uselesskey-tonic 0.7.0

tonic transport TLS adapters for uselesskey X.509 certificate fixtures.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162

//! Error path and boundary condition tests for uselesskey-tonic.

mod testutil;

use testutil::fx;
use uselesskey_tonic::{TonicClientTlsExt, TonicIdentityExt, TonicMtlsExt, TonicServerTlsExt};
use uselesskey_x509::{ChainSpec, X509FactoryExt, X509Spec};

// =========================================================================
// Self-signed cert: configs build without error
// =========================================================================

#[test]
fn self_signed_identity_builds() {
    let fx = fx();
    let cert = fx.x509_self_signed("tonic-ss", X509Spec::self_signed("localhost"));
    let _identity = cert.identity_tonic();
}

#[test]
fn self_signed_server_tls_builds() {
    let fx = fx();
    let cert = fx.x509_self_signed("tonic-server", X509Spec::self_signed("localhost"));
    let _server = cert.server_tls_config_tonic();
}

#[test]
fn self_signed_client_tls_builds() {
    let fx = fx();
    let cert = fx.x509_self_signed("tonic-client", X509Spec::self_signed("localhost"));
    let _client = cert.client_tls_config_tonic("localhost");
}

// =========================================================================
// Chain: configs build without error
// =========================================================================

#[test]
fn chain_identity_builds() {
    let fx = fx();
    let chain = fx.x509_chain("tonic-chain", ChainSpec::new("test.example.com"));
    let _identity = chain.identity_tonic();
}

#[test]
fn chain_server_tls_builds() {
    let fx = fx();
    let chain = fx.x509_chain("tonic-chain-srv", ChainSpec::new("test.example.com"));
    let _server = chain.server_tls_config_tonic();
}

#[test]
fn chain_client_tls_builds() {
    let fx = fx();
    let chain = fx.x509_chain("tonic-chain-cli", ChainSpec::new("test.example.com"));
    let _client = chain.client_tls_config_tonic("test.example.com");
}

// =========================================================================
// mTLS: configs build without error
// =========================================================================

#[test]
fn chain_mtls_server_builds() {
    let fx = fx();
    let chain = fx.x509_chain("tonic-mtls-srv", ChainSpec::new("test.example.com"));
    let _server = chain.server_tls_config_mtls_tonic();
}

#[test]
fn chain_mtls_client_builds() {
    let fx = fx();
    let chain = fx.x509_chain("tonic-mtls-cli", ChainSpec::new("test.example.com"));
    let _client = chain.client_tls_config_mtls_tonic("test.example.com");
}

// =========================================================================
// Boundary: empty domain name
// =========================================================================

#[test]
fn client_tls_empty_domain_builds() {
    let fx = fx();
    let cert = fx.x509_self_signed("tonic-empty-dom", X509Spec::self_signed("localhost"));
    // Empty domain is accepted by tonic (it's just a string)
    let _client = cert.client_tls_config_tonic("");
}

#[test]
fn mtls_client_empty_domain_builds() {
    let fx = fx();
    let chain = fx.x509_chain("tonic-mtls-empty", ChainSpec::new("test.example.com"));
    let _client = chain.client_tls_config_mtls_tonic("");
}

// =========================================================================
// Expired cert identity still builds (tonic doesn't validate at build time)
// =========================================================================

#[test]
fn expired_cert_identity_builds() {
    let fx = fx();
    let spec = X509Spec::self_signed("expired.example.com");
    let cert = fx.x509_self_signed("tonic-expired", spec);
    let expired = cert.expired();

    // tonic Identity::from_pem doesn't validate cert times
    let _identity = expired.identity_tonic();
}

#[test]
fn expired_cert_server_tls_builds() {
    let fx = fx();
    let spec = X509Spec::self_signed("expired.example.com");
    let cert = fx.x509_self_signed("tonic-expired-srv", spec);
    let expired = cert.expired();

    let _server = expired.server_tls_config_tonic();
}

#[test]
fn expired_cert_client_tls_builds() {
    let fx = fx();
    let spec = X509Spec::self_signed("expired.example.com");
    let cert = fx.x509_self_signed("tonic-expired-cli", spec);
    let expired = cert.expired();

    let _client = expired.client_tls_config_tonic("expired.example.com");
}

// =========================================================================
// Not-yet-valid cert identity still builds
// =========================================================================

#[test]
fn not_yet_valid_cert_identity_builds() {
    let fx = fx();
    let spec = X509Spec::self_signed("future.example.com");
    let cert = fx.x509_self_signed("tonic-future", spec);
    let future = cert.not_yet_valid();

    let _identity = future.identity_tonic();
}

// =========================================================================
// Determinism: same seed produces same TLS configs
// =========================================================================

#[test]
fn deterministic_chain_material_consistent() {
    use uselesskey_core::{Factory, Seed};

    let seed = Seed::from_env_value("tonic-det-test").expect("seed");
    let fx = Factory::deterministic(seed);

    let a = fx.x509_chain("det-test", ChainSpec::new("det.example.com"));
    fx.clear_cache();
    let b = fx.x509_chain("det-test", ChainSpec::new("det.example.com"));

    assert_eq!(a.chain_pem(), b.chain_pem());
    assert_eq!(a.root_cert_pem(), b.root_cert_pem());
}