spiffe-rs 0.1.0

Rust port of spiffe-go with SPIFFE IDs, bundles, SVIDs, Workload API client, federation helpers, and rustls-based SPIFFE TLS utilities.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

use spiffe_rs::workloadapi::{get_default_address, validate_address, SocketEnv};
use std::env;

struct ValidateAddressCase {
    addr: &'static str,
    err: &'static str,
}

#[test]
fn get_default_address_env() {
    let original = env::var(SocketEnv).ok();
    env::remove_var(SocketEnv);
    assert!(get_default_address().is_none());

    env::set_var(SocketEnv, "ADDRESS");
    assert_eq!(get_default_address().as_deref(), Some("ADDRESS"));

    match original {
        Some(value) => env::set_var(SocketEnv, value),
        None => env::remove_var(SocketEnv),
    }
}

#[test]
fn validate_address_cases() {
    let mut cases = vec![
        ValidateAddressCase {
            addr: "\t",
            err: "workload endpoint socket is not a valid URI",
        },
        ValidateAddressCase {
            addr: "blah",
            err: "workload endpoint socket URI must have a \"tcp\" or \"unix\" scheme",
        },
        ValidateAddressCase {
            addr: "tcp:opaque",
            err: "workload endpoint tcp socket URI must not be opaque",
        },
        ValidateAddressCase {
            addr: "tcp://",
            err: "workload endpoint tcp socket URI must include a host",
        },
        ValidateAddressCase {
            addr: "tcp://1.2.3.4:5?whatever",
            err: "workload endpoint tcp socket URI must not include query values",
        },
        ValidateAddressCase {
            addr: "tcp://1.2.3.4:5#whatever",
            err: "workload endpoint tcp socket URI must not include a fragment",
        },
        ValidateAddressCase {
            addr: "tcp://john:doe@1.2.3.4:5/path",
            err: "workload endpoint tcp socket URI must not include user info",
        },
        ValidateAddressCase {
            addr: "tcp://1.2.3.4:5/path",
            err: "workload endpoint tcp socket URI must not include a path",
        },
        ValidateAddressCase {
            addr: "tcp://foo",
            err: "workload endpoint tcp socket URI host component must be an IP:port",
        },
        ValidateAddressCase {
            addr: "tcp://1.2.3.4",
            err: "workload endpoint tcp socket URI host component must include a port",
        },
        ValidateAddressCase {
            addr: "tcp://1.2.3.4:5",
            err: "",
        },
        ValidateAddressCase {
            addr: "unix:opaque",
            err: "workload endpoint unix socket URI must not be opaque",
        },
        ValidateAddressCase {
            addr: "unix://",
            err: "workload endpoint unix socket URI must include a path",
        },
        ValidateAddressCase {
            addr: "unix://foo?whatever",
            err: "workload endpoint unix socket URI must not include query values",
        },
        ValidateAddressCase {
            addr: "unix://foo#whatever",
            err: "workload endpoint unix socket URI must not include a fragment",
        },
        ValidateAddressCase {
            addr: "unix://john:doe@foo/path",
            err: "workload endpoint unix socket URI must not include user info",
        },
        ValidateAddressCase {
            addr: "unix://foo",
            err: "",
        },
        ValidateAddressCase {
            addr: "unix:/tmp/agent.sock",
            err: "",
        },
        ValidateAddressCase {
            addr: "unix:///tmp/agent.sock",
            err: "",
        },
    ];

    for case in cases.drain(..) {
        let result = validate_address(case.addr);
        if case.err.is_empty() {
            assert!(result.is_ok(), "expected ok for {}", case.addr);
        } else {
            let err = result.expect_err("expected error");
            assert!(
                err.to_string().contains(case.err),
                "error mismatch for {}: {}",
                case.addr,
                err
            );
        }
    }
}