From ea1ce69ec958130f0d14260fa62e0b69b1052a65 Mon Sep 17 00:00:00 2001
From: Richard Zak <richard@profian.com>
Date: Mon, 17 Oct 2022 18:14:11 -0400
Subject: [PATCH] Adding canned CSRs, tests

Signed-off-by: Richard Zak <richard@profian.com>
---
 src/ext/sgx/icelake.csr | Bin 0 -> 4971 bytes
 src/ext/snp/milan.csr   | Bin 0 -> 2850 bytes
 src/main.rs             |  36 +++++++++++++++++++++++++++++++++---
 3 files changed, 33 insertions(+), 3 deletions(-)
 create mode 100644 src/ext/sgx/icelake.csr
 create mode 100644 src/ext/snp/milan.csr

diff --git a/src/ext/sgx/icelake.csr b/src/ext/sgx/icelake.csr
new file mode 100644
index 0000000000000000000000000000000000000000..e397a2284e2fcc2c728c532d1fd73276fcab673d
GIT binary patch
literal 4971
zcmc&&YmnR274~K~yNU85yAWO>zyv6;4VE9fUQ=H8O0q1iWm}RZTb@GkYh}sr_1dxp
zElnT^q%fo;ff)ic;ZXu*7)lCc3TX-@NgGOl3?V6P2WWu86xvcAnU+F&?cGhhd5{Et
zR5KcDzH@c%x%YnOd`HF?^{Duwp6Qd?EVu<%@Se`D3zvAeUplF+b4v4}y{)SqS~}Wi
z@BGPs&CR#|XjkCd;q~$z9qj7$+bI6}b2ojuZqL$=^W@dLfAHd*OM2eF0H1T=dvk_}
zRiDiG@aLEJx39cu#ixr`zqMvj_d0x0_x+tyk=G@AXS7Y7X<O923PC?c_br`RZ)aOa
z+x1)LwN2_+)cyT-%Op$V>at9?thjU7vG*?DLo2Zv>sMXZ+4YwzXZe$N?b^Nd#!b&%
zvn^0-jO*;2Ib+|x#?!G~lgEbrb?o=uO?O~dC+eGDbZy-0-n$(vduvxte|gTT*H3%;
zqZiHZ`Htq54y}21ZF0{r_xgiNwK*%_p<aI8aazy3r+<6#YYW!iGw+L|z5oBVKd|wJ
z%b&dMm&JLvPhPe&xO(Sz7k=_^*Yq{DtwGlQ$_;<G^=R?^?gWeFox9(@=dRujS9WZ=
z|B2bt7koTzccA+5PnT{Un6`FTc-F4uhV|#Zzs>vL@+aPVX6*%o{q(XIuG+rA_)^<)
z_WZf`;6KwpiCq>CKYq^AvtIi3!r7<3`}wTJUC&OXcJ!Y=>#+y7?$~;n=i$5GS@_nK
z@t%)&2LC;0_}-o8d~ok~ezotB*(cxmeEEY-|2$p}oHVwmaSlA%eaWVWvga+n`i-4$
zeCZ8sCog^b&HwN_7M|i;dH$~ZuK4_DdvJ3gT-kMd@Uq)`t~0hQTXd&Ie&m)9iziN-
za{5$q`Q~emgPlj4>G1Y8lr7)n>UwkLwcYFf^otkXoAK(-ZL!CfulU=^`xbkZGyk>Z
zxy7Gd>^hq7?zL++{(bpv*WP%>tBcn^pxyV_XHzJb?~i-hZ@Q@Z=|x{Wx}dYR<?Vfe
zjZ0p$&VA+s_J^lDwR>p{-1N{jS3E!T=c)UqoMo}JO=|C$+}Sl{DmHEUjG41enBCoT
z;z@H(KIPQYPM>?myfY_TVlyq41&s?*G~+*upo9?PVF(bSnkdFG3^ia91Y|W87z_j|
zBZ*0^S07>MNX}gg6mzr=r~$ib=dv!`AXJ4JEJPVo$0;=4z!D^-aRi`&O+tVX6~lda
zG;F96o>UkQB*i-9<Fp5l=G^tT2uVIf#W<)o#}ld{VB;_Fc6U8NyX#6sD8}v1nui1;
zRQ)mp368M&)A78JW+;DIiLhyoFB=4}kTTCR7zx;hS04v5O|LM`5wgq~-gLsx=}e6y
zsX7<p>H(7P3pcUM1Plx7(BMSIU_jF&Ny03PX3NG27!qu%Dp7tPnmL=u3&m(ItD^|B
zoKP_6(eZ;A2|eR4kZ}iVpgWzUv(>mxNgQNGqcRMiWcO5(G^O(PS~`)VYJ>^c#u72K
z?I?ObY*`mg8LTXsFv>xWhV>FHa!xl;DViY0o(;+ia0WmcuVbNPN|34s*;^fm4sivq
zpA)rg$x5@sq{|6&g>s1*Vcc3_09Ryp5RaCmbUcv?4s(#DQ#GB&dW{mDXX?5)Rfbwl
zu{->Ox~g&k#1E3t!B8ViugFm}3BoEA<+#n^uL{+4zXaKOGK6E?fD_6_H6@d9xH(uD
zprRzyIGRu+C74KOi-n|DFcM~=>a%-{nAnFW^0Jwv<xIjZ*Rdqp*=U5T#6}5JQS9y!
zpTnO|5pIODcq|+(Ds~V0bys{2#q>F#9<%%Fanh|TA)A36U|BR9&-trSI$MdFwoEj_
z7~Te11UvwtLV4&IAy%TUff4|$i|wz$vd#}nB38@~R5;*l99NPwC}=hK2FGcG1c<R{
z{Q?KU&;SK=0MNb=0YhOMxsa}={eZ_I1`+5Z2?A)U;Z>EvRwLkfUQ&VsDQDSd4wWfq
zC>bw^by5hS@nMN3v=WVpOxzjbDddeYRMjJ+`DmhX_6Kl86^c3xPBd`rFa{DC$iv{&
zD2@o#G69BW_MjR7tR@hkS}vtC8r@6bC~qkOs;F=T2Mh`*z6ncH69nKv6UQbR)cuBu
zc;*Orfj|+AdYbq``3Nr<hv3Kojy4HD#4w6GkAM&C$0sf!4fY!*M3klwUN*eOL3@E}
z6h?stae`K>0a~xd22JFI!4qhJ;W-FL^?;`V4G}>R)4)KJ90xcc4I=-C5Dcn_VBX+x
ztY*fra2|4+YK2UN9IEJ$f@-1lD7_r19CC~hQ6ACz&|`!RT^KX8?g6TrP5dBDAVqY7
zn4mIgzzNx$%~neXQnqlfFJ`CuhKLYlH`$VH(BrU);fM#1MBL%J*99~R3|AvoCSFO4
zz7Z1})MQV&*e|eBzU<G(Dn-hl;0q(T3QfEYxl6I8fKh((P*H1Ijx2aYR!2Ff+s6e@
z2CQ6-B<yaw*IVSNJZlT`rm1=&gu74TKw*E$g@7Y4j#g_(5|u_pKmbQcSya^JGUM@k
z!vqxLb~ldH0=6ndt3Y61M<H4T0vl7lF@*prkAc?$B(QNhg@jEqxDbpX%;e0880Q5w
zMh7Z39y&cSbe_k{szle2c15d+9Io;>)w0yW{-t7Qebq!BqCunem=kz|Qk&}OCBaBY
zK{Z@KVvkC4U1^bK0wCE&PO)+2gFp#^tQ_Jz8G|wuZ-ZW_wLq!0zs(>4pCEY^P<|0w
zT_bi|HX;TvJ5e!<HN)jhvCw6w>Ljg(`-UULNX<SXhkT{}^kAmn?3FYjO5{s|t5^<H
z)siPA*0Q-!md#?RP)@Ul71L1)z=}!03VE=|@miEO!{H*1YeNBYgq6jr4a5Utf*vNJ
z*xW=f5;@U?EJvkOAqL5G#?vBl6FY`P{a6GKA0<<xdy;bQY7!C2mlLuH9VD9)#5*aE
z%1ha>JBgWbJnl?oftbikZZa4Ea>D1x@&?&B2>}lR-fKmbq#*$GSR0b0Ms<zh5P>n2
z)Xm~{Z~_YkFa*G;k+Pi8aHCi2mlZnfkUUnqy%LM0aD^pxo0P)xpf{wGwwTtJAQ(c4
z+eDBf`)Zk?kX)=5oKm5#iArsl4Eu7D;3OEgf3Q9j^!I*)+|^OD3UqNicO@n#akgwJ
z>1Xn$>JnvX*v->sCJ#%-q0MTHJkWfiW>pyPJx7~Wwi<WvM<jiN^Vl~beS`C3sW(P?
z=!}pd%87CoHK>%~C#4$aDIkpR<3fztxc#AwEg%<+@yM~UKKr;sACDYs^iRi|udV5d
z9c#W4{dvmZNJfbUbgLE&mkBdQ4QejT7SIBsPw=F}v>wkxnH`ez8O2#~FnWem6d%sj
z0?u5iTvzlgjAcWzQu74uWfl(hnc2Yr#J*0xjy7<k>56@wd~NMdG4zEq+Mpg|z8=g{
ztd*w6ny;hjN;PTSY*NNP!kU8H)Z0MV+Q(;vUeQfxBAM_P3Wl!|6ny0{J!Dlh7cEBI
zPN*6oL&X|`>tyllu(!aKdn1Lug0&p!54ibo%`1RvRH6e(fp;aUB_R?kF<+&(I5zg*
zS4aD#cE*BxCY^1$WB$#*nX>1}(~EUw%SjUc`=`=7avx1CZ+PVV$<=LFt)S76oBzSj
i^<DUiLwsMG|8y`KpM1%>`GYS#<-H1gi;(ttcmEIYLB+QK

literal 0
HcmV?d00001

diff --git a/src/ext/snp/milan.csr b/src/ext/snp/milan.csr
new file mode 100644
index 0000000000000000000000000000000000000000..c7e70d42231498572a620603efd1a8a019135335
GIT binary patch
literal 2850
zcmXqL;+8XL;#$JQ$Y8)=P-Y;&#;(=oan6>Bk&RWmk%d8tIf;Q~$#Kc3ggzdBg9*MS
z&3hIcxSxA`vHydk+cU4ouP<m~bPZ>nerfT9BW70Y+caDM>~qw$n!csy=!wr46MxrE
zeDqXF!1_V6`=PH>zuxMu_6q0kJ^g*c{pHIRp1K%d_HVBd>xu<UT*^R4$g^<*?QZ+d
z%gD)R*u*6O6ygD54mK`rHbxf4=HqgV%q&fuKMa~UzZf*J`WQ4Z{a(P##K;74yc=9I
zBbR~Y0)7KtHqL}L55`nx7A7WEhJ`W)QV10sXtIldrWh;+5{w4bh9U++Y|No7+&tW_
zdFh#Xsi{SodFh7S2Am*KHesgFV3-ni9`4}8yplu(=bXf%M3@o|9wui;LwN&Pka{j2
zF~^j$#JuFx6b0YR<f429m(;S%<kVtAAz)Yo6)^K~2D^so`ex=N<{8L|^BNf$SQ=Rx
z8kty_nneM*mPlNKDwxf*cATIAKg4kyAjgF{yL#hF8$t{0z7*BJ`Qf<6kZYmdIscM5
z2{y5JCr3v}ZM8`~w1DgM?c4f6|0f(x7yPgyyyRxCp5knuy!ZZh#b;}-nb6Js{B+-$
z>H1Cb;z9Xla(k|69Qva_zx>Iv&nkYatoG==Zke^XiBZg;i4hc9oZw_Ir-G4@1sGKf
z2I2@2CKfI+4saOiIvE%ULQ@P-DKl6t6N(TML_4x77EB>lOd&Q*A$Ck5W{?mYij5o~
zp;!Z7go9aF9AY*l>^$V#HD|xn>Q-C6)$2^|EN{P2wr={5>kFQ<Uu-zXe&z3`TeTS?
zo4!Y@Xlc&<+t_$8ys*bRc;(vX^O`RC?4?$cXKn%pW|el;FM~fXjkoc&Ub_2Mi?t|U
z>hRs<(lftuTtXkunsh1Ww8J4sC)Ovr5oZ^CHhb9fBJ<ac=oP0`&)UyX+!<5Kuk3tf
zm*TuBDgq17X-SKxeioS<bL@eC-UiF~%Tu3~IxvdPdXoP2+5Ab@-4<<Gb>aP#EqB*`
z{oV8X`~q8^FQK33+=}qiol}_oC9brZeWCP!R_W=^H&|Y1SjC>b;QD7N%l@_cCzpyn
zojXS)cfynvznqq4&wjDd?bNQ@bwM7=?0fgmFZ|_QSiRPcXOpd>!?z9@SEI0XdupC~
zS@tl@;OShc{PVeAgHq%4`AzpSK5gLh(c@QA+>l_a8MnXE!cS4x-~>aFAKS4uXU9*c
z6E>PX3HrT2;O!M|{kqOo>TFj}Op%&m5RhP*p7nGYU(e~|f!7pv^1H;Y-14-4&j+KQ
zJrjKL<ckiT<U87#A>Vg@zf-2RN~@2^^|~|4UrwcD-b&S%W7d&5^Qm5A`r|;4ikpWN
z(r>xhK0Cr4r1H=+YDMC+OFitXPrrT5#8i33)^x+Q>?`(Cdy@^`yyaMW-D>Gk(H>Xp
z9_7l}y*thRS_<--|Gd8WSj9^9D|=cGUb}8mHPd;!>%3I8yGs(P{JtlYG_RNwkpA6d
z!53{`aob&66Pz+_HTyIsZ@$JqpG)dAqp);0Kigt1o5|{DA_M+?Z5A|E5h^oosGBbw
z$<oBKfQbPDj2W4sEW#8cPzgjITP%o;3}S7a-+Wg4*0}k_)fE{jtoBE{+qxrowA!P7
z-eNKgEwN?`JHEcR>j3AM?;esCaUsRXdO_^v2Q|v~%u1aZWXEc%vA-r*t7uo`4A!~l
z_DtgVu(cyuZsKN_r8Bty{+$(mP%6pxZXUXRdh?HI*S`!b*&%-EOUdb+mobwyH+j7H
za#TjSo%6VBaxZ)9e*yp&j=0=SX@LPVpV^p^0fb?ET=oq%aR&+O%`<<5T@SE#)Uz*I
zkfi7P?a$NYJNE3d)4RFxGEb7vlIJrdFW(V3f3&anbWKkmF88OO(q~+`Y0l&m=Ck*F
zRCieOD{ED);6cvdv+ifkG9NEI_t3*=s;*omSO2UpcTIW<4&gFqRGhvcV8F%30dAbK
zFf%h}Fc_pV8L+rd-gV!%Ue&Q&%3*~|+a$FX{>38BPi8JruCm|ns{hmci-|?P&m3QO
zt<Z@%om&<#88S@#U;FU+HgVIid0%)x_wZEA$tX#CuCQ7uP0qDL=k?xVf1!o*?3$<C
NGj{!*@_k+0HvosI@(ut1

literal 0
HcmV?d00001

diff --git a/src/main.rs b/src/main.rs
index fcc62e67..6f7e72da 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -511,15 +511,14 @@ mod tests {
         use der::{AnyRef, Encode};
         use x509::attr::Attribute;
         use x509::request::{CertReq, CertReqInfo, ExtensionReq};
-        #[cfg(feature = "insecure")]
         use x509::PkiPath;
         use x509::{ext::Extension, name::RdnSequence};
 
-        #[cfg(feature = "insecure")]
         use axum::response::Response;
         use http::header::CONTENT_TYPE;
         use http::Request;
         use hyper::Body;
+        #[cfg(feature = "insecure")]
         use rstest::rstest;
         use tower::ServiceExt; // for `app.oneshot()`
 
@@ -586,7 +585,6 @@ mod tests {
             }
         }
 
-        #[cfg(feature = "insecure")]
         async fn attest_response(state: State, response: Response, multi: bool) {
             let body = hyper::body::to_bytes(response.into_body()).await.unwrap();
 
@@ -714,6 +712,22 @@ mod tests {
             assert_eq!(output.issued.len(), five_crs.len());
         }
 
+        #[tokio::test]
+        async fn sgx_canned_csr() {
+            let csr = include_bytes!("ext/sgx/icelake.csr");
+
+            let request = Request::builder()
+                .method("POST")
+                .uri("/")
+                .header(CONTENT_TYPE, PKCS10)
+                .body(Body::from(Bytes::from(csr.as_slice())))
+                .unwrap();
+
+            let response = app(certificates_state()).oneshot(request).await.unwrap();
+            assert_eq!(response.status(), StatusCode::OK);
+            attest_response(certificates_state(), response, false).await;
+        }
+
         #[cfg(feature = "insecure")]
         #[rstest]
         #[case(PKCS10, false)]
@@ -773,6 +787,22 @@ mod tests {
             }
         }
 
+        #[tokio::test]
+        async fn snp_canned_csr() {
+            let csr = include_bytes!("ext/snp/milan.csr");
+
+            let request = Request::builder()
+                .method("POST")
+                .uri("/")
+                .header(CONTENT_TYPE, PKCS10)
+                .body(Body::from(Bytes::from(csr.as_slice())))
+                .unwrap();
+
+            let response = app(certificates_state()).oneshot(request).await.unwrap();
+            assert_eq!(response.status(), StatusCode::OK);
+            attest_response(certificates_state(), response, false).await;
+        }
+
         #[cfg(feature = "insecure")]
         #[rstest]
         #[case(PKCS10, false)]