package signer import ( "bytes" "reflect" "testing" "time" "github.com/nsheridan/cashier/lib" "github.com/nsheridan/cashier/server/store" "github.com/nsheridan/cashier/testdata" "github.com/stripe/krl" "golang.org/x/crypto/ssh" ) var ( key, _ = ssh.ParsePrivateKey(testdata.Priv) signer = &KeySigner{ ca: key, validity: 12 * time.Hour, principals: []string{"ec2-user"}, permissions: []string{"permit-pty", "force-command=/bin/ls"}, } ) func TestCert(t *testing.T) { r := &lib.SignRequest{ Key: string(testdata.Pub), ValidUntil: time.Now().Add(1 * time.Hour), Message: "hello world", } cert, err := signer.SignUserKey(r, "gopher1") if err != nil { t.Error(err) } if !bytes.Equal(cert.SignatureKey.Marshal(), signer.ca.PublicKey().Marshal()) { t.Error("Cert signer and server signer don't match") } var principals []string principals = append(principals, "gopher1") principals = append(principals, signer.principals...) if !reflect.DeepEqual(cert.ValidPrincipals, principals) { t.Errorf("Expected %s, got %s", cert.ValidPrincipals, principals) } k1, _, _, _, err := ssh.ParseAuthorizedKey([]byte(r.Key)) k2 := cert.Key if !bytes.Equal(k1.Marshal(), k2.Marshal()) { t.Error("Cert key doesn't match public key") } if cert.ValidBefore != uint64(r.ValidUntil.Unix()) { t.Errorf("Invalid validity, expected %d, got %d", r.ValidUntil.Unix(), cert.ValidBefore) } } func TestRevocationList(t *testing.T) { r := &lib.SignRequest{ Key: string(testdata.Pub), ValidUntil: time.Now().Add(1 * time.Hour), } cert1, _ := signer.SignUserKey(r, "revoked") cert2, _ := signer.SignUserKey(r, "ok") var rec []*store.CertRecord rec = append(rec, &store.CertRecord{ KeyID: cert1.KeyId, }) rl, err := signer.GenerateRevocationList(rec) if err != nil { t.Error(err) } k, err := krl.ParseKRL(rl) if err != nil { t.Error(err) } if !k.IsRevoked(cert1) { t.Errorf("expected cert %s to be revoked", cert1.KeyId) } if k.IsRevoked(cert2) { t.Errorf("cert %s should not be revoked", cert2.KeyId) } } func TestPermissions(t *testing.T) { r := &lib.SignRequest{ Key: string(testdata.Pub), ValidUntil: time.Now().Add(1 * time.Hour), } cert, err := signer.SignUserKey(r, "gopher1") if err != nil { t.Error(err) } want := struct { extensions map[string]string options map[string]string }{ extensions: map[string]string{"permit-pty": ""}, options: map[string]string{"force-command": "/bin/ls"}, } if !reflect.DeepEqual(cert.Extensions, want.extensions) { t.Errorf("Wrong permissions: wanted: %v got :%v", cert.Extensions, want.extensions) } if !reflect.DeepEqual(cert.CriticalOptions, want.options) { t.Errorf("Wrong options: wanted: %v got :%v", cert.CriticalOptions, want.options) } }