import (
"crypto/sha1"
+ "crypto/tls"
"encoding/hex"
"fmt"
"io/ioutil"
passwdPath = "testdata/passwd.nsscash"
plainPath = "testdata/plain"
groupPath = "testdata/group.nsscash"
+ tlsCAPath = "testdata/ca.crt"
+ tlsCertPath = "testdata/server.crt"
+ tlsKeyPath = "testdata/server.key"
+ tlsCA2Path = "testdata/ca2.crt"
)
type args struct {
type = "passwd"
url = "%[2]s/passwd"
path = "%[3]s"
-`, statePath, url, passwdPath))
+ca = "%[4]s"
+`, statePath, url, passwdPath, tlsCAPath))
}
func mustWriteGroupConfig(t *testing.T, url string) {
type = "group"
url = "%[2]s/group"
path = "%[3]s"
-`, statePath, url, groupPath))
+ca = "%[4]s"
+`, statePath, url, groupPath, tlsCAPath))
}
// mustCreate creates a file, truncating it if it exists. It then changes the
fetchSecondFetchFails,
}
+ // HTTP tests
+
+ for _, f := range tests {
+ runMainTest(t, f, nil)
+ }
+
+ // HTTPS tests
+
+ tests = append(tests, fetchInvalidCA)
+
+ cert, err := tls.LoadX509KeyPair(tlsCertPath, tlsKeyPath)
+ if err != nil {
+ t.Fatal(err)
+ }
+ tls := &tls.Config{
+ Certificates: []tls.Certificate{cert},
+ }
+
+ for _, f := range tests {
+ runMainTest(t, f, tls)
+ }
+}
+
+func runMainTest(t *testing.T, f func(args), tls *tls.Config) {
cleanup := []string{
configPath,
statePath,
groupPath,
}
- for _, f := range tests {
- // NOTE: This is not guaranteed to work according to reflect's
- // documentation but seems to work reliable for normal
- // functions.
- fn := runtime.FuncForPC(reflect.ValueOf(f).Pointer())
- name := fn.Name()
- name = name[strings.LastIndex(name, ".")+1:]
-
- t.Run(name, func(t *testing.T) {
- // Preparation & cleanup
- for _, p := range cleanup {
- err := os.Remove(p)
- if err != nil && !os.IsNotExist(err) {
- t.Fatal(err)
- }
- // Remove the file at the end of this test
- // run, if it was created
- defer os.Remove(p)
+ // NOTE: This is not guaranteed to work according to reflect's
+ // documentation but seems to work reliable for normal functions.
+ fn := runtime.FuncForPC(reflect.ValueOf(f).Pointer())
+ name := fn.Name()
+ name = name[strings.LastIndex(name, ".")+1:]
+ if tls != nil {
+ name = "tls" + name
+ }
+
+ t.Run(name, func(t *testing.T) {
+ // Preparation & cleanup
+ for _, p := range cleanup {
+ err := os.Remove(p)
+ if err != nil && !os.IsNotExist(err) {
+ t.Fatal(err)
}
+ // Remove the file at the end of this test run, if it
+ // was created
+ defer os.Remove(p)
+ }
- var handler func(http.ResponseWriter, *http.Request)
- ts := httptest.NewServer(http.HandlerFunc(
- func(w http.ResponseWriter, r *http.Request) {
- handler(w, r)
- }))
- defer ts.Close()
-
- f(args{
- t: t,
- url: ts.URL,
- handler: &handler,
- })
+ var handler func(http.ResponseWriter, *http.Request)
+ ts := httptest.NewUnstartedServer(http.HandlerFunc(
+ func(w http.ResponseWriter, r *http.Request) {
+ handler(w, r)
+ }))
+ if tls == nil {
+ ts.Start()
+ } else {
+ ts.TLS = tls
+ ts.StartTLS()
+ }
+ defer ts.Close()
+
+ f(args{
+ t: t,
+ url: ts.URL,
+ handler: &handler,
})
- }
+ })
}
func fetchPasswdCacheFileDoesNotExist(a args) {
type = "plain"
url = "%[2]s/plain"
path = "%[3]s"
-`, statePath, a.url, plainPath))
+ca = "%[4]s"
+`, statePath, a.url, plainPath, tlsCAPath))
mustCreate(t, plainPath)
*a.handler = func(w http.ResponseWriter, r *http.Request) {
type = "plain"
url = "%[2]s/plain"
path = "%[3]s"
-`, statePath, a.url, plainPath))
+ca = "%[4]s"
+`, statePath, a.url, plainPath, tlsCAPath))
mustCreate(t, plainPath)
mustHaveHash(t, plainPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
type = "passwd"
url = "%[2]s/passwd"
path = "%[3]s"
+ca = "%[5]s"
[[file]]
type = "group"
url = "%[2]s/group"
path = "%[4]s"
-`, statePath, a.url, passwdPath, groupPath))
+ca = "%[5]s"
+`, statePath, a.url, passwdPath, groupPath, tlsCAPath))
mustCreate(t, passwdPath)
mustCreate(t, groupPath)
mustHaveHash(t, passwdPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
// because the second fetch failed
mustBeOld(t, passwdPath, groupPath)
}
+
+func fetchInvalidCA(a args) {
+ t := a.t
+
+ // System CA
+
+ mustWriteConfig(t, fmt.Sprintf(`
+statepath = "%[1]s"
+
+[[file]]
+type = "passwd"
+url = "%[2]s/passwd"
+path = "%[3]s"
+`, statePath, a.url, passwdPath))
+ mustCreate(t, passwdPath)
+ mustHaveHash(t, passwdPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+
+ *a.handler = func(w http.ResponseWriter, r *http.Request) {
+ if r.URL.Path == "/passwd" {
+ fmt.Fprintln(w, "root:x:0:0:root:/root:/bin/bash")
+ }
+ }
+
+ err := mainFetch(configPath)
+ mustBeErrorWithSubstring(t, err,
+ "x509: certificate signed by unknown authority")
+
+ mustNotExist(t, statePath, plainPath, groupPath)
+ mustBeOld(t, passwdPath)
+
+ // Invalid CA
+
+ mustWriteConfig(t, fmt.Sprintf(`
+statepath = "%[1]s"
+
+[[file]]
+type = "passwd"
+url = "%[2]s/passwd"
+path = "%[3]s"
+ca = "%[4]s"
+`, statePath, a.url, passwdPath, tlsCA2Path))
+ mustCreate(t, passwdPath)
+ mustHaveHash(t, passwdPath, "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+
+ *a.handler = func(w http.ResponseWriter, r *http.Request) {
+ if r.URL.Path == "/passwd" {
+ fmt.Fprintln(w, "root:x:0:0:root:/root:/bin/bash")
+ }
+ }
+
+ err = mainFetch(configPath)
+ mustBeErrorWithSubstring(t, err,
+ "x509: certificate signed by unknown authority")
+
+ mustNotExist(t, statePath, plainPath, groupPath)
+ mustBeOld(t, passwdPath)
+}