-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
cdf4b5e
commit b1be443
Showing
4 changed files
with
101 additions
and
109 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,47 +1,113 @@ | ||
| import fs from 'fs' | ||
| import os from 'os' | ||
| import Polykey from "../../../src/lib/Polykey" | ||
| import net from 'net' | ||
| import http from 'https' | ||
| import crypto from 'crypto' | ||
| import { randomString } from '../../../src/lib/utils' | ||
| import KeyManager from '../../../src/lib/keys/KeyManager' | ||
| import PublicKeyInfrastructure, { TLSCredentials } from '../../../src/lib/keys/pki/PublicKeyInfrastructure' | ||
|
|
||
| // TODO: part of adding PKI functionality to polykey | ||
| describe('PKI', () => { | ||
| let tempDirPeerCA: string | ||
| let pkiCA: PublicKeyInfrastructure | ||
|
|
||
| let tempDirPeerA: string | ||
| let peerA: Polykey | ||
| let pkiA: PublicKeyInfrastructure | ||
|
|
||
| let tempDirPeerB: string | ||
| let peerB: Polykey | ||
| let pkiB: PublicKeyInfrastructure | ||
|
|
||
| beforeAll(async () => { | ||
| // ======== CA PEER ======== // | ||
| // Define temp directory | ||
| tempDirPeerCA = fs.mkdtempSync(`${os.tmpdir}/pktest${randomString()}`) | ||
|
|
||
| // Create pki | ||
| const keyCA = crypto.pbkdf2Sync('passphrase', crypto.randomBytes(16), 10000, 256 / 8, 'sha256') | ||
| pkiCA = new PublicKeyInfrastructure(tempDirPeerCA, keyCA, 'localhost') | ||
|
|
||
| // ======== PEER A ======== // | ||
| // Define temp directory | ||
| tempDirPeerA = fs.mkdtempSync(`${os.tmpdir}/pktest${randomString()}`) | ||
|
|
||
| // Create keyManager | ||
| const keyManagerA = new KeyManager(tempDirPeerA, fs) | ||
| await keyManagerA.generateKeyPair('John Smith', '[email protected]', 'some passphrase', 1024, true) | ||
|
|
||
| // Initialize polykey | ||
| peerA = new Polykey( | ||
| tempDirPeerA, | ||
| fs, | ||
| keyManagerA | ||
| ) | ||
| while (!peerA.peerManager.peerServer.started) { | ||
| await new Promise((resolve, reject) => { | ||
| setTimeout(() => resolve(), 500) | ||
| }) | ||
| } | ||
| // Create pki | ||
| const keyA = crypto.pbkdf2Sync('passphrase', crypto.randomBytes(16), 10000, 256 / 8, 'sha256') | ||
| pkiA = new PublicKeyInfrastructure(tempDirPeerA, keyA, 'localhost') | ||
| pkiA.addCA(pkiCA.RootCert) | ||
|
|
||
| // ======== PEER B ======== // | ||
| // Define temp directory | ||
| tempDirPeerB = fs.mkdtempSync(`${os.tmpdir}/pktest${randomString()}`) | ||
|
|
||
| // Create pki | ||
| const keyB = crypto.pbkdf2Sync('passphrase', crypto.randomBytes(16), 10000, 256 / 8, 'sha256') | ||
| pkiB = new PublicKeyInfrastructure(tempDirPeerB, keyB, 'localhost') | ||
| pkiB.addCA(pkiCA.RootCert) | ||
| }) | ||
|
|
||
| afterAll(() => { | ||
| fs.rmdirSync(tempDirPeerA, { recursive: true }) | ||
| fs.rmdirSync(tempDirPeerB, { recursive: true }) | ||
| }) | ||
|
|
||
| describe('Peer Connections', () => { | ||
| test('can connect securely to another peer and send data back and forth', async done => { | ||
| done() | ||
| test('can request a certificate from a ca peer', () => { | ||
| const csr = pkiA.createCSR('localhost', 'passphrase') | ||
| const certificate = pkiCA.handleCSR(csr) | ||
| expect(certificate).not.toEqual(undefined) | ||
| }) | ||
|
|
||
| describe('Transport Layer Security', () => { | ||
| let tlsServerCredentials: TLSCredentials | undefined | ||
| let tlsClientCredentials: TLSCredentials | undefined | ||
|
|
||
| beforeAll(() => { | ||
| // request certificates from CA for both pkiA and pkiB | ||
| // ==== PEER A ==== // | ||
| const csrA = pkiA.createCSR('localhost', 'passphrase') | ||
| pkiA.importCertificate(pkiCA.handleCSR(csrA)) | ||
| // ==== PEER B ==== // | ||
| const csrB = pkiB.createCSR('localhost', 'passphrase') | ||
| pkiB.importCertificate(pkiCA.handleCSR(csrB)) | ||
|
|
||
| // pkiA will provide the server credentials and pkiB will provide the client credentials | ||
| tlsServerCredentials = pkiA.TLSServerCredentials | ||
| tlsClientCredentials = pkiB.TLSClientCredentials | ||
| }) | ||
|
|
||
| test('can use certificates to create an mtls connection', done => { | ||
| // set up the mock server | ||
| const randomSecureMessage = `random-secure-message: ${randomString()}\n` | ||
| const server = http.createServer({ | ||
| key: tlsServerCredentials!.privateKey, | ||
| cert: tlsServerCredentials!.certificate, | ||
| ca: [tlsServerCredentials!.rootCertificate] | ||
| }, (req, res) => { | ||
| res.writeHead(200); | ||
| res.end(randomSecureMessage); | ||
| }).listen(0) | ||
| const serverAddress = <net.AddressInfo>server.address() | ||
|
|
||
| const req = http.request({ | ||
| host: serverAddress.address, | ||
| port: serverAddress.port, | ||
| path: '/', | ||
| method: 'GET', | ||
| key: tlsClientCredentials!.privateKey, | ||
| cert: tlsClientCredentials!.certificate, | ||
| ca: [pkiCA!.RootCert] | ||
| }, (res) => { | ||
| res.on('data', (d) => { | ||
| expect(d).toEqual(randomSecureMessage) | ||
| done() | ||
| }); | ||
| }) | ||
|
|
||
| req.on('error', (e) => { | ||
| expect(e).toBeUndefined() | ||
| done() | ||
| }); | ||
|
|
||
| req.end() | ||
| }) | ||
| }) | ||
| }) |