Function test_auth_intermediate_ca

src/environmentd/tests/auth.rs:2635–2693

unsupported operation: can't call foreign function `OPENSSL_init_ssl` on OS `linux`

()

#[mz_ore::test(tokio::test(flavor = "multi_thread", worker_threads = 1))]
#[cfg_attr(miri, ignore)] // unsupported operation: can't call foreign function `OPENSSL_init_ssl` on OS `linux`
async fn test_auth_intermediate_ca() {
    // Create a CA, an intermediate CA, and a server key pair signed by the
    // intermediate CA.
    let ca = Ca::new_root("test ca").unwrap();
    let intermediate_ca = ca.request_ca("intermediary").unwrap();
    let (server_cert, server_key) = intermediate_ca
        .request_cert("server", vec![IpAddr::V4(Ipv4Addr::LOCALHOST)])
        .unwrap();

    // Create a certificate chain bundle that contains the server's certificate
    // and the intermediate CA's certificate.
    let server_cert_chain = {
        let path = intermediate_ca.dir.path().join("server.chain.crt");
        let mut buf = vec![];
        File::open(server_cert)
            .unwrap()
            .read_to_end(&mut buf)
            .unwrap();
        File::open(intermediate_ca.ca_cert_path())
            .unwrap()
            .read_to_end(&mut buf)
            .unwrap();
        fs::write(&path, buf).unwrap();
        path
    };

    // When the server is configured to present the entire certificate chain,
    // the client should be able to verify the chain even though it only knows
    // about the root CA.
    let server = test_util::TestHarness::default()
        .with_tls(server_cert_chain, server_key)
        .start()
        .await;

    run_tests(
        "TlsMode::Require",
        &server,
        &[
            TestCase::Pgwire {
                user_to_auth_as: "materialize",
                user_reported_by_system: "materialize",
                password: None,
                ssl_mode: SslMode::Require,
                options: None,
                configure: Box::new(|b| b.set_ca_file(ca.ca_cert_path())),
                assert: Assert::Success,
            },
            TestCase::Http {
                user_to_auth_as: &*HTTP_DEFAULT_USER.name,
                user_reported_by_system: &*HTTP_DEFAULT_USER.name,
                scheme: Scheme::HTTPS,
                headers: &HeaderMap::new(),
                configure: Box::new(|b| b.set_ca_file(ca.ca_cert_path())),
                assert: Assert::Success,
            },
        ],
    )
    .await;