name: Tomcat HTTPS with multiple certificates

on: workflow_call

env:
  NAMESPACE: ${{ vars.REGISTRY_NAMESPACE || 'dogtagpki' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get -y install xmlstarlet

      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve JSS images
        uses: actions/cache@v4
        with:
          key: jss-images-${{ github.sha }}
          path: jss-images.tar

      - name: Load JSS images
        run: docker load --input jss-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up JSS container
        run: |
          tests/bin/runner-init.sh \
              --hostname=server.example.com \
              --network=example \
              --network-alias=server.example.com \
              server

          # get Fedora version
          FEDORA_VERSION=$(docker exec server sed -n 's/^VERSION_ID=//p' /etc/os-release)
          echo "FEDORA_VERSION=$FEDORA_VERSION" >> $GITHUB_ENV

      - name: Import LDAP SDK packages
        run: |
          docker create --name=ldapjdk-dist quay.io/$NAMESPACE/ldapjdk-dist:5.6
          docker cp ldapjdk-dist:/root/RPMS/. /tmp/RPMS/
          docker rm -f ldapjdk-dist

      - name: Import PKI packages
        run: |
          docker create --name=pki-dist quay.io/$NAMESPACE/pki-dist:11.9
          docker cp pki-dist:/root/RPMS/. /tmp/RPMS/
          docker rm -f pki-dist

      - name: Install packages
        run: |
          docker cp /tmp/RPMS/. server:/root/RPMS/
          docker exec server bash -c "dnf install -y /root/RPMS/*"

      - name: Create Tomcat
        run: |
          docker exec server pki-server create -v

      - name: Create NSS database in Tomcat
        run: |
          docker exec server pki-server nss-create --no-password

      - name: Create RSA SSL server cert
        run: |
          docker exec server pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-request \
              --subject "CN=server.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver-RSA.csr

          docker exec server pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-issue \
              --csr sslserver-RSA.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert sslserver-RSA.crt

          docker exec server pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-import \
              --cert sslserver-RSA.crt \
              sslserver-RSA

      - name: Create EC SSL server cert
        run: |
          docker exec server pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-request \
              --key-type EC \
              --subject "CN=server.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver-EC.csr

          docker exec server pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-issue \
              --csr sslserver-EC.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert sslserver-EC.crt

          docker exec server pki \
              -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-import \
              --cert sslserver-EC.crt \
              sslserver-EC

      - name: Create HTTPS connector
        run: |
          docker exec server pki-server jss-enable

          docker exec server pki-server http-connector-add \
              --port 8443 \
              --scheme https \
              --secure true \
              --sslEnabled true \
              --sslProtocol SSL \
              --sslImpl org.dogtagpki.jss.tomcat.JSSImplementation \
              Secure

      - name: Add HTTPS connector certificates
        run: |
          docker exec server pki-server http-connector-cert-add \
              --keyAlias sslserver-EC \
              --keystoreType pkcs11 \
              --keystoreProvider Mozilla-JSS \
              EC

          docker exec server pki-server http-connector-cert-add \
              --keyAlias sslserver-RSA \
              --keystoreType pkcs11 \
              --keystoreProvider Mozilla-JSS \
              RSA

          docker exec server cat /etc/pki/pki-tomcat/server.xml

      - name: Start Tomcat
        run: |
          docker exec server pki-server start --wait -v

      - name: Check connection using RSA certificate
        if: ${{ fromJSON(env.FEDORA_VERSION) < 43 }}
        run: |
          echo "Hello" \
            | docker exec server openssl s_client -sigalgs 'RSA-PSS+SHA256' server.example.com:8443 \
            | tee output

          echo "   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256" > expected
          grep "a:PKEY" output > actual
          diff expected actual

      - name: Check connection using RSA certificate
        if: ${{ fromJSON(env.FEDORA_VERSION) >= 43 }}
        run: |
          echo "Hello" \
            | docker exec server openssl s_client -sigalgs 'RSA-PSS+SHA256' server.example.com:8443 \
            | tee output

          echo "   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption" > expected
          grep "a:PKEY" output > actual
          diff expected actual

      - name: Check connection using EC certificate
        if: ${{ fromJSON(env.FEDORA_VERSION) < 43 }}
        run: |
          echo "Hello" \
            | docker exec server openssl s_client -sigalgs 'ECDSA+SHA256' server.example.com:8443 \
            | tee output

          echo "   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA256" > expected
          grep "a:PKEY" output > actual
          diff expected actual

      - name: Check connection using EC certificate
        if: ${{ fromJSON(env.FEDORA_VERSION) >= 43 }}
        run: |
          echo "Hello" \
            | docker exec server openssl s_client -sigalgs 'ECDSA+SHA256' server.example.com:8443 \
            | tee output

          echo "   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA256" > expected
          grep "a:PKEY" output > actual
          diff expected actual

      - name: Stop Tomcat
        run: |
          docker exec server pki-server stop --wait -v

      - name: Remove Tomcat
        run: |
          docker exec server pki-server remove -v

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec server journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service
