Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

microbu-esp32c5/external/vanetza-idf/vanetza/security/v2/tests/certificate_cache.cpp

@@ -0,0 +1,135 @@
+#include <gtest/gtest.h>
+#include <vanetza/common/manual_runtime.hpp>
+#include <vanetza/security/v2/certificate.hpp>
+#include <vanetza/security/v2/certificate_cache.hpp>
+#include <vanetza/security/tests/serialization.hpp>
+
+using namespace vanetza;
+using namespace vanetza::security;
+using namespace vanetza::security::v2;
+
+class CertificateCacheTest : public ::testing::Test
+{
+public:
+    CertificateCacheTest() :
+        runtime(Clock::at("2018-01-03 17:15")),
+        cache(runtime)
+    {
+    }
+
+    Certificate build_certificate(SubjectType subject_type, uint8_t id = 0)
+    {
+        Certificate cert;
+        cert.subject_info.subject_type = subject_type;
+        cert.signer_info = HashedId8 {{ id, id, id, id, id, id, id, id }};
+        EcdsaSignature signature;
+        X_Coordinate_Only x_only;;
+        x_only.x.insert(x_only.x.end(), 32, 0x22);
+        signature.R = std::move(x_only);
+        signature.s.insert(signature.s.end(), 32, 0x11);
+        cert.signature = std::move(signature);
+        return cert;
+    }
+
+protected:
+    ManualRuntime runtime;
+    CertificateCache cache;
+};
+
+static const HashedId8 zero_id = {{ 0, 0, 0, 0, 0, 0, 0, 0 }};
+
+TEST_F(CertificateCacheTest, lookup)
+{
+    const Certificate cert = build_certificate(SubjectType::Authorization_Ticket);
+    const HashedId8 cert_id = calculate_hash(cert);
+
+    // empty cache
+    EXPECT_EQ(0, cache.lookup(cert_id, SubjectType::Authorization_Ticket).size());
+
+    cache.insert(cert);
+
+    // cache only contains 'cert' and must be able to find it
+    EXPECT_EQ(1, cache.lookup(cert_id, SubjectType::Authorization_Ticket).size());
+
+    // cache only contains 'cert' and must not return it for other types
+    EXPECT_EQ(0, cache.lookup(cert_id, SubjectType::Authorization_Authority).size());
+
+    // but nothing else
+    HashedId8 other_id = cert_id;
+    other_id[3] = cert_id[3] + 1;
+    EXPECT_EQ(0, cache.lookup(other_id, SubjectType::Authorization_Ticket).size());
+}
+
+TEST_F(CertificateCacheTest, insert_only_some_subject_type)
+{
+    cache.insert(build_certificate(SubjectType::Enrollment_Credential));
+    EXPECT_EQ(0, cache.size());
+    cache.insert(build_certificate(SubjectType::Authorization_Ticket));
+    EXPECT_EQ(1, cache.size());
+    cache.insert(build_certificate(SubjectType::Authorization_Authority));
+    EXPECT_EQ(2, cache.size());
+    cache.insert(build_certificate(SubjectType::Enrollment_Authority));
+    EXPECT_EQ(2, cache.size());
+    cache.insert(build_certificate(SubjectType::Root_CA));
+    EXPECT_EQ(2, cache.size());
+    cache.insert(build_certificate(SubjectType::CRL_Signer));
+    EXPECT_EQ(2, cache.size());
+}
+
+TEST_F(CertificateCacheTest, drop_expired)
+{
+    const Certificate cert1 = build_certificate(SubjectType::Authorization_Ticket); // 2 seconds
+    const Certificate cert2 = build_certificate(SubjectType::Authorization_Authority); // 1 hour
+    ASSERT_NE(calculate_hash(cert1), calculate_hash(cert2));
+    cache.insert(cert1);
+    cache.insert(cert2);
+    ASSERT_EQ(2, cache.size());
+
+    runtime.trigger(std::chrono::seconds(3));
+    EXPECT_EQ(2, cache.size());
+    cache.lookup(zero_id, SubjectType::Authorization_Ticket); // any lookup drops expired cache entries
+    EXPECT_EQ(1, cache.size());
+
+    runtime.trigger(std::chrono::minutes(60));
+    cache.lookup(zero_id, SubjectType::Authorization_Ticket);
+    EXPECT_EQ(0, cache.size());
+}
+
+TEST_F(CertificateCacheTest, lookup_match_extends_lifetime)
+{
+    const Certificate cert1 = build_certificate(SubjectType::Authorization_Ticket);
+    const Certificate cert2 = build_certificate(SubjectType::Authorization_Authority);
+    const HashedId8 id_cert2 = calculate_hash(cert2);
+
+    cache.insert(cert1);
+    cache.insert(cert2);
+    EXPECT_EQ(2, cache.size());
+
+    for (unsigned i = 0; i < 3601; ++i) {
+        runtime.trigger(std::chrono::seconds(1));
+        cache.lookup(id_cert2, SubjectType::Authorization_Authority);
+    }
+    EXPECT_EQ(1, cache.size());
+    EXPECT_EQ(1, cache.lookup(id_cert2, SubjectType::Authorization_Authority).size());
+}
+
+TEST_F(CertificateCacheTest, insert_extends_lifetime)
+{
+    const Certificate cert = build_certificate(SubjectType::Authorization_Ticket);
+    const HashedId8 id = calculate_hash(cert);
+    EXPECT_NE(zero_id, id);
+
+    cache.insert(cert);
+    EXPECT_EQ(1, cache.size());
+
+    runtime.trigger(std::chrono::seconds(1));
+    cache.insert(cert);
+    EXPECT_EQ(1, cache.size());
+
+    cache.lookup(zero_id, SubjectType::Authorization_Ticket);
+    EXPECT_EQ(1, cache.size());
+
+    runtime.trigger(std::chrono::seconds(2));
+    cache.lookup(id, SubjectType::Authorization_Ticket);
+    EXPECT_EQ(1, cache.size());
+}