20260711 补充P1缓存与证书profile回归

2026-07-12 07:15:32 +08:00
parent 1ce897dbff
commit 4a64fa7900
3 changed files with 272 additions and 0 deletions
--- a/tests/test_resource_certificate_profile.rs
+++ b/tests/test_resource_certificate_profile.rs
@@ -0,0 +1,131 @@
+use der_parser::num_bigint::BigUint;
+use rpki::data_model::common::X509NameDer;
+use rpki::data_model::oid::{
+    OID_AUTONOMOUS_SYS_IDS, OID_BASIC_CONSTRAINTS, OID_CERTIFICATE_POLICIES, OID_CP_IPADDR_ASNUMBER,
+};
+use rpki::data_model::rc::{
+    AsIdOrRange, AsIdentifierChoice, AsResourceSet, BasicConstraintsProfile,
+    CertificatePoliciesProfile, RcExtensions, ResourceCertKind, ResourceCertificate,
+    ResourceCertificateProfileError, ResourceCertificateRole, RpkixTbsCertificate,
+};
+use time::OffsetDateTime;
+
+fn valid_ca_certificate() -> ResourceCertificate {
+    let validation_time = OffsetDateTime::from_unix_timestamp(0).expect("valid epoch");
+    ResourceCertificate {
+        raw_der: Vec::new(),
+        kind: ResourceCertKind::Ca,
+        tbs: RpkixTbsCertificate {
+            version: 2,
+            serial_number: BigUint::from(1u32),
+            signature_algorithm: "1.2.840.113549.1.1.11".to_string(),
+            issuer_name: X509NameDer(b"CN=issuer".to_vec()),
+            subject_name: X509NameDer(b"CN=subject".to_vec()),
+            validity_not_before: validation_time,
+            validity_not_after: validation_time,
+            subject_public_key_info: Vec::new(),
+            extensions: RcExtensions {
+                basic_constraints_ca: true,
+                basic_constraints: Some(BasicConstraintsProfile {
+                    ca: true,
+                    critical: true,
+                    path_len_constraint: None,
+                }),
+                subject_key_identifier: None,
+                authority_key_identifier: None,
+                crl_distribution_points_uris: None,
+                ca_issuers_uris: None,
+                subject_info_access: None,
+                certificate_policies_oid: Some(OID_CP_IPADDR_ASNUMBER.to_string()),
+                certificate_policies: Some(CertificatePoliciesProfile {
+                    policy_oid: OID_CP_IPADDR_ASNUMBER.to_string(),
+                    qualifier_oids: Vec::new(),
+                }),
+                extension_oids: vec![
+                    OID_BASIC_CONSTRAINTS.to_string(),
+                    OID_CERTIFICATE_POLICIES.to_string(),
+                ],
+                ip_resources: None,
+                as_resources: None,
+            },
+        },
+    }
+}
+
+#[test]
+fn ca_profile_accepts_required_basic_constraints_and_policy() {
+    valid_ca_certificate()
+        .validate_rfc6487_profile(ResourceCertificateRole::Ca)
+        .expect("valid CA profile");
+}
+
+#[test]
+fn ca_profile_rejects_noncritical_basic_constraints() {
+    let mut certificate = valid_ca_certificate();
+    certificate
+        .tbs
+        .extensions
+        .basic_constraints
+        .as_mut()
+        .expect("constraints")
+        .critical = false;
+
+    assert!(matches!(
+        certificate.validate_rfc6487_profile(ResourceCertificateRole::Ca),
+        Err(ResourceCertificateProfileError::BasicConstraintsCriticality)
+    ));
+}
+
+#[test]
+fn ca_profile_rejects_unknown_extension() {
+    let mut certificate = valid_ca_certificate();
+    certificate
+        .tbs
+        .extensions
+        .extension_oids
+        .push("1.2.3.4".to_string());
+
+    assert!(matches!(
+        certificate.validate_rfc6487_profile(ResourceCertificateRole::Ca),
+        Err(ResourceCertificateProfileError::DisallowedExtension { .. })
+    ));
+}
+
+#[test]
+fn ca_profile_rejects_non_cps_policy_qualifier() {
+    let mut certificate = valid_ca_certificate();
+    certificate
+        .tbs
+        .extensions
+        .certificate_policies
+        .as_mut()
+        .expect("certificate policies")
+        .qualifier_oids
+        .push("1.2.3.4".to_string());
+
+    assert!(matches!(
+        certificate.validate_rfc6487_profile(ResourceCertificateRole::Ca),
+        Err(ResourceCertificateProfileError::CertificatePoliciesInvalidQualifier(_))
+    ));
+}
+
+#[test]
+fn ca_profile_rejects_autonomous_system_rdi() {
+    let mut certificate = valid_ca_certificate();
+    certificate.tbs.extensions.as_resources = Some(AsResourceSet {
+        asnum: None,
+        rdi: Some(AsIdentifierChoice::AsIdsOrRanges(vec![AsIdOrRange::Id(
+            64512,
+        )])),
+    });
+    certificate
+        .tbs
+        .extensions
+        .extension_oids
+        .push(OID_AUTONOMOUS_SYS_IDS.to_string());
+
+    assert!(matches!(
+        certificate.validate_rfc6487_profile(ResourceCertificateRole::Ca),
+        Err(ResourceCertificateProfileError::AsResourcesRdiPresent)
+    ));
+}