def setUp(self):
self.profile = "facilitydata"
self.root_scope_def = ScopeDefinition.objects.create(
id="rootcert",
profile=self.profile,
version=1,
primary_scope_param_key="mainpartition",
description="Root cert for ${mainpartition}.",
read_filter_template="",
write_filter_template="",
read_write_filter_template="${mainpartition}",
)
self.subset_scope_def = ScopeDefinition.objects.create(
id="subcert",
profile=self.profile,
version=1,
primary_scope_param_key="",
description=
"Subset cert under ${mainpartition} for ${subpartition}.",
read_filter_template="${mainpartition}",
write_filter_template="${mainpartition}:${subpartition}",
read_write_filter_template="",
)
self.root_cert = Certificate.generate_root_certificate(
self.root_scope_def.id)
self.subset_cert = Certificate(
parent=self.root_cert,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition": self.root_cert.id,
"subpartition": "abracadabra"
}),
private_key=Key(),
)
self.root_cert.sign_certificate(self.subset_cert)
self.subset_cert.save()
self.unsaved_cert = Certificate(
parent=self.root_cert,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition": self.root_cert.id,
"subpartition": "other"
}),
public_key=Key(),
)
self.root_cert.sign_certificate(self.unsaved_cert)
self.controller = MorangoProfileController('facilitydata')
self.network_connection = self.controller.create_network_connection(
self.live_server_url)
self.key = SharedKey.get_or_create_shared_key()
def test_bad_scope_subset_does_not_validate(self):
bad_subset_cert = Certificate(
parent=self.root_cert,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition": "a" * 32,
"subpartition": "abracadabra"
}),
private_key=Key(),
)
self.root_cert.sign_certificate(bad_subset_cert)
bad_subset_cert.save()
with self.assertRaises(CertificateScopeNotSubset):
bad_subset_cert.check_certificate()
def setUp(self):
self.profile = "testprofile"
self.root_scope_def = ScopeDefinition.objects.create(
id="rootcert",
profile=self.profile,
version=1,
primary_scope_param_key="mainpartition",
description="Root cert for ${mainpartition}.",
read_filter_template="",
write_filter_template="",
read_write_filter_template="${mainpartition}",
)
self.subset_scope_def = ScopeDefinition.objects.create(
id="subcert",
profile=self.profile,
version=1,
primary_scope_param_key="",
description=
"Subset cert under ${mainpartition} for ${subpartition}.",
read_filter_template="${mainpartition}",
write_filter_template="${mainpartition}:${subpartition}",
read_write_filter_template="",
)
self.root_cert = Certificate.generate_root_certificate(
self.root_scope_def.id)
self.subset_cert = Certificate(
parent=self.root_cert,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition": self.root_cert.id,
"subpartition": "abracadabra"
}),
private_key=Key(),
)
self.root_cert.sign_certificate(self.subset_cert)
self.subset_cert.save()
def push_signed_client_certificate_chain(self, local_parent_cert,
scope_definition_id,
scope_params):
# grab shared public key of server
publickey_response = self._get_public_key()
# request the server for a one-time-use nonce
nonce_response = self._get_nonce()
# build up data for csr
certificate = Certificate(
parent_id=local_parent_cert.id,
profile=local_parent_cert.profile,
scope_definition_id=scope_definition_id,
scope_version=local_parent_cert.scope_version,
scope_params=json.dumps(scope_params),
public_key=Key(
public_key_string=publickey_response.json()[0]['public_key']),
salt=nonce_response.json()[
"id"] # for pushing signed certs, we use nonce as salt
)
# add ID and signature to the certificate
certificate.id = certificate.calculate_uuid()
certificate.parent.sign_certificate(certificate)
# serialize the chain for sending to server
certificate_chain = list(
local_parent_cert.get_descendants(
include_self=True)) + [certificate]
data = json.dumps(
CertificateSerializer(certificate_chain, many=True).data)
# client sends signed certificate chain to server
self._push_certificate_chain(data)
# if there are no errors, we can save the pushed certificate
certificate.save()
return certificate
def setUp(self):
self.user = MyUser(username="******")
self.user.actual_password = "******"
self.user.set_password(self.user.actual_password)
self.user.save()
self.superuser = MyUser(username="******", is_superuser=True)
self.superuser.actual_password = "******"
self.superuser.set_password(self.superuser.actual_password)
self.superuser.save()
self.fakeuser = MyUser(username="******")
self.fakeuser.actual_password = "******"
self.profile = "facilitydata"
self.root_scope_def = ScopeDefinition.objects.create(
id="rootcert",
profile=self.profile,
version=1,
primary_scope_param_key="mainpartition",
description="Root cert for ${mainpartition}.",
read_filter_template="",
write_filter_template="",
read_write_filter_template="${mainpartition}",
)
self.subset_scope_def = ScopeDefinition.objects.create(
id="subcert",
profile=self.profile,
version=1,
primary_scope_param_key="",
description=
"Subset cert under ${mainpartition} for ${subpartition}.",
read_filter_template=
"${mainpartition}:shared\n${mainpartition}:${subpartition}",
write_filter_template="${mainpartition}:${subpartition}",
read_write_filter_template="",
)
self.root_cert1_with_key = Certificate.generate_root_certificate(
self.root_scope_def.id)
self.subset_cert1_without_key = Certificate(
parent=self.root_cert1_with_key,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition": self.root_cert1_with_key.id,
"subpartition": "abracadabra"
}),
private_key=Key(),
)
self.root_cert1_with_key.sign_certificate(
self.subset_cert1_without_key)
self.subset_cert1_without_key.save()
self.sub_subset_cert1_with_key = Certificate(
parent=self.subset_cert1_without_key,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=self.subset_cert1_without_key.scope_params,
private_key=Key(),
)
self.subset_cert1_without_key.sign_certificate(
self.sub_subset_cert1_with_key)
self.sub_subset_cert1_with_key.save()
self.subset_cert1_without_key._private_key = None
self.subset_cert1_without_key.save()
self.root_cert2_without_key = Certificate.generate_root_certificate(
self.root_scope_def.id)
self.subset_cert2_with_key = Certificate(
parent=self.root_cert2_without_key,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition":
self.root_cert2_without_key.id,
"subpartition":
"abracadabra"
}),
private_key=Key(),
)
self.root_cert2_without_key.sign_certificate(
self.subset_cert2_with_key)
self.subset_cert2_with_key.save()
self.root_cert2_without_key._private_key = None
self.root_cert2_without_key.save()
self.original_cert_count = Certificate.objects.count()
self.sharedkey = SharedKey.get_or_create_shared_key()
# create a root cert
self.unsaved_root_cert = Certificate(
scope_definition=self.root_scope_def,
scope_version=self.root_scope_def.version,
profile=self.profile,
private_key=Key())
self.unsaved_root_cert.id = self.unsaved_root_cert.calculate_uuid()
self.unsaved_root_cert.scope_params = json.dumps({
self.root_scope_def.primary_scope_param_key:
self.unsaved_root_cert.id
})
self.unsaved_root_cert.sign_certificate(self.unsaved_root_cert)
# create a child cert
self.unsaved_subset_cert = Certificate(
parent=self.unsaved_root_cert,
profile=self.profile,
scope_definition=self.subset_scope_def,
scope_version=self.subset_scope_def.version,
scope_params=json.dumps({
"mainpartition": self.unsaved_root_cert.id,
"subpartition": "hooplah"
}),
public_key=self.sharedkey.public_key,
)
def test_setting_public_key_does_not_set_private_key(self):
cert = Certificate()
cert.public_key = Key()
self.assertEqual(cert.private_key, None)
def test_setting_private_key_sets_public_key(self):
cert = Certificate()
cert.private_key = Key()
self.assertTrue(
cert.public_key.verify("testval",
cert.private_key.sign("testval")))