cert_provider_shared_cred_test.cc

#include <gtest/gtest.h>

#include <boost/format.hpp>

#include "cert_provider_test.h"
#include "libaktualizr/config.h"
#include "utilities/utils.h"

static boost::filesystem::path CERT_PROVIDER_PATH;
static boost::filesystem::path CREDENTIALS_PATH;

class AktualizrCertProviderTest : public ::testing::Test {
 protected:
  struct TestArgs {
    TestArgs(const TemporaryDirectory& tmp_dir, const std::string& cred_path_in)
        : test_dir{tmp_dir.PathString()}, credentials_path(tmp_dir.Path() / "credentials.zip") {
      boost::filesystem::copy_file(cred_path_in, credentials_path);
    }

    const std::string test_dir;
    const std::string fleet_ca_cert = "tests/test_data/CAcert.pem";
    const std::string fleet_ca_private_key = "tests/test_data/CApkey.pem";
    const boost::filesystem::path credentials_path;
  };

  TemporaryDirectory tmp_dir_;
  TestArgs test_args_{tmp_dir_, CREDENTIALS_PATH.string()};
  DeviceCredGenerator device_cred_gen_{CERT_PROVIDER_PATH.string()};
};

/**
 * Verifies that cert-provider works when given shared provisioning credentials
 * and the fleet CA and private key are not specified.
 *
 * - [x] Use shared provisioning credentials if fleet CA and private key are not provided
 *  - [x] Provision with shared credentials
 *  - [x] Read server root CA from p12
 *  - [x] Provide root CA if requested
 *  - [x] Provide server URL if requested
 */
TEST_F(AktualizrCertProviderTest, SharedCredProvisioning) {
  DeviceCredGenerator::ArgSet args;

  args.credentialFile = test_args_.credentials_path.string();
  args.localDir = test_args_.test_dir;
  args.provideRootCA.set();
  args.provideServerURL.set();

  device_cred_gen_.run(args);
  ASSERT_EQ(device_cred_gen_.lastExitCode(), 0) << device_cred_gen_.lastStdErr();

  DeviceCredGenerator::OutputPath device_cred_path(test_args_.test_dir);

  ASSERT_TRUE(boost::filesystem::exists(device_cred_path.privateKeyFileFullPath))
      << device_cred_path.privateKeyFileFullPath;
  ASSERT_TRUE(boost::filesystem::exists(device_cred_path.certFileFullPath)) << device_cred_path.certFileFullPath;

  ASSERT_TRUE(boost::filesystem::exists(device_cred_path.serverRootCAFullPath))
      << device_cred_path.serverRootCAFullPath;
  ASSERT_TRUE(boost::filesystem::exists(device_cred_path.gtwURLFileFullPath)) << device_cred_path.gtwURLFileFullPath;

  Process openssl("/usr/bin/openssl");

  openssl.run({"verify", "-verbose", "-CAfile", device_cred_path.serverRootCAFullPath.string(),
               device_cred_path.certFileFullPath.string()});
  ASSERT_EQ(openssl.lastExitCode(), 0) << openssl.lastStdErr();
  ASSERT_EQ(openssl.lastStdOut(), str(boost::format("%1%: OK\n") % device_cred_path.certFileFullPath.string()));
}

#ifndef __NO_MAIN__
int main(int argc, char** argv) {
  ::testing::InitGoogleTest(&argc, argv);

  if (argc < 3) {
    std::cerr << "Two arguments are required: <path-to-cert-provider> <path-to-credentials>" << std::endl;
    return EXIT_FAILURE;
  }

  CERT_PROVIDER_PATH = argv[1];
  std::cout << "Path to the cert-provider executable: " << CERT_PROVIDER_PATH << std::endl;

  CREDENTIALS_PATH = argv[2];
  std::cout << "Path to the shared provisioning credentials: " << CREDENTIALS_PATH << std::endl;

  int test_run_res = RUN_ALL_TESTS();

  return test_run_res;
}
#endif