package ca

import (

"context"

"crypto"

"crypto/ecdsa"

"crypto/elliptic"

"crypto/rand"

"crypto/x509"

"crypto/x509/pkix"

"encoding/asn1"

"errors"

"fmt"

"io/ioutil"

"math/big"

"strings"

"testing"

"time"

"github.com/beeker1121/goque"

ct "github.com/google/certificate-transparency-go"

cttls "github.com/google/certificate-transparency-go/tls"

ctx509 "github.com/google/certificate-transparency-go/x509"

"github.com/jmhodges/clock"

"github.com/prometheus/client_golang/prometheus"

"google.golang.org/grpc"

"google.golang.org/protobuf/types/known/emptypb"

capb "github.com/letsencrypt/boulder/ca/proto"

"github.com/letsencrypt/boulder/cmd"

"github.com/letsencrypt/boulder/core"

corepb "github.com/letsencrypt/boulder/core/proto"

berrors "github.com/letsencrypt/boulder/errors"

"github.com/letsencrypt/boulder/features"

"github.com/letsencrypt/boulder/goodkey"

"github.com/letsencrypt/boulder/issuance"

"github.com/letsencrypt/boulder/linter"

blog "github.com/letsencrypt/boulder/log"

"github.com/letsencrypt/boulder/metrics"

"github.com/letsencrypt/boulder/policy"

sapb "github.com/letsencrypt/boulder/sa/proto"

"github.com/letsencrypt/boulder/test"

)

var (

// * Random public key

// * CN = not-example.com

// * DNSNames = not-example.com, www.not-example.com

CNandSANCSR = mustRead("./testdata/cn_and_san.der.csr")

// CSR generated by Go:

// * Random public key

// * CN = not-example.com

// * Includes an extensionRequest attribute for a well-formed TLS Feature extension

MustStapleCSR = mustRead("./testdata/must_staple.der.csr")

// CSR generated by Go:

// * Random public key

// * CN = not-example.com

// * Includes extensionRequest attributes for *two* must-staple extensions

DuplicateMustStapleCSR = mustRead("./testdata/duplicate_must_staple.der.csr")

// CSR generated by Go:

// * Random public key

// * CN = not-example.com

// * Includes an extensionRequest attribute for an unknown extension with an

// empty value. That extension's OID, 2.25.123456789, is on the UUID arc.

// It isn't a real randomly-generated UUID because Go represents the

// components of the OID as 32-bit integers, which aren't large enough to

// hold a real 128-bit UUID; this doesn't matter as far as what we're

// testing here is concerned.

UnsupportedExtensionCSR = mustRead("./testdata/unsupported_extension.der.csr")

// CSR generated by Go:

// * Random public key

// * CN = not-example.com

// * Includes an extensionRequest attribute for the CT poison extension

// with a valid NULL value.

CTPoisonExtensionCSR = mustRead("./testdata/ct_poison_extension.der.csr")

// CSR generated by Go:

// * Random public key

// * CN = not-example.com

// * Includes an extensionRequest attribute for the CT poison extension

// with an invalid empty value.

CTPoisonExtensionEmptyCSR = mustRead("./testdata/ct_poison_extension_empty.der.csr")

// CSR generated by Go:

// * Random ECDSA public key.

// * CN = [none]

// * DNSNames = example.com, example2.com

ECDSACSR = mustRead("./testdata/ecdsa.der.csr")

// OIDExtensionCTPoison is defined in RFC 6962 s3.1.

OIDExtensionCTPoison = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 3}

// OIDExtensionSCTList is defined in RFC 6962 s3.3.

OIDExtensionSCTList = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 2}

// The "certificate-for-precertificate" tests use the precertificate from a

// previous "precertificate" test, in order to verify that the CA is

// stateless with respect to these two operations, since a separate CA

// object instance will be used for generating each. Consequently, the

// "precertificate" tests must be before the "certificate-for-precertificate"

// tests in this list, and we cannot run these sub-tests concurrently.

//

// In order to test the case where the same CA object is used for issuing

// both the precertificate and the certificate, we'd need to contort

// |TestIssueCertificate| quite a bit, and since it isn't clear that that

// would be useful, we've avoided adding that case, at least for now.

issuanceModes = []IssuanceMode{

{name: "precertificate", issueCertificateForPrecertificate: false},

{name: "certificate-for-precertificate", issueCertificateForPrecertificate: true},

}

)

const arbitraryRegID int64 = 1001

const yamlLoadErrMsg = "Error loading YAML bytes for ECDSA allow list:"

const caKeyFile = "../test/test-ca.key"

const caCertFile = "../test/test-ca.pem"

const caCertFile2 = "../test/test-ca2.pem"

func mustRead(path string) []byte {

}

type testCtx struct {

}

type mockSA struct {

certificate core.Certificate

}

func (m *mockSA) AddCertificate(ctx context.Context, req *sapb.AddCertificateRequest, _ ...grpc.CallOption) (*sapb.AddCertificateResponse, error) {

m.certificate.DER = req.Der

return nil, nil

}

func (m *mockSA) AddPrecertificate(ctx context.Context, req *sapb.AddCertificateRequest, _ ...grpc.CallOption) (*emptypb.Empty, error) {

return &emptypb.Empty{}, nil

}

func (m *mockSA) AddSerial(ctx context.Context, req *sapb.AddSerialRequest, _ ...grpc.CallOption) (*emptypb.Empty, error) {

return &emptypb.Empty{}, nil

}

func (m *mockSA) GetCertificate(ctx context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*corepb.Certificate, error) {

return nil, berrors.NotFoundError("cannot find the cert")

}

func (m *mockSA) GetPrecertificate(ctx context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*corepb.Certificate, error) {

return nil, berrors.NotFoundError("cannot find the precert")

}

var caKey crypto.Signer

var caCert *issuance.Certificate

var caCert2 *issuance.Certificate

var ctx = context.Background()

func init() {

}

func setup(t *testing.T) *testCtx {

}

func TestFailNoSerialPrefix(t *testing.T) {

}

type TestCertificateIssuance struct {

}

type IssuanceMode struct {

name string

issueCertificateForPrecertificate bool

}

func TestIssuePrecertificate(t *testing.T) {

}

func makeECDSAAllowListBytes(regID int64) []byte {

}

func issueCertificateSubTestSetup(t *testing.T) (*certificateAuthorityImpl, *mockSA) {

}

func issueCertificateSubTestIssuePrecertificate(t *testing.T, i *TestCertificateIssuance) {

}

func issueCertificateSubTestValidityUsesCAClock(t *testing.T, i *TestCertificateIssuance) {

test.AssertEquals(t, i.cert.NotBefore, i.ca.clk.Now().Add(-1*i.ca.backdate))

test.AssertEquals(t, i.cert.NotAfter.Add(time.Second).Sub(i.cert.NotBefore), i.ca.validityPeriod)

}

func TestMultipleIssuers(t *testing.T) {

}

func TestECDSAAllowList(t *testing.T) {

}

func TestInvalidCSRs(t *testing.T) {

}

func TestRejectValidityTooLong(t *testing.T) {

}

func issueCertificateSubTestProfileSelectionRSA(t *testing.T, i *TestCertificateIssuance) {

}

func issueCertificateSubTestProfileSelectionECDSA(t *testing.T, i *TestCertificateIssuance) {

}

func countMustStaple(t *testing.T, cert *x509.Certificate) (count int) {

}

func issueCertificateSubTestMustStaple(t *testing.T, i *TestCertificateIssuance) {

test.AssertMetricWithLabelsEquals(t, i.ca.signatureCount, prometheus.Labels{"purpose": "precertificate"}, 1)

test.AssertEquals(t, countMustStaple(t, i.cert), 1)

}

func issueCertificateSubTestUnknownExtension(t *testing.T, i *TestCertificateIssuance) {

}

func issueCertificateSubTestCTPoisonExtension(t *testing.T, i *TestCertificateIssuance) {

test.AssertMetricWithLabelsEquals(t, i.ca.signatureCount, prometheus.Labels{"purpose": "precertificate"}, 1)

}

func findExtension(extensions []pkix.Extension, id asn1.ObjectIdentifier) *pkix.Extension {

}

func makeSCTs() ([][]byte, error) {

}

func TestIssueCertificateForPrecertificate(t *testing.T) {

}

func deserializeSCTList(serializedSCTList []byte) ([]ct.SignedCertificateTimestamp, error) {

}

type dupeSA struct {

mockSA

}

func (m *dupeSA) GetCertificate(ctx context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*corepb.Certificate, error) {

return nil, nil

}

type getCertErrorSA struct {

mockSA

}

func (m *getCertErrorSA) GetCertificate(ctx context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*corepb.Certificate, error) {

return nil, fmt.Errorf("i don't like it")

}

func TestIssueCertificateForPrecertificateDuplicateSerial(t *testing.T) {

}

type queueSA struct {

}

func (qsa *queueSA) AddCertificate(_ context.Context, req *sapb.AddCertificateRequest, _ ...grpc.CallOption) (*sapb.AddCertificateResponse, error) {

}

func (qsa *queueSA) AddPrecertificate(ctx context.Context, req *sapb.AddCertificateRequest, _ ...grpc.CallOption) (*emptypb.Empty, error) {

}

func TestPrecertOrphanQueue(t *testing.T) {