UpdateChildRequest::resources(ca_res.clone())
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap().unpack();
|
|
assert_eq!(definitions.len(), 1);
|
|
assert_eq!(definitions.first().unwrap().asn(), asn_owned);
|
|
assert!(server.wait_for_objects(&ca, &definitions).await);
|
|
|
|
eprintln!(">>>> Remove BGPsec definition.");
|
|
server.client().bgpsec_delete_single(
|
|
&ca, asn_owned, csr.public_key().key_identifier()
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap().unpack();
|
|
assert_eq!(definitions.len(), 0);
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
}
|
|
|
|
|
|
//------------ Extend KrillServer --------------------------------------------
|
|
|
|
impl common::KrillServer {
|
|
/// Checks that the given CA has the given ASPA definitions.
|
|
async fn wait_for_objects(
|
|
&self, ca: &CaHandle, definitions: &[BgpSecCsrInfo]
|
|
) -> bool {
|
|
let mut files = self.expected_objects(ca);
|
|
files.push_mft_and_crl(&ResourceClassName::from(0)).await;
|
|
files.extend(definitions.iter().map(|csr_info| {
|
|
csr_info.object_name().to_string()
|
|
}));
|
|
files.wait_for_published().await
|
|
}
|
|
}
|
|
|