NASP/rpki
84
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add role-aware resource certificate profile

Browse Source
This commit is contained in:
yuyr
2026-07-11 21:40:52 +08:00
parent 8e37ef48cb
commit 6de0bced1c
12 changed files with 329 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tests/bench_stage2_collect_selected_der_v2.rs
View File

@@ -383,7 +383,7 @@ fn metrics_for(obj_type: ObjType, der: &[u8]) -> Result<Metrics, String> {
ObjType::Cer => {
let parsed = ResourceCertificate::parse_der(der).map_err(|e| e.to_string())?;
let spki_len = parsed.subject_public_key_info.len() as u32;
let ext_count = (parsed.extensions.basic_constraints_ca.len()
let ext_count = (parsed.extensions.basic_constraints.len()
+ parsed.extensions.subject_key_identifier.len()
+ parsed.extensions.authority_key_identifier.len()
+ parsed.extensions.crl_distribution_points.len()

3
tests/test_aspa_validate_ee_resources.rs
View File

@@ -25,6 +25,7 @@ fn dummy_ee(
subject_public_key_info: vec![],
extensions: RcExtensions {
basic_constraints_ca: false,
basic_constraints: None,
subject_key_identifier: Some(vec![0x01]),
authority_key_identifier: None,
crl_distribution_points_uris: None,
@@ -35,6 +36,8 @@ fn dummy_ee(
},
)),
certificate_policies_oid: None,
certificate_policies: None,
extension_oids: Vec::new(),
ip_resources,
as_resources,
},

3
tests/test_roa_validate_ee_resources.rs
View File

@@ -28,6 +28,7 @@ fn dummy_ee(
subject_public_key_info: vec![],
extensions: RcExtensions {
basic_constraints_ca: false,
basic_constraints: None,
subject_key_identifier: Some(vec![0x01]),
authority_key_identifier: None,
crl_distribution_points_uris: None,
@@ -38,6 +39,8 @@ fn dummy_ee(
},
)),
certificate_policies_oid: None,
certificate_policies: None,
extension_oids: Vec::new(),
ip_resources,
as_resources,
},

6
tests/test_ta_certificate.rs
View File

@@ -68,12 +68,15 @@ fn ta_certificate_rejects_non_self_signed_ca() {
fn ta_constraints_require_policies_and_ski() {
let rc = dummy_rc_ca(RcExtensions {
basic_constraints_ca: true,
basic_constraints: None,
subject_key_identifier: None,
authority_key_identifier: None,
crl_distribution_points_uris: None,
ca_issuers_uris: None,
subject_info_access: None,
certificate_policies_oid: None,
certificate_policies: None,
extension_oids: Vec::new(),
ip_resources: Some(rpki::data_model::rc::IpResourceSet { families: vec![] }),
as_resources: None,
});
@@ -97,12 +100,15 @@ fn ta_constraints_require_non_empty_resources_and_no_inherit() {
// Missing both IP and AS resources.
let rc = dummy_rc_ca(RcExtensions {
basic_constraints_ca: true,
basic_constraints: None,
subject_key_identifier: Some(vec![1]),
authority_key_identifier: None,
crl_distribution_points_uris: None,
ca_issuers_uris: None,
subject_info_access: None,
certificate_policies_oid: Some(OID_CP_IPADDR_ASNUMBER.to_string()),
certificate_policies: None,
extension_oids: Vec::new(),
ip_resources: None,
as_resources: None,
});