added kkp_ca_file config option

7 files changed, 160 insertions, 13 deletions

diff --git a/config/default.yml b/config/default.yml
index 8ddadce..898b91b 100644
--- a/config/default.yml
+++ b/config/default.yml
@@ -21,4 +21,4 @@ couch_password: ~
 # HKP
 #
 hkp_url: 'https://hkps.pool.sks-keyservers.net:/pks/lookup'
-
+hkp_ca_file: 'config/sks-keyservers.netCA.pem'
diff --git a/config/sks-keyservers.netCA.pem b/config/sks-keyservers.netCA.pem
new file mode 100644
index 0000000..24a2ad2
--- /dev/null
+++ b/config/sks-keyservers.netCA.pem
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFizCCA3OgAwIBAgIJAK9zyLTPn4CPMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNV
+BAYTAk5PMQ0wCwYDVQQIDARPc2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5u
+ZXQgQ0ExHjAcBgNVBAMMFXNrcy1rZXlzZXJ2ZXJzLm5ldCBDQTAeFw0xMjEwMDkw
+MDMzMzdaFw0yMjEwMDcwMDMzMzdaMFwxCzAJBgNVBAYTAk5PMQ0wCwYDVQQIDARP
+c2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5uZXQgQ0ExHjAcBgNVBAMMFXNr
+cy1rZXlzZXJ2ZXJzLm5ldCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBANdsWy4PXWNUCkS3L//nrd0GqN3dVwoBGZ6w94Tw2jPDPifegwxQozFXkG6I
+6A4TK1CJLXPvfz0UP0aBYyPmTNadDinaB9T4jIwd4rnxl+59GiEmqkN3IfPsv5Jj
+MkKUmJnvOT0DEVlEaO1UZIwx5WpfprB3mR81/qm4XkAgmYrmgnLXd/pJDAMk7y1F
+45b5zWofiD5l677lplcIPRbFhpJ6kDTODXh/XEdtF71EAeaOdEGOvyGDmCO0GWqS
+FDkMMPTlieLA/0rgFTcz4xwUYj/cD5e0ZBuSkYsYFAU3hd1cGfBue0cPZaQH2HYx
+Qk4zXD8S3F4690fRhr+tki5gyG6JDR67aKp3BIGLqm7f45WkX1hYp+YXywmEziM4
+aSbGYhx8hoFGfq9UcfPEvp2aoc8u5sdqjDslhyUzM1v3m3ZGbhwEOnVjljY6JJLx
+MxagxnZZSAY424ZZ3t71E/Mn27dm2w+xFRuoy8JEjv1d+BT3eChM5KaNwrj0IO/y
+u8kFIgWYA1vZ/15qMT+tyJTfyrNVV/7Df7TNeWyNqjJ5rBmt0M6NpHG7CrUSkBy9
+p8JhimgjP5r0FlEkgg+lyD+V79H98gQfVgP3pbJICz0SpBQf2F/2tyS4rLm+49rP
+fcOajiXEuyhpcmzgusAj/1FjrtlynH1r9mnNaX4e+rLWzvU5AgMBAAGjUDBOMB0G
+A1UdDgQWBBTkwyoJFGfYTVISTpM8E+igjdq28zAfBgNVHSMEGDAWgBTkwyoJFGfY
+TVISTpM8E+igjdq28zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQAR
+OXnYwu3g1ZjHyley3fZI5aLPsaE17cOImVTehC8DcIphm2HOMR/hYTTL+V0G4P+u
+gH+6xeRLKSHMHZTtSBIa6GDL03434y9CBuwGvAFCMU2GV8w92/Z7apkAhdLToZA/
+X/iWP2jeaVJhxgEcH8uPrnSlqoPBcKC9PrgUzQYfSZJkLmB+3jEa3HKruy1abJP5
+gAdQvwvcPpvYRnIzUc9fZODsVmlHVFBCl2dlu/iHh2h4GmL4Da2rRkUMlbVTdioB
+UYIvMycdOkpH5wJftzw7cpjsudGas0PARDXCFfGyKhwBRFY7Xp7lbjtU5Rz0Gc04
+lPrhDf0pFE98Aw4jJRpFeWMjpXUEaG1cq7D641RpgcMfPFvOHY47rvDTS7XJOaUT
+BwRjmDt896s6vMDcaG/uXJbQjuzmmx3W2Idyh3s5SI0GTHb0IwMKYb4eBUIpQOnB
+cE77VnCYqKvN1NVYAqhWjXbY7XasZvszCRcOG+W3FqNaHOK/n/0ueb0uijdLan+U
+f4p1bjbAox8eAOQS/8a3bzkJzdyBNUKGx1BIK2IBL9bn/HravSDOiNRSnZ/R3l9G
+ZauX0tu7IIDlRCILXSyeazu0aj/vdT3YFQXPcvt5Fkf5wiNTo53f72/jYEJd6qph
+WrpoKqrwGwTpRUCMhYIUt65hsTxCiJJ5nKe39h46sg==
+-----END CERTIFICATE-----
diff --git a/lib/nickserver/config.rb b/lib/nickserver/config.rb
index 31fbfea..0f44b79 100644
--- a/lib/nickserver/config.rb
+++ b/lib/nickserver/config.rb
@@ -9,6 +9,7 @@ module Nickserver
 
     class << self
       attr_accessor :hkp_url
+      attr_accessor :hkp_ca_file
       attr_accessor :couch_port
       attr_accessor :couch_host
       attr_accessor :couch_database
@@ -32,10 +33,27 @@ module Nickserver
         end
         true
       end
+      self.validate
     end
 
     private
 
+    def self.validate
+      if @hkp_ca_file
+        # look for the hkp_ca_file either by absolute path or relative to nickserver gem root
+        [@hkp_ca_file, File.expand_path(@hkp_ca_file, "#{__FILE__}/../../../")].each do |file|
+          if File.exists?(file)
+            @hkp_ca_file = file
+            break
+          end
+        end
+        unless File.exists?(@hkp_ca_file)
+          STDERR.puts "ERROR in configuration: cannot find hkp_ca_file `#{@hkp_ca_file}`"
+          exit(1)
+        end
+      end
+    end
+
     def self.load_config(file_path)
       begin
         YAML.load(File.read(file_path)).each do |key, value|
diff --git a/test/files/autistici-ca.pem b/test/files/autistici-ca.pem
new file mode 100644
index 0000000..f7f5c12
--- /dev/null
+++ b/test/files/autistici-ca.pem
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIHGzCCBQOgAwIBAgIJAOz4nHK3k904MA0GCSqGSIb3DQEBBQUAMIGCMQswCQYD
+VQQGEwJJVDEcMBoGA1UEChMTQXV0aXN0aWNpL0ludmVudGF0aTE0MDIGA1UEAxMr
+QXV0aXN0aWNpL0ludmVudGF0aSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEfMB0G
+CSqGSIb3DQEJARYQY2FAYXV0aXN0aWNpLm9yZzAeFw0wNTEwMDgxNDIxMTRaFw0x
+NTA5MjkxNDIxMTRaMIGCMQswCQYDVQQGEwJJVDEcMBoGA1UEChMTQXV0aXN0aWNp
+L0ludmVudGF0aTE0MDIGA1UEAxMrQXV0aXN0aWNpL0ludmVudGF0aSBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQY2FAYXV0aXN0aWNpLm9y
+ZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM0J8NPYkgcSrBpBXxEo
+rDoxPwbwUP+IYfVD/clMV66mBTovzGaZYC/q+Y8JcpvYPpLDs+Cwm0MSGRFLV8j8
+w6fmQI0ybaV5m4htGiM4HmzMaJ2b7kBuBuCM2GprSgpESS9EXJ+q0kmuMiKkvl5/
+ZdHB0DVUoNN7qnvlRTz9yK7PzXioPVHA+i6ViH90WxYpdndBjI+vSEcA9t7kVU2N
+gjuZuFDcz99e+yHn5o/yTomX0Te8BndznVlyaypIUyTVTdKAoHHJ5PoL3FkdaYAe
+CamXbLev8+9nt9p4Vc1JBiou9y6jG/Eklp9v4+fQ+p+RJxt64H+DmYpTgnWTm/3Q
+XZQuLCLyRFuLuc5hrywBQMiBFPIaZBYJmW6fYI9yIjbXbndQujWq1WFdk65NWg4t
+8PxRvmzvpIdd7WKRAPbjXsUVfDPD/k3XqZzHNd7W70kWCvszbQLH+syNUVMhgBF2
+rx19A9fbsH8GT5asNx1xqfJpueyhgl+7o2s1kjCC20RPw+Umue/JqDlorvrqBqSx
+I/VOGKipUsw/WW3c3CSIE+k5GVGoBQ07f+I+qmFl3p1yqVLk4aiDUy+UBQMWsCYH
+pyPJpyNF7254WLgb5ZaBCB55K1T72iUDx4VJn1uQd8sXjPpFlyjhIvvIszcXw0t0
+IuO8TJYgLyQbGvLwskPpaxwJAgMBAAGjggGQMIIBjDAdBgNVHQ4EFgQUcgSPaLY/
+zYu2JDg6NydLKwFrjW0wgbcGA1UdIwSBrzCBrIAUcgSPaLY/zYu2JDg6NydLKwFr
+jW2hgYikgYUwgYIxCzAJBgNVBAYTAklUMRwwGgYDVQQKExNBdXRpc3RpY2kvSW52
+ZW50YXRpMTQwMgYDVQQDEytBdXRpc3RpY2kvSW52ZW50YXRpIENlcnRpZmljYXRp
+b24gQXV0aG9yaXR5MR8wHQYJKoZIhvcNAQkBFhBjYUBhdXRpc3RpY2kub3JnggkA
+7PiccreT3TgwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYwEQYJYIZIAYb4
+QgEBBAQDAgAHMEYGCWCGSAGG+EIBDQQ5FjdBdXRpc3RpY2kvSW52ZW50YXRpIENl
+cnRpZmljYXRpb24gQXV0aG9yaXR5IENlcnRpZmljYXRlMBsGA1UdEQQUMBKBEGNh
+QGF1dGlzdGljaS5vcmcwGwYDVR0SBBQwEoEQY2FAYXV0aXN0aWNpLm9yZzANBgkq
+hkiG9w0BAQUFAAOCAgEAOEHJZVfVVNwe2b9tu2CGjvnKjf/wIAc6qGvVp/o2aQpZ
+TDJWNWEMXqCgQ/c90Fk4thIr47TzYYl0eaNQBNN/l87WHGRmjuCTzhJCdBcdPrqI
+jwep3IouuwZMoN0VZCTlIgeZ/DX/HC3B3bE3HNGTWlBdk3mNobw1saE9CKKEbuDX
+FE1BFbZQ3Kc3vqCY3ZOOrOy1usposj5aq2n8kfnlylvSW3Xyxpd6Ad4MkEhDuohK
+W1vQlmKMyoLwMhLlGtfiqDxeKg/nzZCBavEXg4DIelRTbCuqMwglSDFO95R0uCUG
+meI6GQ/N1+8VVY4+3yMxSmua7kQ1A00J839qqduqcMfE5/KlnZ1IDY+kBP39jBa1
+JHgpRLc3zi8Rn0GRuxuMX3L4bYAWhqcNdlodgCvh1HU2JqWRdCv0xamy2XRk99m1
+zyTYZh5ZkthQJTCJcnKm/C91jLwzm0Jxze/xftBzTQopdZ2zrr4JFGei9MHNpLZ7
+kBXXeobvgkl0bq4TLHP0wE6A9QgA39b8KQ/7LlCSHjpNxtQKv4y54Yz9Lsdj7eUh
+ZIRZTLZuwNzIlT0TGXaqQnLCmqKiP2AJKGAhUyAT4P3QXGheExdpcSyQ3X0kaVaS
+kWSqyylqMmL7oO1p7RVnSApnoVToqaTZXEj8DtmztgWUe7s2n/x8jYKR0qCtx84=
+-----END CERTIFICATE-----
diff --git a/test/files/mayfirst-ca.pem b/test/files/mayfirst-ca.pem
new file mode 100644
index 0000000..471f532
--- /dev/null
+++ b/test/files/mayfirst-ca.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAvagAwIBAgIJANhg2/WVrETtMA0GCSqGSIb3DQEBBQUAMIGMMR4wHAYD
+VQQKExVNYXkgRmlyc3QvUGVvcGxlIExpbmsxIDAeBgkqhkiG9w0BCQEWEWluZm9A
+bWF5Zmlyc3Qub3JnMREwDwYDVQQHEwhOZXcgWW9yazERMA8GA1UECBMITmV3IFlv
+cmsxCzAJBgNVBAYTAlVTMRUwEwYDVQQDEwxNRlBMIFJvb3QgQ0EwHhcNMDkwMTEy
+MTYyNjU3WhcNMTkwMTEwMTYyNjU3WjCBjDEeMBwGA1UEChMVTWF5IEZpcnN0L1Bl
+b3BsZSBMaW5rMSAwHgYJKoZIhvcNAQkBFhFpbmZvQG1heWZpcnN0Lm9yZzERMA8G
+A1UEBxMITmV3IFlvcmsxETAPBgNVBAgTCE5ldyBZb3JrMQswCQYDVQQGEwJVUzEV
+MBMGA1UEAxMMTUZQTCBSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+gQDQgYTGNjAJADudHV2MZ1QJQdf3YAMB1g/buR9ADsoTzM3vKWzXBvgoC6CFrojw
+RNbVtgU3A9aetLxaWJuBSqqREub+HyZvzD14tP90hq10YthtXoCtjhs6C/mEqckk
+LCGdTZ/lsIiM8tSdoE/OFQNRqk81A4lHgyumHlw3wnVICQIDAQABo4H0MIHxMAwG
+A1UdEwQFMAMBAf8wHQYDVR0OBBYEFHzhAs1Q0Pu6lbptL6VlnVVTDni0MIHBBgNV
+HSMEgbkwgbaAFHzhAs1Q0Pu6lbptL6VlnVVTDni0oYGSpIGPMIGMMR4wHAYDVQQK
+ExVNYXkgRmlyc3QvUGVvcGxlIExpbmsxIDAeBgkqhkiG9w0BCQEWEWluZm9AbWF5
+Zmlyc3Qub3JnMREwDwYDVQQHEwhOZXcgWW9yazERMA8GA1UECBMITmV3IFlvcmsx
+CzAJBgNVBAYTAlVTMRUwEwYDVQQDEwxNRlBMIFJvb3QgQ0GCCQDYYNv1laxE7TAN
+BgkqhkiG9w0BAQUFAAOBgQA8kagGZR+Tp6GRyQWYlcNW9xVYza/xPZhPY4dVYUtv
+Czcw5N1mB0R444c4jhVLIrPWUjcpz46akXXHMGpcIsX/rNetbLCtcE9/AuB+Xg1K
+Fwr/SXkZXVK1vIppXmV0ZBaIB/tRV/SozcGRN/D9ETYX4JhBZU6OXPxNVjp5dvlH
+vQ==
+-----END CERTIFICATE-----
diff --git a/test/test_helper.rb b/test/test_helper.rb
index d6eabe5..7fbe400 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -19,7 +19,11 @@ class Minitest::Test
   end
 
   def file_content(filename)
-    (@file_contents ||= {})[filename] ||= File.read("%s/files/%s" % [File.dirname(__FILE__), filename])
+    (@file_contents ||= {})[filename] ||= File.read(file_path(filename))
+  end
+
+  def file_path(filename)
+    "%s/files/%s" % [File.dirname(__FILE__), filename]
   end
 
   def real_network
@@ -54,4 +58,11 @@ class Minitest::Test
     end
   end
 
+  #
+  # temporarily stubs the config property for the duration of the given block
+  #
+  def stub_config(property, value, &block)
+    Nickserver::Config.stub(property, value, &block)
+  end
+
 end
diff --git a/test/unit/hkp_test.rb b/test/unit/hkp_test.rb
index 0ac4728..9c10aab 100644
--- a/test/unit/hkp_test.rb
+++ b/test/unit/hkp_test.rb
@@ -34,16 +34,6 @@ class HkpTest < Minitest::Test
     end
   end
 
-  def test_key_info_real_network
-    real_network do
-      uid = 'elijah@riseup.net'
-      test_em_callback "Nickserver::HKP::FetchKeyInfo.new.search '#{uid}'" do |keys|
-        assert_equal 1, keys.size
-        assert keys.first.keyid =~ /00440025$/
-      end
-    end
-  end
-
   def test_fetch_key
     uid    = 'cloudadmin@leap.se'
     key_id = 'E818C478D3141282F7590D29D041EB11B1647490'
@@ -77,6 +67,39 @@ class HkpTest < Minitest::Test
     end
   end
 
+  #
+  # real network tests
+  # remember: must be run with REAL_NET=true
+  #
+
+  def test_key_info_real_network
+    real_network do
+      uid = 'elijah@riseup.net'
+      test_em_callback "Nickserver::HKP::FetchKeyInfo.new.search '#{uid}'" do |keys|
+        assert_equal 1, keys.size
+        assert keys.first.keyid =~ /00440025$/
+      end
+    end
+  end
+
+  def test_tls_validation_with_real_network
+    hkp_url = 'https://keys.mayfirst.org/pks/lookup'
+    ca_file = file_path('mayfirst-ca.pem')
+
+    real_network do
+      stub_config(:hkp_url, hkp_url) do
+        stub_config(:hkp_ca_file, ca_file) do
+        #stub_config(:hkp_ca_file, file_path('autistici-ca.pem')) do
+          assert File.exists?(Nickserver::Config.hkp_ca_file)
+          uid = 'elijah@riseup.net'
+          test_em_callback "Nickserver::HKP::FetchKeyInfo.new.search '#{uid}'" do |keys|
+            assert_equal 1, keys.size
+            assert keys.first.keyid =~ /00440025$/
+          end
+        end
+      end
+    end
+  end
 
   protected
 
@@ -97,7 +120,8 @@ class HkpTest < Minitest::Test
       }
       deferrable.errback {|response, msg|
         EM.stop
-        flunk "Expecting callback, but errback invoked with response: #{response} #{msg}"
+        puts caller.join("\n")
+        flunk "Expecting callback, but errback invoked with response: #{response} #{msg}\n\n#{caller.join("\n")}"
       }
     end
     assert false, 'should not get here'