github.com/letsencrypt/boulder@v0.20251208.0/linter/lints/cpcps/lint_crl_has_idp_test.go (about)

     1  package cpcps
     2  
     3  import (
     4  	"fmt"
     5  	"strings"
     6  	"testing"
     7  
     8  	"github.com/zmap/zlint/v3/lint"
     9  
    10  	linttest "github.com/letsencrypt/boulder/linter/lints/test"
    11  )
    12  
    13  func TestCrlHasIDP(t *testing.T) {
    14  	t.Parallel()
    15  
    16  	testCases := []struct {
    17  		name       string
    18  		want       lint.LintStatus
    19  		wantSubStr string
    20  	}{
    21  		{
    22  			name: "good", // CRL for subscriber certs
    23  			want: lint.Pass,
    24  		},
    25  		{
    26  			name: "good_subordinate_ca",
    27  			want: lint.Pass,
    28  		},
    29  		{
    30  			name:       "no_idp",
    31  			want:       lint.Warn,
    32  			wantSubStr: "CRL missing IssuingDistributionPoint",
    33  		},
    34  		{
    35  			name:       "idp_no_dpn",
    36  			want:       lint.Error,
    37  			wantSubStr: "User certificate CRLs MUST have at least one DistributionPointName FullName",
    38  		},
    39  		{
    40  			name:       "idp_no_fullname",
    41  			want:       lint.Error,
    42  			wantSubStr: "Failed to read IssuingDistributionPoint distributionPoint fullName",
    43  		},
    44  		{
    45  			name:       "idp_no_uris",
    46  			want:       lint.Error,
    47  			wantSubStr: "IssuingDistributionPoint FullName URI MUST be present",
    48  		},
    49  		{
    50  			name:       "idp_two_uris",
    51  			want:       lint.Notice,
    52  			wantSubStr: "IssuingDistributionPoint unexpectedly has more than one FullName",
    53  		},
    54  		{
    55  			name:       "idp_https",
    56  			want:       lint.Error,
    57  			wantSubStr: "IssuingDistributionPoint URI MUST use http scheme",
    58  		},
    59  		{
    60  			name:       "idp_no_usercerts",
    61  			want:       lint.Error,
    62  			wantSubStr: "Neither onlyContainsUserCerts nor onlyContainsCACerts was set",
    63  		},
    64  		{
    65  			name:       "idp_some_reasons", // Subscriber cert
    66  			want:       lint.Error,
    67  			wantSubStr: "Unexpected IssuingDistributionPoint fields were found",
    68  		},
    69  		{
    70  			name:       "idp_distributionPoint_and_onlyCA",
    71  			want:       lint.Error,
    72  			wantSubStr: "CA certificate CRLs SHOULD NOT have a DistributionPointName FullName",
    73  		},
    74  		{
    75  			name:       "idp_distributionPoint_and_onlyUser_and_onlyCA",
    76  			want:       lint.Error,
    77  			wantSubStr: "IssuingDistributionPoint should not have both onlyContainsUserCerts: TRUE and onlyContainsCACerts: TRUE",
    78  		},
    79  	}
    80  
    81  	for _, tc := range testCases {
    82  		t.Run(tc.name, func(t *testing.T) {
    83  			l := NewCrlHasIDP()
    84  			c := linttest.LoadPEMCRL(t, fmt.Sprintf("testdata/crl_%s.pem", tc.name))
    85  			r := l.Execute(c)
    86  
    87  			if r.Status != tc.want {
    88  				t.Errorf("expected %q, got %q", tc.want, r.Status)
    89  			}
    90  			if !strings.Contains(r.Details, tc.wantSubStr) {
    91  				t.Errorf("expected %q, got %q", tc.wantSubStr, r.Details)
    92  			}
    93  		})
    94  	}
    95  }