X509CertRequest { boolean validateInstanceCnames(final String provider, final DataCache athenzSysDomainCache, final String serviceFqn, final String instanceHostname, List<String> instanceHostCnames, HostnameResolver hostnameResolver) { if (instanceHostCnames == null || instanceHostCnames.isEmpty()) { return true; } if (instanceHostname == null || instanceHostname.isEmpty()) { LOGGER.error("Instance Host CNAME list provided without Hostname"); return false; } for (String cname : instanceHostCnames) { if (!isHostnameAllowed(provider, athenzSysDomainCache, cname)) { return false; } } if (hostnameResolver != null) { if (!hostnameResolver.isValidHostCnameList(serviceFqn, instanceHostname, instanceHostCnames, CertType.X509)) { LOGGER.error("{} does not have all hosts in {} as configured CNAMEs", instanceHostname, String.join(",", instanceHostCnames)); return false; } return true; } LOGGER.error("Instance host name CNAME list provided without a valid hostname resolver"); return false; } X509CertRequest(String csr); PKCS10CertificationRequest getCertReq(); void setCertReq(PKCS10CertificationRequest certReq); boolean validateDnsNames(final String domainName, final String serviceName, final String provider,
            final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname,
            final List<String> instanceHostCnames, HostnameResolver hostnameResolver); boolean validateDnsNames(X509Certificate cert); boolean validateInstanceId(final String reqInstanceId, X509Certificate cert); boolean validateCommonName(String reqCommonName); boolean validateSubjectOField(Set<String> validValues); boolean validateSubjectOUField(final String provider, final String certSubjectOU,
            Set<String> validValues); boolean validatePublicKeys(final String publicKey); boolean validatePublicKeys(X509Certificate cert); boolean validateIPAddress(final String ip); void setNormCsrPublicKey(String normCsrPublicKey); String getCommonName(); String getInstanceId(); String getUriHostname(); List<String> getDnsNames(); List<String> getProviderDnsNames(); List<String> getUris(); List<String> getIpAddresses();  }
@Test public void testValidateInstanceCnames() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.uri.csr"); String csr = new String(Files.readAllBytes(path)); String service = "athenz.api"; X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); assertTrue(certReq.validateInstanceCnames(null, null, service, null, null, null)); assertTrue(certReq.validateInstanceCnames(null, null, service, null, Collections.emptyList(), null)); assertFalse(certReq.validateInstanceCnames(null, null, service, null, Collections.singletonList("host1.athenz.cloud"), null)); assertFalse(certReq.validateInstanceCnames(null, null, service, "", Collections.singletonList("host1.athenz.cloud"), null)); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); List<String> providerHostnameAllowedSuffixList = Collections.singletonList("athenz.cloud"); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(providerHostnameAllowedSuffixList); List<String> providerHostnameDeniedSuffixList = Collections.singletonList("athenz.info"); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(providerHostnameDeniedSuffixList); assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.data"), null)); List<String> cnameList = new ArrayList<>(); cnameList.add("host1.athenz.cloud"); cnameList.add("host1.athenz.data"); assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", cnameList, null)); assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.info"), null)); cnameList.add("host1.athenz.info"); assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", cnameList, null)); assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), null)); HostnameResolver resolver = Mockito.mock(HostnameResolver.class); Mockito.when(resolver.isValidHostCnameList(service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), CertType.X509)) .thenReturn(false); assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), resolver)); Mockito.when(resolver.isValidHostCnameList(service, "hostname.athenz.cloud", Collections.singletonList("host2.athenz.cloud"), CertType.X509)) .thenReturn(true); assertTrue(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud", Collections.singletonList("host2.athenz.cloud"), resolver)); }