NASP/rpki
84
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260418 优化去掉冗余存储repo object，mix quick最快170s

Browse Source
This commit is contained in:
yuyr
2026-04-18 14:10:47 +08:00
parent f485786470
commit 417c82bef6
34 changed files with 1482 additions and 328 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
tests/test_apnic_stats_live_stage2.rs
View File

@@ -88,7 +88,11 @@ impl LiveStats {
if f.rsync_uri.ends_with(".crl") {
self.crl_total += 1;
if f.bytes().ok().and_then(|b| RpkixCrl::decode_der(b).ok()).is_some() {
if f.bytes()
.ok()
.and_then(|b| RpkixCrl::decode_der(b).ok())
.is_some()
{
self.crl_decode_ok += 1;
}
}

104
tests/test_cert_path_key_usage.rs
View File

@@ -2,6 +2,7 @@ use std::process::Command;
use rpki::validation::cert_path::{
CertPathError, validate_ee_cert_path, validate_ee_cert_path_with_predecoded_ee,
validate_signed_object_ee_cert_path_fast,
};
fn openssl_available() -> bool {
@@ -367,6 +368,109 @@ fn validate_ee_cert_path_with_predecoded_ee_matches_prevalidated_path_rules() {
assert!(matches!(err, CertPathError::EeRevoked), "{err}");
}
#[test]
fn validate_signed_object_ee_cert_path_fast_matches_predecoded_helper_on_real_manifest_fixture() {
use rpki::data_model::common::BigUnsigned;
use rpki::data_model::crl::RpkixCrl;
use rpki::data_model::manifest::ManifestObject;
use rpki::data_model::rc::ResourceCertificate;
use std::collections::HashSet;
use x509_parser::prelude::FromDer;
use x509_parser::x509::SubjectPublicKeyInfo;
let manifest_der = std::fs::read(
"tests/fixtures/repository/rpki.cernet.net/repo/cernet/0/05FC9C5B88506F7C0D3F862C8895BED67E9F8EBA.mft",
)
.expect("read manifest fixture");
let crl_der = std::fs::read(
"tests/fixtures/repository/rpki.cernet.net/repo/cernet/0/05FC9C5B88506F7C0D3F862C8895BED67E9F8EBA.crl",
)
.expect("read crl fixture");
let issuer_der = std::fs::read(
"tests/fixtures/repository/rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/BfycW4hQb3wNP4YsiJW-1n6fjro.cer",
)
.expect("read issuer fixture");
let manifest = ManifestObject::decode_der(&manifest_der).expect("decode manifest");
let ee = &manifest.signed_object.signed_data.certificates[0];
let issuer = ResourceCertificate::decode_der(&issuer_der).expect("decode issuer");
let issuer_crl = RpkixCrl::decode_der(&crl_der).expect("decode crl");
let (rem, issuer_spki) = SubjectPublicKeyInfo::from_der(&issuer.tbs.subject_public_key_info)
.expect("parse issuer spki");
assert!(rem.is_empty());
let now = ee
.resource_cert
.tbs
.validity_not_before
.max(issuer.tbs.validity_not_before)
.max(issuer_crl.this_update.utc)
+ time::Duration::seconds(1);
assert!(now < ee.resource_cert.tbs.validity_not_after);
assert!(now < issuer.tbs.validity_not_after);
assert!(now < issuer_crl.next_update.utc);
let issuer_uri = ee
.resource_cert
.tbs
.extensions
.ca_issuers_uris
.as_ref()
.and_then(|uris| uris.iter().find(|u| u.starts_with("rsync://")))
.expect("issuer uri")
.to_string();
let crl_uri = ee
.resource_cert
.tbs
.extensions
.crl_distribution_points_uris
.as_ref()
.and_then(|uris| uris.iter().find(|u| u.starts_with("rsync://")))
.expect("crl uri")
.to_string();
validate_ee_cert_path_with_predecoded_ee(
&ee.resource_cert,
&ee.raw_der,
&issuer,
&issuer_spki,
&issuer_crl,
&HashSet::new(),
Some(&issuer_uri),
Some(&crl_uri),
now,
)
.expect("predecoded helper accepts fixture");
validate_signed_object_ee_cert_path_fast(
ee,
&issuer,
&issuer_spki,
&issuer_crl,
&HashSet::new(),
Some(&issuer_uri),
Some(&crl_uri),
now,
)
.expect("fast helper accepts fixture");
let mut revoked = HashSet::new();
revoked.insert(BigUnsigned::from_biguint(&ee.resource_cert.tbs.serial_number).bytes_be);
let err = validate_signed_object_ee_cert_path_fast(
ee,
&issuer,
&issuer_spki,
&issuer_crl,
&revoked,
Some(&issuer_uri),
Some(&crl_uri),
now,
)
.unwrap_err();
assert!(matches!(err, CertPathError::EeRevoked), "{err}");
}
#[test]
fn validate_ee_cert_path_with_prevalidated_issuer_rejects_non_ee_and_non_ca_issuer() {
use rpki::data_model::crl::RpkixCrl;

5
tests/test_cir_matrix_m9.rs
View File

@@ -135,7 +135,10 @@ fn cir_replay_matrix_script_matches_reference_for_all_participants() {
PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("scripts/cir/run_cir_replay_matrix.sh");
let out = Command::new(script)
.env("CIR_MATERIALIZE_BIN", env!("CARGO_BIN_EXE_cir_materialize"))
.env("CIR_EXTRACT_INPUTS_BIN", env!("CARGO_BIN_EXE_cir_extract_inputs"))
.env(
"CIR_EXTRACT_INPUTS_BIN",
env!("CARGO_BIN_EXE_cir_extract_inputs"),
)
.env(
"CCR_TO_COMPARE_VIEWS_BIN",
env!("CARGO_BIN_EXE_ccr_to_compare_views"),

10
tests/test_cir_peer_replay_m8.rs
View File

@@ -133,7 +133,10 @@ fn cir_routinator_script_matches_reference_on_ta_only_cir() {
PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("scripts/cir/run_cir_replay_routinator.sh");
let out = Command::new(script)
.env("CIR_MATERIALIZE_BIN", env!("CARGO_BIN_EXE_cir_materialize"))
.env("CIR_EXTRACT_INPUTS_BIN", env!("CARGO_BIN_EXE_cir_extract_inputs"))
.env(
"CIR_EXTRACT_INPUTS_BIN",
env!("CARGO_BIN_EXE_cir_extract_inputs"),
)
.env(
"CCR_TO_COMPARE_VIEWS_BIN",
env!("CARGO_BIN_EXE_ccr_to_compare_views"),
@@ -189,7 +192,10 @@ fn cir_rpki_client_script_matches_reference_on_ta_only_cir() {
PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("scripts/cir/run_cir_replay_rpki_client.sh");
let out = Command::new(script)
.env("CIR_MATERIALIZE_BIN", env!("CARGO_BIN_EXE_cir_materialize"))
.env("CIR_EXTRACT_INPUTS_BIN", env!("CARGO_BIN_EXE_cir_extract_inputs"))
.env(
"CIR_EXTRACT_INPUTS_BIN",
env!("CARGO_BIN_EXE_cir_extract_inputs"),
)
.env(
"CCR_TO_COMPARE_VIEWS_BIN",
env!("CARGO_BIN_EXE_ccr_to_compare_views"),

10
tests/test_cir_sequence_peer_replay_m4.rs
View File

@@ -182,7 +182,10 @@ fn peer_sequence_replay_scripts_replay_all_steps() {
.join("scripts/cir/run_cir_replay_sequence_routinator.sh");
let out = Command::new(routinator_script)
.env("CIR_MATERIALIZE_BIN", env!("CARGO_BIN_EXE_cir_materialize"))
.env("CIR_EXTRACT_INPUTS_BIN", env!("CARGO_BIN_EXE_cir_extract_inputs"))
.env(
"CIR_EXTRACT_INPUTS_BIN",
env!("CARGO_BIN_EXE_cir_extract_inputs"),
)
.env(
"CCR_TO_COMPARE_VIEWS_BIN",
env!("CARGO_BIN_EXE_ccr_to_compare_views"),
@@ -206,7 +209,10 @@ fn peer_sequence_replay_scripts_replay_all_steps() {
.join("scripts/cir/run_cir_replay_sequence_rpki_client.sh");
let out = Command::new(rpki_client_script)
.env("CIR_MATERIALIZE_BIN", env!("CARGO_BIN_EXE_cir_materialize"))
.env("CIR_EXTRACT_INPUTS_BIN", env!("CARGO_BIN_EXE_cir_extract_inputs"))
.env(
"CIR_EXTRACT_INPUTS_BIN",
env!("CARGO_BIN_EXE_cir_extract_inputs"),
)
.env(
"CCR_TO_COMPARE_VIEWS_BIN",
env!("CARGO_BIN_EXE_ccr_to_compare_views"),

5
tests/test_cir_sequence_replay_m3.rs
View File

@@ -174,7 +174,10 @@ fn ours_sequence_replay_script_replays_all_steps() {
.join("scripts/cir/run_cir_replay_sequence_ours.sh");
let out = Command::new(script)
.env("CIR_MATERIALIZE_BIN", env!("CARGO_BIN_EXE_cir_materialize"))
.env("CIR_EXTRACT_INPUTS_BIN", env!("CARGO_BIN_EXE_cir_extract_inputs"))
.env(
"CIR_EXTRACT_INPUTS_BIN",
env!("CARGO_BIN_EXE_cir_extract_inputs"),
)
.env(
"CCR_TO_COMPARE_VIEWS_BIN",
env!("CARGO_BIN_EXE_ccr_to_compare_views"),

5
tests/test_multi_rir_case_info.rs
View File

@@ -20,7 +20,10 @@ fn wrapper_script() -> std::path::PathBuf {
fn multi_rir_case_info_resolves_all_five_rirs_and_timings() {
let bundle_root = multi_rir_bundle_root();
if !bundle_root.is_dir() {
eprintln!("skipping multi-rir case info test; bundle root missing: {}", bundle_root.display());
eprintln!(
"skipping multi-rir case info test; bundle root missing: {}",
bundle_root.display()
);
return;
}

16
tests/test_signed_object_decode.rs
View File

@@ -1,5 +1,5 @@
use rpki::data_model::oid::{OID_CT_RPKI_MANIFEST, OID_SHA256, OID_SIGNED_DATA};
use rpki::data_model::signed_object::RpkiSignedObject;
use rpki::data_model::signed_object::{EeKeyUsageSummary, RpkiSignedObject};
#[test]
fn decode_manifest_signed_object_smoke() {
@@ -32,6 +32,20 @@ fn decode_manifest_signed_object_smoke() {
.iter()
.any(|u| u.starts_with("rsync://"))
);
assert!(
!so.signed_data.certificates[0]
.tbs_certificate_der
.is_empty(),
"expected cached tbsCertificate DER"
);
assert!(
!so.signed_data.certificates[0].signature_bytes.is_empty(),
"expected cached EE signature bytes"
);
assert_eq!(
so.signed_data.certificates[0].key_usage_summary,
EeKeyUsageSummary::DigitalSignatureOnly
);
assert_eq!(so.signed_data.signer_infos.len(), 1);
println!("{so:#?}")
}