446 lines
17 KiB
Diff
446 lines
17 KiB
Diff
From 0f77b359e241fc4055fb8d785e18f96338451ebf Mon Sep 17 00:00:00 2001
|
|
From: Mohammad Rizwan <myusuf@redhat.com>
|
|
Date: Mon, 6 Feb 2023 15:31:27 +0530
|
|
Subject: [PATCH] ipatests: tests for certificate pruning
|
|
|
|
1. Test to prune the expired certificate by manual run
|
|
2. Test to prune expired certificate by cron job
|
|
3. Test to prune expired certificate with retention unit option
|
|
4. Test to prune expired certificate with search size limit option
|
|
5. Test to check config-show command shows set param
|
|
6. Test prune command shows proper status after disabling the pruning
|
|
|
|
related: https://pagure.io/freeipa/issue/9294
|
|
|
|
Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
|
|
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
---
|
|
ipatests/test_integration/test_acme.py | 306 +++++++++++++++++++++----
|
|
1 file changed, 260 insertions(+), 46 deletions(-)
|
|
|
|
diff --git a/ipatests/test_integration/test_acme.py b/ipatests/test_integration/test_acme.py
|
|
index 5ceba05976059de69414a79634d98045c3ab68bb..1334be52f4530dd8b2a4207744146cd0eb5477a3 100644
|
|
--- a/ipatests/test_integration/test_acme.py
|
|
+++ b/ipatests/test_integration/test_acme.py
|
|
@@ -122,21 +122,23 @@ def certbot_register(host, acme_server):
|
|
)
|
|
|
|
|
|
-def certbot_standalone_cert(host, acme_server):
|
|
+def certbot_standalone_cert(host, acme_server, no_of_cert=1):
|
|
"""method to issue a certbot's certonly standalone cert"""
|
|
# Get a cert from ACME service using HTTP challenge and Certbot's
|
|
# standalone HTTP server mode
|
|
host.run_command(['systemctl', 'stop', 'httpd'])
|
|
- host.run_command(
|
|
- [
|
|
- 'certbot',
|
|
- '--server', acme_server,
|
|
- 'certonly',
|
|
- '--domain', host.hostname,
|
|
- '--standalone',
|
|
- '--key-type', 'rsa',
|
|
- ]
|
|
- )
|
|
+ for _i in range(0, no_of_cert):
|
|
+ host.run_command(
|
|
+ [
|
|
+ 'certbot',
|
|
+ '--server', acme_server,
|
|
+ 'certonly',
|
|
+ '--domain', host.hostname,
|
|
+ '--standalone',
|
|
+ '--key-type', 'rsa',
|
|
+ '--force-renewal'
|
|
+ ]
|
|
+ )
|
|
|
|
|
|
class TestACME(CALessBase):
|
|
@@ -573,43 +575,41 @@ class TestACMEwithExternalCA(TestACME):
|
|
tasks.install_replica(cls.master, cls.replicas[0])
|
|
|
|
|
|
-class TestACMERenew(IntegrationTest):
|
|
-
|
|
- num_clients = 1
|
|
+@pytest.fixture
|
|
+def issue_and_expire_acme_cert():
|
|
+ """Fixture to expire cert by moving date past expiry of acme cert"""
|
|
+ hosts = []
|
|
|
|
- @classmethod
|
|
- def install(cls, mh):
|
|
-
|
|
- # install packages before client install in case of IPA DNS problems
|
|
- cls.acme_server = prepare_acme_client(cls.master, cls.clients[0])
|
|
+ def _issue_and_expire_acme_cert(
|
|
+ master, client,
|
|
+ acme_server_url, no_of_cert=1
|
|
+ ):
|
|
|
|
- tasks.install_master(cls.master, setup_dns=True)
|
|
- tasks.install_client(cls.master, cls.clients[0])
|
|
+ hosts.append(master)
|
|
+ hosts.append(client)
|
|
|
|
- @pytest.fixture
|
|
- def issue_and_expire_cert(self):
|
|
- """Fixture to expire cert by moving date past expiry of acme cert"""
|
|
# enable the ACME service on master
|
|
- self.master.run_command(['ipa-acme-manage', 'enable'])
|
|
+ master.run_command(['ipa-acme-manage', 'enable'])
|
|
|
|
# register the account with certbot
|
|
- certbot_register(self.clients[0], self.acme_server)
|
|
+ certbot_register(client, acme_server_url)
|
|
|
|
# request a standalone acme cert
|
|
- certbot_standalone_cert(self.clients[0], self.acme_server)
|
|
+ certbot_standalone_cert(client, acme_server_url, no_of_cert)
|
|
|
|
# move system date to expire acme cert
|
|
- for host in self.clients[0], self.master:
|
|
+ for host in hosts:
|
|
tasks.kdestroy_all(host)
|
|
tasks.move_date(host, 'stop', '+90days')
|
|
|
|
+ time.sleep(10)
|
|
tasks.get_kdcinfo(host)
|
|
# Note raiseonerr=False:
|
|
# the assert is located after kdcinfo retrieval.
|
|
- result = host.run_command(
|
|
+ result = master.run_command(
|
|
"KRB5_TRACE=/dev/stdout kinit admin",
|
|
stdin_text='{0}\n{0}\n{0}\n'.format(
|
|
- self.clients[0].config.admin_password
|
|
+ master.config.admin_password
|
|
),
|
|
raiseonerr=False
|
|
)
|
|
@@ -618,16 +618,28 @@ class TestACMERenew(IntegrationTest):
|
|
tasks.get_kdcinfo(host)
|
|
assert result.returncode == 0
|
|
|
|
- yield
|
|
+ yield _issue_and_expire_acme_cert
|
|
|
|
- # move back date
|
|
- for host in self.clients[0], self.master:
|
|
- tasks.kdestroy_all(host)
|
|
- tasks.move_date(host, 'start', '-90days')
|
|
- tasks.kinit_admin(host)
|
|
+ # move back date
|
|
+ for host in hosts:
|
|
+ tasks.move_date(host, 'start', '-90days')
|
|
+
|
|
+
|
|
+class TestACMERenew(IntegrationTest):
|
|
+
|
|
+ num_clients = 1
|
|
+
|
|
+ @classmethod
|
|
+ def install(cls, mh):
|
|
+
|
|
+ # install packages before client install in case of IPA DNS problems
|
|
+ cls.acme_server = prepare_acme_client(cls.master, cls.clients[0])
|
|
+
|
|
+ tasks.install_master(cls.master, setup_dns=True)
|
|
+ tasks.install_client(cls.master, cls.clients[0])
|
|
|
|
@pytest.mark.skipif(skip_certbot_tests, reason='certbot not available')
|
|
- def test_renew(self, issue_and_expire_cert):
|
|
+ def test_renew(self, issue_and_expire_acme_cert):
|
|
"""Test if ACME renews the issued cert with cerbot
|
|
|
|
This test is to check if ACME certificate renews upon
|
|
@@ -635,6 +647,8 @@ class TestACMERenew(IntegrationTest):
|
|
|
|
related: https://pagure.io/freeipa/issue/4751
|
|
"""
|
|
+ issue_and_expire_acme_cert(
|
|
+ self.master, self.clients[0], self.acme_server)
|
|
data = self.clients[0].get_file_contents(
|
|
f'/etc/letsencrypt/live/{self.clients[0].hostname}/cert.pem'
|
|
)
|
|
@@ -656,6 +670,7 @@ class TestACMEPrune(IntegrationTest):
|
|
"""Validate that ipa-acme-manage configures dogtag for pruning"""
|
|
|
|
random_serial = True
|
|
+ num_clients = 1
|
|
|
|
@classmethod
|
|
def install(cls, mh):
|
|
@@ -663,6 +678,8 @@ class TestACMEPrune(IntegrationTest):
|
|
raise pytest.skip("RNSv3 not supported")
|
|
tasks.install_master(cls.master, setup_dns=True,
|
|
random_serial=True)
|
|
+ cls.acme_server = prepare_acme_client(cls.master, cls.clients[0])
|
|
+ tasks.install_client(cls.master, cls.clients[0])
|
|
|
|
@classmethod
|
|
def uninstall(cls, mh):
|
|
@@ -718,7 +735,7 @@ class TestACMEPrune(IntegrationTest):
|
|
['ipa-acme-manage', 'pruning',
|
|
'--requestretention=60',
|
|
'--requestretentionunit=minute',
|
|
- '--requestresearchsizelimit=2000',
|
|
+ '--requestsearchsizelimit=2000',
|
|
'--requestsearchtimelimit=5',]
|
|
)
|
|
cs_cfg = self.master.get_file_contents(paths.CA_CS_CFG_PATH)
|
|
@@ -741,7 +758,7 @@ class TestACMEPrune(IntegrationTest):
|
|
|
|
self.master.run_command(
|
|
['ipa-acme-manage', 'pruning',
|
|
- '--cron="0 23 1 * *',]
|
|
+ '--cron=0 23 1 * *',]
|
|
)
|
|
cs_cfg = self.master.get_file_contents(paths.CA_CS_CFG_PATH)
|
|
assert (
|
|
@@ -760,7 +777,7 @@ class TestACMEPrune(IntegrationTest):
|
|
'--enable', '--disable'],
|
|
raiseonerr=False
|
|
)
|
|
- assert result.returncode == 1
|
|
+ assert result.returncode == 2
|
|
assert "Cannot both enable and disable" in result.stderr_text
|
|
|
|
for cmd in ('--config-show', '--run'):
|
|
@@ -769,20 +786,20 @@ class TestACMEPrune(IntegrationTest):
|
|
cmd, '--enable'],
|
|
raiseonerr=False
|
|
)
|
|
- assert result.returncode == 1
|
|
+ assert result.returncode == 2
|
|
assert "Cannot change and show config" in result.stderr_text
|
|
|
|
result = self.master.run_command(
|
|
['ipa-acme-manage', 'pruning',
|
|
- '--cron="* *"'],
|
|
+ '--cron=* *'],
|
|
raiseonerr=False
|
|
)
|
|
- assert result.returncode == 1
|
|
- assert "Invalid format format --cron" in result.stderr_text
|
|
+ assert result.returncode == 2
|
|
+ assert "Invalid format for --cron" in result.stderr_text
|
|
|
|
result = self.master.run_command(
|
|
['ipa-acme-manage', 'pruning',
|
|
- '--cron="100 * * * *"'],
|
|
+ '--cron=100 * * * *'],
|
|
raiseonerr=False
|
|
)
|
|
assert result.returncode == 1
|
|
@@ -790,8 +807,205 @@ class TestACMEPrune(IntegrationTest):
|
|
|
|
result = self.master.run_command(
|
|
['ipa-acme-manage', 'pruning',
|
|
- '--cron="10 1-5 * * *"'],
|
|
+ '--cron=10 1-5 * * *'],
|
|
raiseonerr=False
|
|
)
|
|
assert result.returncode == 1
|
|
assert "1-5 ranges are not supported" in result.stderr_text
|
|
+
|
|
+ def test_prune_cert_manual(self, issue_and_expire_acme_cert):
|
|
+ """Test to prune expired certificate by manual run"""
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('11.3.0')):
|
|
+ raise pytest.skip("Certificate pruning is not available")
|
|
+
|
|
+ issue_and_expire_acme_cert(
|
|
+ self.master, self.clients[0], self.acme_server)
|
|
+
|
|
+ # check that the certificate issued for the client
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname]
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' in result.stdout_text
|
|
+
|
|
+ # run prune command manually
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--enable'])
|
|
+ self.master.run_command(['ipactl', 'restart'])
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--run'])
|
|
+ # wait for cert to get prune
|
|
+ time.sleep(50)
|
|
+
|
|
+ # check if client cert is removed
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname],
|
|
+ raiseonerr=False
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' not in result.stdout_text
|
|
+
|
|
+ def test_prune_cert_cron(self, issue_and_expire_acme_cert):
|
|
+ """Test to prune expired certificate by cron job"""
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('11.3.0')):
|
|
+ raise pytest.skip("Certificate pruning is not available")
|
|
+
|
|
+ issue_and_expire_acme_cert(
|
|
+ self.master, self.clients[0], self.acme_server)
|
|
+
|
|
+ # check that the certificate issued for the client
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname]
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' in result.stdout_text
|
|
+
|
|
+ # enable pruning
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--enable'])
|
|
+
|
|
+ # cron would be set to run the next minute
|
|
+ cron_minute = self.master.run_command(
|
|
+ [
|
|
+ "python3",
|
|
+ "-c",
|
|
+ (
|
|
+ "from datetime import datetime; "
|
|
+ "print(int(datetime.now().strftime('%M')) + 5)"
|
|
+ ),
|
|
+ ]
|
|
+ ).stdout_text.strip()
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ f'--cron={cron_minute} * * * *']
|
|
+ )
|
|
+ self.master.run_command(['ipactl', 'restart'])
|
|
+ # wait for 5 minutes to cron to execute and 20 sec for just in case
|
|
+ time.sleep(320)
|
|
+
|
|
+ # check if client cert is removed
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname],
|
|
+ raiseonerr=False
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' not in result.stdout_text
|
|
+
|
|
+ def test_prune_cert_retention_unit(self, issue_and_expire_acme_cert):
|
|
+ """Test to prune expired certificate with retention unit option"""
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('11.3.0')):
|
|
+ raise pytest.skip("Certificate pruning is not available")
|
|
+ issue_and_expire_acme_cert(
|
|
+ self.master, self.clients[0], self.acme_server)
|
|
+
|
|
+ # check that the certificate issued for the client
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname]
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' in result.stdout_text
|
|
+
|
|
+ # enable pruning
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--enable'])
|
|
+
|
|
+ # certretention set to 5 min
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--certretention=5', '--certretentionunit=minute']
|
|
+ )
|
|
+ self.master.run_command(['ipactl', 'restart'])
|
|
+
|
|
+ # wait for 5 min and check if expired cert is removed
|
|
+ time.sleep(310)
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--run'])
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname],
|
|
+ raiseonerr=False
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' not in result.stdout_text
|
|
+
|
|
+ def test_prune_cert_search_size_limit(self, issue_and_expire_acme_cert):
|
|
+ """Test to prune expired certificate with search size limit option"""
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('11.3.0')):
|
|
+ raise pytest.skip("Certificate pruning is not available")
|
|
+ no_of_cert = 10
|
|
+ search_size_limit = 5
|
|
+ issue_and_expire_acme_cert(
|
|
+ self.master, self.clients[0], self.acme_server, no_of_cert)
|
|
+
|
|
+ # check that the certificate issued for the client
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname]
|
|
+ )
|
|
+ assert f'CN={self.clients[0].hostname}' in result.stdout_text
|
|
+ assert f'Number of entries returned {no_of_cert}'
|
|
+
|
|
+ # enable pruning
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--enable'])
|
|
+
|
|
+ # certretention set to 5 min
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ f'--certsearchsizelimit={search_size_limit}',
|
|
+ '--certsearchtimelimit=100']
|
|
+ )
|
|
+ self.master.run_command(['ipactl', 'restart'])
|
|
+
|
|
+ # prune the certificates
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--run'])
|
|
+
|
|
+ # check if 5 expired cert is removed
|
|
+ result = self.master.run_command(
|
|
+ ['ipa', 'cert-find', '--subject', self.clients[0].hostname]
|
|
+ )
|
|
+ assert f'Number of entries returned {no_of_cert - search_size_limit}'
|
|
+
|
|
+ def test_prune_config_show(self, issue_and_expire_acme_cert):
|
|
+ """Test to check config-show command shows set param"""
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('11.3.0')):
|
|
+ raise pytest.skip("Certificate pruning is not available")
|
|
+
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--enable'])
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--cron=0 0 1 * *']
|
|
+ )
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--certretention=30', '--certretentionunit=day']
|
|
+ )
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--certsearchsizelimit=1000', '--certsearchtimelimit=0']
|
|
+ )
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--requestretention=30', '--requestretentionunit=day']
|
|
+ )
|
|
+ self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--requestsearchsizelimit=1000', '--requestsearchtimelimit=0']
|
|
+ )
|
|
+ result = self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning', '--config-show']
|
|
+ )
|
|
+ assert 'Status: enabled' in result.stdout_text
|
|
+ assert 'Certificate Retention Time: 30' in result.stdout_text
|
|
+ assert 'Certificate Retention Unit: day' in result.stdout_text
|
|
+ assert 'Certificate Search Size Limit: 1000' in result.stdout_text
|
|
+ assert 'Certificate Search Time Limit: 100' in result.stdout_text
|
|
+ assert 'Request Retention Time: 30' in result.stdout_text
|
|
+ assert 'Request Retention Unit: day' in result.stdout_text
|
|
+ assert 'Request Search Size Limit' in result.stdout_text
|
|
+ assert 'Request Search Time Limit: 100' in result.stdout_text
|
|
+ assert 'cron Schedule: 0 0 1 * *' in result.stdout_text
|
|
+
|
|
+ def test_prune_disable(self, issue_and_expire_acme_cert):
|
|
+ """Test prune command throw error after disabling the pruning"""
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('11.3.0')):
|
|
+ raise pytest.skip("Certificate pruning is not available")
|
|
+
|
|
+ self.master.run_command(['ipa-acme-manage', 'pruning', '--disable'])
|
|
+ result = self.master.run_command(
|
|
+ ['ipa-acme-manage', 'pruning',
|
|
+ '--cron=0 0 1 * *']
|
|
+ )
|
|
+ assert 'Status: disabled' in result.stdout_text
|
|
--
|
|
2.39.1
|
|
|