InstanceUtils { public static boolean validateCertRequestSanDnsNames(final Map<String, String> attributes, final String domain, final String service, final String dnsSuffix, StringBuilder instanceId) { if (dnsSuffix == null || dnsSuffix.isEmpty()) { LOGGER.error("No AWS DNS suffix specified for validation"); return false; } final String hostnames = InstanceUtils.getInstanceProperty(attributes, InstanceProvider.ZTS_INSTANCE_SAN_DNS); if (hostnames == null || hostnames.isEmpty()) { LOGGER.error("Request contains no SAN DNS entries for validation"); return false; } final String hostNameCheck = service + "." + domain.replace('.', '-') + "." + dnsSuffix; boolean hostCheck = false; boolean instanceIdCheck = false; String[] hosts = hostnames.split(","); if (hosts.length > 2) { LOGGER.error("Request does not contain expected number of SAN DNS entries: {}", hosts.length); return false; } for (String host : hosts) { int idx = host.indexOf(ZTS_CERT_INSTANCE_ID); if (idx != -1) { instanceId.append(host, 0, idx); if (!dnsSuffix.equals(host.substring(idx + ZTS_CERT_INSTANCE_ID.length()))) { LOGGER.error("Host: {} does not have expected instance id format", host); return false; } instanceIdCheck = true; } else { if (!hostNameCheck.equals(host)) { LOGGER.error("Unable to verify SAN DNS entry: {}", host); return false; } hostCheck = true; } } if (!hostCheck) { LOGGER.error("Request does not contain expected host SAN DNS entry"); return false; } if (!instanceIdCheck && !validateCertRequestUriId(attributes, instanceId)) { LOGGER.error("Request does not contain expected instance id entry"); return false; } return true; }  static String getInstanceProperty(final Map<String, String> attributes,
            final String propertyName); static boolean validateCertRequestSanDnsNames(final Map<String, String> attributes,
                                                         final String domain, final String service, final String dnsSuffix,
                                                         StringBuilder instanceId); static boolean validateCertRequestUriId(final Map<String, String> attributes,
            StringBuilder instanceId);  }
@Test public void testValidateCertRequestHostnamesNullSuffix() { assertFalse(InstanceUtils.validateCertRequestSanDnsNames(null, null, null, null, null)); }
@Test public void testValidateCertRequestHostnamesEmptySuffix() { assertFalse(InstanceUtils.validateCertRequestSanDnsNames(null, null, null, "", null)); }
@Test public void testValidateCertRequestHostnamesInvalidCount() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "service.athenz.athenz.cloud,service2.athenz.athenz.cloud,service3.athenz.athenz.cloud"); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", null)); }
@Test public void testValidateCertRequestHostnamesInvalidInstanceId() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "api.athenz.athenz.cloud,i-1234.instanceid.athenz.athenz2.cloud"); StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }
@Test public void testValidateCertRequestHostnamesInvalidHost() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "storage.athenz.athenz.cloud,i-1234.instanceid.athenz.athenz.cloud"); StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }
@Test public void testValidateCertRequestHostnamesMissingInstanceId() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "api.athenz.athenz.cloud,api.athenz.athenz.cloud"); StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }
@Test public void testValidateCertRequestHostnamesMissingHost() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "i-1234.instanceid.athenz.athenz.cloud,i-1234.instanceid.athenz.athenz.cloud"); StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }
@Test public void testValidateCertRequestHostnames() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "api.athenz.athenz.cloud,i-1234.instanceid.athenz.athenz.cloud"); StringBuilder id = new StringBuilder(256); assertTrue(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); assertEquals(id.toString(), "i-1234"); }
@Test public void testValidateCertRequestHostnamesWithInstanceIdURI() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "api.athenz.athenz.cloud"); attributes.put("sanURI", "spiffe: StringBuilder id = new StringBuilder(256); assertTrue(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); assertEquals(id.toString(), "i-1234"); }
@Test public void testValidateCertRequestHostnamesWithInvalidInstanceIdURI() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", "api.athenz.athenz.cloud"); attributes.put("sanURI", "spiffe: StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }
@Test public void testValidateCertRequestHostnamesNullHostnames() { HashMap<String, String> attributes = new HashMap<>(); StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }
@Test public void testValidateCertRequestHostnamesEmptyHostnames() { HashMap<String, String> attributes = new HashMap<>(); attributes.put("sanDNS", ""); StringBuilder id = new StringBuilder(256); assertFalse(InstanceUtils.validateCertRequestSanDnsNames(attributes, "athenz", "api", "athenz.cloud", id)); }