@@ -20,10 +20,17 @@ package libreswan_test
2020
2121import (
2222 "context"
23- "maps"
23+ "crypto/rand"
24+ "crypto/rsa"
25+ "crypto/x509"
26+ "crypto/x509/pkix"
27+ _ "embed"
28+ "encoding/pem"
29+ "math/big"
2430 "os"
2531 "os/exec"
2632 "path/filepath"
33+ "time"
2734
2835 . "github.com/onsi/ginkgo/v2"
2936 . "github.com/onsi/gomega"
@@ -34,17 +41,59 @@ import (
3441)
3542
3643var _ = Describe ("CertificateHandler" , func () {
37- certData := map [string ][]byte {
38- certificate .CADataKey : []byte ("-----BEGIN CERTIFICATE-----\n MOCK_CA_CERT\n -----END CERTIFICATE-----" ),
39- certificate .TLSDataKey : []byte ("-----BEGIN CERTIFICATE-----\n MOCK_CLIENT_CERT\n -----END CERTIFICATE-----" ),
40- certificate .PrivateKeyDataKey : []byte ("-----BEGIN PRIVATE KEY-----\n MOCK_CLIENT_KEY\n -----END PRIVATE KEY-----" ),
41- }
42-
4344 var (
44- cmdExecutor * fakecommand.Executor
45- handler * libreswan.CertificateHandler
45+ cmdExecutor * fakecommand.Executor
46+ handler * libreswan.CertificateHandler
47+ testCertData map [string ][]byte
48+ newCertData map [string ][]byte
4649 )
4750
51+ BeforeEach (func () {
52+ if testCertData == nil || newCertData == nil {
53+ // CA
54+ caKey , caCert , err := certificate .CreateCAKeyAndCertificate ("CA" , 24 * 365 * 10 * time .Hour )
55+ Expect (err ).NotTo (HaveOccurred ())
56+ caDER , err := x509 .CreateCertificate (rand .Reader , caCert , caCert , & caKey .PublicKey , caKey )
57+ Expect (err ).NotTo (HaveOccurred ())
58+ caPEM := pem .EncodeToMemory (& pem.Block {Type : "CERTIFICATE" , Bytes : caDER })
59+
60+ createSignedCertificate := func (name string ) map [string ][]byte {
61+ privateKey , err := rsa .GenerateKey (rand .Reader , certificate .RSABitSize )
62+ Expect (err ).NotTo (HaveOccurred ())
63+
64+ serialNumber , err := rand .Int (rand .Reader , new (big.Int ).Lsh (big .NewInt (1 ), 128 ))
65+ Expect (err ).NotTo (HaveOccurred ())
66+
67+ cert := & x509.Certificate {
68+ SerialNumber : serialNumber ,
69+ Subject : pkix.Name {
70+ CommonName : name ,
71+ Organization : []string {"submariner.io" },
72+ },
73+ NotBefore : time .Now (),
74+ NotAfter : time .Now ().AddDate (10 , 0 , 0 ),
75+ KeyUsage : x509 .KeyUsageDigitalSignature ,
76+ ExtKeyUsage : []x509.ExtKeyUsage {x509 .ExtKeyUsageClientAuth , x509 .ExtKeyUsageServerAuth },
77+ }
78+
79+ certDER , err := x509 .CreateCertificate (rand .Reader , cert , caCert , & privateKey .PublicKey , caKey )
80+ Expect (err ).NotTo (HaveOccurred ())
81+
82+ return map [string ][]byte {
83+ certificate .CADataKey : caPEM ,
84+ certificate .TLSDataKey : pem .EncodeToMemory (& pem.Block {Type : "CERTIFICATE" , Bytes : certDER }),
85+ certificate .PrivateKeyDataKey : pem .EncodeToMemory (& pem.Block {Type : "RSA PRIVATE KEY" , Bytes : x509 .MarshalPKCS1PrivateKey (privateKey )}),
86+ }
87+ }
88+
89+ // First test certificate
90+ testCertData = createSignedCertificate ("test" )
91+
92+ // New test certificate
93+ newCertData = createSignedCertificate ("new" )
94+ }
95+ })
96+
4897 BeforeEach (func () {
4998 setupTempDir ()
5099
@@ -64,22 +113,15 @@ var _ = Describe("CertificateHandler", func() {
64113 }
65114
66115 It ("should successfully load the certificates into the NSS database" , func () {
67- Expect (handler .OnSignedCallback (certData )).To (Succeed ())
116+ Expect (handler .OnSignedCallback (testCertData )).To (Succeed ())
68117
69118 cmdExecutor .AwaitCommand (ContainSubstring ("certutil" ), "-N" , "-d" , "sql:" + handler .NSSDatabaseDir ())
70119 assertCmdStdIn (cmdExecutor .AwaitCommand (ContainSubstring ("certutil" ), "-A" , libreswan .CACertName ,
71- "-d" , "sql:" + handler .NSSDatabaseDir ()), certData [certificate .CADataKey ])
72- cmdExecutor .AwaitCommand (ContainSubstring ("openssl" ), "pkcs12" , "-export" , "-name" , libreswan .ClientCertName )
120+ "-d" , "sql:" + handler .NSSDatabaseDir ()), testCertData [certificate .CADataKey ])
73121 cmdExecutor .AwaitCommand (ContainSubstring ("pk12util" ), "-d" , "sql:" + handler .NSSDatabaseDir ())
74122 cmdExecutor .Clear ()
75123
76124 By ("Invoking OnSignedCallback with new cert data" )
77-
78- newCertData := map [string ][]byte {
79- certificate .CADataKey : []byte ("NEW_CA_CERT" ),
80- certificate .TLSDataKey : []byte ("NEW_CLIENT_CERT" ),
81- certificate .PrivateKeyDataKey : []byte ("NEW_CLIENT_KEY" ),
82- }
83125 Expect (handler .OnSignedCallback (newCertData )).To (Succeed ())
84126
85127 cmdExecutor .AwaitCommand (ContainSubstring ("certutil" ), "-A" , libreswan .CACertName )
@@ -103,7 +145,7 @@ var _ = Describe("CertificateHandler", func() {
103145 return fakecommand.InterceptorFuncs {}
104146 })
105147
106- Expect (handler .OnSignedCallback (certData )).NotTo (Succeed ())
148+ Expect (handler .OnSignedCallback (testCertData )).NotTo (Succeed ())
107149 })
108150
109151 It ("should handle certificate loading failure" , func () {
@@ -117,11 +159,11 @@ var _ = Describe("CertificateHandler", func() {
117159 return fakecommand.InterceptorFuncs {}
118160 })
119161
120- Expect (handler .OnSignedCallback (certData )).NotTo (Succeed ())
162+ Expect (handler .OnSignedCallback (testCertData )).NotTo (Succeed ())
121163 })
122164
123165 It ("should only initialize the NSS database once" , func () {
124- Expect (handler .OnSignedCallback (certData )).To (Succeed ())
166+ Expect (handler .OnSignedCallback (testCertData )).To (Succeed ())
125167
126168 cmdExecutor .AwaitCommand (ContainSubstring ("certutil" ), "-N" )
127169 cmdExecutor .Clear ()
@@ -131,8 +173,6 @@ var _ = Describe("CertificateHandler", func() {
131173 _ , err := os .Create (nssDBFile )
132174 Expect (err ).NotTo (HaveOccurred ())
133175
134- newCertData := maps .Clone (certData )
135- newCertData [certificate .CADataKey ] = []byte ("NEW_CA_CERT" )
136176 Expect (handler .OnSignedCallback (newCertData )).To (Succeed ())
137177
138178 cmdExecutor .EnsureNoCommand (ContainSubstring ("certutil" ), "-N" )
0 commit comments