-
Notifications
You must be signed in to change notification settings - Fork 5
/
authority_test.go
139 lines (113 loc) · 3.77 KB
/
authority_test.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
package tlsconfig
import (
"crypto/x509"
"os"
"strings"
"testing"
"code.cloudfoundry.org/tlsconfig/certtest"
)
func TestEmptyPool(t *testing.T) {
t.Parallel()
pool, err := FromEmptyPool().Build()
if err != nil {
t.Fatalf("unexpected error when building empty pool: %q", err)
}
if !pool.Equal(x509.NewCertPool()) {
t.Errorf("expected pool to be empty")
}
}
func TestSystemPool(t *testing.T) {
t.Parallel()
pool, err := FromSystemPool().Build()
if err != nil {
t.Fatalf("unexpected error when building system pool: %q", err)
}
systemPool, err := x509.SystemCertPool()
if err != nil {
t.Fatalf("unexpected error when getting system pool: %q", err)
}
if !pool.Equal(systemPool) {
t.Errorf("expected pool to equal %#v, got %#v", systemPool, pool)
}
}
func TestWithCert(t *testing.T) {
t.Parallel()
auth, err := certtest.BuildCA("theauthority")
if err != nil {
t.Fatalf("failed to create CA: %s", err)
}
cert, err := auth.Certificate()
if err != nil {
t.Fatalf("failed to create certificate: %s", err)
}
pool, err := FromEmptyPool(
WithCert(cert),
).Build()
if err != nil {
t.Fatalf("unexpected error when building pool: %q", err)
}
//lint:ignore SA1019 - we are not using Subject() based on the system pool
if want, have := 1, len(pool.Subjects()); have != want { //nolint:staticcheck
t.Errorf("expected pool to have size %d but it had %d certificates", want, have)
}
//lint:ignore SA1019 - we are not using Subject() based on the system pool
if s, subj := "theauthority", string(pool.Subjects()[0]); !strings.Contains(subj, s) { //nolint:staticcheck
t.Errorf("pool should have contained cert with subject %q but it was acutally %q", s, subj)
}
}
func TestLoadCertsFromFile(t *testing.T) {
t.Parallel()
auth, err := certtest.BuildCA("authority")
if err != nil {
t.Fatalf("failed to create CA: %s", err)
}
cert1, err := auth.BuildSignedCertificate("cert1")
if err != nil {
t.Fatalf("failed to create certificate: %s", err)
}
cert1Pem, _, err := cert1.CertificatePEMAndPrivateKey()
if err != nil {
t.Fatalf("failed to PEM-encode certificate: %s", err)
}
cert2, err := auth.BuildSignedCertificate("cert2")
if err != nil {
t.Fatalf("failed to create certificate: %s", err)
}
cert2Pem, _, err := cert2.CertificatePEMAndPrivateKey()
if err != nil {
t.Fatalf("failed to PEM-encode certificate: %s", err)
}
f, err := os.CreateTemp("", "tlsconfig_authority")
if err != nil {
t.Fatalf("failed to create temporary certificate file: %s", err)
}
if _, err := f.Write(cert1Pem); err != nil {
t.Fatalf("failed to write PEM to file: %s", err)
}
if _, err := f.Write(cert2Pem); err != nil {
t.Fatalf("failed to write PEM to file: %s", err)
}
if err := f.Close(); err != nil {
t.Fatalf("failed to close certificate file: %s", err)
}
defer os.Remove(f.Name())
pool, err := FromEmptyPool(
WithCertsFromFile(f.Name()),
).Build()
if err != nil {
t.Fatalf("unexpected error when building pool: %q", err)
}
// We add 2 certificates to the pool from the file.
//lint:ignore SA1019 - we are not using Subject() based on the system pool
if want, have := 2, len(pool.Subjects()); have != want { //nolint:staticcheck
t.Errorf("expected pool to have size %d but it had %d certificates", want, have)
}
//lint:ignore SA1019 - we are not using Subject() based on the system pool
if s, subj := "cert1", string(pool.Subjects()[0]); !strings.Contains(subj, s) { //nolint:staticcheck
t.Errorf("pool should have contained cert with subject %q but it was acutally %q", s, subj)
}
//lint:ignore SA1019 - we are not using Subject() based on the system pool
if s, subj := "cert2", string(pool.Subjects()[1]); !strings.Contains(subj, s) { //nolint:staticcheck
t.Errorf("pool should have contained cert with subject %q but it was acutally %q", s, subj)
}
}