X509RoleCertRequest extends X509CertRequest { public boolean validateIPAddress(X509Certificate cert, final String ip) { if (ipAddresses.isEmpty()) { return true; } if (cert != null) { List<String> certIPs = Crypto.extractX509CertIPAddresses(cert); if (!certIPs.isEmpty()) { return certIPs.containsAll(ipAddresses); } } return validateIPAddress(ip); } X509RoleCertRequest(String csr); Map<String, String[]> getRequestedRoleList(); boolean validate(Set<String> roles, final String domainName, final String principal,
            final String proxyUser, Set<String> validCertSubjectOrgValues); boolean validate(final String principal, final String proxyUser,
            Set<String> validCertSubjectOrgValues); boolean validateIPAddress(X509Certificate cert, final String ip);  }
@Test public void testValidateRoleIPAddressNoIPs() throws IOException { Path path = Paths.get("src/test/resources/spiffe_role.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); assertTrue(certReq.validateIPAddress(null, "10.10.11.12")); }
@Test public void testValidateRoleIPAddressNoCert() throws IOException { Path path = Paths.get("src/test/resources/role_single_ip.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); assertTrue(certReq.validateIPAddress(null, "10.11.12.13")); assertFalse(certReq.validateIPAddress(null, "10.10.11.12")); }
@Test public void testValidateRoleIPAddressCertNoIPs() throws IOException { Path path = Paths.get("src/test/resources/role_single_ip.csr"); String csr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); assertTrue(certReq.validateIPAddress(cert, "10.11.12.13")); assertFalse(certReq.validateIPAddress(cert, "10.10.11.12")); }
@Test public void testValidateRoleIPAddressCertIPs() throws IOException { Path path = Paths.get("src/test/resources/role_single_ip.csr"); String csr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/svc_single_ip.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert1 = Crypto.loadX509Certificate(pem); path = Paths.get("src/test/resources/svc_multiple_ip.pem"); pem = new String(Files.readAllBytes(path)); X509Certificate cert2 = Crypto.loadX509Certificate(pem); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); assertTrue(certReq.validateIPAddress(cert1, "10.11.12.13")); assertTrue(certReq.validateIPAddress(cert2, "10.11.12.13")); }
@Test public void testValidateRoleIPAddressCertMultipleIPs() throws IOException { Path path = Paths.get("src/test/resources/role_multiple_ip.csr"); String csr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/svc_single_ip.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert1 = Crypto.loadX509Certificate(pem); path = Paths.get("src/test/resources/svc_multiple_ip.pem"); pem = new String(Files.readAllBytes(path)); X509Certificate cert2 = Crypto.loadX509Certificate(pem); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); assertFalse(certReq.validateIPAddress(cert1, "10.11.12.13")); assertTrue(certReq.validateIPAddress(cert2, "10.11.12.13")); }