storj/pkg/peertls/tlsopts/tls_test.go

158 lines
4.7 KiB
Go
Raw Normal View History

// Copyright (C) 2019 Storj Labs, Inc.
// See LICENSE for copying information.
package tlsopts_test
import (
2019-04-03 16:03:53 +01:00
"crypto/x509"
"testing"
2019-04-03 16:03:53 +01:00
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
2019-04-03 16:03:53 +01:00
"storj.io/storj/internal/testcontext"
"storj.io/storj/internal/testidentity"
"storj.io/storj/internal/testpeertls"
"storj.io/storj/internal/testrevocation"
"storj.io/storj/pkg/identity"
2019-04-03 16:03:53 +01:00
"storj.io/storj/pkg/peertls"
"storj.io/storj/pkg/peertls/extensions"
"storj.io/storj/pkg/peertls/tlsopts"
"storj.io/storj/pkg/storj"
2019-04-03 16:03:53 +01:00
"storj.io/storj/storage"
)
func TestVerifyIdentity_success(t *testing.T) {
for i := 0; i < 50; i++ {
2019-04-08 19:15:19 +01:00
ident, err := testidentity.PregeneratedIdentity(i, storj.LatestIDVersion())
require.NoError(t, err)
err = tlsopts.VerifyIdentity(ident.ID)(nil, identity.ToChains(ident.Chain()))
assert.NoError(t, err)
}
}
func TestVerifyIdentity_success_signed(t *testing.T) {
for i := 0; i < 50; i++ {
2019-04-08 19:15:19 +01:00
ident, err := testidentity.PregeneratedSignedIdentity(i, storj.LatestIDVersion())
require.NoError(t, err)
err = tlsopts.VerifyIdentity(ident.ID)(nil, identity.ToChains(ident.Chain()))
assert.NoError(t, err)
}
}
func TestVerifyIdentity_error(t *testing.T) {
2019-04-08 19:15:19 +01:00
ident, err := testidentity.PregeneratedIdentity(0, storj.LatestIDVersion())
require.NoError(t, err)
2019-04-08 19:15:19 +01:00
identTheftVictim, err := testidentity.PregeneratedIdentity(1, storj.LatestIDVersion())
require.NoError(t, err)
cases := []struct {
test string
nodeID storj.NodeID
}{
{"empty node ID", storj.NodeID{}},
{"garbage node ID", storj.NodeID{0, 1, 2, 3}},
{"wrong node ID", identTheftVictim.ID},
}
for _, cc := range cases {
testCase := cc
t.Run(testCase.test, func(t *testing.T) {
err := tlsopts.VerifyIdentity(testCase.nodeID)(nil, identity.ToChains(ident.Chain()))
assert.Error(t, err)
})
}
}
2019-04-03 16:03:53 +01:00
func TestExtensionMap_HandleExtensions(t *testing.T) {
ctx := testcontext.New(t)
defer ctx.Cleanup()
2019-04-08 19:15:19 +01:00
testidentity.IdentityVersionsTest(t, func(t *testing.T, version storj.IDVersion, _ *identity.FullIdentity) {
keys, originalChain, err := testpeertls.NewCertChain(2, version.Number)
assert.NoError(t, err)
2019-04-03 16:03:53 +01:00
2019-04-08 19:15:19 +01:00
rev := new(extensions.Revocation)
2019-04-03 16:03:53 +01:00
2019-04-08 19:15:19 +01:00
oldRevokedLeafChain, revocationExt, err := testpeertls.RevokeLeaf(keys[peertls.CAIndex], originalChain)
require.NoError(t, err)
err = rev.Unmarshal(revocationExt.Value)
require.NoError(t, err)
err = rev.Verify(oldRevokedLeafChain[peertls.CAIndex])
require.NoError(t, err)
2019-04-03 16:03:53 +01:00
2019-04-08 19:15:19 +01:00
// NB: node ID is the same, timestamp must change
// (see: identity.RevocationDB#Put)
time.Sleep(1 * time.Second)
newRevokedLeafChain, revocationExt, err := testpeertls.RevokeLeaf(keys[peertls.CAIndex], oldRevokedLeafChain)
require.NoError(t, err)
err = rev.Unmarshal(revocationExt.Value)
require.NoError(t, err)
err = rev.Verify(newRevokedLeafChain[peertls.CAIndex])
require.NoError(t, err)
2019-04-03 16:03:53 +01:00
testrevocation.RevocationDBsTest(t, func(t *testing.T, revDB extensions.RevocationDB, db storage.KeyValueStore) {
2019-04-08 19:15:19 +01:00
opts := &extensions.Options{
RevDB: revDB,
2019-04-09 18:01:45 +01:00
PeerIDVersions: "*",
2019-04-03 16:03:53 +01:00
}
2019-04-08 19:15:19 +01:00
testcases := []struct {
name string
chain []*x509.Certificate
}{
{"no extensions", originalChain},
{"leaf revocation", oldRevokedLeafChain},
{"double leaf revocation", newRevokedLeafChain},
// TODO: more and more diverse extensions in cases
}
{
handlerFuncMap := extensions.DefaultHandlers.WithOptions(opts)
2019-04-08 19:15:19 +01:00
for _, testcase := range testcases {
t.Log(testcase.name)
extensionsMap := tlsopts.NewExtensionsMap(testcase.chain...)
err := extensionsMap.HandleExtensions(handlerFuncMap, identity.ToChains(testcase.chain))
assert.NoError(t, err)
}
}
})
2019-04-03 16:03:53 +01:00
})
}
func TestExtensionMap_HandleExtensions_error(t *testing.T) {
ctx := testcontext.New(t)
defer ctx.Cleanup()
testrevocation.RevocationDBsTest(t, func(t *testing.T, revDB extensions.RevocationDB, db storage.KeyValueStore) {
2019-04-03 16:03:53 +01:00
keys, chain, oldRevocation, err := testpeertls.NewRevokedLeafChain()
assert.NoError(t, err)
// NB: node ID is the same, timestamp must change
// (see: identity.RevocationDB#Put)
time.Sleep(time.Second)
2019-04-08 19:15:19 +01:00
_, newRevocation, err := testpeertls.RevokeLeaf(keys[peertls.CAIndex], chain)
2019-04-03 16:03:53 +01:00
require.NoError(t, err)
assert.NotEqual(t, oldRevocation, newRevocation)
err = revDB.Put(ctx, chain, newRevocation)
2019-04-03 16:03:53 +01:00
assert.NoError(t, err)
opts := &extensions.Options{RevDB: revDB}
handlerFuncMap := extensions.HandlerFactories{
extensions.RevocationUpdateHandler,
}.WithOptions(opts)
extensionsMap := tlsopts.NewExtensionsMap(chain[peertls.LeafIndex])
assert.Equal(t, oldRevocation, extensionsMap[extensions.RevocationExtID.String()])
err = extensionsMap.HandleExtensions(handlerFuncMap, identity.ToChains(chain))
assert.Errorf(t, err, extensions.ErrRevocationTimestamp.Error())
})
}