mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-30 21:34:53 +02:00
Martin HoffmannandGitHub
c277854eed
This PR refactors how requests are processed in Krill. It creates a clear distinction between the HTTP server running async on a Tokio runtime and the core of Krill running as regular sync code on a thread pool. This means that those portions of the core that were previously async, notable the HTTP requests to remote parents and publishers, end up blocking a thread now. For most things this should be fine. For potentially long-running tasks, we have a separate thread pool so they won’t block all of Krill.
116 lines
4.0 KiB
Rust
116 lines
4.0 KiB
Rust
//! Tests manipulating BGPsec router keys.
|
|
|
|
use rpki::ca::csr::BgpsecCsr;
|
|
use rpki::ca::idexchange::CaHandle;
|
|
use rpki::ca::provisioning::ResourceClassName;
|
|
use rpki::repository::resources::{Asn, ResourceSet};
|
|
use krill::api::admin::UpdateChildRequest;
|
|
use krill::api::bgpsec::BgpSecCsrInfo;
|
|
|
|
mod common;
|
|
|
|
|
|
//------------ Test Function -------------------------------------------------
|
|
|
|
/// Tests sdding, updating, and deleting router keys.
|
|
///
|
|
/// Uses the following layout:
|
|
///
|
|
/// ```text
|
|
/// TA
|
|
/// |
|
|
/// testbed
|
|
/// |
|
|
/// CA
|
|
/// ```
|
|
#[tokio::test]
|
|
async fn functional_bgpsec() {
|
|
let server = common::KrillServer::start_with_testbed().await;
|
|
|
|
let testbed = common::ca_handle("testbed");
|
|
let ca = common::ca_handle("CA");
|
|
let ca_res = common::resources("AS65000", "10.0.0.0/16", "");
|
|
let ca_res_shrunk = common::resources("", "10.0.0.0/16", "");
|
|
|
|
// Wait for the *testbed* CA to get its certificate, this means
|
|
// that all CAs which are set up as part of krill_start under the
|
|
// testbed config have been set up.
|
|
assert!(
|
|
server.wait_for_ca_resources(&testbed, &ResourceSet::all()).await
|
|
);
|
|
|
|
eprintln!(">>>> Set up 'CA' under 'testbed'.");
|
|
server.create_ca_with_repo(&ca).await;
|
|
server.register_ca_with_parent(&ca, &testbed, &ca_res).await;
|
|
|
|
let csr = BgpsecCsr::decode(
|
|
include_bytes!("../test-resources/bgpsec/router-csr.der").as_ref()
|
|
).unwrap();
|
|
|
|
let asn_owned = Asn::from_u32(65000);
|
|
let asn_not_owned = Asn::from_u32(65001);
|
|
|
|
eprintln!(">>>> Reject BGPsec definition for ASN not held.");
|
|
assert!(common::check_bad_request(
|
|
server.client().bgpsec_add_single(
|
|
&ca, asn_not_owned, csr.clone()
|
|
).await
|
|
));
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
|
|
eprintln!(">>>> Add BGPsec definition.");
|
|
server.client().bgpsec_add_single(
|
|
&ca, asn_owned, csr.clone()
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 1);
|
|
assert_eq!(definitions.as_slice().first().unwrap().asn, asn_owned);
|
|
assert!(server.wait_for_objects(&ca, definitions.as_slice()).await);
|
|
|
|
eprintln!(">>>> Shrink resources: definition but no certificate.");
|
|
server.client().child_update(
|
|
&testbed, &ca.convert(),
|
|
UpdateChildRequest::resources(ca_res_shrunk.clone())
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 1);
|
|
assert_eq!(definitions.as_slice().first().unwrap().asn, asn_owned);
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
|
|
eprintln!(">>>> Grow resources: certificate comes back.");
|
|
server.client().child_update(
|
|
&testbed, &ca.convert(),
|
|
UpdateChildRequest::resources(ca_res.clone())
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 1);
|
|
assert_eq!(definitions.as_slice().first().unwrap().asn, asn_owned);
|
|
assert!(server.wait_for_objects(&ca, definitions.as_slice()).await);
|
|
|
|
eprintln!(">>>> Remove BGPsec definition.");
|
|
server.client().bgpsec_delete_single(
|
|
&ca, asn_owned, csr.public_key().key_identifier()
|
|
).await.unwrap();
|
|
let definitions = server.client().bgpsec_list(&ca).await.unwrap();
|
|
assert_eq!(definitions.as_slice().len(), 0);
|
|
assert!(server.wait_for_objects(&ca, &[]).await);
|
|
}
|
|
|
|
|
|
//------------ Extend KrillServer --------------------------------------------
|
|
|
|
impl common::KrillServer {
|
|
/// Checks that the given CA has the given ASPA definitions.
|
|
async fn wait_for_objects(
|
|
&self, ca: &CaHandle, definitions: &[BgpSecCsrInfo]
|
|
) -> bool {
|
|
let mut files = self.expected_objects(ca);
|
|
files.push_mft_and_crl(&ResourceClassName::from(0)).await;
|
|
files.extend(definitions.iter().map(|csr_info| {
|
|
csr_info.object_name().to_string()
|
|
}));
|
|
files.wait_for_published().await
|
|
}
|
|
}
|
|
|