mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-20 16:37:43 +02:00
Martin HoffmannandGitHub
6d253c22da
This PR changes how the clients -- krillc, krillta, as well as the integration tests -- work to better fit the derive model provided by clap. This results in basically everything in the cli module and all the integration tests being different now. The PR slightly changes the options for both krillc and krillta. For krillc, the --server, --token, --format, and --api options are now before the first subcommand (since they affect all commands). For krillta, those options are now after krillta proxy but before the next subcommand, while --format is now after krillta signer. This PR also removes client support and integration tests for RTA. This is a breaking change.
118 lines
4.1 KiB
Rust
118 lines
4.1 KiB
Rust
//! Test setting up Krill as a trust anchor.
|
||
|
||
use std::str::FromStr;
|
||
use rpki::uri;
|
||
use rpki::repository::resources::ResourceSet;
|
||
use krill::cli::ta::signer::{SignerInitInfo, TrustAnchorSignerManager};
|
||
use krill::commons::api;
|
||
|
||
mod common;
|
||
|
||
|
||
//------------ Test Function -------------------------------------------------
|
||
|
||
/// Tests setting up Krill as a trust anchor.
|
||
///
|
||
/// This tests performs the steps described in the [Krill as a Trust Anchor]
|
||
/// section of the manual.
|
||
///
|
||
/// [Krill as a Trust Anchor]: https://krill.docs.nlnetlabs.nl/en/stable/trust-anchor.html
|
||
#[tokio::test]
|
||
async fn functional_at() {
|
||
let (mut config, _tempdir) = common::TestConfig::mem_storage()
|
||
.enable_second_signer().finalize();
|
||
let port = config.port;
|
||
config.ta_support_enabled = true;
|
||
let server = common::KrillServer::start_with_config(config).await;
|
||
|
||
eprintln!(">>>> Initialise TA proxy.");
|
||
server.client().ta_proxy_init().await.unwrap();
|
||
|
||
eprintln!(">>>> Initialise publication server.");
|
||
server.pubserver_init(port).await;
|
||
|
||
eprintln!(">>>> Get TA proxy publisher request.");
|
||
let request = server.client().ta_proxy_repo_request().await.unwrap();
|
||
|
||
eprintln!(">>>> Add TA Proxy as Publisher.");
|
||
let response = server.client().publishers_add(request).await.unwrap();
|
||
|
||
eprintln!(">>>> Configure repository for TA proxy.");
|
||
server.client().ta_proxy_repo_configure(response).await.unwrap();
|
||
|
||
eprintln!(">>>> Configure the TA signer.");
|
||
let signer = TrustAnchorSignerManager::create(
|
||
krill::ta::Config::parse_str(
|
||
include_str!("../test-resources/ta/ta.conf")
|
||
).unwrap()
|
||
).unwrap();
|
||
|
||
eprintln!(">>>> Initialise the TA signer.");
|
||
signer.init(
|
||
SignerInitInfo {
|
||
proxy_id: server.client().ta_proxy_id().await.unwrap(),
|
||
repo_info: {
|
||
server.client().ta_proxy_repo_contact().await.unwrap().into()
|
||
},
|
||
tal_https: vec![
|
||
uri::Https::from_string(
|
||
format!("https://localhost:{}/ta/ta.cer", port)
|
||
).unwrap()
|
||
],
|
||
tal_rsync: uri::Rsync::from_str(
|
||
"rsync://localhost/ta/ta.cer"
|
||
).unwrap(),
|
||
private_key_pem: None,
|
||
ta_mft_nr_override: None
|
||
}
|
||
).unwrap();
|
||
|
||
eprintln!(">>>> Associate the TA signer with the proxy.");
|
||
let signer_info = signer.show().unwrap();
|
||
server.client().ta_proxy_signer_add(signer_info).await.unwrap();
|
||
|
||
eprintln!(">>>> Fetch TAL and check it isn’t empty.");
|
||
assert!(!server.client().testbed_tal().await.unwrap().is_empty());
|
||
|
||
eprintln!(">>>> Create child CA under TA.");
|
||
|
||
// Create the “online” CA.
|
||
let ca = common::ca_handle("online");
|
||
let ta = common::ca_handle("ta");
|
||
server.client().ca_add(ca.clone()).await.unwrap();
|
||
|
||
// Add “online” as a child of “ta”
|
||
let details = server.client().ca_details(&ca).await.unwrap();
|
||
server.client().ta_proxy_children_add(
|
||
api::AddChildRequest::new(
|
||
details.handle().convert(),
|
||
ResourceSet::all(),
|
||
details.id_cert().try_into().unwrap(),
|
||
)
|
||
).await.unwrap();
|
||
|
||
// Add “ta” as a parent of “online”
|
||
let response = server.client().ta_proxy_child_response(
|
||
&ca.convert()
|
||
).await.unwrap();
|
||
server.client().parent_add(
|
||
&ca, api::ParentCaReq::new(ta.convert(), response)
|
||
).await.unwrap();
|
||
|
||
// Add “online” as a Publisher
|
||
let request = server.client().repo_request(&ca).await.unwrap();
|
||
let response = server.client().publishers_add(request).await.unwrap();
|
||
server.client().repo_update(&ca, response).await.unwrap();
|
||
|
||
eprintln!(">>>> Process proxy signer exchange.");
|
||
server.client().ta_proxy_signer_make_request().await.unwrap();
|
||
let req = server.client().ta_proxy_signer_show_request().await.unwrap();
|
||
signer.process(req, None).unwrap();
|
||
let response = signer.show_last_response().unwrap();
|
||
server.client().ta_proxy_signer_response(response).await.unwrap();
|
||
|
||
// XXX This should probably test that everything is in order but I don’t
|
||
// know how just yet.
|
||
}
|
||
|