features.Reset()

dbMap, err := NewDbMap(vars.DBConnSA, DbSettings{})

if err != nil {

t.Fatalf("Failed to create dbMap: %s", err)

}

fc := clock.NewFake()

fc.Set(time.Date(2015, 3, 4, 5, 0, 0, 0, time.UTC))

sa, err := NewSQLStorageAuthority(dbMap, fc, log, metrics.NoopRegisterer, 1)

if err != nil {

t.Fatalf("Failed to create SA: %s", err)

}

cleanUp := test.ResetSATestDatabase(t)

return sa, fc, cleanUp

t.Helper()

authz := core.Authorization{

Identifier: identifier.DNSIdentifier(domain),

RegistrationID: 1,

Status: "pending",

Expires: &exp,

Challenges: []core.Challenge{

{

Token: core.NewToken(),

Type: core.ChallengeTypeHTTP01,

Status: core.StatusPending,

},

},

}

authzPB, err := bgrpc.AuthzToPB(authz)

test.AssertNotError(t, err, "AuthzToPB failed")

ids, err := sa.NewAuthorizations2(context.Background(), &sapb.AddPendingAuthorizationsRequest{

Authz: []*corepb.Authorization{authzPB},

})

test.AssertNotError(t, err, "sa.NewAuthorizations2 failed")

return ids.Ids[0]

status string, attemptedAt time.Time) int64 {

t.Helper()

pendingID := createPendingAuthorization(t, sa, domain, exp)

expInt := exp.UnixNano()

attempted := string(core.ChallengeTypeHTTP01)

attemptedAtInt := attemptedAt.UnixNano()

err := sa.FinalizeAuthorization2(context.Background(), &sapb.FinalizeAuthorizationRequest{

Id: pendingID,

Status: status,

Expires: expInt,

Attempted: attempted,

AttemptedAt: attemptedAtInt,

})

test.AssertNotError(t, err, "sa.FinalizeAuthorizations2 failed")

return pendingID

sa, clk, cleanUp := initSA(t)

defer cleanUp()

jwk := satest.GoodJWK()

contact := "mailto:foo@example.com"

contacts := &[]string{contact}

reg, err := sa.NewRegistration(ctx, core.Registration{

Key: jwk,

Contact: contacts,

InitialIP: net.ParseIP("43.34.43.34"),

})

if err != nil {

t.Fatalf("Couldn't create new registration: %s", err)

}

test.Assert(t, reg.ID != 0, "ID shouldn't be 0")

test.AssertDeepEquals(t, reg.Contact, contacts)

_, err = sa.GetRegistration(ctx, 0)

test.AssertError(t, err, "Registration object for ID 0 was returned")

dbReg, err := sa.GetRegistration(ctx, reg.ID)

test.AssertNotError(t, err, fmt.Sprintf("Couldn't get registration with ID %v", reg.ID))

expectedReg := core.Registration{

ID: reg.ID,

Key: jwk,

InitialIP: net.ParseIP("43.34.43.34"),

CreatedAt: clk.Now(),

}

test.AssertEquals(t, dbReg.ID, expectedReg.ID)

test.Assert(t, core.KeyDigestEquals(dbReg.Key, expectedReg.Key), "Stored key != expected")

newReg := core.Registration{

ID: reg.ID,

Key: jwk,

Contact: &[]string{"test.com"},

InitialIP: net.ParseIP("72.72.72.72"),

Agreement: "yes",

}

err = sa.UpdateRegistration(ctx, newReg)

test.AssertNotError(t, err, fmt.Sprintf("Couldn't get registration with ID %v", reg.ID))

dbReg, err = sa.GetRegistrationByKey(ctx, jwk)

test.AssertNotError(t, err, "Couldn't get registration by key")

test.AssertEquals(t, dbReg.ID, newReg.ID)

test.AssertEquals(t, dbReg.Agreement, newReg.Agreement)

var anotherJWK jose.JSONWebKey

err = json.Unmarshal([]byte(anotherKey), &anotherJWK)

test.AssertNotError(t, err, "couldn't unmarshal anotherJWK")

_, err = sa.GetRegistrationByKey(ctx, &anotherJWK)

test.AssertError(t, err, "Registration object for invalid key was returned")

sa, _, cleanUp := initSA(t)

defer cleanUp()

_, err := sa.GetRegistration(ctx, 100)

test.AssertErrorIs(t, err, berrors.NotFound)

jwk := satest.GoodJWK()

_, err = sa.GetRegistrationByKey(ctx, jwk)

test.AssertErrorIs(t, err, berrors.NotFound)

err = sa.UpdateRegistration(ctx, core.Registration{ID: 100, Key: jwk})

test.AssertErrorIs(t, err, berrors.NotFound)

sa, clk, cleanUp := initSA(t)

defer cleanUp()

reg := satest.CreateWorkingRegistration(t, sa)

// An example cert taken from EFF's website

certDER, err := ioutil.ReadFile("www.eff.org.der")

test.AssertNotError(t, err, "Couldn't read example cert DER")

// Calling AddCertificate with a non-nil issued should succeed

issued := sa.clk.Now()

digest, err := sa.AddCertificate(ctx, certDER, reg.ID, nil, &issued)

test.AssertNotError(t, err, "Couldn't add www.eff.org.der")

test.AssertEquals(t, digest, "qWoItDZmR4P9eFbeYgXXP3SR4ApnkQj8x4LsB_ORKBo")

retrievedCert, err := sa.GetCertificate(ctx, "000000000000000000000000000000021bd4")

test.AssertNotError(t, err, "Couldn't get www.eff.org.der by full serial")

test.AssertByteEquals(t, certDER, retrievedCert.DER)

// Because nil was provided as the Issued time we expect the cert was stored

// with an issued time equal to now

test.AssertEquals(t, retrievedCert.Issued, clk.Now())

// Test cert generated locally by Boulder / CFSSL, names [example.com,

// www.example.com, admin.example.com]

certDER2, err := ioutil.ReadFile("test-cert.der")

test.AssertNotError(t, err, "Couldn't read example cert DER")

serial := "ffdd9b8a82126d96f61d378d5ba99a0474f0"

// Add the certificate with a specific issued time instead of nil

issuedTime := time.Date(2018, 4, 1, 7, 0, 0, 0, time.UTC)

digest2, err := sa.AddCertificate(ctx, certDER2, reg.ID, nil, &issuedTime)

test.AssertNotError(t, err, "Couldn't add test-cert.der")

test.AssertEquals(t, digest2, "vrlPN5wIPME1D2PPsCy-fGnTWh8dMyyYQcXPRkjHAQI")

retrievedCert2, err := sa.GetCertificate(ctx, serial)

test.AssertNotError(t, err, "Couldn't get test-cert.der")

test.AssertByteEquals(t, certDER2, retrievedCert2.DER)

// The cert should have been added with the specific issued time we provided

// as the issued field.

test.AssertEquals(t, retrievedCert2.Issued, issuedTime)

// Test adding OCSP response with cert

certDER3, err := ioutil.ReadFile("test-cert2.der")

test.AssertNotError(t, err, "Couldn't read example cert DER")

ocspResp := []byte{0, 0, 1}

_, err = sa.AddCertificate(ctx, certDER3, reg.ID, ocspResp, &issuedTime)

test.AssertNotError(t, err, "Couldn't add test-cert2.der")

sa, clk, cleanUp := initSA(t)

defer cleanUp()

// Test cert generated locally by Boulder / CFSSL, names [example.com,

// www.example.com, admin.example.com]

certDER, err := ioutil.ReadFile("test-cert.der")

test.AssertNotError(t, err, "Couldn't read example cert DER")

cert, err := x509.ParseCertificate(certDER)

test.AssertNotError(t, err, "Couldn't parse example cert DER")

// Set the test clock's time to the time from the test certificate, plus an

// hour to account for rounding.

clk.Add(time.Hour - clk.Now().Sub(cert.NotBefore))

now := clk.Now()

yesterday := clk.Now().Add(-24 * time.Hour)

twoDaysAgo := clk.Now().Add(-48 * time.Hour)

tomorrow := clk.Now().Add(24 * time.Hour)

// Count for a name that doesn't have any certs

counts, err := sa.CountCertificatesByNames(ctx, []string{"example.com"}, yesterday, now)

test.AssertNotError(t, err, "Error counting certs.")

test.AssertEquals(t, len(counts), 1)

test.AssertEquals(t, counts[0].Name, "example.com")

test.AssertEquals(t, counts[0].Count, int64(0))

// Add the test cert and query for its names.

reg := satest.CreateWorkingRegistration(t, sa)

issued := sa.clk.Now()

_, err = sa.AddCertificate(ctx, certDER, reg.ID, nil, &issued)

test.AssertNotError(t, err, "Couldn't add test-cert.der")

// Time range including now should find the cert

counts, err = sa.CountCertificatesByNames(ctx, []string{"example.com"}, yesterday, now)

test.AssertNotError(t, err, "sa.CountCertificatesByName failed")

test.AssertEquals(t, len(counts), 1)

test.AssertEquals(t, counts[0].Name, "example.com")

test.AssertEquals(t, counts[0].Count, int64(1))

// Time range between two days ago and yesterday should not.

counts, err = sa.CountCertificatesByNames(ctx, []string{"example.com"}, twoDaysAgo, yesterday)

test.AssertNotError(t, err, "Error counting certs.")

test.AssertEquals(t, len(counts), 1)

test.AssertEquals(t, counts[0].Name, "example.com")

test.AssertEquals(t, counts[0].Count, int64(0))

// Time range between now and tomorrow also should not (time ranges are

// inclusive at the tail end, but not the beginning end).

counts, err = sa.CountCertificatesByNames(ctx, []string{"example.com"}, now, tomorrow)

test.AssertNotError(t, err, "Error counting certs.")

test.AssertEquals(t, len(counts), 1)

test.AssertEquals(t, counts[0].Name, "example.com")

test.AssertEquals(t, counts[0].Count, int64(0))

// Add a second test cert (for example.co.bn) and query for multiple names.

names := []string{"example.com", "foo.com", "example.co.bn"}

// Override countCertificatesByName with an implementation of certCountFunc

// that will block forever if it's called in serial, but will succeed if

// called in parallel.

var interlocker sync.WaitGroup

interlocker.Add(len(names))

sa.parallelismPerRPC = len(names)

oldCertCountFunc := sa.countCertificatesByName

sa.countCertificatesByName = func(sel db.Selector, domain string, earliest, latest time.Time) (int, error) {

interlocker.Done()

interlocker.Wait()

return oldCertCountFunc(sel, domain, earliest, latest)

}

certDER2, err := ioutil.ReadFile("test-cert2.der")

test.AssertNotError(t, err, "Couldn't read test-cert2.der")

_, err = sa.AddCertificate(ctx, certDER2, reg.ID, nil, &issued)

test.AssertNotError(t, err, "Couldn't add test-cert2.der")

counts, err = sa.CountCertificatesByNames(ctx, names, yesterday, now.Add(10000*time.Hour))

test.AssertNotError(t, err, "Error counting certs.")

test.AssertEquals(t, len(counts), 3)

expected := map[string]int{

"example.co.bn": 1,

"foo.com": 0,

"example.com": 1,

}

for _, entry := range counts {

domain := entry.Name

actualCount := entry.Count

expectedCount := int64(expected[domain])

test.AssertEquals(t, actualCount, expectedCount)

}

sa, fc, cleanUp := initSA(t)

defer cleanUp()

contact := "mailto:foo@example.com"

// Create one IPv4 registration

_, err := sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(1), E: 1}},

Contact: &[]string{contact},

InitialIP: net.ParseIP("43.34.43.34"),

})

// Create two IPv6 registrations, both within the same /48

test.AssertNotError(t, err, "Couldn't insert registration")

_, err = sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(2), E: 1}},

Contact: &[]string{contact},

InitialIP: net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9652"),

})

test.AssertNotError(t, err, "Couldn't insert registration")

_, err = sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(3), E: 1}},

Contact: &[]string{contact},

InitialIP: net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9653"),

})

test.AssertNotError(t, err, "Couldn't insert registration")

earliest := fc.Now().Add(-time.Hour * 24)

latest := fc.Now()

// There should be 0 registrations for an IPv4 address we didn't add

// a registration for

count, err := sa.CountRegistrationsByIP(ctx, net.ParseIP("1.1.1.1"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 0)

// There should be 1 registration for the IPv4 address we did add

// a registration for

count, err = sa.CountRegistrationsByIP(ctx, net.ParseIP("43.34.43.34"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 1)

// There should be 1 registration for the first IPv6 address we added

// a registration for

count, err = sa.CountRegistrationsByIP(ctx, net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9652"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 1)

// There should be 1 registration for the second IPv6 address we added

// a registration for as well

count, err = sa.CountRegistrationsByIP(ctx, net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9653"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 1)

// There should be 0 registrations for an IPv6 address in the same /48 as the

// two IPv6 addresses with registrations

count, err = sa.CountRegistrationsByIP(ctx, net.ParseIP("2001:cdba:1234:0000:0000:0000:0000:0000"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 0)

sa, fc, cleanUp := initSA(t)

defer cleanUp()

contact := "mailto:foo@example.com"

// Create one IPv4 registration

_, err := sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(1), E: 1}},

Contact: &[]string{contact},

InitialIP: net.ParseIP("43.34.43.34"),

})

// Create two IPv6 registrations, both within the same /48

test.AssertNotError(t, err, "Couldn't insert registration")

_, err = sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(2), E: 1}},

Contact: &[]string{contact},

InitialIP: net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9652"),

})

test.AssertNotError(t, err, "Couldn't insert registration")

_, err = sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(3), E: 1}},

Contact: &[]string{contact},

InitialIP: net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9653"),

})

test.AssertNotError(t, err, "Couldn't insert registration")

earliest := fc.Now().Add(-time.Hour * 24)

latest := fc.Now()

// There should be 0 registrations in the range for an IPv4 address we didn't

// add a registration for

count, err := sa.CountRegistrationsByIPRange(ctx, net.ParseIP("1.1.1.1"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 0)

// There should be 1 registration in the range for the IPv4 address we did

// add a registration for

count, err = sa.CountRegistrationsByIPRange(ctx, net.ParseIP("43.34.43.34"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 1)

// There should be 2 registrations in the range for the first IPv6 address we added

// a registration for because it's in the same /48

count, err = sa.CountRegistrationsByIPRange(ctx, net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9652"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 2)

// There should be 2 registrations in the range for the second IPv6 address

// we added a registration for as well, because it too is in the same /48

count, err = sa.CountRegistrationsByIPRange(ctx, net.ParseIP("2001:cdba:1234:5678:9101:1121:3257:9653"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 2)

// There should also be 2 registrations in the range for an arbitrary IPv6 address in

// the same /48 as the registrations we added

count, err = sa.CountRegistrationsByIPRange(ctx, net.ParseIP("2001:cdba:1234:0000:0000:0000:0000:0000"), earliest, latest)

test.AssertNotError(t, err, "Failed to count registrations")

test.AssertEquals(t, count, 2)

sa, fc, cleanUp := initSA(t)

defer cleanUp()

tx, err := sa.dbMap.Begin()

test.AssertNotError(t, err, "Failed to open transaction")

names := []string{"a.example.com", "B.example.com"}

expires := fc.Now().Add(time.Hour * 2).UTC()

issued := fc.Now()

err = addFQDNSet(tx, names, "serial", issued, expires)

test.AssertNotError(t, err, "Failed to add name set")

test.AssertNotError(t, tx.Commit(), "Failed to commit transaction")

// only one valid

threeHours := time.Hour * 3

count, err := sa.CountFQDNSets(ctx, threeHours, names)

test.AssertNotError(t, err, "Failed to count name sets")

test.AssertEquals(t, count, int64(1))

// check hash isn't affected by changing name order/casing

count, err = sa.CountFQDNSets(ctx, threeHours, []string{"b.example.com", "A.example.COM"})

test.AssertNotError(t, err, "Failed to count name sets")

test.AssertEquals(t, count, int64(1))

// add another valid set

tx, err = sa.dbMap.Begin()

test.AssertNotError(t, err, "Failed to open transaction")

err = addFQDNSet(tx, names, "anotherSerial", issued, expires)

test.AssertNotError(t, err, "Failed to add name set")

test.AssertNotError(t, tx.Commit(), "Failed to commit transaction")

// only two valid

count, err = sa.CountFQDNSets(ctx, threeHours, names)

test.AssertNotError(t, err, "Failed to count name sets")

test.AssertEquals(t, count, int64(2))

// add an expired set

tx, err = sa.dbMap.Begin()

test.AssertNotError(t, err, "Failed to open transaction")

err = addFQDNSet(

tx,

names,

"yetAnotherSerial",

issued.Add(-threeHours),

expires.Add(-threeHours),

)

test.AssertNotError(t, err, "Failed to add name set")

test.AssertNotError(t, tx.Commit(), "Failed to commit transaction")

// only two valid

count, err = sa.CountFQDNSets(ctx, threeHours, names)

test.AssertNotError(t, err, "Failed to count name sets")

test.AssertEquals(t, count, int64(2))

sa, fc, cleanUp := initSA(t)

defer cleanUp()

names := []string{"a.example.com", "B.example.com"}

exists, err := sa.FQDNSetExists(ctx, names)

test.AssertNotError(t, err, "Failed to check FQDN set existence")

test.Assert(t, !exists, "FQDN set shouldn't exist")

tx, err := sa.dbMap.Begin()

test.AssertNotError(t, err, "Failed to open transaction")

expires := fc.Now().Add(time.Hour * 2).UTC()

issued := fc.Now()

err = addFQDNSet(tx, names, "serial", issued, expires)

test.AssertNotError(t, err, "Failed to add name set")

test.AssertNotError(t, tx.Commit(), "Failed to commit transaction")

exists, err = sa.FQDNSetExists(ctx, names)

test.AssertNotError(t, err, "Failed to check FQDN set existence")

test.Assert(t, exists, "FQDN set does exist")

e.query = query

e.args = args

return nil, nil

serial := big.NewInt(1)

expectedSerial := "000000000000000000000000000000000001"

notBefore := time.Date(2018, 2, 14, 12, 0, 0, 0, time.UTC)

placeholdersPerName := "(?, ?, ?, ?)"

baseQuery := "INSERT INTO issuedNames (reversedName, serial, notBefore, renewal) VALUES"

testCases := []struct {

Name string

IssuedNames []string

SerialNumber *big.Int

NotBefore time.Time

Renewal bool

ExpectedArgs []interface{}

}{

{

Name: "One domain, not a renewal",

IssuedNames: []string{"example.co.uk"},

SerialNumber: serial,

NotBefore: notBefore,

Renewal: false,

ExpectedArgs: []interface{}{

"uk.co.example",

expectedSerial,

notBefore,

false,

},

},

{

Name: "Two domains, not a renewal",

IssuedNames: []string{"example.co.uk", "example.xyz"},

SerialNumber: serial,

NotBefore: notBefore,

Renewal: false,

ExpectedArgs: []interface{}{

"uk.co.example",

expectedSerial,

notBefore,

false,

"xyz.example",

expectedSerial,

notBefore,

false,

},

},

{

Name: "One domain, renewal",

IssuedNames: []string{"example.co.uk"},

SerialNumber: serial,

NotBefore: notBefore,

Renewal: true,

ExpectedArgs: []interface{}{

"uk.co.example",

expectedSerial,

notBefore,

true,

},

},

{

Name: "Two domains, renewal",

IssuedNames: []string{"example.co.uk", "example.xyz"},

SerialNumber: serial,

NotBefore: notBefore,

Renewal: true,

ExpectedArgs: []interface{}{

"uk.co.example",

expectedSerial,

notBefore,

true,

"xyz.example",

expectedSerial,

notBefore,

true,

},

},

}

for _, tc := range testCases {

t.Run(tc.Name, func(t *testing.T) {

var e execRecorder

err := addIssuedNames(

&e,

&x509.Certificate{

DNSNames: tc.IssuedNames,

SerialNumber: tc.SerialNumber,

NotBefore: tc.NotBefore,

},

tc.Renewal)

test.AssertNotError(t, err, "addIssuedNames failed")

expectedPlaceholders := placeholdersPerName

for i := 0; i < len(tc.IssuedNames)-1; i++ {

expectedPlaceholders = fmt.Sprintf("%s, %s", expectedPlaceholders, placeholdersPerName)

}

expectedQuery := fmt.Sprintf("%s %s;", baseQuery, expectedPlaceholders)

test.AssertEquals(t, e.query, expectedQuery)

if !reflect.DeepEqual(e.args, tc.ExpectedArgs) {

t.Errorf("Wrong args: got\n%#v, expected\n%#v", e.args, tc.ExpectedArgs)

}

})

}

sa, _, cleanUp := initSA(t)

defer cleanUp()

reg := satest.CreateWorkingRegistration(t, sa)

// An example cert taken from EFF's website

certDER, err := ioutil.ReadFile("www.eff.org.der")

test.AssertNotError(t, err, "reading cert DER")

issued := sa.clk.Now()

_, err = sa.AddPrecertificate(ctx, &sapb.AddCertificateRequest{

Der: certDER,

Issued: issued.UnixNano(),

RegID: reg.ID,

IssuerID: 1,

})

test.AssertNotError(t, err, "Failed to add precertificate")

_, err = sa.AddCertificate(ctx, certDER, reg.ID, nil, &issued)

test.AssertNotError(t, err, "calling AddCertificate")

cases := []struct {

name string

domain string

regID int64

expected bool

}{

{"matches", "www.eff.org", reg.ID, true},

{"wrongDomain", "wwoof.org", reg.ID, false},

{"wrongAccount", "www.eff.org", 3333, false},

}

for _, testCase := range cases {

t.Run(testCase.name, func(t *testing.T) {

exists, err := sa.PreviousCertificateExists(context.Background(),

&sapb.PreviousCertificateExistsRequest{

Domain: testCase.domain,

RegID: testCase.regID,

})

test.AssertNotError(t, err, "calling PreviousCertificateExists")

if exists.Exists != testCase.expected {

t.Errorf("wanted %v got %v", testCase.expected, exists.Exists)

}

})

}

sa, fc, cleanUp := initSA(t)

defer cleanUp()

// deactivate a pending authorization

expires := fc.Now().Add(time.Hour).UTC()

attemptedAt := fc.Now()

authzID := createPendingAuthorization(t, sa, "example.com", expires)

_, err := sa.DeactivateAuthorization2(context.Background(), &sapb.AuthorizationID2{Id: authzID})

test.AssertNotError(t, err, "sa.DeactivateAuthorization2 failed")

// deactivate a valid authorization"

authzID = createFinalizedAuthorization(t, sa, "example.com", expires, "valid", attemptedAt)

_, err = sa.DeactivateAuthorization2(context.Background(), &sapb.AuthorizationID2{Id: authzID})

test.AssertNotError(t, err, "sa.DeactivateAuthorization2 failed")

sa, _, cleanUp := initSA(t)

defer cleanUp()

reg := satest.CreateWorkingRegistration(t, sa)

err := sa.DeactivateRegistration(context.Background(), reg.ID)

test.AssertNotError(t, err, "DeactivateRegistration failed")

dbReg, err := sa.GetRegistration(context.Background(), reg.ID)

test.AssertNotError(t, err, "GetRegistration failed")

test.AssertEquals(t, dbReg.Status, core.StatusDeactivated)

testCases := []struct {

inputDomain string

inputReversed string

}{

{"", ""},

{"...", "..."},

{"com", "com"},

{"example.com", "com.example"},

{"www.example.com", "com.example.www"},

{"world.wide.web.example.com", "com.example.web.wide.world"},

}

for _, tc := range testCases {

output := ReverseName(tc.inputDomain)

test.AssertEquals(t, output, tc.inputReversed)

}

Serial string

Names []string

ExpectedHash setHash

Issued time.Time

Expires time.Time

namesA := []string{"a.example.com", "B.example.com"}

namesB := []string{"example.org"}

namesC := []string{"letsencrypt.org"}

expectedHashA := setHash{0x92, 0xc7, 0xf2, 0x47, 0xbd, 0x1e, 0xea, 0x8d, 0x52, 0x7f, 0xb0, 0x59, 0x19, 0xe9, 0xbe, 0x81, 0x78, 0x88, 0xe6, 0xf7, 0x55, 0xf0, 0x1c, 0xc9, 0x63, 0x15, 0x5f, 0x8e, 0x52, 0xae, 0x95, 0xc1}

expectedHashB := setHash{0xbf, 0xab, 0xc3, 0x74, 0x32, 0x95, 0x8b, 0x6, 0x33, 0x60, 0xd3, 0xad, 0x64, 0x61, 0xc9, 0xc4, 0x73, 0x5a, 0xe7, 0xf8, 0xed, 0xd4, 0x65, 0x92, 0xa5, 0xe0, 0xf0, 0x14, 0x52, 0xb2, 0xe4, 0xb5}

expectedHashC := setHash{0xf2, 0xbb, 0x7b, 0xab, 0x8, 0x2c, 0x18, 0xee, 0x8, 0x97, 0x17, 0xbe, 0x67, 0xd7, 0x12, 0x14, 0xaa, 0x4, 0xac, 0xe2, 0x29, 0x2a, 0x67, 0x2c, 0x37, 0x2c, 0xf3, 0x33, 0xe1, 0xb0, 0xd8, 0xe7}

now := fc.Now()

testcases := map[string]fqdnTestcase{

// One test case with serial "a" issued now and expiring in two hours for

// namesA

"a": {

Serial: "a",

Names: namesA,

ExpectedHash: expectedHashA,

Issued: now,

Expires: now.Add(time.Hour * 2).UTC(),

},

// One test case with serial "b", issued one hour from now and expiring in

// two hours, also for namesA

"b": {

Serial: "b",

Names: namesA,

ExpectedHash: expectedHashA,

Issued: now.Add(time.Hour),

Expires: now.Add(time.Hour * 2).UTC(),

},

// One test case with serial "c", issued one hour from now and expiring in

// two hours, for namesB

"c": {

Serial: "c",

Names: namesB,

ExpectedHash: expectedHashB,

Issued: now.Add(time.Hour),

Expires: now.Add(time.Hour * 2).UTC(),

},

// One test case with serial "d", issued five hours in the past and expiring

// in two hours from now, with namesC

"d": {

Serial: "d",

Names: namesC,

ExpectedHash: expectedHashC,

Issued: now.Add(-5 * time.Hour),

Expires: now.Add(time.Hour * 2).UTC(),

},

}

for _, tc := range testcases {

tx, err := db.Begin()

test.AssertNotError(t, err, "Failed to open transaction")

err = addFQDNSet(tx, tc.Names, tc.Serial, tc.Issued, tc.Expires)

test.AssertNotError(t, err, fmt.Sprintf("Failed to add fqdnSet for %#v", tc))

test.AssertNotError(t, tx.Commit(), "Failed to commit transaction")

}

return testcases

sa, fc, cleanUp := initSA(t)

defer cleanUp()

// Add the test fqdn sets

testcases := setupFQDNSets(t, sa.dbMap, fc)

// Asking for the fqdnSets for no serials should produce an error since this

// is not expected in normal conditions

fqdnSets, err := sa.getFQDNSetsBySerials(sa.dbMap, []string{})

test.AssertError(t, err, "No error calling getFQDNSetsBySerials for empty serials")

test.AssertEquals(t, len(fqdnSets), 0)

// Asking for the fqdnSets for serials that don't exist should return nothing

fqdnSets, err = sa.getFQDNSetsBySerials(sa.dbMap, []string{"this", "doesn't", "exist"})

test.AssertNotError(t, err, "Error calling getFQDNSetsBySerials for non-existent serials")

test.AssertEquals(t, len(fqdnSets), 0)

// Asking for the fqdnSets for serial "a" should return the expectedHashA hash

fqdnSets, err = sa.getFQDNSetsBySerials(sa.dbMap, []string{"a"})

test.AssertNotError(t, err, "Error calling getFQDNSetsBySerials for serial \"a\"")

test.AssertEquals(t, len(fqdnSets), 1)

test.AssertEquals(t, string(fqdnSets[0]), string(testcases["a"].ExpectedHash))

// Asking for the fqdnSets for serial "b" should return the expectedHashA hash

// because cert "b" has namesA subjects

fqdnSets, err = sa.getFQDNSetsBySerials(sa.dbMap, []string{"b"})

test.AssertNotError(t, err, "Error calling getFQDNSetsBySerials for serial \"b\"")

test.AssertEquals(t, len(fqdnSets), 1)

test.AssertEquals(t, string(fqdnSets[0]), string(testcases["b"].ExpectedHash))

// Asking for the fqdnSets for serial "d" should return the expectedHashC hash

// because cert "d" has namesC subjects

fqdnSets, err = sa.getFQDNSetsBySerials(sa.dbMap, []string{"d"})

test.AssertNotError(t, err, "Error calling getFQDNSetsBySerials for serial \"d\"")

test.AssertEquals(t, len(fqdnSets), 1)

test.AssertEquals(t, string(fqdnSets[0]), string(testcases["d"].ExpectedHash))

// Asking for the fqdnSets for serial "c" should return the expectedHashB hash

// because cert "c" has namesB subjects

fqdnSets, err = sa.getFQDNSetsBySerials(sa.dbMap, []string{"c"})

test.AssertNotError(t, err, "Error calling getFQDNSetsBySerials for serial \"c\"")

test.AssertEquals(t, len(fqdnSets), 1)

test.AssertEquals(t, string(fqdnSets[0]), string(testcases["c"].ExpectedHash))

// Asking for the fqdnSets for serial "a", "b", "c" and "made up" should return

// the three expected hashes - two expectedHashA (for "a" and "b"), one

// expectedHashB (for "c")

expectedHashes := map[string]int{

string(testcases["a"].ExpectedHash): 2,

string(testcases["c"].ExpectedHash): 1,

}

fqdnSets, err = sa.getFQDNSetsBySerials(sa.dbMap, []string{"a", "b", "c", "made up"})

test.AssertNotError(t, err, "Error calling getFQDNSetsBySerials for serial \"a\", \"b\", \"c\", \"made up\"")

for _, setHash := range fqdnSets {

setHashKey := string(setHash)

if _, present := expectedHashes[setHashKey]; !present {

t.Errorf("Unexpected setHash in results: %#v", setHash)

}

expectedHashes[setHashKey]--

if expectedHashes[setHashKey] <= 0 {

delete(expectedHashes, setHashKey)

}

}

if len(expectedHashes) != 0 {

t.Errorf("Some expected setHashes were not observed: %#v", expectedHashes)

}

sa, fc, cleanUp := initSA(t)

defer cleanUp()

// Add the test fqdn sets

testcases := setupFQDNSets(t, sa.dbMap, fc)

// Use one hour ago as the earliest cut off

earliest := fc.Now().Add(-time.Hour)

// Calling getNewIssuancesByFQDNSet with an empty FQDNSet should error

count, err := sa.getNewIssuancesByFQDNSet(sa.dbMap, nil, earliest)

test.AssertError(t, err, "No error calling getNewIssuancesByFQDNSet for empty fqdn set")

test.AssertEquals(t, count, -1)

// Calling getNewIssuancesByFQDNSet with FQDNSet hashes that don't exist

// should return 0

count, err = sa.getNewIssuancesByFQDNSet(sa.dbMap, []setHash{{0xC0, 0xFF, 0xEE}, {0x13, 0x37}}, earliest)

test.AssertNotError(t, err, "Error calling getNewIssuancesByFQDNSet for non-existent set hashes")

test.AssertEquals(t, count, 0)

// Calling getNewIssuancesByFQDNSet with the "a" expected hash should return

// 1, since both testcase "b" was a renewal of testcase "a"

count, err = sa.getNewIssuancesByFQDNSet(sa.dbMap, []setHash{testcases["a"].ExpectedHash}, earliest)

test.AssertNotError(t, err, "Error calling getNewIssuancesByFQDNSet for testcase a")

test.AssertEquals(t, count, 1)

// Calling getNewIssuancesByFQDNSet with the "c" expected hash should return

// 1, since there is only one issuance for this sethash

count, err = sa.getNewIssuancesByFQDNSet(sa.dbMap, []setHash{testcases["c"].ExpectedHash}, earliest)

test.AssertNotError(t, err, "Error calling getNewIssuancesByFQDNSet for testcase c")

test.AssertEquals(t, count, 1)

// Calling getNewIssuancesByFQDNSet with the "c" and "d" expected hashes should return

// only 1, since there is only one issuance for the provided set hashes that

// is within the earliest window. The issuance for "d" was too far in the past

// to be counted

count, err = sa.getNewIssuancesByFQDNSet(sa.dbMap, []setHash{testcases["c"].ExpectedHash, testcases["d"].ExpectedHash}, earliest)

test.AssertNotError(t, err, "Error calling getNewIssuancesByFQDNSet for testcase c and d")

test.AssertEquals(t, count, 1)

// But by moving the earliest point behind the "d" issuance, we should now get a count of 2

count, err = sa.getNewIssuancesByFQDNSet(sa.dbMap, []setHash{testcases["c"].ExpectedHash, testcases["d"].ExpectedHash}, earliest.Add(-6*time.Hour))

test.AssertNotError(t, err, "Error calling getNewIssuancesByFQDNSet for testcase c and d with adjusted earliest")

test.AssertEquals(t, count, 2)

sa, _, cleanup := initSA(t)

defer cleanup()

// Create a test registration to reference

reg, err := sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(1), E: 1}},

InitialIP: net.ParseIP("42.42.42.42"),

})

test.AssertNotError(t, err, "Couldn't create test registration")

order, err := sa.NewOrder(context.Background(), &corepb.Order{

RegistrationID: reg.ID,

Expires: 1,

Names: []string{"example.com", "just.another.example.com"},

V2Authorizations: []int64{1, 2, 3},

Status: string(core.StatusPending),

})

test.AssertNotError(t, err, "sa.NewOrder failed")

test.AssertEquals(t, order.Id, int64(1))

var authzIDs []int64

_, err = sa.dbMap.Select(&authzIDs, "SELECT authzID FROM orderToAuthz2 WHERE orderID = ?;", order.Id)

test.AssertNotError(t, err, "Failed to count orderToAuthz entries")

test.AssertEquals(t, len(authzIDs), 3)

test.AssertDeepEquals(t, authzIDs, []int64{1, 2, 3})

names, err := sa.namesForOrder(context.Background(), order.Id)

test.AssertNotError(t, err, "namesForOrder errored")

test.AssertEquals(t, len(names), 2)

test.AssertDeepEquals(t, names, []string{"com.example", "com.example.another.just"})

names, err = sa.namesForOrder(context.Background(), order.Id)

test.AssertNotError(t, err, "namesForOrder errored")

test.AssertEquals(t, len(names), 2)

test.AssertDeepEquals(t, names, []string{"com.example", "com.example.another.just"})

sa, fc, cleanup := initSA(t)

defer cleanup()

// Create a test registration to reference

reg, err := sa.NewRegistration(ctx, core.Registration{

Key: &jose.JSONWebKey{Key: &rsa.PublicKey{N: big.NewInt(1), E: 1}},

InitialIP: net.ParseIP("42.42.42.42"),

})

test.AssertNotError(t, err, "Couldn't create test registration")

// Add one valid authz

expires := fc.Now().Add(time.Hour)

attemptedAt := fc.Now()

authzID := createFinalizedAuthorization(t, sa, "example.com", expires, "valid", attemptedAt)

order := &corepb.Order{

RegistrationID: reg.ID,

Expires: sa.clk.Now().Add(365 * 24 * time.Hour).UnixNano(),

Names: []string{"example.com"},

V2Authorizations: []int64{authzID},

}

// Add a new order in pending status with no certificate serial

order, err = sa.NewOrder(context.Background(), order)

test.AssertNotError(t, err, "NewOrder failed")

// Set the order to be processing

err = sa.SetOrderProcessing(context.Background(), order)

test.AssertNotError(t, err, "SetOrderProcessing failed")

// Read the order by ID from the DB to check the status was correctly updated

// to processing

updatedOrder, err := sa.GetOrder(

context.Background(),

&sapb.OrderRequest{Id: order.Id})

test.AssertNotError(t, err, "GetOrder failed")

test.AssertEquals(t, updatedOrder.Status, string(core.StatusProcessing))

test.AssertEquals(t, updatedOrder.BeganProcessing, true)

// Try to set the same order to be processing again. We should get an error.

err = sa.SetOrderProcessing(context.Background(), order)

test.AssertError(t, err, "Set the same order processing twice. This should have been an error.")

test.AssertErrorIs(t, err, berrors.OrderNotReady)

sa, fc, cleanup := initSA(t)

defer cleanup()