277 lines
8.9 KiB
Python
277 lines
8.9 KiB
Python
"""End-to-end coverage for the #170 public TOML validation settings."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
import socket
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
from urllib.parse import urlparse
|
|
|
|
|
|
def free_port() -> int:
|
|
with socket.socket() as sock:
|
|
sock.bind(("127.0.0.1", 0))
|
|
return int(sock.getsockname()[1])
|
|
|
|
|
|
def toml_string(path: Path) -> str:
|
|
return json.dumps(str(path))
|
|
|
|
|
|
def run_checked(args: list[str], *, timeout: int = 120) -> subprocess.CompletedProcess[str]:
|
|
result = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
|
|
if result.returncode != 0:
|
|
raise AssertionError(
|
|
f"command failed ({result.returncode}): {' '.join(args)}\n"
|
|
f"stdout:\n{result.stdout}\nstderr:\n{result.stderr}"
|
|
)
|
|
return result
|
|
|
|
|
|
def wait_for_server(server: subprocess.Popen[str]) -> None:
|
|
assert server.stdout is not None
|
|
line = server.stdout.readline().strip()
|
|
if line != "ready":
|
|
raise AssertionError(f"RRDP fixture server did not become ready: {line!r}")
|
|
|
|
|
|
def stop_process(process: subprocess.Popen[str] | None) -> None:
|
|
if process is None:
|
|
return
|
|
if process.poll() is None:
|
|
process.terminate()
|
|
try:
|
|
process.wait(timeout=5)
|
|
except subprocess.TimeoutExpired:
|
|
process.kill()
|
|
process.wait()
|
|
|
|
|
|
def write_config(
|
|
path: Path,
|
|
*,
|
|
fixture: Path,
|
|
output: Path,
|
|
state: Path,
|
|
ccr: Path,
|
|
wrapper: Path,
|
|
mirror: Path,
|
|
sync_preference: str,
|
|
rrdp_mode: str,
|
|
validation_time: str,
|
|
resource_mode: str,
|
|
scope: str,
|
|
) -> None:
|
|
path.write_text(
|
|
f'''config-version = 1
|
|
mode = "validate"
|
|
out = {toml_string(output)}
|
|
rrdp-state-dir = {toml_string(state)}
|
|
rrdp-sync-mode = "{rrdp_mode}"
|
|
ccr-out = {toml_string(ccr)}
|
|
http-timeout-secs = 2
|
|
http-root-cert = [{toml_string(fixture / "certs/rrdp-ca.pem")}]
|
|
require-complete = true
|
|
parallel-max-repo-sync-workers-global = 2
|
|
parallel-phase2-object-workers = 2
|
|
log-level = "info"
|
|
log-format = "json"
|
|
resource-validation-mode = "{resource_mode}"
|
|
validation-time = "{validation_time}"
|
|
sync-preference = "{sync_preference}"
|
|
rsync-timeout-secs = 47
|
|
rsync-command = {toml_string(wrapper)}
|
|
rsync-mirror-root = {toml_string(mirror)}
|
|
rsync-scope = "{scope}"
|
|
|
|
[strict]
|
|
name = true
|
|
cms-der = true
|
|
signed-attrs = true
|
|
|
|
[[anchors]]
|
|
id = "custom"
|
|
tal = {toml_string(fixture / "tal/custom.tal")}
|
|
ta = {toml_string(fixture / "ta/custom-ta.cer")}
|
|
''',
|
|
encoding="utf-8",
|
|
)
|
|
|
|
|
|
def make_rsync_wrapper(path: Path, fixture: Path, log: Path) -> None:
|
|
repository = fixture / "cases" / "baseline-v1" / "repository"
|
|
path.write_text(
|
|
f'''#!/usr/bin/env python3
|
|
import json
|
|
import shutil
|
|
import sys
|
|
from pathlib import Path
|
|
from urllib.parse import urlparse
|
|
|
|
repository = Path({str(repository)!r})
|
|
log = Path({str(log)!r})
|
|
args = sys.argv[1:]
|
|
with log.open("a", encoding="utf-8") as stream:
|
|
stream.write(json.dumps(args) + "\\n")
|
|
|
|
if len(args) < 2:
|
|
raise SystemExit("rsync wrapper expected source and destination")
|
|
source_uri, destination_text = args[-2:]
|
|
destination = Path(destination_text)
|
|
parts = [part for part in urlparse(source_uri).path.split("/") if part]
|
|
if not parts or parts[0] != "custom":
|
|
raise SystemExit(f"unexpected fixture rsync source: {{source_uri}}")
|
|
relative = Path(*parts[1:]) if len(parts) > 1 else Path()
|
|
source = repository / relative
|
|
if not source.exists():
|
|
raise SystemExit(f"fixture rsync source does not exist: {{source}}")
|
|
destination.mkdir(parents=True, exist_ok=True)
|
|
if source.is_file():
|
|
shutil.copy2(source, destination / source.name)
|
|
else:
|
|
for item in source.iterdir():
|
|
target = destination / item.name
|
|
if item.is_dir():
|
|
shutil.copytree(item, target, dirs_exist_ok=True)
|
|
else:
|
|
shutil.copy2(item, target)
|
|
''',
|
|
encoding="utf-8",
|
|
)
|
|
path.chmod(0o755)
|
|
|
|
|
|
def read_json(path: Path) -> dict:
|
|
return json.loads(path.read_text(encoding="utf-8"))
|
|
|
|
|
|
def assert_successful_output(output: Path, expected_validation_time: str) -> None:
|
|
summary = read_json(output / "summary.json")
|
|
assert summary["resultStatus"] == "success", summary
|
|
assert summary["vrps"] == 1, summary
|
|
assert (output / "result-complete.json").is_file()
|
|
assert len((output / "vrps.csv").read_text(encoding="utf-8").splitlines()) == 2
|
|
|
|
timing = read_json(output / "analysis" / "timing.json")
|
|
assert timing["meta"]["validation_time_utc_rfc3339"] == expected_validation_time, timing
|
|
|
|
|
|
def run(binary: str) -> None:
|
|
support = Path(__file__).resolve().parent
|
|
with tempfile.TemporaryDirectory(prefix="panda-rpki-public-config-") as tmp:
|
|
base = Path(tmp)
|
|
fixture = base / "fixture"
|
|
port = free_port()
|
|
run_checked(
|
|
[
|
|
sys.executable,
|
|
str(support / "generate_repository.py"),
|
|
"--rrdp-host",
|
|
"127.0.0.1",
|
|
"--rrdp-port",
|
|
str(port),
|
|
"--rsync-host",
|
|
"127.0.0.1",
|
|
"--strict-names",
|
|
"--output",
|
|
str(fixture),
|
|
]
|
|
)
|
|
active = fixture / "active"
|
|
active.symlink_to("cases/baseline-v1/http")
|
|
|
|
wrapper_log = base / "rsync-wrapper.log"
|
|
wrapper = base / "rsync-wrapper.py"
|
|
make_rsync_wrapper(wrapper, fixture, wrapper_log)
|
|
|
|
server = subprocess.Popen(
|
|
[
|
|
sys.executable,
|
|
str(support / "serve_repository.py"),
|
|
str(active),
|
|
str(port),
|
|
str(fixture / "certs/rrdp-server.pem"),
|
|
str(fixture / "certs/rrdp-server.key"),
|
|
],
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.PIPE,
|
|
text=True,
|
|
)
|
|
try:
|
|
wait_for_server(server)
|
|
fixed_input = "2026-06-01T08:00:00.250+08:00"
|
|
fixed_effective = "2026-06-01T00:00:00Z"
|
|
rrdp_output = base / "rrdp-output"
|
|
rrdp_state = base / "rrdp-state"
|
|
rrdp_config = base / "rrdp.toml"
|
|
write_config(
|
|
rrdp_config,
|
|
fixture=fixture,
|
|
output=rrdp_output,
|
|
state=rrdp_state,
|
|
ccr=rrdp_output / "result.ccr",
|
|
wrapper=wrapper,
|
|
mirror=base / "rrdp-mirror",
|
|
sync_preference="rrdp-then-rsync",
|
|
rrdp_mode="snapshot",
|
|
validation_time=fixed_input,
|
|
resource_mode="validation-update-03",
|
|
scope="publication-point",
|
|
)
|
|
run_checked([binary, "validate", "--config", str(rrdp_config)])
|
|
assert_successful_output(rrdp_output, fixed_effective)
|
|
assert not wrapper_log.exists() or not wrapper_log.read_text(encoding="utf-8").strip(), (
|
|
"RRDP success path unexpectedly invoked the rsync command"
|
|
)
|
|
finally:
|
|
stop_process(server)
|
|
|
|
rsync_output = base / "rsync-output"
|
|
rsync_state = base / "rsync-state"
|
|
rsync_mirror = base / "rsync-mirror"
|
|
rsync_config = base / "rsync.toml"
|
|
write_config(
|
|
rsync_config,
|
|
fixture=fixture,
|
|
output=rsync_output,
|
|
state=rsync_state,
|
|
ccr=rsync_output / "result.ccr",
|
|
wrapper=wrapper,
|
|
mirror=rsync_mirror,
|
|
sync_preference="rsync-only",
|
|
rrdp_mode="auto",
|
|
validation_time="2026-06-01T00:00:00Z",
|
|
resource_mode="rfc6487",
|
|
scope="publication-point",
|
|
)
|
|
# The RRDP server is stopped. A successful run therefore proves that
|
|
# sync-preference came from public TOML and reached the scheduler.
|
|
run_checked([binary, "validate", "--config", str(rsync_config)])
|
|
assert_successful_output(rsync_output, "2026-06-01T00:00:00Z")
|
|
|
|
calls = [
|
|
json.loads(line)
|
|
for line in wrapper_log.read_text(encoding="utf-8").splitlines()
|
|
if line.strip()
|
|
]
|
|
assert calls, "rsync-only validation did not invoke configured rsync command"
|
|
assert all("--timeout" in call and call[call.index("--timeout") + 1] == "47" for call in calls), calls
|
|
sources = [call[-2] for call in calls]
|
|
assert any("/custom/root/" in source for source in sources), sources
|
|
assert any("/custom/child/" in source for source in sources), sources
|
|
assert all("/custom/" in source and source.rstrip("/") != "rsync://127.0.0.1:873/custom" for source in sources), sources
|
|
mirror_files = [path for path in rsync_mirror.rglob("*") if path.is_file()]
|
|
assert mirror_files, f"configured rsync mirror remained empty: {rsync_mirror}"
|
|
|
|
print(
|
|
"Public TOML E2E passed: strict/resource/time + RRDP path + "
|
|
"rsync-only command/timeout/mirror/scope"
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
run(str(Path(sys.argv[1]).resolve()))
|