1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
package crl
import (
"crypto/x509"
"testing"
"time"
"github.com/cloudflare/cfssl/certdb"
"github.com/cloudflare/cfssl/certdb/sql"
"github.com/cloudflare/cfssl/certdb/testdb"
"github.com/cloudflare/cfssl/cli"
"github.com/cloudflare/cfssl/helpers"
)
var dbAccessor certdb.Accessor
const (
fakeAKI = "fake aki"
testCaFile = "../testdata/ca.pem"
testCaKeyFile = "../testdata/ca-key.pem"
)
func prepDB() (err error) {
db := testdb.SQLiteDB("../../certdb/testdb/certstore_development.db")
expirationTime := time.Now().AddDate(1, 0, 0)
var cert = certdb.CertificateRecord{
Serial: "1",
AKI: fakeAKI,
Expiry: expirationTime,
PEM: "revoked cert",
Status: "revoked",
RevokedAt: time.Now(),
Reason: 4,
}
dbAccessor = sql.NewAccessor(db)
err = dbAccessor.InsertCertificate(cert)
if err != nil {
return err
}
return
}
func verifyCRL(t *testing.T, crlBytesDER []byte, serial string, expireAfter time.Duration) {
parsedCrl, err := x509.ParseCRL(crlBytesDER)
if err != nil {
t.Fatal("failed to get certificate ", err)
}
if !parsedCrl.HasExpired(time.Now().Add(expireAfter)) {
t.Fatal("the CRL should have expired")
}
certs := parsedCrl.TBSCertList.RevokedCertificates
if len(certs) != 1 {
t.Fatal("failed to get one certificate")
}
cert := certs[0]
if cert.SerialNumber.String() != serial {
t.Fatal("cert was not correctly inserted in CRL, serial was " + cert.SerialNumber.String())
}
}
func TestRevokeMain(t *testing.T) {
err := prepDB()
if err != nil {
t.Fatal(err)
}
crlBytes, err := generateCRL(cli.Config{CAFile: testCaFile, CAKeyFile: testCaKeyFile, DBConfigFile: "../testdata/db-config.json"})
if err != nil {
t.Fatal(err)
}
verifyCRL(t, crlBytes, "1", 7*helpers.OneDay+time.Second)
}
func TestRevokeExpiry(t *testing.T) {
err := prepDB()
if err != nil {
t.Fatal(err)
}
crlBytes, err := generateCRL(cli.Config{CAFile: testCaFile, CAKeyFile: testCaKeyFile, DBConfigFile: "../testdata/db-config.json", CRLExpiration: 23 * time.Hour})
if err != nil {
t.Fatal(err)
}
verifyCRL(t, crlBytes, "1", 23*time.Hour+time.Second)
}
|
