|
@@ -5,7 +5,6 @@ set -u
|
|
|
|
|
|
setup_file() {
|
|
setup_file() {
|
|
load "../lib/setup_file.sh"
|
|
load "../lib/setup_file.sh"
|
|
- [[ "${PACKAGE_TESTING}" == "true" ]] && return
|
|
|
|
./instance-data load
|
|
./instance-data load
|
|
|
|
|
|
CONFIG_DIR=$(dirname "${CONFIG_YAML}")
|
|
CONFIG_DIR=$(dirname "${CONFIG_YAML}")
|
|
@@ -36,6 +35,8 @@ setup_file() {
|
|
echo "ibase=16; ${serial}" | bc >"${tmpdir}/serials.txt"
|
|
echo "ibase=16; ${serial}" | bc >"${tmpdir}/serials.txt"
|
|
cfssl gencrl "${tmpdir}/serials.txt" "${tmpdir}/ca.pem" "${tmpdir}/ca-key.pem" | base64 -d | openssl crl -inform DER -out "${tmpdir}/crl.pem"
|
|
cfssl gencrl "${tmpdir}/serials.txt" "${tmpdir}/ca.pem" "${tmpdir}/ca-key.pem" | base64 -d | openssl crl -inform DER -out "${tmpdir}/crl.pem"
|
|
|
|
|
|
|
|
+ cat "${tmpdir}/ca.pem" "${tmpdir}/inter.pem" > "${tmpdir}/bundle.pem"
|
|
|
|
+
|
|
config_set '
|
|
config_set '
|
|
.api.server.tls.cert_file=strenv(tmpdir) + "/server.pem" |
|
|
.api.server.tls.cert_file=strenv(tmpdir) + "/server.pem" |
|
|
.api.server.tls.key_file=strenv(tmpdir) + "/server-key.pem" |
|
|
.api.server.tls.key_file=strenv(tmpdir) + "/server-key.pem" |
|
|
@@ -53,7 +54,6 @@ teardown_file() {
|
|
}
|
|
}
|
|
|
|
|
|
setup() {
|
|
setup() {
|
|
- [[ "${PACKAGE_TESTING}" == "true" ]] && skip
|
|
|
|
load "../lib/setup.sh"
|
|
load "../lib/setup.sh"
|
|
}
|
|
}
|
|
|
|
|
|
@@ -65,7 +65,7 @@ teardown() {
|
|
|
|
|
|
@test "invalid OU for agent" {
|
|
@test "invalid OU for agent" {
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
- .ca_cert_path=strenv(tmpdir) + "/inter.pem" |
|
|
|
|
|
|
+ .ca_cert_path=strenv(tmpdir) + "/bundle.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent_bad_ou-key.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent_bad_ou-key.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent_bad_ou.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent_bad_ou.pem" |
|
|
.url="https://127.0.0.1:8080"
|
|
.url="https://127.0.0.1:8080"
|
|
@@ -79,7 +79,7 @@ teardown() {
|
|
|
|
|
|
@test "we have exactly one machine registered with TLS" {
|
|
@test "we have exactly one machine registered with TLS" {
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
- .ca_cert_path=strenv(tmpdir) + "/inter.pem" |
|
|
|
|
|
|
+ .ca_cert_path=strenv(tmpdir) + "/bundle.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent-key.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent-key.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent.pem" |
|
|
.url="https://127.0.0.1:8080"
|
|
.url="https://127.0.0.1:8080"
|
|
@@ -97,7 +97,7 @@ teardown() {
|
|
|
|
|
|
@test "invalid cert for agent" {
|
|
@test "invalid cert for agent" {
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
- .ca_cert_path=strenv(tmpdir) + "/inter.pem" |
|
|
|
|
|
|
+ .ca_cert_path=strenv(tmpdir) + "/bundle.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent_invalid-key.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent_invalid-key.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent_invalid.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent_invalid.pem" |
|
|
.url="https://127.0.0.1:8080"
|
|
.url="https://127.0.0.1:8080"
|
|
@@ -110,7 +110,7 @@ teardown() {
|
|
|
|
|
|
@test "revoked cert for agent" {
|
|
@test "revoked cert for agent" {
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
config_set "${CONFIG_DIR}/local_api_credentials.yaml" '
|
|
- .ca_cert_path=strenv(tmpdir) + "/inter.pem" |
|
|
|
|
|
|
+ .ca_cert_path=strenv(tmpdir) + "/bundle.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent_revoked-key.pem" |
|
|
.key_path=strenv(tmpdir) + "/agent_revoked-key.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent_revoked.pem" |
|
|
.cert_path=strenv(tmpdir) + "/agent_revoked.pem" |
|
|
.url="https://127.0.0.1:8080"
|
|
.url="https://127.0.0.1:8080"
|