yog 0.0.76

yog: the standalone server for litany loops — the world, the balls and the conversations, behind one wire
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

//! The two configurations, and every way PEM can fail to be one.

use super::*;
use crate::test_support::wire::{material, mint};
use crate::wire::material::Role;
use tempfile::TempDir;

/// Provisioned material builds both ends.
#[test]
fn provisioned_material_builds_both_ends() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect("server");
    client_config(&material(tmp.path(), Role::Client, "127.0.0.1:0")).expect("client");
}

/// An anchors file that holds no certificate is refused by name — not
/// quietly accepted as an empty trust store, which would trust nothing while
/// looking configured.
#[test]
fn empty_anchors_refuse_by_name() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    std::fs::write(tmp.path().join("ca.pem"), "").expect("write");
    let m = material(tmp.path(), Role::Server, "127.0.0.1:0");
    let err = server_config(&m).expect_err("refused");
    assert!(err.contains("ca.pem"), "{err}");
    let err =
        client_config(&material(tmp.path(), Role::Client, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("ca.pem"), "{err}");
}

/// Anchors that are not PEM at all are refused where they are read.
#[test]
fn unreadable_anchors_refuse() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    std::fs::remove_file(tmp.path().join("ca.pem")).expect("rm");
    let err =
        server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("ca.pem"), "{err}");
}

/// An anchor that is syntactically a certificate and semantically not one is
/// refused by the store rather than added.
#[test]
fn a_malformed_anchor_refuses() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    std::fs::write(
        tmp.path().join("ca.pem"),
        "-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----\n",
    )
    .expect("write");
    let err =
        server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("ca.pem"), "{err}");
}

/// A chain file with no certificate in it is refused by name.
#[test]
fn an_empty_chain_refuses() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    std::fs::write(tmp.path().join("server.pem"), "").expect("write");
    let err =
        server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("server.pem"), "{err}");
}

/// A chain that will not read is refused where it is read.
#[test]
fn an_unreadable_chain_refuses() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    std::fs::remove_file(tmp.path().join("client.pem")).expect("rm");
    let err =
        client_config(&material(tmp.path(), Role::Client, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("client.pem"), "{err}");
}

/// A chain whose PEM is malformed refuses on the entry, not on the file.
#[test]
fn a_malformed_chain_entry_refuses() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    let good = std::fs::read_to_string(tmp.path().join("server.pem")).expect("read");
    std::fs::write(
        tmp.path().join("server.pem"),
        format!("{good}-----BEGIN CERTIFICATE-----\nnot base64!!\n"),
    )
    .expect("write");
    let err =
        server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("server.pem"), "{err}");
}

/// A missing key is refused by name.
#[test]
fn a_missing_key_refuses() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    std::fs::remove_file(tmp.path().join("server.key")).expect("rm");
    let err =
        server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("server.key"), "{err}");
    std::fs::remove_file(tmp.path().join("client.key")).expect("rm");
    let err =
        client_config(&material(tmp.path(), Role::Client, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("client.key"), "{err}");
}

/// A key that does not match its certificate is refused by rustls, and the
/// refusal names the chain it disagreed with.
#[test]
fn a_key_that_does_not_match_its_chain_refuses() {
    let tmp = TempDir::new().expect("tmp");
    mint(tmp.path());
    let other = TempDir::new().expect("tmp");
    mint(other.path());
    std::fs::copy(
        other.path().join("server.key"),
        tmp.path().join("server.key"),
    )
    .expect("copy");
    std::fs::copy(
        other.path().join("client.key"),
        tmp.path().join("client.key"),
    )
    .expect("copy");
    let err =
        server_config(&material(tmp.path(), Role::Server, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("server.pem"), "{err}");
    let err =
        client_config(&material(tmp.path(), Role::Client, "127.0.0.1:0")).expect_err("refused");
    assert!(err.contains("client.pem"), "{err}");
}