test_create_self_signed_cert.py 21.1 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
#
# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
#
# Licensed under the MIT License. See the LICENSE accompanying this file
# for the specific language governing permissions and limitations under
# the License.
#

import mount_efs
import os

import pytest

from datetime import datetime
from mock import MagicMock

try:
    import ConfigParser
except ImportError:
    from configparser import ConfigParser

FS_ID = 'fs-deadbeef'
AP_ID = 'fsap-fedcba9876543210'
24
CLIENT_INFO = {'source': 'test'}
25
26
27
28
29
30
31
32
33
34
35
36
REGION = 'us-east-1'
COMMON_NAME = 'fs-deadbeef.efs.us-east-1.amazonaws.com'
MOUNT_NAME = 'fs-deadbeef.mount.dir.12345'
ACCESS_KEY_ID_VAL = 'FAKE_AWS_ACCESS_KEY_ID'
SECRET_ACCESS_KEY_VAL = 'FAKE_AWS_SECRET_ACCESS_KEY'
SESSION_TOKEN_VAL = 'FAKE_SESSION_TOKEN'
CREDENTIALS = {
    'AccessKeyId': ACCESS_KEY_ID_VAL,
    'SecretAccessKey': SECRET_ACCESS_KEY_VAL,
    'Token': SESSION_TOKEN_VAL
}
FIXED_DT = datetime(2000, 1, 1, 12, 0, 0)
37
38
39
40
41
42
43
PUBLIC_KEY_BODY = '-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEArGJgJTTwefL+jHV8A9EM\npX56n3Z' \
                  'JczM+4iPPSnledJzBcUO1VF+j6TOzy39BWBtvRjSs0nqd5wqw+1xHawhh\ndJF5KsqMNGcP/y9fLi9Bm1vInHfQVan4NhXWh8S' \
                  'NbRZM1tNZV5/k+VnFur6ACHwq\neWppGXkGBASL0zG0MiCbOVMkwfv/E69APVC6ljnPXBWaDuggAClYheTv5RIU4wD1\nc1nohR' \
                  'b0ZHyfZjELjnqLfY0eOqY+msQXzP0eUmZXCMvUkGxi5DJnNVKhw5y96QbB\nRFO5ImQXpNsQmp8F9Ih1RIxNsl4csaEuK+/Zo' \
                  'J68vR47oQNtPp1PjdIwcnQ3cOvO\nHMxulMX21Fd/e9TsnqISOTOyebmYFgaHczg4JVu5lV699+7QWJm1a7M4ab0WgVVR\nz27J0' \
                  'Lx/691MZB4TbGoEIFza30/sk6uTPxAzebzCaroXzT7uA6TIRtRpxt4X9a+4\n6GhfgR5RJfFMb8rPGmaKWqA2YkTsZzRGHhbAzs' \
                  'J/nEstAgMBAAE=\n-----END PUBLIC KEY-----'
44
45
46
47


@pytest.fixture(autouse=True)
def setup_method(mocker):
48
49
    mocker.patch('mount_efs.get_region_from_instance_metadata', return_value=REGION)
    mocker.patch('mount_efs.get_target_region', return_value=REGION)
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
    mocker.patch('mount_efs.get_aws_security_credentials', return_value=CREDENTIALS)
    mocker.patch('mount_efs.get_utc_now', return_value=FIXED_DT)
    mocker.patch('socket.gethostbyname')


def _get_config():
    try:
        config = ConfigParser.SafeConfigParser()
    except AttributeError:
        config = ConfigParser()
    config.add_section(mount_efs.CONFIG_SECTION)
    config.set(mount_efs.CONFIG_SECTION, 'state_file_dir_mode', '750')
    config.set(mount_efs.CONFIG_SECTION, 'dns_name_format', '{fs_id}.efs.{region}.amazonaws.com')
    return config


66
def _create_ca_conf_helper(tmpdir, current_time, iam=True, ap=True, client_info=True):
67
68
69
70
71
72
73
74
75
76
77
78
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    mount_efs.create_required_directory({}, tls_dict['mount_dir'])
    tls_dict['certificate_path'] = os.path.join(tls_dict['mount_dir'], 'config.conf')
    tls_dict['private_key'] = os.path.join(tls_dict['mount_dir'], 'privateKey.pem')
    tls_dict['public_key'] = os.path.join(tls_dict['mount_dir'], 'publicKey.pem')

    if iam:
        with open(tls_dict['public_key'], 'w') as f:
            f.write(PUBLIC_KEY_BODY)

    credentials = CREDENTIALS if iam else None
    ap_id = AP_ID if ap else None
79
    client_info = CLIENT_INFO if client_info else None
80
    full_config_body = mount_efs.create_ca_conf(tls_dict['certificate_path'], COMMON_NAME, tls_dict['mount_dir'],
81
82
                                                tls_dict['private_key'], current_time, REGION, FS_ID, credentials,
                                                ap_id, client_info)
83
84
85
    assert os.path.exists(tls_dict['certificate_path'])

    return tls_dict, full_config_body
86
87


88
def _get_mock_config(dns_name_format='{fs_id}.efs.{region}.amazonaws.com', client_info=CLIENT_INFO):
89
90
91
92
93
    def config_get_side_effect(section, field):
        if section == mount_efs.CONFIG_SECTION and field == 'state_file_dir_mode':
            return '0755'
        elif section == mount_efs.CONFIG_SECTION and field == 'dns_name_format':
            return dns_name_format
94
95
        elif section == mount_efs.CLIENT_INFO_SECTION and field == 'source':
            return client_info['source']
96
97
98
99
100
101
102
103
104
105
106
        else:
            raise ValueError('Unexpected arguments')

    mock_config = MagicMock()
    mock_config.get.side_effect = config_get_side_effect
    return mock_config


def _get_mock_private_key_path(mocker, tmpdir):
    pk_path = os.path.join(str(tmpdir), 'privateKey.pem')
    mocker.patch('mount_efs.get_private_key_path', return_value=pk_path)
107
    return pk_path  
108
109
110
111
112
113
114


def test_certificate_without_iam_with_ap_id(mocker, tmpdir):
    config = _get_mock_config()
    pk_path = _get_mock_private_key_path(mocker, tmpdir)
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    tmp_config_path = os.path.join(str(tmpdir), MOUNT_NAME, 'tmpConfig')
115
    mount_efs.create_certificate(config, MOUNT_NAME, COMMON_NAME, REGION, FS_ID, None, AP_ID, CLIENT_INFO, base_path=str(tmpdir))
116
117
    with open(os.path.join(tls_dict['mount_dir'], 'config.conf')) as f:
        conf_body = f.read()
118
        assert conf_body == mount_efs.create_ca_conf(tmp_config_path, COMMON_NAME, tls_dict['mount_dir'], pk_path, FIXED_DT, REGION,
119
                                                     FS_ID, None, AP_ID, CLIENT_INFO)
120
121
122
123
124
125
126
127
128
129
130
    assert os.path.exists(pk_path)
    assert not os.path.exists(os.path.join(tls_dict['mount_dir'], 'publicKey.pem'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))


def test_certificate_with_iam_with_ap_id(mocker, tmpdir):
    config = _get_mock_config()
    pk_path = _get_mock_private_key_path(mocker, tmpdir)
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    tmp_config_path = os.path.join(str(tmpdir), MOUNT_NAME, 'tmpConfig')
131
    mount_efs.create_certificate(config, MOUNT_NAME, COMMON_NAME, REGION, FS_ID, CREDENTIALS, AP_ID, CLIENT_INFO, base_path=str(tmpdir))
132
133
    with open(os.path.join(tls_dict['mount_dir'], 'config.conf')) as f:
        conf_body = f.read()
134
        assert conf_body == mount_efs.create_ca_conf(tmp_config_path, COMMON_NAME, tls_dict['mount_dir'], pk_path, FIXED_DT, REGION,
135
                                                     FS_ID, CREDENTIALS, AP_ID, CLIENT_INFO)
136
137
138
139
140
141
    assert os.path.exists(pk_path)
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'publicKey.pem'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))


142
143
144
145
146
def _test_certificate_with_iam_with_ap_with_invalid_client_source_config(mocker, tmpdir, client_source):
    config = _get_mock_config(client_info={'source': client_source}) if client_source else _get_config()
    pk_path = _get_mock_private_key_path(mocker, tmpdir)
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    tmp_config_path = os.path.join(str(tmpdir), MOUNT_NAME, 'tmpConfig')
147
    mount_efs.create_certificate(config, MOUNT_NAME, COMMON_NAME, REGION, FS_ID, CREDENTIALS, AP_ID, None,
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
                                 base_path=str(tmpdir))
    with open(os.path.join(tls_dict['mount_dir'], 'config.conf')) as f:
        conf_body = f.read()
        assert conf_body == mount_efs.create_ca_conf(tmp_config_path, COMMON_NAME, tls_dict['mount_dir'], pk_path,
                                                     FIXED_DT, REGION, FS_ID, CREDENTIALS, AP_ID, None)
    assert os.path.exists(pk_path)
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'publicKey.pem'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))


def test_certificate_with_iam_with_ap_with_empty_client_source_config(mocker, tmpdir):
    _test_certificate_with_iam_with_ap_with_invalid_client_source_config(mocker, tmpdir, None)


def test_certificate_with_iam_with_ap_with_empty_client_source_config(mocker, tmpdir):
    _test_certificate_with_iam_with_ap_with_invalid_client_source_config(mocker, tmpdir, '')


def test_certificate_with_iam_with_ap_with_long_client_source_config(mocker, tmpdir):
    _test_certificate_with_iam_with_ap_with_invalid_client_source_config(mocker, tmpdir, 'a' * 101)


171
172
173
174
175
def test_certificate_with_iam_without_ap_id(mocker, tmpdir):
    config = _get_mock_config()
    pk_path = _get_mock_private_key_path(mocker, tmpdir)
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    tmp_config_path = os.path.join(str(tmpdir), MOUNT_NAME, 'tmpConfig')
176
    mount_efs.create_certificate(config, MOUNT_NAME, COMMON_NAME, REGION, FS_ID, CREDENTIALS, None, CLIENT_INFO, base_path=str(tmpdir))
177
178
    with open(os.path.join(tls_dict['mount_dir'], 'config.conf')) as f:
        conf_body = f.read()
179
        assert conf_body == mount_efs.create_ca_conf(tmp_config_path, COMMON_NAME, tls_dict['mount_dir'], pk_path, FIXED_DT, REGION,
180
                                                     FS_ID, CREDENTIALS, None, CLIENT_INFO)
181
182
183
184
185
186
    assert os.path.exists(pk_path)
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'publicKey.pem'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))


187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
def test_certificate_without_iam_without_ap_id_without_client_source(mocker, tmpdir):
    config = _get_config()
    pk_path = _get_mock_private_key_path(mocker, tmpdir)
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    tmp_config_path = os.path.join(str(tmpdir), MOUNT_NAME, 'tmpConfig')
    mount_efs.create_certificate(config, MOUNT_NAME, COMMON_NAME, REGION, FS_ID, None, None, None, base_path=str(tmpdir))
    with open(os.path.join(tls_dict['mount_dir'], 'config.conf')) as f:
        conf_body = f.read()
        assert conf_body == mount_efs.create_ca_conf(tmp_config_path, COMMON_NAME, tls_dict['mount_dir'], pk_path, FIXED_DT,
                                                     REGION, FS_ID, None, None, None)
    assert os.path.exists(pk_path)
    assert not os.path.exists(os.path.join(tls_dict['mount_dir'], 'publicKey.pem'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))


def test_certificate_without_iam_without_ap_id_with_client_source(mocker, tmpdir):
    config = _get_mock_config()
    pk_path = _get_mock_private_key_path(mocker, tmpdir)
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    tmp_config_path = os.path.join(str(tmpdir), MOUNT_NAME, 'tmpConfig')
    mount_efs.create_certificate(config, MOUNT_NAME, COMMON_NAME, REGION, FS_ID, None, None, CLIENT_INFO, base_path=str(tmpdir))
    with open(os.path.join(tls_dict['mount_dir'], 'config.conf')) as f:
        conf_body = f.read()
        assert conf_body == mount_efs.create_ca_conf(tmp_config_path, COMMON_NAME, tls_dict['mount_dir'], pk_path, FIXED_DT,
                                                     REGION, FS_ID, None, None, CLIENT_INFO)
    assert os.path.exists(pk_path)
    assert not os.path.exists(os.path.join(tls_dict['mount_dir'], 'publicKey.pem'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))


219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
def test_create_ca_supporting_dirs(tmpdir):
    config = _get_config()
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    mount_efs.ca_dirs_check(config, tls_dict['database_dir'], tls_dict['certs_dir'])
    assert os.path.exists(tls_dict['database_dir'])
    assert os.path.exists(tls_dict['certs_dir'])


def test_create_ca_supporting_files(tmpdir):
    config = _get_config()
    tls_dict = mount_efs.tls_paths_dictionary(MOUNT_NAME, str(tmpdir))
    index = tls_dict['index']
    index_attr = tls_dict['index_attr']
    serial = tls_dict['serial']
    rand = tls_dict['rand']

    mount_efs.ca_dirs_check(config, tls_dict['database_dir'], tls_dict['certs_dir'])
    mount_efs.ca_supporting_files_check(index, index_attr, serial, rand)
    with open(index_attr, 'r') as index_attr_file:
        index_attr_content = index_attr_file.read()
    with open(serial, 'r') as serial_file:
        serial_content = serial_file.read()

    assert os.path.exists(index)
    assert os.path.exists(index_attr)
    assert os.path.exists(serial)
    assert os.path.exists(rand)

    assert 'unique_subject = no' == index_attr_content
    assert '00' == serial_content


def test_create_canonical_request_without_token():
    public_key_hash = 'fake_public_key_hash'
    canonical_request_out = mount_efs.create_canonical_request(public_key_hash, FIXED_DT, ACCESS_KEY_ID_VAL, REGION, FS_ID)

    assert 'GET\n/\nAction=Connect&PublicKeyHash=fake_public_key_hash&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=' \
           'FAKE_AWS_ACCESS_KEY_ID%2F20000101%2Fus-east-1%2Felasticfilesystem%2Faws4_request&X-Amz-Date=20000101T120000Z&' \
           'X-Amz-Expires=86400&X-Amz-SignedHeaders=host\nhost:fs-deadbeef\nhost\n' \
           'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' == canonical_request_out


def test_create_canonical_request_with_token(mocker):
    mocker.patch('mount_efs.get_utc_now', return_value=FIXED_DT)
    public_key_hash = 'fake_public_key_hash'
    canonical_request_out = mount_efs.create_canonical_request(public_key_hash, FIXED_DT, ACCESS_KEY_ID_VAL, REGION, FS_ID,
                                                               SESSION_TOKEN_VAL)

    assert 'GET\n/\nAction=Connect&PublicKeyHash=fake_public_key_hash&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=' \
           'FAKE_AWS_ACCESS_KEY_ID%2F20000101%2Fus-east-1%2Felasticfilesystem%2Faws4_request&X-Amz-Date=20000101T120000Z&' \
           'X-Amz-Expires=86400&X-Amz-Security-Token=FAKE_SESSION_TOKEN&X-Amz-SignedHeaders=host\nhost:fs-deadbeef\nhost' \
           '\ne3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' == canonical_request_out


def test_get_public_key_sha1(tmpdir):
    fake_public_key_filename = 'fake_public_key.pem'
    fake_public_key_path = os.path.join(str(tmpdir), fake_public_key_filename)
276
    tmpdir.join(fake_public_key_filename).write(PUBLIC_KEY_BODY)
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297

    sha1_result = mount_efs.get_public_key_sha1(fake_public_key_path)

    assert sha1_result == 'd9c2a68f2c4de49982e310d95e539a89abd6bc13'


def test_create_string_to_sign():
    canonical_request = 'canonical_request'

    string_to_sign_output = mount_efs.create_string_to_sign(canonical_request, FIXED_DT, REGION)

    assert 'AWS4-HMAC-SHA256\n20000101T120000Z\n20000101/us-east-1/elasticfilesystem/aws4_request\n' \
           '572b1e335109068b81e4def81524c5fe5d0e385143b5656cbf2f7c88e5c1a51e' == string_to_sign_output


def test_calculate_signature():
    string_to_sign = 'string_to_sign'

    signature_output = mount_efs.calculate_signature(string_to_sign, FIXED_DT, SECRET_ACCESS_KEY_VAL, REGION)

    assert '6aa643803d4a1b07c5ac87bff96347ef28dab1cb5a5c5d63969c90ca11454c4a' == signature_output
298
299


300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
def test_create_ca_conf_without_client_info(tmpdir):
    current_time = mount_efs.get_utc_now()
    tls_dict, full_config_body = _create_ca_conf_helper(tmpdir, current_time, iam=True, ap=True, client_info=False)

    ca_extension_body = ('[ v3_ca ]\n'
                         'subjectKeyIdentifier = hash\n' 
                        '1.3.6.1.4.1.4843.7.1 = ASN1:UTF8String:%s\n' 
                        '1.3.6.1.4.1.4843.7.2 = ASN1:SEQUENCE:efs_client_auth\n' 
                        '1.3.6.1.4.1.4843.7.3 = ASN1:UTF8String:%s'
                         ) % (AP_ID, FS_ID)
    efs_client_auth_body = mount_efs.efs_client_auth_builder(tls_dict['public_key'], CREDENTIALS['AccessKeyId'],
                                                             CREDENTIALS['SecretAccessKey'], current_time, REGION,
                                                             FS_ID, CREDENTIALS['Token'])
    efs_client_info_body = ''
    matching_config_body = mount_efs.CA_CONFIG_BODY % (tls_dict['mount_dir'], tls_dict['private_key'], COMMON_NAME,
                                                       ca_extension_body, efs_client_auth_body, efs_client_info_body)

    assert full_config_body == matching_config_body


def test_create_ca_conf_with_all(tmpdir):
321
322
323
    current_time = mount_efs.get_utc_now()
    tls_dict, full_config_body = _create_ca_conf_helper(tmpdir, current_time, iam=True, ap=True)

324
325
326
327
328
329
330
    ca_extension_body = ('[ v3_ca ]\n'
                        'subjectKeyIdentifier = hash\n'
                        '1.3.6.1.4.1.4843.7.1 = ASN1:UTF8String:%s\n'
                        '1.3.6.1.4.1.4843.7.2 = ASN1:SEQUENCE:efs_client_auth\n'
                        '1.3.6.1.4.1.4843.7.3 = ASN1:UTF8String:%s\n'
                        '1.3.6.1.4.1.4843.7.4 = ASN1:SEQUENCE:efs_client_info'
                         ) % (AP_ID, FS_ID)
331
332
333
    efs_client_auth_body = mount_efs.efs_client_auth_builder(tls_dict['public_key'], CREDENTIALS['AccessKeyId'],
                                                             CREDENTIALS['SecretAccessKey'], current_time, REGION, FS_ID,
                                                             CREDENTIALS['Token'])
334
    efs_client_info_body = mount_efs.efs_client_info_builder(CLIENT_INFO)
335
    matching_config_body = mount_efs.CA_CONFIG_BODY % (tls_dict['mount_dir'], tls_dict['private_key'], COMMON_NAME,
336
                                                       ca_extension_body, efs_client_auth_body, efs_client_info_body)
337
338
339
340
341
342

    assert full_config_body == matching_config_body


def test_create_ca_conf_with_iam_no_accesspoint(tmpdir):
    current_time = mount_efs.get_utc_now()
343
344
345
346
347
348
349
350
    tls_dict, full_config_body = _create_ca_conf_helper(tmpdir, current_time, iam=True, ap=False, client_info=True)

    ca_extension_body = ('[ v3_ca ]\n' 
                        'subjectKeyIdentifier = hash\n' 
                        '1.3.6.1.4.1.4843.7.2 = ASN1:SEQUENCE:efs_client_auth\n' 
                        '1.3.6.1.4.1.4843.7.3 = ASN1:UTF8String:%s\n' 
                        '1.3.6.1.4.1.4843.7.4 = ASN1:SEQUENCE:efs_client_info'
                         ) % (FS_ID)
351
352
353
    efs_client_auth_body = mount_efs.efs_client_auth_builder(tls_dict['public_key'], CREDENTIALS['AccessKeyId'],
                                                             CREDENTIALS['SecretAccessKey'], current_time, REGION, FS_ID,
                                                             CREDENTIALS['Token'])
354
    efs_client_info_body = mount_efs.efs_client_info_builder(CLIENT_INFO)
355
    matching_config_body = mount_efs.CA_CONFIG_BODY % (tls_dict['mount_dir'], tls_dict['private_key'], COMMON_NAME,
356
                                                       ca_extension_body, efs_client_auth_body, efs_client_info_body)
357
358
359
360
361
362

    assert full_config_body == matching_config_body


def test_create_ca_conf_with_accesspoint_no_iam(tmpdir):
    current_time = mount_efs.get_utc_now()
363
364
365
366
367
368
369
370
    tls_dict, full_config_body = _create_ca_conf_helper(tmpdir, current_time, iam=False, ap=True, client_info=True)

    ca_extension_body = ('[ v3_ca ]\n' 
                        'subjectKeyIdentifier = hash\n' 
                        '1.3.6.1.4.1.4843.7.1 = ASN1:UTF8String:%s\n' 
                        '1.3.6.1.4.1.4843.7.3 = ASN1:UTF8String:%s\n' 
                        '1.3.6.1.4.1.4843.7.4 = ASN1:SEQUENCE:efs_client_info'
                         ) % (AP_ID, FS_ID)
371
    efs_client_auth_body = ''
372
    efs_client_info_body = mount_efs.efs_client_info_builder(CLIENT_INFO)
373
    matching_config_body = mount_efs.CA_CONFIG_BODY % (tls_dict['mount_dir'], tls_dict['private_key'], COMMON_NAME,
374
                                                       ca_extension_body, efs_client_auth_body, efs_client_info_body)
375

376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
    assert full_config_body == matching_config_body


def test_create_ca_conf_no_ap_no_iam_no_client_source(tmpdir):
    current_time = mount_efs.get_utc_now()
    tls_dict, full_config_body = _create_ca_conf_helper(tmpdir, current_time, iam=False, ap=False, client_info=False)

    ca_extension_body = ('[ v3_ca ]\n'
                         'subjectKeyIdentifier = hash\n'
                         '1.3.6.1.4.1.4843.7.3 = ASN1:UTF8String:%s'
                         ) % (FS_ID)
    efs_client_auth_body = ''
    efs_client_info_body = ''
    matching_config_body = mount_efs.CA_CONFIG_BODY % (tls_dict['mount_dir'], tls_dict['private_key'], COMMON_NAME,
                                                       ca_extension_body, efs_client_auth_body, efs_client_info_body)

    assert full_config_body == matching_config_body


def test_create_ca_conf_no_ap_no_iam_with_client_source(tmpdir):
    current_time = mount_efs.get_utc_now()
    tls_dict, full_config_body = _create_ca_conf_helper(tmpdir, current_time, iam=False, ap=False, client_info=True)

    ca_extension_body = ('[ v3_ca ]\n'
                         'subjectKeyIdentifier = hash\n'
                         '1.3.6.1.4.1.4843.7.3 = ASN1:UTF8String:%s\n' 
                        '1.3.6.1.4.1.4843.7.4 = ASN1:SEQUENCE:efs_client_info'
                         ) % (FS_ID)
    efs_client_auth_body = ''
    efs_client_info_body = mount_efs.efs_client_info_builder(CLIENT_INFO)
    matching_config_body = mount_efs.CA_CONFIG_BODY % (tls_dict['mount_dir'], tls_dict['private_key'], COMMON_NAME,
                                                       ca_extension_body, efs_client_auth_body, efs_client_info_body)

409
    assert full_config_body == matching_config_body