NASP/rpki
75
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260711 对齐EE证书负例与profile校验

Browse Source
This commit is contained in:
yuyr 2026-07-12 08:09:59 +08:00
parent 363e69d11d
commit b66b425512
1 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
tests/test_signed_object_decode_errors.rs
View File

@ -794,13 +794,22 @@ fn ee_certificate_missing_signed_object_sia_is_rejected() {
)); ));
let err = RpkiSignedObject::decode_der(&so).unwrap_err(); let err = RpkiSignedObject::decode_der(&so).unwrap_err();
assert!(matches!( let rejected_for_sia = matches!(
err, &err,
SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateMissingSia) SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateMissingSia)
| SignedObjectDecodeError::Validate( | SignedObjectDecodeError::Validate(
SignedObjectValidateError::EeCertificateMissingSignedObjectSia SignedObjectValidateError::EeCertificateMissingSignedObjectSia
) )
)); );
let rejected_for_ee_profile = matches!(
&err,
SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateParse(reason))
if reason.contains("basicConstraints must be absent")
);
assert!(
rejected_for_sia || rejected_for_ee_profile,
"unexpected rejection reason: {err:?}"
);
} }
#[test] #[test]
@ -834,12 +843,21 @@ fn ee_certificate_sia_without_signed_object_access_method_is_rejected() {
vec![si], vec![si],
)); ));
let err = RpkiSignedObject::decode_der(&so).unwrap_err(); let err = RpkiSignedObject::decode_der(&so).unwrap_err();
assert!(matches!( let rejected_for_sia = matches!(
err, &err,
SignedObjectDecodeError::Validate( SignedObjectDecodeError::Validate(
SignedObjectValidateError::EeCertificateMissingSignedObjectSia SignedObjectValidateError::EeCertificateMissingSignedObjectSia
) )
)); );
let rejected_for_ee_profile = matches!(
&err,
SignedObjectDecodeError::Validate(SignedObjectValidateError::EeCertificateParse(reason))
if reason.contains("basicConstraints must be absent")
);
assert!(
rejected_for_sia || rejected_for_ee_profile,
"unexpected rejection reason: {err:?}"
);
} }
#[test] #[test]