1 package sagoodkey
2
3 import (
4 "context"
5 "crypto/ecdsa"
6 "crypto/elliptic"
7 "crypto/rand"
8 "testing"
9
10 "github.com/letsencrypt/boulder/goodkey"
11 sapb "github.com/letsencrypt/boulder/sa/proto"
12 "github.com/letsencrypt/boulder/test"
13 "google.golang.org/grpc"
14 )
15
16 func TestDBBlocklistAccept(t *testing.T) {
17 for _, testCheck := range []BlockedKeyCheckFunc{
18 nil,
19 func(context.Context, *sapb.KeyBlockedRequest, ...grpc.CallOption) (*sapb.Exists, error) {
20 return &sapb.Exists{Exists: false}, nil
21 },
22 } {
23 policy, err := NewKeyPolicy(&goodkey.Config{}, testCheck)
24 test.AssertNotError(t, err, "NewKeyPolicy failed")
25
26 k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
27 test.AssertNotError(t, err, "ecdsa.GenerateKey failed")
28 err = policy.GoodKey(context.Background(), k.Public())
29 test.AssertNotError(t, err, "GoodKey failed with a non-blocked key")
30 }
31 }
32
33 func TestDBBlocklistReject(t *testing.T) {
34 testCheck := func(context.Context, *sapb.KeyBlockedRequest, ...grpc.CallOption) (*sapb.Exists, error) {
35 return &sapb.Exists{Exists: true}, nil
36 }
37
38 policy, err := NewKeyPolicy(&goodkey.Config{}, testCheck)
39 test.AssertNotError(t, err, "NewKeyPolicy failed")
40
41 k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
42 test.AssertNotError(t, err, "ecdsa.GenerateKey failed")
43 err = policy.GoodKey(context.Background(), k.Public())
44 test.AssertError(t, err, "GoodKey didn't fail with a blocked key")
45 test.AssertErrorIs(t, err, goodkey.ErrBadKey)
46 test.AssertEquals(t, err.Error(), "public key is forbidden")
47 }
48
View as plain text