// Make sure the staple host cleaned func (s *StaplerSuite) TestStapleReplaced(c *C) { srv := testutils.NewOCSPResponder() defer srv.Close() s.st.beforeUpdateC = make(chan bool) h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) beforeId := s.st.v[h.Name].id s.st.kickC <- true // first make sure the fan out channel is at the right place s.st.beforeUpdateC <- true // update settings so the staple will be replaced h2, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "10h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) s.st.StapleHost(h2) afterId := s.st.v[h.Name].id // now allow it to proceed s.st.beforeUpdateC <- true c.Assert(afterId, Not(Equals), beforeId) }
func (s *StaplerSuite) TestCRUD(c *C) { srv := testutils.NewOCSPResponder() defer srv.Close() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) // subsequent call will return cached response other, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(other, Equals, re) // delete host hk := engine.HostKey{Name: h.Name} s.st.DeleteHost(hk) c.Assert(len(s.st.v), Equals, 0) // second call succeeds s.st.DeleteHost(hk) }
// Periodic update updated the staple value, we got the notification func (s *StaplerSuite) TestUpdateStapleResult(c *C) { srv := testutils.NewOCSPResponder() defer srv.Close() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) events := make(chan *StapleUpdated, 1) close := make(chan struct{}) s.st.Subscribe(events, close) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) s.st.kickC <- true var update *StapleUpdated select { case update = <-events: c.Assert(update, NotNil) c.Assert(update.Staple.IsValid(), Equals, true) case <-time.After(100 * time.Millisecond): c.Fatalf("timeout waiting for update") } }
func (s *StaplerSuite) TestStapleFailed(c *C) { srv := testutils.NewOCSPResponder() srv.Close() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) re, err := s.st.StapleHost(h) c.Assert(err, NotNil) c.Assert(re, IsNil) }
// Responder became unavailable after series of retries func (s *StaplerSuite) TestResponderUnavailable(c *C) { // we are setting up discard channel that will be used by Stapler to notify about discard events s.st.discardC = make(chan bool) srv := testutils.NewOCSPResponder() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) events := make(chan *StapleUpdated, 1) close := make(chan struct{}) s.st.Subscribe(events, close) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) srv.Close() // The first update did not generate any events, as the time for the next update has not passed s.clock.CurrentTime = s.re.NextUpdate.Add(-1 * time.Hour) s.st.kickC <- true // The server discarded the event because the server is unreachable select { case <-s.st.discardC: case <-time.After(100 * time.Millisecond): c.Fatalf("timeout waiting for discard") } s.clock.CurrentTime = s.re.NextUpdate.Add(time.Hour) s.st.kickC <- true var update *StapleUpdated select { case update = <-events: c.Assert(update, NotNil) c.Assert(update.Err, NotNil) case <-time.After(100 * time.Millisecond): c.Fatalf("timeout waiting for update") } }
func (s *StaplerSuite) TestFanOutUnsubscribe(c *C) { srv := testutils.NewOCSPResponder() defer srv.Close() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) events := make(chan *StapleUpdated, 1) closeC := make(chan struct{}) s.st.Subscribe(events, closeC) events2 := make(chan *StapleUpdated, 1) closeC2 := make(chan struct{}) s.st.Subscribe(events2, closeC2) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) s.st.kickC <- true // both channels got the update for _, ch := range []chan *StapleUpdated{events, events2} { select { case update := <-ch: c.Assert(update, NotNil) case <-time.After(100 * time.Millisecond): c.Fatalf("timeout waiting for update") } } // unsubscribe first channel, second will still get the notification close(closeC) s.st.kickC <- true select { case update := <-events2: c.Assert(update, NotNil) case <-time.After(100 * time.Millisecond): c.Fatalf("timeout waiting for update") } }
func (s *StaplerSuite) TestStopInFlightTimers(c *C) { srv := testutils.NewOCSPResponder() defer srv.Close() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) events := make(chan *StapleUpdated, 1) close := make(chan struct{}) s.st.Subscribe(events, close) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) }
// Update of the settings re-initializes staple func (s *StaplerSuite) TestUpdateSettings(c *C) { srv := testutils.NewOCSPResponder() defer srv.Close() h, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "1h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) re, err := s.st.StapleHost(h) c.Assert(err, IsNil) c.Assert(re, NotNil) c.Assert(re.Response.Status, Equals, ocsp.Good) id := s.st.v[h.Name].id h2, err := engine.NewHost("localhost", engine.HostSettings{ KeyPair: &engine.KeyPair{Key: testutils.LocalhostKey, Cert: testutils.LocalhostCertChain}, OCSP: engine.OCSPSettings{Enabled: true, Period: "2h", Responders: []string{srv.URL}, SkipSignatureCheck: true}, }) c.Assert(err, IsNil) re2, err := s.st.StapleHost(h2) c.Assert(err, IsNil) c.Assert(re2, NotNil) c.Assert(re2.Response.Status, Equals, ocsp.Good) // the host stapler has been updated id2 := s.st.v[h.Name].id c.Assert(re2, Not(Equals), re) c.Assert(id2, Not(Equals), id) }