xianyun_pki/
domain.rs

1//! Leaf verification within a cluster's DNS domain.
2//!
3//! Ported from `internal/pki/domain_test.go`. `domain.go` doesn't exist in
4//! the Go codebase either — this file holds only tests, exercising public
5//! API from `ca.rs`, `constraints.rs`, and `svc.rs`.
6
7#[cfg(test)]
8mod tests {
9    use crate::ca::load_or_generate;
10    use crate::constraints::build_permitted_dns;
11    use crate::svc::{issue_leaf, verify_against};
12
13    /// Ported from `TestLeafInClusterDomainVerifies`.
14    #[test]
15    fn leaf_in_cluster_domain_verifies() {
16        struct Case {
17            name: &'static str,
18            cluster_domain: &'static str,
19            san: &'static str,
20        }
21
22        let cases = [
23            Case {
24                name: "default cluster domain",
25                cluster_domain: "cluster.local",
26                san: "web.gitlab.svc.cluster.local",
27            },
28            Case {
29                name: "custom cluster domain",
30                cluster_domain: "corp.example",
31                san: "web.gitlab.svc.corp.example",
32            },
33        ];
34
35        for case in cases {
36            let pki_dir = tempfile::tempdir().unwrap();
37            let ca = load_or_generate(
38                pki_dir.path(),
39                &build_permitted_dns("gitlab.test", case.cluster_domain),
40            )
41            .unwrap();
42
43            let leaf = issue_leaf(&ca, case.san);
44
45            assert!(verify_against(&leaf, &ca).is_ok(), "case: {}", case.name);
46        }
47    }
48}
xianyun_pki/domain.rs

xianyun_pki/
domain.rs
