|
| 1 | +// Copyright 2024 Keyfactor |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +using System.Collections.Concurrent; |
| 16 | +using Keyfactor.Extensions.CAPlugin.GCPCAS.Client; |
| 17 | +using Keyfactor.AnyGateway.Extensions; |
| 18 | +using Keyfactor.Logging; |
| 19 | +using Microsoft.Extensions.Logging; |
| 20 | +using NLog.Extensions.Logging; |
| 21 | +using System.Security.Cryptography; |
| 22 | +using System.Security.Cryptography.X509Certificates; |
| 23 | +using Keyfactor.PKI.Enums.EJBCA; |
| 24 | +using Keyfactor.Extensions.CAPlugin.GCPCAS; |
| 25 | +using Google.Cloud.Security.PrivateCA.V1; |
| 26 | + |
| 27 | +namespace Keyfactor.Extensions.CAPlugin.GCPCASTests; |
| 28 | + |
| 29 | +public class ClientTests |
| 30 | +{ |
| 31 | + ILogger _logger { get; set; } |
| 32 | + |
| 33 | + public ClientTests() |
| 34 | + { |
| 35 | + ConfigureLogging(); |
| 36 | + |
| 37 | + _logger = LogHandler.GetClassLogger<ClientTests>(); |
| 38 | + } |
| 39 | + |
| 40 | + [IntegrationTestingFact] |
| 41 | + public void GCPCASClient_Integration_GetTemplates_ReturnSuccess() |
| 42 | + { |
| 43 | + // Arrange |
| 44 | + IntegrationTestingFact env = new(); |
| 45 | + |
| 46 | + IGCPCASClient client = new GCPCASClient(env.LocationId, env.ProjectId, env.CAPool, env.CAId); |
| 47 | + client.Enable(); |
| 48 | + |
| 49 | + // Act |
| 50 | + List<string> templates = client.GetTemplates(); |
| 51 | + // There is never a case where there are zero templates - there's always the default "no template" |
| 52 | + Assert.NotEmpty(templates); |
| 53 | + _logger.LogInformation($"Found {templates.Count} templates: {string.Join(", ", templates)}"); |
| 54 | + } |
| 55 | + |
| 56 | + [IntegrationTestingFact] |
| 57 | + public void GCPCASClient_Integration_DownloadAllCertificates_ReturnSuccess() |
| 58 | + { |
| 59 | + // Arrange |
| 60 | + IntegrationTestingFact env = new(); |
| 61 | + |
| 62 | + IGCPCASClient client = new GCPCASClient(env.LocationId, env.ProjectId, env.CAPool, env.CAId); |
| 63 | + client.Enable(); |
| 64 | + |
| 65 | + BlockingCollection<AnyCAPluginCertificate> certificates = new(); |
| 66 | + |
| 67 | + // Act |
| 68 | + int numberOfDownloadedCerts = client.DownloadAllIssuedCertificates(certificates, CancellationToken.None).Result; |
| 69 | + _logger.LogInformation($"Number of downloaded certificates: {numberOfDownloadedCerts}"); |
| 70 | + } |
| 71 | + |
| 72 | + [IntegrationTestingFact] |
| 73 | + public void GCPCASClient_Integration_DownloadAllCertificatesAfter_ReturnSuccess() |
| 74 | + { |
| 75 | + // Arrange |
| 76 | + IntegrationTestingFact env = new(); |
| 77 | + |
| 78 | + IGCPCASClient client = new GCPCASClient(env.LocationId, env.ProjectId, env.CAPool, env.CAId); |
| 79 | + client.Enable(); |
| 80 | + |
| 81 | + BlockingCollection<AnyCAPluginCertificate> certificates = new(); |
| 82 | + |
| 83 | + DateTime after = DateTime.UtcNow.AddDays(-100); |
| 84 | + |
| 85 | + // Act |
| 86 | + int numberOfDownloadedCerts = client.DownloadAllIssuedCertificates(certificates, CancellationToken.None, after).Result; |
| 87 | + _logger.LogInformation($"Number of downloaded certificates: {numberOfDownloadedCerts}"); |
| 88 | + } |
| 89 | + |
| 90 | + [IntegrationTestingFact] |
| 91 | + public void GCPCASClient_Integration_EnrollGetRevoke_ReturnSuccess() |
| 92 | + { |
| 93 | + // Arrange |
| 94 | + IntegrationTestingFact env = new(); |
| 95 | + |
| 96 | + GCPCASClient client = new GCPCASClient(env.LocationId, env.ProjectId, env.CAPool, env.CAId); |
| 97 | + client.Enable(); |
| 98 | + |
| 99 | + // Create a CSR |
| 100 | + string subject = "CN=Test Subject"; |
| 101 | + string csrString = GenerateCSR(subject); |
| 102 | + |
| 103 | + EnrollmentProductInfo productInfo = new EnrollmentProductInfo |
| 104 | + { |
| 105 | + ProductID = GCPCASPluginConfig.NoTemplateName, |
| 106 | + ProductParameters = new Dictionary<string, string> |
| 107 | + { |
| 108 | + { GCPCASPluginConfig.EnrollmentParametersConstants.CertificateLifetimeDays, "200" } |
| 109 | + } |
| 110 | + }; |
| 111 | + ICreateCertificateRequestBuilder builder = new CreateCertificateRequestBuilder() |
| 112 | + .WithCsr(csrString) |
| 113 | + .WithEnrollmentProductInfo(productInfo); |
| 114 | + |
| 115 | + // Act |
| 116 | + _logger.LogInformation($"Enrolling test certificate with DN {subject} using GCP CAS CA called {env.CAId}"); |
| 117 | + EnrollmentResult enrollResult = client.Enroll(builder, CancellationToken.None).Result; |
| 118 | + |
| 119 | + // Assert |
| 120 | + Assert.Equal(enrollResult.Status, (int)EndEntityStatus.GENERATED); |
| 121 | + Assert.NotNull(enrollResult.CARequestID); |
| 122 | + _logger.LogInformation($"Certificate enrollment validated successfully"); |
| 123 | + |
| 124 | + // Act |
| 125 | + _logger.LogInformation($"Downloading test certificate identified as {enrollResult.CARequestID} from GCP CAS CA called {env.CAId}"); |
| 126 | + AnyCAPluginCertificate downloadResult = client.DownloadCertificate(enrollResult.CARequestID).Result; |
| 127 | + |
| 128 | + // Assert |
| 129 | + Assert.Equal(enrollResult.Status, downloadResult.Status); |
| 130 | + Assert.Equal(enrollResult.CARequestID, downloadResult.CARequestID); |
| 131 | + Assert.Equal(enrollResult.Certificate, downloadResult.Certificate); |
| 132 | + _logger.LogInformation($"Verified that the downloaded certificate identified as {downloadResult.CARequestID} is the same as the initially enrolled certificate"); |
| 133 | + |
| 134 | + // Act |
| 135 | + _logger.LogInformation($"Revoking test certificate identified as {enrollResult.CARequestID} issued by GCP CAS CA called {env.CAId}"); |
| 136 | + client.RevokeCertificate(enrollResult.CARequestID, RevocationReason.CessationOfOperation).Wait(); |
| 137 | + |
| 138 | + _logger.LogInformation($"Downloading test certificate identified as {enrollResult.CARequestID} from GCP CAS CA called {env.CAId}"); |
| 139 | + downloadResult = client.DownloadCertificate(enrollResult.CARequestID).Result; |
| 140 | + |
| 141 | + // Assert |
| 142 | + Assert.Equal(enrollResult.CARequestID, downloadResult.CARequestID); |
| 143 | + Assert.Equal(enrollResult.Certificate, downloadResult.Certificate); |
| 144 | + Assert.Equal(downloadResult.Status, (int)EndEntityStatus.REVOKED); |
| 145 | + // Cecession of Operation should be reason 5 |
| 146 | + Assert.Equal(downloadResult.RevocationReason, 5); |
| 147 | + |
| 148 | + _logger.LogInformation("GCPCASClient_Integration_EnrollGetRevoke_ReturnSuccess was successful"); |
| 149 | + } |
| 150 | + |
| 151 | + static void ConfigureLogging() |
| 152 | + { |
| 153 | + var config = new NLog.Config.LoggingConfiguration(); |
| 154 | + |
| 155 | + // Targets where to log to: File and Console |
| 156 | + var logconsole = new NLog.Targets.ConsoleTarget("logconsole"); |
| 157 | + logconsole.Layout = @"${date:format=HH\:mm\:ss} ${logger} [${level}] - ${message}"; |
| 158 | + |
| 159 | + // Rules for mapping loggers to targets |
| 160 | + config.AddRule(NLog.LogLevel.Trace, NLog.LogLevel.Fatal, logconsole); |
| 161 | + |
| 162 | + // Apply config |
| 163 | + NLog.LogManager.Configuration = config; |
| 164 | + |
| 165 | + LogHandler.Factory = LoggerFactory.Create(builder => |
| 166 | + { |
| 167 | + builder.AddNLog(); |
| 168 | + }); |
| 169 | + } |
| 170 | + |
| 171 | + static string GenerateCSR(string subject) |
| 172 | + { |
| 173 | + using RSA rsa = RSA.Create(2048); |
| 174 | + X500DistinguishedName subjectName = new X500DistinguishedName(subject); |
| 175 | + CertificateRequest csr = new CertificateRequest(subjectName, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1); |
| 176 | + return csr.CreateSigningRequestPem(); |
| 177 | + } |
| 178 | +} |
| 179 | + |
0 commit comments