@ -16,6 +16,8 @@
# include <stdio.h>
# include <string.h>
# include <utility>
# include <gmock/gmock.h>
# include <gtest/gtest.h>
@ -34,6 +36,7 @@
# include "src/core/tsi/transport_security_interface.h"
# include "test/core/tsi/transport_security_test_lib.h"
# include "test/core/util/test_config.h"
# include "test/core/util/tls_utils.h"
extern " C " {
# include <openssl/crypto.h>
@ -42,9 +45,6 @@ extern "C" {
namespace {
const int kSslTsiTestRevokedKeyCertPairsNum = 1 ;
const int kSslTsiTestValidKeyCertPairsNum = 1 ;
const int kSslTsiTestRevokedIntermedidateKeyCertPairsNum = 1 ;
const char * kSslTsiTestCrlSupportedCredentialsDir =
" test/core/tsi/test_creds/crl_data/ " ;
const char * kSslTsiTestCrlSupportedCrlDir =
@ -54,6 +54,18 @@ const char* kSslTsiTestCrlSupportedCrlDirMissingIntermediate =
const char * kSslTsiTestCrlSupportedCrlDirMissingRoot =
" test/core/tsi/test_creds/crl_data/crls_missing_root/ " ;
const char * kSslTsiTestFaultyCrlsDir = " bad_path/ " ;
const char * kRevokedKeyPath = " test/core/tsi/test_creds/crl_data/revoked.key " ;
const char * kRevokedCertPath = " test/core/tsi/test_creds/crl_data/revoked.pem " ;
const char * kValidKeyPath = " test/core/tsi/test_creds/crl_data/valid.key " ;
const char * kValidCertPath = " test/core/tsi/test_creds/crl_data/valid.pem " ;
const char * kRevokedIntermediateKeyPath =
" test/core/tsi/test_creds/crl_data/leaf_signed_by_intermediate.key " ;
const char * kRevokedIntermediateCertPath =
" test/core/tsi/test_creds/crl_data/leaf_and_intermediate_chain.pem " ;
const char * kRootCrlPath = " test/core/tsi/test_creds/crl_data/crls/current.crl " ;
const char * kIntermediateCrlPath =
" test/core/tsi/test_creds/crl_data/crls/intermediate.crl " ;
class CrlSslTransportSecurityTest
: public testing : : TestWithParam < tsi_tls_version > {
@ -61,22 +73,40 @@ class CrlSslTransportSecurityTest
// A tsi_test_fixture implementation.
class SslTsiTestFixture {
public :
// When use_faulty_crl_directory is set, the crl_directory of the
// client is set to a non-existant path.
static SslTsiTestFixture * Create ( bool use_revoked_server_cert ,
bool use_revoked_client_cert ,
bool use_faulty_crl_directory ) {
return new SslTsiTestFixture (
use_revoked_server_cert , use_revoked_client_cert ,
use_faulty_crl_directory , false , false , false ) ;
}
static SslTsiTestFixture * CreateWithIntermediate (
bool use_revoked_intermediate , bool use_missing_intermediate_crl ,
bool use_missing_root_crl ) {
return new SslTsiTestFixture (
false , false , false , use_revoked_intermediate ,
use_missing_intermediate_crl , use_missing_root_crl ) ;
SslTsiTestFixture (
absl : : string_view server_key_path , absl : : string_view server_cert_path ,
absl : : string_view client_key_path , absl : : string_view client_cert_path ,
const char * crl_directory ,
std : : shared_ptr < grpc_core : : experimental : : CrlProvider > crl_provider ,
bool expect_server_success , bool expect_client_success_1_2 ,
bool expect_client_success_1_3 ) {
tsi_test_fixture_init ( & base_ ) ;
base_ . test_unused_bytes = true ;
base_ . vtable = & kVtable ;
server_key_ = grpc_core : : testing : : GetFileContents ( server_key_path . data ( ) ) ;
server_cert_ =
grpc_core : : testing : : GetFileContents ( server_cert_path . data ( ) ) ;
client_key_ = grpc_core : : testing : : GetFileContents ( client_key_path . data ( ) ) ;
client_cert_ =
grpc_core : : testing : : GetFileContents ( client_cert_path . data ( ) ) ;
root_cert_ = grpc_core : : testing : : GetFileContents (
absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir , " ca.pem " ) . data ( ) ) ;
root_store_ = tsi_ssl_root_certs_store_create ( root_cert_ . c_str ( ) ) ;
crl_directory_ = crl_directory ;
crl_provider_ = std : : move ( crl_provider ) ;
expect_server_success_ = expect_server_success ;
expect_client_success_1_2_ = expect_client_success_1_2 ;
expect_client_success_1_3_ = expect_client_success_1_3 ;
server_pem_key_cert_pairs_ = static_cast < tsi_ssl_pem_key_cert_pair * > (
gpr_malloc ( sizeof ( tsi_ssl_pem_key_cert_pair ) ) ) ;
server_pem_key_cert_pairs_ [ 0 ] . private_key = server_key_ . c_str ( ) ;
server_pem_key_cert_pairs_ [ 0 ] . cert_chain = server_cert_ . c_str ( ) ;
client_pem_key_cert_pairs_ = static_cast < tsi_ssl_pem_key_cert_pair * > (
gpr_malloc ( sizeof ( tsi_ssl_pem_key_cert_pair ) ) ) ;
client_pem_key_cert_pairs_ [ 0 ] . private_key = client_key_ . c_str ( ) ;
client_pem_key_cert_pairs_ [ 0 ] . cert_chain = client_cert_ . c_str ( ) ;
GPR_ASSERT ( root_store_ ! = nullptr ) ;
}
void Run ( ) {
@ -84,73 +114,16 @@ class CrlSslTransportSecurityTest
tsi_test_fixture_destroy ( & base_ ) ;
}
private :
SslTsiTestFixture ( bool use_revoked_server_cert ,
bool use_revoked_client_cert ,
bool use_faulty_crl_directory ,
bool use_revoked_intermediate ,
bool use_missing_intermediate_crl ,
bool use_missing_root_crl )
: use_revoked_server_cert_ ( use_revoked_server_cert ) ,
use_revoked_client_cert_ ( use_revoked_client_cert ) ,
use_faulty_crl_directory_ ( use_faulty_crl_directory ) ,
use_revoked_intermediate_ ( use_revoked_intermediate ) ,
use_missing_intermediate_crl_ ( use_missing_intermediate_crl ) ,
use_missing_root_crl_ ( use_missing_root_crl ) {
tsi_test_fixture_init ( & base_ ) ;
base_ . test_unused_bytes = true ;
base_ . vtable = & kVtable ;
// Load cert data.
revoked_pem_key_cert_pairs_ = static_cast < tsi_ssl_pem_key_cert_pair * > (
gpr_malloc ( sizeof ( tsi_ssl_pem_key_cert_pair ) *
kSslTsiTestRevokedKeyCertPairsNum ) ) ;
revoked_pem_key_cert_pairs_ [ 0 ] . private_key = LoadFile (
absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir , " revoked.key " ) ) ;
revoked_pem_key_cert_pairs_ [ 0 ] . cert_chain = LoadFile (
absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir , " revoked.pem " ) ) ;
valid_pem_key_cert_pairs_ = static_cast < tsi_ssl_pem_key_cert_pair * > (
gpr_malloc ( sizeof ( tsi_ssl_pem_key_cert_pair ) *
kSslTsiTestValidKeyCertPairsNum ) ) ;
valid_pem_key_cert_pairs_ [ 0 ] . private_key = LoadFile (
absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir , " valid.key " ) ) ;
valid_pem_key_cert_pairs_ [ 0 ] . cert_chain = LoadFile (
absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir , " valid.pem " ) ) ;
revoked_intermediate_pem_key_cert_pairs_ =
static_cast < tsi_ssl_pem_key_cert_pair * > (
gpr_malloc ( sizeof ( tsi_ssl_pem_key_cert_pair ) *
kSslTsiTestRevokedIntermedidateKeyCertPairsNum ) ) ;
revoked_intermediate_pem_key_cert_pairs_ [ 0 ] . private_key =
LoadFile ( absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir ,
" leaf_signed_by_intermediate.key " ) ) ;
revoked_intermediate_pem_key_cert_pairs_ [ 0 ] . cert_chain =
LoadFile ( absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir ,
" leaf_and_intermediate_chain.pem " ) ) ;
root_cert_ = LoadFile (
absl : : StrCat ( kSslTsiTestCrlSupportedCredentialsDir , " ca.pem " ) ) ;
root_store_ = tsi_ssl_root_certs_store_create ( root_cert_ ) ;
GPR_ASSERT ( root_store_ ! = nullptr ) ;
}
~ SslTsiTestFixture ( ) {
for ( size_t i = 0 ; i < kSslTsiTestValidKeyCertPairsNum ; i + + ) {
PemKeyCertPairDestroy ( valid_pem_key_cert_pairs_ [ i ] ) ;
}
gpr_free ( valid_pem_key_cert_pairs_ ) ;
for ( size_t i = 0 ; i < kSslTsiTestRevokedKeyCertPairsNum ; i + + ) {
PemKeyCertPairDestroy ( revoked_pem_key_cert_pairs_ [ i ] ) ;
}
gpr_free ( revoked_pem_key_cert_pairs_ ) ;
for ( size_t i = 0 ; i < kSslTsiTestRevokedIntermedidateKeyCertPairsNum ;
i + + ) {
PemKeyCertPairDestroy ( revoked_intermediate_pem_key_cert_pairs_ [ i ] ) ;
}
gpr_free ( revoked_intermediate_pem_key_cert_pairs_ ) ;
gpr_free ( root_cert_ ) ;
gpr_free ( server_pem_key_cert_pairs_ ) ;
gpr_free ( client_pem_key_cert_pairs_ ) ;
tsi_ssl_root_certs_store_destroy ( root_store_ ) ;
tsi_ssl_server_handshaker_factory_unref ( server_handshaker_factory_ ) ;
tsi_ssl_client_handshaker_factory_unref ( client_handshaker_factory_ ) ;
}
private :
static void SetupHandshakers ( tsi_test_fixture * fixture ) {
GPR_ASSERT ( fixture ! = nullptr ) ;
auto * self = reinterpret_cast < SslTsiTestFixture * > ( fixture ) ;
@ -160,22 +133,10 @@ class CrlSslTransportSecurityTest
void SetupHandshakers ( ) {
// Create client handshaker factory.
tsi_ssl_client_handshaker_options client_options ;
client_options . pem_root_certs = root_cert_ ;
if ( use_revoked_client_cert_ ) {
client_options . pem_key_cert_pair = revoked_pem_key_cert_pairs_ ;
} else {
client_options . pem_key_cert_pair = valid_pem_key_cert_pairs_ ;
}
if ( use_faulty_crl_directory_ ) {
client_options . crl_directory = kSslTsiTestFaultyCrlsDir ;
} else if ( use_missing_intermediate_crl_ ) {
client_options . crl_directory =
kSslTsiTestCrlSupportedCrlDirMissingIntermediate ;
} else if ( use_missing_root_crl_ ) {
client_options . crl_directory = kSslTsiTestCrlSupportedCrlDirMissingRoot ;
} else {
client_options . crl_directory = kSslTsiTestCrlSupportedCrlDir ;
}
client_options . pem_root_certs = root_cert_ . c_str ( ) ;
client_options . pem_key_cert_pair = client_pem_key_cert_pairs_ ;
client_options . crl_directory = crl_directory_ ;
client_options . crl_provider = crl_provider_ ;
client_options . root_store = root_store_ ;
client_options . min_tls_version = GetParam ( ) ;
client_options . max_tls_version = GetParam ( ) ;
@ -184,27 +145,11 @@ class CrlSslTransportSecurityTest
TSI_OK ) ;
// Create server handshaker factory.
tsi_ssl_server_handshaker_options server_options ;
if ( use_revoked_server_cert_ ) {
server_options . pem_key_cert_pairs = revoked_pem_key_cert_pairs_ ;
server_options . num_key_cert_pairs = kSslTsiTestRevokedKeyCertPairsNum ;
} else if ( ! use_revoked_intermediate_ ) {
server_options . pem_key_cert_pairs = valid_pem_key_cert_pairs_ ;
server_options . num_key_cert_pairs = kSslTsiTestValidKeyCertPairsNum ;
} else {
server_options . pem_key_cert_pairs =
revoked_intermediate_pem_key_cert_pairs_ ;
server_options . num_key_cert_pairs =
kSslTsiTestRevokedIntermedidateKeyCertPairsNum ;
}
server_options . pem_client_root_certs = root_cert_ ;
if ( use_missing_intermediate_crl_ ) {
server_options . crl_directory =
kSslTsiTestCrlSupportedCrlDirMissingIntermediate ;
} else if ( use_missing_root_crl_ ) {
server_options . crl_directory = kSslTsiTestCrlSupportedCrlDirMissingRoot ;
} else {
server_options . crl_directory = kSslTsiTestCrlSupportedCrlDir ;
}
server_options . pem_key_cert_pairs = server_pem_key_cert_pairs_ ;
server_options . num_key_cert_pairs = 1 ;
server_options . pem_client_root_certs = root_cert_ . c_str ( ) ;
server_options . crl_directory = crl_directory_ ;
server_options . crl_provider = crl_provider_ ;
server_options . client_certificate_request =
TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY ;
server_options . session_ticket_key = nullptr ;
@ -252,20 +197,17 @@ class CrlSslTransportSecurityTest
// 3. CRL Directory without CA's CRL with but Intermediate CA's CRL ->
// Handshake succeeds because the CRL that revokes the cert is not
// present.
bool expect_server_success =
! ( use_revoked_server_cert_ | | use_revoked_client_cert_ | |
( use_revoked_intermediate_ & ! use_missing_root_crl_ ) ) ;
bool expect_server_success = expect_server_success_ ;
# if OPENSSL_VERSION_NUMBER >= 0x10100000
bool expect_client_success =
GetParam ( ) = = tsi_tls_version : : TSI_TLS1_2
? expect_server_success
: ! ( use_revoked_server_cert_ | |
( use_revoked_intermediate_ & ! use_missing_root_crl_ ) ) ;
bool expect_client_success = GetParam ( ) = = tsi_tls_version : : TSI_TLS1_2
? expect_client_success_1_2_
: expect_client_success_1_3_ ;
# else
// If using OpenSSL version < 1.1, the CRL revocation won't be enabled
// anyways, so we always expect the connection to be successful.
// If using OpenSSL version < 1.1, the CRL revocation won't
// be enabled anyways, so we always expect the connection to
// be successful.
expect_server_success = true ;
bool expect_client_success = expect_server_success ;
expect_client_success = expect_server_success ;
# endif
tsi_peer peer ;
if ( expect_client_success ) {
@ -286,41 +228,30 @@ class CrlSslTransportSecurityTest
}
}
static void PemKeyCertPairDestroy ( tsi_ssl_pem_key_cert_pair kp ) {
gpr_free ( const_cast < char * > ( kp . private_key ) ) ;
gpr_free ( const_cast < char * > ( kp . cert_chain ) ) ;
}
static void Destruct ( tsi_test_fixture * fixture ) {
auto * self = reinterpret_cast < SslTsiTestFixture * > ( fixture ) ;
delete self ;
}
static char * LoadFile ( absl : : string_view file_path ) {
grpc_slice slice ;
GPR_ASSERT ( grpc_load_file ( file_path . data ( ) , 1 , & slice ) = =
absl : : OkStatus ( ) ) ;
char * data = grpc_slice_to_c_string ( slice ) ;
grpc_slice_unref ( slice ) ;
return data ;
}
static struct tsi_test_fixture_vtable kVtable ;
tsi_test_fixture base_ ;
bool use_revoked_server_cert_ ;
bool use_revoked_client_cert_ ;
bool use_faulty_crl_directory_ ;
bool use_revoked_intermediate_ ;
bool use_missing_intermediate_crl_ ;
bool use_missing_root_crl_ ;
char * root_cert_ ;
std : : string root_cert_ ;
tsi_ssl_root_certs_store * root_store_ ;
tsi_ssl_pem_key_cert_pair * revoked_pem_key_cert_pairs_ ;
tsi_ssl_pem_key_cert_pair * valid_pem_key_cert_pairs_ ;
tsi_ssl_pem_key_cert_pair * revoked_intermediate_pem_key_cert_pairs_ ;
tsi_ssl_server_handshaker_factory * server_handshaker_factory_ ;
tsi_ssl_client_handshaker_factory * client_handshaker_factory_ ;
std : : string server_key_ ;
std : : string server_cert_ ;
std : : string client_key_ ;
std : : string client_cert_ ;
const char * crl_directory_ ;
bool expect_server_success_ ;
bool expect_client_success_1_2_ ;
bool expect_client_success_1_3_ ;
tsi_ssl_pem_key_cert_pair * client_pem_key_cert_pairs_ ;
tsi_ssl_pem_key_cert_pair * server_pem_key_cert_pairs_ ;
std : : shared_ptr < grpc_core : : experimental : : CrlProvider > crl_provider_ ;
} ;
} ;
@ -331,55 +262,149 @@ struct tsi_test_fixture_vtable
& CrlSslTransportSecurityTest : : SslTsiTestFixture : : Destruct } ;
TEST_P ( CrlSslTransportSecurityTest , RevokedServerCert ) {
auto * fixture = SslTsiTestFixture : : Create ( /*use_revoked_server_cert=*/ true ,
/*use_revoked_client_cert=*/ false ,
/*use_faulty_crl_directory=*/ false ) ;
auto * fixture = new SslTsiTestFixture (
kRevokedKeyPath , kRevokedCertPath , kValidKeyPath , kValidCertPath ,
kSslTsiTestCrlSupportedCrlDir , nullptr , false , false , false ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , RevokedClientCert ) {
auto * fixture = SslTsiTestFixture : : Create ( /*use_revoked_server_cert=*/ false ,
/*use_revoked_client_cert=*/ true ,
/*use_faulty_crl_directory=*/ fals e ) ;
auto * fixture = new SslTsiTestFixture (
kValidKeyPath , kValidCertPath , kRevokedKeyPath , kRevokedCertPath ,
kSslTsiTestCrlSupportedCrlDir , nullptr , false , false , tru e) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , ValidCerts ) {
auto * fixture = SslTsiTestFixture : : Create ( /*use_revoked_server_cert=*/ false ,
/*use_revoked_client_cert=*/ false ,
/*use_faulty_crl_directory=*/ fals e ) ;
auto * fixture = new SslTsiTestFixture (
kValidKeyPath , kValidCertPath , kValidKeyPath , kValidCertPath ,
kSslTsiTestCrlSupportedCrlDir , nullptr , true , true , tru e) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , UseFaultyCrlDirectory ) {
auto * fixture = SslTsiTestFixture : : Create ( /*use_revoked_server_cert=*/ false ,
/*use_revoked_client_cert=*/ false ,
/*use_faulty_crl_directory=*/ true ) ;
auto * fixture = new SslTsiTestFixture (
kRevokedKeyPath , kRevokedCertPath , kValidKeyPath , kValidCertPath ,
kSslTsiTestFaultyCrlsDir , nullptr , true , true , true ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , UseRevokedIntermediate ) {
auto * fixture = SslTsiTestFixture : : CreateWithIntermediat e(
/*use_revoked_intermediate=*/ true ,
/*use_missing_intermediate_crl=*/ false ,
/*use_missing_root_crl=*/ false ) ;
TEST_P ( CrlSslTransportSecurityTest , UseRevokedIntermediateValidCrl ) {
auto * fixture = new SslTsiTestFixtur e(
kRevokedIntermediateKeyPath , kRevokedIntermediateCertPath , kValidKeyPath ,
kValidCertPath , kSslTsiTestCrlSupportedCrlDir , nullptr , false , false ,
false ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest ,
UseRevokedIntermediateWithMissingIntermediateCrl ) {
auto * fixture = SslTsiTestFixture : : CreateWithIntermediat e(
/*use_revoked_intermediate=*/ true ,
/*use_missing_intermediate_crl=*/ true ,
/*use_missing_root_crl=*/ false ) ;
auto * fixture = new SslTsiTestFixtur e(
kRevokedIntermediateKeyPath , kRevokedIntermediateCertPath , kValidKeyPath ,
kValidCertPath , kSslTsiTestCrlSupportedCrlDirMissingIntermediate , nullptr ,
false , false , false ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , UseRevokedIntermediateWithMissingRootCrl ) {
auto * fixture = SslTsiTestFixture : : CreateWithIntermediate (
/*use_revoked_intermediate=*/ true ,
/*use_missing_intermediate_crl=*/ false ,
/*use_missing_root_crl=*/ true ) ;
auto * fixture = new SslTsiTestFixture (
kRevokedIntermediateKeyPath , kRevokedIntermediateCertPath , kValidKeyPath ,
kValidCertPath , kSslTsiTestCrlSupportedCrlDirMissingRoot , nullptr , true ,
true , true ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , CrlProviderValidCerts ) {
std : : string root_crl = grpc_core : : testing : : GetFileContents ( kRootCrlPath ) ;
std : : string intermediate_crl =
grpc_core : : testing : : GetFileContents ( kIntermediateCrlPath ) ;
absl : : StatusOr < std : : shared_ptr < grpc_core : : experimental : : CrlProvider > >
provider = grpc_core : : experimental : : CreateStaticCrlProvider (
{ root_crl , intermediate_crl } ) ;
ASSERT_TRUE ( provider . ok ( ) ) ;
auto * fixture = new SslTsiTestFixture ( kValidKeyPath , kValidCertPath ,
kValidKeyPath , kValidCertPath , nullptr ,
* provider , true , true , true ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , CrlProviderRevokedServer ) {
std : : string root_crl = grpc_core : : testing : : GetFileContents ( kRootCrlPath ) ;
std : : string intermediate_crl =
grpc_core : : testing : : GetFileContents ( kIntermediateCrlPath ) ;
absl : : StatusOr < std : : shared_ptr < grpc_core : : experimental : : CrlProvider > >
provider = grpc_core : : experimental : : CreateStaticCrlProvider (
{ root_crl , intermediate_crl } ) ;
ASSERT_TRUE ( provider . ok ( ) ) ;
auto * fixture = new SslTsiTestFixture ( kRevokedKeyPath , kRevokedCertPath ,
kValidKeyPath , kValidCertPath , nullptr ,
* provider , false , false , false ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , CrlProviderRevokedClient ) {
std : : string root_crl = grpc_core : : testing : : GetFileContents ( kRootCrlPath ) ;
std : : string intermediate_crl =
grpc_core : : testing : : GetFileContents ( kIntermediateCrlPath ) ;
absl : : StatusOr < std : : shared_ptr < grpc_core : : experimental : : CrlProvider > >
provider = grpc_core : : experimental : : CreateStaticCrlProvider (
{ root_crl , intermediate_crl } ) ;
ASSERT_TRUE ( provider . ok ( ) ) ;
auto * fixture = new SslTsiTestFixture ( kValidKeyPath , kValidCertPath ,
kRevokedKeyPath , kRevokedCertPath ,
nullptr , * provider , false , false , true ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest , CrlProviderRevokedIntermediateValidCrl ) {
std : : string root_crl = grpc_core : : testing : : GetFileContents ( kRootCrlPath ) ;
std : : string intermediate_crl =
grpc_core : : testing : : GetFileContents ( kIntermediateCrlPath ) ;
absl : : StatusOr < std : : shared_ptr < grpc_core : : experimental : : CrlProvider > >
provider = grpc_core : : experimental : : CreateStaticCrlProvider (
{ root_crl , intermediate_crl } ) ;
ASSERT_TRUE ( provider . ok ( ) ) ;
auto * fixture = new SslTsiTestFixture (
kRevokedIntermediateKeyPath , kRevokedIntermediateCertPath , kValidKeyPath ,
kValidCertPath , nullptr , * provider , false , false , false ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest ,
CrlProviderRevokedIntermediateMissingIntermediateCrl ) {
std : : string root_crl = grpc_core : : testing : : GetFileContents ( kRootCrlPath ) ;
absl : : StatusOr < std : : shared_ptr < grpc_core : : experimental : : CrlProvider > >
provider = grpc_core : : experimental : : CreateStaticCrlProvider ( { root_crl } ) ;
ASSERT_TRUE ( provider . ok ( ) ) ;
auto * fixture = new SslTsiTestFixture (
kRevokedIntermediateKeyPath , kRevokedIntermediateCertPath , kValidKeyPath ,
kValidCertPath , nullptr , * provider , false , false , false ) ;
fixture - > Run ( ) ;
}
TEST_P ( CrlSslTransportSecurityTest ,
CrlProviderRevokedIntermediateMissingRootCrl ) {
std : : string intermediate_crl =
grpc_core : : testing : : GetFileContents ( kIntermediateCrlPath ) ;
absl : : StatusOr < std : : shared_ptr < grpc_core : : experimental : : CrlProvider > >
provider =
grpc_core : : experimental : : CreateStaticCrlProvider ( { intermediate_crl } ) ;
ASSERT_TRUE ( provider . ok ( ) ) ;
auto * fixture = new SslTsiTestFixture (
kRevokedIntermediateKeyPath , kRevokedIntermediateCertPath , kValidKeyPath ,
kValidCertPath , nullptr , * provider , true , true , true ) ;
fixture - > Run ( ) ;
}
@ -390,6 +415,11 @@ std::string TestNameSuffix(
return " TLS_1_3 " ;
}
// TODO(gtcooke94) Add nullptr issuer test cases - this is not simple to test
// the way the code is currently designed - we plan to refactor ways the OpenSSL
// callback functions are written to have more easily testable chunks in
// ssl_transport_security_utils and will add nullptr issuer tests at that time.
INSTANTIATE_TEST_SUITE_P ( TLSVersionsTest , CrlSslTransportSecurityTest ,
testing : : Values ( tsi_tls_version : : TSI_TLS1_2 ,
tsi_tls_version : : TSI_TLS1_3 ) ,
Gregory Cooke
1 year ago
committed by
GitHub