yuyr/panda-rpki-oss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260922 对齐 OSS 验证配置并补充 public TOML E2E
Some checks failed
ci / rust (push) Has been cancelled
Details
ci / docker (push) Has been cancelled
Details
ci / audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
yuyr
2026-09-22 22:27:10 +08:00
parent 09b4c40b9f
commit af693f5e6b
9 changed files with 779 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
tests/support/generate_repository.py
View File

@@ -20,6 +20,7 @@ from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.serialization import Encoding, NoEncryption, PrivateFormat, PublicFormat
from cryptography.x509 import AccessDescription, AuthorityInformationAccess, DistributionPoint, UniformResourceIdentifier
from cryptography.x509.name import _ASN1Type
from cryptography.x509.oid import AuthorityInformationAccessOID, NameOID, ObjectIdentifier
@@ -55,6 +56,14 @@ SECOND_PREFIX = ipaddress.ip_network("203.0.113.128/25")
OUTSIDE_PREFIX = ipaddress.ip_network("203.0.114.0/24")
TEST_ASN = 64496
SESSION_ID = "11111111-2222-4333-8444-555555555555"
STRICT_NAMES = False
def common_name(value: str) -> x509.NameAttribute:
"""Build the fixture CN with the DER string type selected by the test."""
if STRICT_NAMES:
return x509.NameAttribute(NameOID.COMMON_NAME, value, _type=_ASN1Type.PrintableString)
return x509.NameAttribute(NameOID.COMMON_NAME, value)
def tlv(tag: int, value: bytes) -> bytes:
@@ -317,7 +326,7 @@ def make_roa(
) -> None:
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
cert = sign_cert(
x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, f"Local Test EE {name}")]),
x509.Name([common_name(f"Local Test EE {name}")]),
child_name,
key.public_key(),
child_key,
@@ -338,7 +347,7 @@ def make_roa(
def make_aspa(name: str, child_name, child_key, common: Path, work: Path) -> None:
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
cert = sign_cert(
x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, f"Local Test EE {name}")]),
x509.Name([common_name(f"Local Test EE {name}")]),
child_name,
key.public_key(),
child_key,
@@ -359,7 +368,7 @@ def make_aspa(name: str, child_name, child_key, common: Path, work: Path) -> Non
def make_manifest(name: str, number: int, files: list[tuple[str, bytes]], child_name, child_key, common: Path, work: Path) -> bytes:
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
cert = sign_cert(
x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, f"Local Test Manifest EE {name}")]),
x509.Name([common_name(f"Local Test Manifest EE {name}")]),
child_name,
key.public_key(),
child_key,
@@ -538,7 +547,7 @@ def make_https_certificates(output: Path) -> None:
def main() -> None:
global RRDP_HOST, FOREIGN_RRDP_HOST, RRDP_PORT, RSYNC_HOST, RSYNC_PORT
global TAL_URI, TAL_HTTPS_URI, RRDP_URI
global TAL_URI, TAL_HTTPS_URI, RRDP_URI, STRICT_NAMES
global ROOT_REPO_URI, ROOT_MFT_URI, CHILD_REPO_URI, CHILD_MFT_URI
parser = argparse.ArgumentParser()
parser.add_argument("--output", type=Path, required=True)
@@ -571,12 +580,18 @@ def main() -> None:
default=RSYNC_PORT,
help="port embedded in rsync URIs (default: 873)",
)
parser.add_argument(
"--strict-names",
action="store_true",
help="encode RPKI commonName values as PrintableString for strict-name tests",
)
args = parser.parse_args()
RRDP_HOST = args.rrdp_host
FOREIGN_RRDP_HOST = args.foreign_rrdp_host
RRDP_PORT = args.rrdp_port
RSYNC_HOST = args.rsync_host
RSYNC_PORT = args.rsync_port
STRICT_NAMES = args.strict_names
TAL_URI = f"rsync://{RSYNC_HOST}:{RSYNC_PORT}/custom/ta.cer"
TAL_HTTPS_URI = f"https://{RRDP_HOST}:{RRDP_PORT}/ta/custom-ta.cer"
RRDP_URI = f"https://{RRDP_HOST}:{RRDP_PORT}/rrdp/notification.xml"
@@ -592,8 +607,8 @@ def main() -> None:
root_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
child_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
root_name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Local Test RPKI Root")])
child_name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Local Test RPKI Child")])
root_name = x509.Name([common_name("Local Test RPKI Root")])
child_name = x509.Name([common_name("Local Test RPKI Child")])
root_cert = sign_cert(
root_name, root_name, root_key.public_key(), root_key, 0x14700001, True, root_key,
ip_ext=ip_resources([CHILD_PREFIX]),
@@ -606,7 +621,7 @@ def main() -> None:
ca_repository=CHILD_REPO_URI, manifest_uri=CHILD_MFT_URI, notify_uri=RRDP_URI,
crl_uri=f"{ROOT_REPO_URI}root.crl", ca_issuer_uri=f"{ROOT_REPO_URI}child.cer",
)
bad_child_name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Local Test RPKI Overclaiming Child")])
bad_child_name = x509.Name([common_name("Local Test RPKI Overclaiming Child")])
bad_child_repo_uri = f"rsync://{RSYNC_HOST}:{RSYNC_PORT}/custom/bad-child/"
bad_child_cert = sign_cert(
bad_child_name, root_name, child_key.public_key(), root_key, 0x14700003, True, child_key, root_key,
@@ -706,6 +721,7 @@ def main() -> None:
"fixture_schema_version=1\nfixture_kind=stack-local-test-rpki-repo\n"
f"tal_uri={TAL_URI}\ntal_https_uri={TAL_HTTPS_URI}\nrrdp_uri={RRDP_URI}\nrsync_module=custom\n"
f"rrdp_host={RRDP_HOST}\nforeign_rrdp_host={FOREIGN_RRDP_HOST}\nrrdp_port={RRDP_PORT}\nrsync_host={RSYNC_HOST}\nrsync_port={RSYNC_PORT}\n"
f"strict_names={str(STRICT_NAMES).lower()}\n"
"cases=baseline-v1,sync-hash-mismatch,rrdp-cross-origin-snapshot,baseline-v2,validation-expired,validation-max-length,validation-max-length-invalid,"
"validation-roa-prefix-outside,validation-out-of-resource,validation-ca-over-resource,validation-nonstandard\n",
encoding="utf-8",