@Test public void should_validate_child_ca() { KeyPair childKeyPair = KEY_PAIR_FACTORY.generate(); TrustAnchor ta = wtx(tx -> factory.createTrustAnchor(tx, x -> { TrustAnchorsFactory.CertificateAuthority child = TrustAnchorsFactory.CertificateAuthority.builder() .dn("CN=child-ca") .keyPair(childKeyPair) .certificateLocation(TA_CA_REPOSITORY_URI + "CN=child-ca.cer") .resources(IpResourceSet.parse("192.168.128.0/17")) .notifyURI(TA_RRDP_NOTIFY_URI) .manifestURI("rsync: .repositoryURI("rsync: .crlDistributionPoint("rsync: .build(); x.children(Arrays.asList(child)); })); wtx0(tx -> { this.getTrustAnchors().add(tx, ta); final Ref<TrustAnchor> trustAnchorRef = this.getTrustAnchors().makeRef(tx, ta.key()); RpkiRepository repository = this.getRpkiRepositories().register(tx, trustAnchorRef, TA_RRDP_NOTIFY_URI, RpkiRepository.Type.RRDP); repository.setDownloaded(); this.getRpkiRepositories().update(tx, repository); }); subject.validate(ta.key().asLong()); List<CertificateTreeValidationRun> completed = rtx(tx -> this.getValidationRuns().findAll(tx, CertificateTreeValidationRun.class)); assertThat(completed).hasSize(1); rtx0(tx -> { final Optional<TrustAnchor> trustAnchor = this.getTrustAnchors().get(tx, ta.key()); assertThat(trustAnchor.get().isInitialCertificateTreeValidationRunCompleted()).as("trust anchor initial validation run completed").isTrue(); assertThat(this.getSettings().isInitialValidationRunCompleted(tx)).as("validator initial validation run completed").isTrue(); }); List<Pair<CertificateTreeValidationRun, RpkiObject>> validated = rtx(tx -> this.getValidationRuns().findCurrentlyValidated(tx, RpkiObject.Type.CER).collect(toList())); assertThat(validated).hasSize(1); assertThat(validated.get(0).getLeft()).isEqualTo(completed.get(0)); Optional<X509ResourceCertificate> cro = validated.get(0).getRight().get(X509ResourceCertificate.class, ValidationResult.withLocation("ignored.cer")); assertThat(cro).isPresent().hasValueSatisfying(x -> assertThat(x.getSubject()).isEqualTo(new X500Principal("CN=child-ca"))); }
public void validate(long trustAnchorId) { Optional<TrustAnchor> maybeTrustAnchor = storage.readTx(tx -> trustAnchors.get(tx, Key.of(trustAnchorId))); if (maybeTrustAnchor.isPresent()) { final TrustAnchor trustAnchor = maybeTrustAnchor.get(); Bench.mark0("validateTa " + trustAnchor.getName(), () -> validateTa(trustAnchor)); } else { log.error("Couldn't find trust anchor {}", trustAnchorId); } }
CertificateTreeValidationService { public void validate(long trustAnchorId) { Optional<TrustAnchor> maybeTrustAnchor = storage.readTx(tx -> trustAnchors.get(tx, Key.of(trustAnchorId))); if (maybeTrustAnchor.isPresent()) { final TrustAnchor trustAnchor = maybeTrustAnchor.get(); Bench.mark0("validateTa " + trustAnchor.getName(), () -> validateTa(trustAnchor)); } else { log.error("Couldn't find trust anchor {}", trustAnchorId); } } }
CertificateTreeValidationService { public void validate(long trustAnchorId) { Optional<TrustAnchor> maybeTrustAnchor = storage.readTx(tx -> trustAnchors.get(tx, Key.of(trustAnchorId))); if (maybeTrustAnchor.isPresent()) { final TrustAnchor trustAnchor = maybeTrustAnchor.get(); Bench.mark0("validateTa " + trustAnchor.getName(), () -> validateTa(trustAnchor)); } else { log.error("Couldn't find trust anchor {}", trustAnchorId); } } @Autowired  CertificateTreeValidationService(RpkiObjects rpkiObjects,
                                            RpkiRepositories rpkiRepositories,
                                            Settings settings,
                                            ValidationScheduler validationScheduler,
                                            ValidationRuns validationRuns,
                                            TrustAnchors trustAnchors,
                                            ValidatedRpkiObjects validatedRpkiObjects,
                                            Storage storage,
                                            TrustAnchorState trustAnchorState,
                                            TrustAnchorMetricsService taMetricsService,
                                            ValidationConfig validationConfig); }
CertificateTreeValidationService { public void validate(long trustAnchorId) { Optional<TrustAnchor> maybeTrustAnchor = storage.readTx(tx -> trustAnchors.get(tx, Key.of(trustAnchorId))); if (maybeTrustAnchor.isPresent()) { final TrustAnchor trustAnchor = maybeTrustAnchor.get(); Bench.mark0("validateTa " + trustAnchor.getName(), () -> validateTa(trustAnchor)); } else { log.error("Couldn't find trust anchor {}", trustAnchorId); } } @Autowired  CertificateTreeValidationService(RpkiObjects rpkiObjects,
                                            RpkiRepositories rpkiRepositories,
                                            Settings settings,
                                            ValidationScheduler validationScheduler,
                                            ValidationRuns validationRuns,
                                            TrustAnchors trustAnchors,
                                            ValidatedRpkiObjects validatedRpkiObjects,
                                            Storage storage,
                                            TrustAnchorState trustAnchorState,
                                            TrustAnchorMetricsService taMetricsService,
                                            ValidationConfig validationConfig); void validate(long trustAnchorId); }
CertificateTreeValidationService { public void validate(long trustAnchorId) { Optional<TrustAnchor> maybeTrustAnchor = storage.readTx(tx -> trustAnchors.get(tx, Key.of(trustAnchorId))); if (maybeTrustAnchor.isPresent()) { final TrustAnchor trustAnchor = maybeTrustAnchor.get(); Bench.mark0("validateTa " + trustAnchor.getName(), () -> validateTa(trustAnchor)); } else { log.error("Couldn't find trust anchor {}", trustAnchorId); } } @Autowired  CertificateTreeValidationService(RpkiObjects rpkiObjects,
                                            RpkiRepositories rpkiRepositories,
                                            Settings settings,
                                            ValidationScheduler validationScheduler,
                                            ValidationRuns validationRuns,
                                            TrustAnchors trustAnchors,
                                            ValidatedRpkiObjects validatedRpkiObjects,
                                            Storage storage,
                                            TrustAnchorState trustAnchorState,
                                            TrustAnchorMetricsService taMetricsService,
                                            ValidationConfig validationConfig); void validate(long trustAnchorId); final long LONG_DURATION_WARNING_MS; }