cacert-gosigner/pkg/x509/revoking/revoking_test.go

package revoking

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"math/big"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
)

type testRepo struct {
	revoked []big.Int
}

func (t *testRepo) RevokedCertificates() ([]pkix.RevokedCertificate, error) {
	result := make([]pkix.RevokedCertificate, len(t.revoked))

	for i, s := range t.revoked {
		result[i] = pkix.RevokedCertificate{
			SerialNumber:   &s,
			RevocationTime: time.Now(),
		}
	}

	return result, nil
}

func (t *testRepo) StoreRevocation(revoked *pkix.RevokedCertificate) error {
	t.revoked = append(t.revoked, *revoked.SerialNumber)
	return nil
}

func randomSerial(t *testing.T) *big.Int {
	t.Helper()
	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
	if err != nil {
		t.Fatalf("could not generate random serial number: %v", err)
	}
	return serial
}

func TestRevoking(t *testing.T) {
	testRepository := testRepo{revoked: make([]big.Int, 0)}

	caKey, err := rsa.GenerateKey(rand.Reader, 3072)
	if err != nil {
		t.Fatalf("could not generate key pair: %v", err)
	}
	caTemplate := &x509.Certificate{Subject: pkix.Name{CommonName: "Test CA"}, SerialNumber: randomSerial(t)}

	certificateBytes, err := x509.CreateCertificate(rand.Reader, caTemplate, caTemplate, caKey.Public(), caKey)
	if err != nil {
		t.Fatalf("could not self-sign CA certificate: %v", err)
	}
	caCertificate, err := x509.ParseCertificate(certificateBytes)
	if err != nil {
		t.Fatalf("could not create test CA certificate: %v", err)
	}

	r := NewX509Revoking(&testRepository, x509.ECDSAWithSHA256, caCertificate, caKey)

	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
	if err != nil {
		t.Errorf("could not create random serial: %v", err)
	}

	revoke, err := r.Revoke(&RevokeCertificate{serialNumber: serial, reason: CRLReasonKeyCompromise})
	assert.NoError(t, err)

	assert.Equal(t, CRLReasonKeyCompromise.BuildExtension(), revoke.Extensions[0])
	assert.Equal(t, serial, revoke.SerialNumber)

	assert.Contains(t, testRepository.revoked, *serial)
}