Skip to content

Commit 3a58471

Browse files
sarmahajsarmahaj
committed
ci(https support ): add test for https support DI
- still WIP Signed-off-by: Sarita Mahajan <[email protected]>
1 parent a281209 commit 3a58471

File tree

11 files changed

+250
-14
lines changed

11 files changed

+250
-14
lines changed

‎client-linuxapp/src/main.rs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,8 @@ async fn perform_to2(
855855
) -> Result<bool> {
856856
log::info!("Performing TO2 protocol, URL: {:?}", url);
857857

858-
let mut client = fdo_http_wrapper::client::ServiceClient::new(ProtocolVersion::Version1_1, url)?;
858+
let mut client =
859+
fdo_http_wrapper::client::ServiceClient::new(ProtocolVersion::Version1_1, url)?;
859860

860861
let nonce5 = match get_nonce(MessageType::TO1RVRedirect).await {
861862
Ok(nonce5) => nonce5,

‎http-wrapper/src/client.rs

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -159,13 +159,13 @@ impl ServiceClient {
159159
client_builder = client_builder.danger_accept_invalid_certs(true);
160160
}
161161

162-
Ok(ServiceClient {
162+
Ok(ServiceClient {
163163
protocol_version,
164164
base_url: base_url.trim_end_matches('/').to_string(),
165165
client: client_builder
166-
.tls_info(true)
167-
// .danger_accept_invalid_certs(true)
168-
.build()?,
166+
.tls_info(true)
167+
// .danger_accept_invalid_certs(true)
168+
.build()?,
169169
authorization_token: None,
170170
encryption_keys: EncryptionKeys::unencrypted(),
171171
last_message_type: None,
@@ -223,15 +223,15 @@ impl ServiceClient {
223223
let to_send = to_send.serialize_data()?;
224224
let to_send = self.encryption_keys.encrypt(&to_send)?;
225225
log::trace!("Sending message: {:?}", hex::encode(&to_send));
226-
227-
let url = format!(
228-
"{}/fdo/{}/msg/{}",
226+
227+
let url = format!(
228+
"{}/fdo/{}/msg/{}",
229229
&self.base_url,
230230
self.protocol_version,
231231
OM::message_type() as u8
232-
);
232+
);
233233

234-
log::debug!("url: {}",url);
234+
log::debug!("url: {}", url);
235235
let mut req = self
236236
.client
237237
.post(&url)

‎integration-tests/Cargo.toml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@ serde_cbor = "0.11"
3232
serde_json = "1.0"
3333
pretty_assertions = "1.0.0"
3434
paste = "1.0"
35-
pem = "2.0"
35+
pem = "3.0.3"
36+
chrono = "0.4.33"
3637

3738
fdo-data-formats = { path = "../data-formats" }
3839
fdo-util = { path = "../util" }

‎integration-tests/templates/manufacturing-server.yml.j2

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ ownership_voucher_store_driver:
88
public_key_store_driver:
99
Directory:
1010
path: {{ config_dir }}/keys/
11-
bind: {{ bind }}
11+
bind_http: {{ bind }}
12+
bind_https: {{ bind_https }}
1213
rendezvous_info:
1314
- dns: localhost
1415
device_port: 8082
@@ -33,3 +34,5 @@ manufacturing:
3334
owner_cert_path: {{ keys_path }}/owner_cert.pem
3435
device_cert_ca_private_key: {{ keys_path }}/device_ca_key.der
3536
device_cert_ca_chain: {{ keys_path }}/device_ca_cert.pem
37+
manufacturing_server_https_cert: {{ keys_path }}/manufacturing_server_https_cert.crt
38+
manufacturing_server_https_key: {{ keys_path }}/manufacturing_server_https_key.key

‎integration-tests/tests/common/mod.rs

Lines changed: 102 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
use std::{
44
env,
55
fs::{self, create_dir, File},
6-
io::{BufRead, BufReader},
6+
io::{BufRead, BufReader, Write},
77
path::{Path, PathBuf},
88
process::{Child, Command, ExitStatus},
99
time::{Duration, Instant},
@@ -22,6 +22,11 @@ use openssl::{
2222

2323
use fdo_util::servers::format_conf_env;
2424

25+
use openssl::rsa::Rsa;
26+
use openssl::x509::extension::SubjectAlternativeName;
27+
use openssl::x509::X509Extension;
28+
use openssl::x509::X509ReqBuilder;
29+
2530
const PORT_BASE: u16 = 5080;
2631

2732
lazy_static::lazy_static! {
@@ -241,6 +246,9 @@ impl TestContext {
241246
};
242247

243248
new_context.create_keys().context("Error creating keys")?;
249+
new_context
250+
.generate_https_keys_and_certs()
251+
.context("Error creating https key & cert")?;
244252

245253
Ok(new_context)
246254
}
@@ -259,6 +267,98 @@ impl TestContext {
259267
pub fn runner_path(&self, number: &TestBinaryNumber) -> PathBuf {
260268
self.testpath.join(number.name())
261269
}
270+
pub fn generate_https_keys_and_certs(&self) -> Result<()> {
271+
let https_keys_path = self.keys_path();
272+
// create_dir(&https_keys_path).context("Error creating HTTPS keys directory")?;
273+
274+
/* // Generate RSA private key
275+
let rsa = Rsa::generate(2048).context("Error generating RSA private key")?;
276+
let private_key = PKey::from_rsa(rsa).context("Error converting RSA private key to PKey")?;
277+
278+
// Generate certificate request
279+
let mut req_builder = X509ReqBuilder::new().context("Error creating X509ReqBuilder")?;
280+
req_builder.set_pubkey(&private_key).context("Error setting public key in request")?;
281+
req_builder
282+
.add_extension(
283+
X509Extension::subject_alt_name(
284+
&SubjectAlternativeName::new()
285+
.dns("localhost")
286+
.dns("example.com"),
287+
)
288+
.context("Error adding Subject Alternative Name extension")?,
289+
)
290+
.context("Error adding extension to request")?;
291+
let req = req_builder.build();
292+
293+
// Sign the certificate request with the private key
294+
let cert = req
295+
.sign(&private_key, MessageDigest::sha256())
296+
.context("Error signing certificate request")?;
297+
298+
// Now serialize the key and certificate
299+
let private_key = private_key
300+
.private_key_to_der()
301+
.context("Error converting private key to DER")?;
302+
let cert = cert.to_pem().context("Error converting certificate to PEM")?;
303+
304+
// Write them to disk
305+
fs::write(https_keys_path.join("server_key.der"), private_key)
306+
.context("Error writing private key")?;
307+
fs::write(https_keys_path.join("server_cert.pem"), cert)
308+
.context("Error writing certificate")?; */
309+
310+
// Generate RSA private key
311+
let rsa = Rsa::generate(2048)?;
312+
//let private_key = rsa.private_key_to_pem()?;
313+
let private_key =
314+
PKey::from_rsa(rsa).context("Error converting RSA private key to PKey")?;
315+
316+
// Write private key to server.key file
317+
let mut key_file = File::create(format!(
318+
"{}/manufacturing_server_https_key.key",
319+
https_keys_path.display()
320+
))?;
321+
//key_file.write_all(&private_key)?;
322+
key_file.write_all(&private_key.private_key_to_pem_pkcs8()?)?;
323+
// Generate X.509 certificate
324+
let mut builder = X509Builder::new()?;
325+
326+
// Set subject for the certificate
327+
let mut name_builder = X509NameBuilder::new()?;
328+
name_builder.append_entry_by_nid(openssl::nid::Nid::COMMONNAME, "localhost")?;
329+
let subject_name = name_builder.build();
330+
builder.set_subject_name(&subject_name)?;
331+
332+
// Set issuer same as subject (self-signed certificate)
333+
builder.set_issuer_name(&subject_name)?;
334+
335+
// Set public key in the certificate
336+
builder.set_pubkey(&private_key)?;
337+
338+
// Set validity period of the certificate (365 days)
339+
// let not_after = chrono::Utc::now() + chrono::Duration::days(365);
340+
//builder.set_not_after(&not_after)?;
341+
//builder.set_not_before(&chrono::Utc::now())?;
342+
343+
// let not_after = chrono::Utc::now() + chrono::Duration::days(365);
344+
// builder.set_not_after(Asn1Time::from(&not_after)?)?;
345+
builder.set_not_after(Asn1Time::days_from_now(365)?.as_ref())?;
346+
builder.set_not_before(Asn1Time::days_from_now(0)?.as_ref())?;
347+
// builder.set_not_before(Asn1Time::from(&chrono::Utc::now())?)?;
348+
349+
// Sign the certificate with the private key
350+
builder.sign(&private_key, openssl::hash::MessageDigest::sha256())?;
351+
let certificate = builder.build();
352+
353+
// Write certificate to server.crt file
354+
let mut cert_file = File::create(format!(
355+
"{}/manufacturing_server_https_cert.crt",
356+
https_keys_path.display()
357+
))?;
358+
cert_file.write_all(&certificate.to_pem()?)?;
359+
360+
Ok(())
361+
}
262362

263363
fn create_keys(&self) -> Result<()> {
264364
let keys_path = self.keys_path();
@@ -336,7 +436,6 @@ impl TestContext {
336436
fs::write(keys_path.join(format!("{}_cert.pem", key_name)), cert)
337437
.context("Error writing certificate")?;
338438
}
339-
340439
Ok(())
341440
}
342441

@@ -801,6 +900,7 @@ impl<'a> TestServerConfigurator<'a> {
801900
"bind",
802901
&format!("127.0.0.1:{}", self.server_number.server_port().unwrap()),
803902
);
903+
cfg.insert("bind_https", &format!("127.0.0.1:{}", 6000));
804904
cfg.insert("test_dir", &self.test_context.testpath());
805905
cfg.insert("owner_port", &self.server_number.server_port().unwrap());
806906
cfg.insert(

‎integration-tests/tests/di_diun.rs

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ async fn test_device_credentials_already_active() -> Result<()> {
2525
cfg.insert("rendezvous_port", "1337");
2626
cfg.insert("diun_key_type", "FileSystem");
2727
cfg.insert("device_identification_format", "SerialNumber");
28+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
29+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
30+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8096"));
2831
Ok(())
2932
})?)
3033
},
@@ -109,6 +112,9 @@ async fn test_device_credentials_generated_with_mac_address() -> Result<()> {
109112
cfg.insert("rendezvous_port", "1337");
110113
cfg.insert("diun_key_type", "FileSystem");
111114
cfg.insert("device_identification_format", "MACAddress");
115+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
116+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
117+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8086"));
112118
Ok(())
113119
})?)
114120
},
@@ -207,6 +213,9 @@ async fn test_device_credentials_with_tpm() -> Result<()> {
207213
cfg.insert("rendezvous_port", "1337");
208214
cfg.insert("diun_key_type", "Tpm");
209215
cfg.insert("device_identification_format", "SerialNumber");
216+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
217+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
218+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8086"));
210219
Ok(())
211220
})?)
212221
},
@@ -254,6 +263,10 @@ async fn test_device_credentials_generated_with_mac_address_no_user_given_iface(
254263
cfg.insert("rendezvous_port", "1337");
255264
cfg.insert("diun_key_type", "FileSystem");
256265
cfg.insert("device_identification_format", "MACAddress");
266+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
267+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
268+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8086"));
269+
257270
Ok(())
258271
})?)
259272
},

‎integration-tests/tests/di_diun_https.rs

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
mod common;
2+
use anyhow::{Context, Result};
3+
use common::{Binary, LogSide, TestContext};
4+
use std::path::Path;
5+
use std::time::Duration;
6+
const L: LogSide = LogSide::Test;
7+
8+
#[tokio::test]
9+
async fn di_diun_https_test() -> Result<()> {
10+
let mut ctx = TestContext::new().context("Error building test context")?;
11+
12+
let mfg_server = ctx
13+
.start_test_server(
14+
Binary::ManufacturingServer,
15+
|cfg| {
16+
Ok(cfg.prepare_config_file(None, |cfg| {
17+
cfg.insert("rendezvous_port", "1337");
18+
cfg.insert("diun_key_type", "FileSystem");
19+
cfg.insert("device_identification_format", "SerialNumber");
20+
// cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
21+
// cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
22+
// cfg.insert("bind_http", "8085");
23+
// cfg.insert("bind_https", &("127.0.0.1:{}" ));
24+
Ok(())
25+
})?)
26+
},
27+
|_| Ok(()),
28+
)
29+
.context("Error creating manufacturing server")?;
30+
ctx.wait_until_servers_ready()
31+
.await
32+
.context("Error waiting for servers to start")?;
33+
34+
let client_result = ctx
35+
.run_client(
36+
Binary::ManufacturingClient,
37+
Some(&mfg_server),
38+
|cfg| {
39+
cfg.env("DEVICE_CREDENTIAL_FILENAME", "devicecredential.dc")
40+
.env("MANUFACTURING_SERVER_URL", "https://localhost:8086")
41+
.env("DEV_ENVIRONMENT", "1")
42+
.env("DIUN_PUB_KEY_INSECURE", "true");
43+
Ok(())
44+
},
45+
Duration::from_secs(5),
46+
)
47+
.context("Error running manufacturing client")?;
48+
client_result
49+
.expect_success()
50+
.context("Manufacturing client failed")?;
51+
52+
let dc_path = client_result.client_path().join("devicecredential.dc");
53+
L.l(format!("Device Credential should be in {:?}", dc_path));
54+
assert!(Path::new(&dc_path).exists());
55+
56+
Ok(())
57+
}

‎integration-tests/tests/e2e.rs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,10 @@ where
192192
cfg.insert("diun_key_type", diun_key_type);
193193
cfg.insert("rendezvous_port", &rendezvous_server.server_port().unwrap());
194194
cfg.insert("device_identification_format", "SerialNumber");
195+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
196+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
197+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8086"));
198+
195199
Ok(())
196200
})?)
197201
},
@@ -514,6 +518,10 @@ where
514518
cfg.insert("diun_key_type", diun_key_type);
515519
cfg.insert("rendezvous_port", &rendezvous_server.server_port().unwrap());
516520
cfg.insert("device_identification_format", "SerialNumber");
521+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
522+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
523+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8086"));
524+
517525
Ok(())
518526
})?)
519527
},

‎integration-tests/tests/service_info.rs

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,9 @@ where
106106
cfg.insert("diun_key_type", diun_key_type);
107107
cfg.insert("rendezvous_port", &rendezvous_server.server_port().unwrap());
108108
cfg.insert("device_identification_format", "SerialNumber");
109+
cfg.insert("manufacturing_server_https_cert_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
110+
cfg.insert("manufacturing_server_https_key_path", "/workspaces/fido-device-onboard-rs/integration-tests/tests/test-data/https-test");
111+
// cfg.insert("bind_https", &format!("0.0.0.0:{}","8086"));
109112
Ok(())
110113
})?)
111114
},

‎integration-tests/tests/test-data/https-test/manufacturing_server_https_cert.crt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDqzCCApMCFDBq5YwvijIjOB6U4yFgJpJwHTsEMA0GCSqGSIb3DQEBCwUAMIGR
3+
MQswCQYDVQQGEwJJRTEPMA0GA1UECAwGR2Fsd2F5MQ8wDQYDVQQHDAZHYWx3YXkx
4+
EDAOBgNVBAoMB1JlZCBIYXQxDDAKBgNVBAsMA1I0RTEcMBoGA1UEAwwTd3d3LmZk
5+
by5leGFtcGxlLmNvbTEiMCAGCSqGSIb3DQEJARYTc2FybWFoYWpAcmVkaGF0LmNv
6+
bTAeFw0yMzA5MTIxMDA5MzdaFw0yNDA5MTExMDA5MzdaMIGRMQswCQYDVQQGEwJJ
7+
RTEPMA0GA1UECAwGR2Fsd2F5MQ8wDQYDVQQHDAZHYWx3YXkxEDAOBgNVBAoMB1Jl
8+
ZCBIYXQxDDAKBgNVBAsMA1I0RTEcMBoGA1UEAwwTd3d3LmZkby5leGFtcGxlLmNv
9+
bTEiMCAGCSqGSIb3DQEJARYTc2FybWFoYWpAcmVkaGF0LmNvbTCCASIwDQYJKoZI
10+
hvcNAQEBBQADggEPADCCAQoCggEBAMiKFA4zj4DZ3S85HosHND7hAapN7MSS6h+4
11+
xdJC6xZBe4EkSNpvuj22I09bxdmdPB4KDI0mKIhzM5QTmeIj5ejGaeviuDbLuF1t
12+
2CLbb4Dprj9uS81XattqSdRDeWa4EZRGf3iGoryb2KgdRaqT1sy5Rh2KfNa+267w
13+
JElZ6EsBjjXojBO2yg+dW75U1oIhLtQPFUIQ78muOr8Hg6p67UHaLO6rry7R/Dhd
14+
bphrJwLME5AaQAvpudWM7y0PrHsOzW3nmykktTSbOXBWtx2d7pZYju+DXSW9/1rV
15+
+GV+NtoUIjUL9fEKm9mT2VuW433ZCvPrQTAcNo87VsMYk4mZyZcCAwEAATANBgkq
16+
hkiG9w0BAQsFAAOCAQEAx0l+3iEf6SydBwWP1qVFPRC9NExym5DN14bYQivBwvNO
17+
454WrO/lQyXuKsMrS5Uu2bURNblxs7lOIfyzIn9CHZq8DRcAfPoVl9nn90WnD72j
18+
YIqCvOcC5VtLR5SFMIfWYgpj7/uHhEO0ykQk5oLkxkooPROOcJPDdUuZZx5hY3f9
19+
r7zGBrPhQHT+3YJmg2aF4j7+GCGoydg+alkxLHhHfs7r+tH7bNtL28x86iqilWGs
20+
7ciG5nZm+tM/DaI+yUtnJhN83J6914Zjm8QX/85IiaBC6rVcEfkFTkqlPXId2kHV
21+
pmRu5tNQOqLctpmIr+M1/JQDuhkoh+MyJBfEwzG6Tw==
22+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)