X509ServiceCertRequest extends X509CertRequest { public boolean validate(final String domainName, final String serviceName, final String provider, final Set<String> validSubjectOValues, final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname, final List<String> instanceHostCnames, HostnameResolver hostnameResolver, StringBuilder errorMsg) { if (instanceId == null || instanceId.isEmpty()) { errorMsg.append("InstanceId cannot be empty"); return false; } final String infoCommonName = domainName + "." + serviceName; if (!validateCommonName(infoCommonName)) { errorMsg.append("Unable to validate CSR common name"); return false; } if (!validateUriHostname(instanceHostname)) { errorMsg.append("Instance/Uri hostname mismatch: ").append(instanceHostname) .append(" vs. ").append(uriHostname); return false; } if (!validateDnsNames(domainName, serviceName, provider, athenzSysDomainCache, serviceDnsSuffix, instanceHostname, instanceHostCnames, hostnameResolver)) { errorMsg.append("Unable to validate CSR SAN dnsNames - invalid dns suffix"); return false; } if (!validateSubjectOField(validSubjectOValues)) { errorMsg.append("Unable to validate Subject O Field"); return false; } if (!validateSpiffeURI(domainName, "sa", serviceName)) { errorMsg.append("Unable to validate Service SPIFFE URI"); return false; } return true; } X509ServiceCertRequest(String csr); boolean validate(final String domainName, final String serviceName, final String provider,
            final Set<String> validSubjectOValues, final DataCache athenzSysDomainCache,
            final String serviceDnsSuffix, final String instanceHostname, final List<String> instanceHostCnames,
            HostnameResolver hostnameResolver, StringBuilder errorMsg);  }
@Test public void testValidateInvalidDnsNames() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); assertFalse(certReq.validate("sys", "production", "provider", null, null, null, null, null, null, errorMsg)); }
@Test public void testValidateInvalidInstanceId() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); List<String> providerDnsSuffixList = Collections.singletonList("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(providerDnsSuffixList); assertFalse(certReq.validate("athenz", "production", "provider", null, athenzSysDomainCache, null, null, null, null, errorMsg)); }
@Test public void testValidateCnMismatch() throws IOException { Path path = Paths.get("src/test/resources/athenz.mismatch.cn.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); List<String> providerDnsSuffixList = Collections.singletonList("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(providerDnsSuffixList); assertFalse(certReq.validate("athenz", "production", "provider", null, athenzSysDomainCache, null, null, null, null, errorMsg)); assertTrue(errorMsg.toString().contains("Unable to validate CSR common name")); }
@Test public void testValidateDnsSuffixMismatch() throws IOException { Path path = Paths.get("src/test/resources/athenz.mismatch.dns.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); List<String> providerDnsSuffixList = Collections.singletonList("zts.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(providerDnsSuffixList); assertFalse(certReq.validate("athenz", "production", "provider", null, athenzSysDomainCache, null, null, null, null, errorMsg)); assertTrue(errorMsg.toString().contains("invalid dns suffix")); }
@Test public void testValidateOFieldCheck() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); HashSet<String> validOrgs = new HashSet<>(); validOrgs.add("Unknown"); List<String> providerDnsSuffixList = Collections.singletonList("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(providerDnsSuffixList); assertFalse(certReq.validate("athenz", "production", "provider", validOrgs, athenzSysDomainCache, null, null, null, null, errorMsg)); assertTrue(errorMsg.toString().contains("Unable to validate Subject O Field")); validOrgs.add("Athenz"); assertTrue(certReq.validate("athenz", "production", "provider", validOrgs, athenzSysDomainCache, null, null, null, null, errorMsg)); }
@Test public void testValidate() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); List<String> providerDnsSuffixList = Collections.singletonList("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(providerDnsSuffixList); assertTrue(certReq.validate("athenz", "production", "provider", null, athenzSysDomainCache, null, null, null, null, errorMsg)); HashSet<String> validOrgs = new HashSet<>(); validOrgs.add("Athenz"); assertTrue(certReq.validate("athenz", "production", "provider", validOrgs, athenzSysDomainCache, null, null, null, null, errorMsg)); }
@Test(dataProvider = "spiffeUriData") public void testValidateSpiffeUri(final String csrPath, boolean expectedResult) throws IOException { Path path = Paths.get(csrPath); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); List<String> providerDnsSuffixList = Collections.singletonList("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")).thenReturn(providerDnsSuffixList); HashSet<String> validOrgs = new HashSet<>(); validOrgs.add("Athenz"); boolean ourResult = certReq.validate("athenz", "production", "provider", validOrgs, athenzSysDomainCache, null, null, null, null, errorMsg); assertEquals(ourResult, expectedResult); }
@Test public void testValidateWithUriHostname() throws IOException { Path path = Paths.get("src/test/resources/athenz.examples.uri-instanceid-hostname.csr"); String csr = new String(Files.readAllBytes(path)); X509ServiceCertRequest certReq = new X509ServiceCertRequest(csr); assertNotNull(certReq); StringBuilder errorMsg = new StringBuilder(256); List<String> providerDnsSuffixList = Collections.singletonList("ostk.athenz.cloud"); List<String> providerHostnameAllowSuffixList = Collections.singletonList("athenz.com"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("ostk.provider")).thenReturn(providerDnsSuffixList); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("ostk.provider")).thenReturn(providerHostnameAllowSuffixList); assertFalse(certReq.validate("athenz.examples", "httpd", "ostk.provider", null, athenzSysDomainCache, null, "def.athenz.com", null, null, errorMsg)); assertFalse(certReq.validate("athenz.examples", "httpd", "ostk.provider", null, athenzSysDomainCache, null, null, null, null, errorMsg)); assertTrue(certReq.validate("athenz.examples", "httpd", "ostk.provider", null, athenzSysDomainCache, null, "abc.athenz.com", null, null, errorMsg)); HashSet<String> validOrgs = new HashSet<>(); validOrgs.add("Athenz"); assertTrue(certReq.validate("athenz.examples", "httpd", "ostk.provider", validOrgs, athenzSysDomainCache, null, "abc.athenz.com", null, null, errorMsg)); }