112 lines
2.9 KiB
Go
112 lines
2.9 KiB
Go
package db
|
|
|
|
import (
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"encoding/pem"
|
|
"math/big"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestEffectiveSSLMode(t *testing.T) {
|
|
if got := EffectiveSSLMode(ConnReq{}); got != "disable" {
|
|
t.Fatalf("empty -> disable, got %s", got)
|
|
}
|
|
if got := EffectiveSSLMode(ConnReq{SSL: true}); got != "require" {
|
|
t.Fatalf("ssl true -> require, got %s", got)
|
|
}
|
|
if got := EffectiveSSLMode(ConnReq{SSL: true, SSLMode: "skip-verify"}); got != "skip-verify" {
|
|
t.Fatalf("mode wins, got %s", got)
|
|
}
|
|
if got := EffectiveSSLMode(ConnReq{SSL: true, SSLMode: "disable"}); got != "disable" {
|
|
t.Fatalf("explicit disable, got %s", got)
|
|
}
|
|
if !SSLEnabled(ConnReq{SSLMode: "require"}) {
|
|
t.Fatal("require should enable")
|
|
}
|
|
}
|
|
|
|
func TestTLSConfigFromDisable(t *testing.T) {
|
|
cfg, err := tlsConfigFrom(ConnReq{})
|
|
if err != nil || cfg != nil {
|
|
t.Fatalf("disable => nil,nil got %#v %v", cfg, err)
|
|
}
|
|
}
|
|
|
|
func TestTLSConfigFromSkipVerify(t *testing.T) {
|
|
cfg, err := tlsConfigFrom(ConnReq{SSL: true, SSLMode: "skip-verify", Host: "db.example"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if cfg == nil || !cfg.InsecureSkipVerify {
|
|
t.Fatalf("expected InsecureSkipVerify, got %#v", cfg)
|
|
}
|
|
if cfg.ServerName != "db.example" {
|
|
t.Fatalf("ServerName %q", cfg.ServerName)
|
|
}
|
|
}
|
|
|
|
func TestTLSConfigFromVerifyCARequiresPath(t *testing.T) {
|
|
_, err := tlsConfigFrom(ConnReq{SSLMode: "verify-ca"})
|
|
if err == nil {
|
|
t.Fatal("expected error without CA")
|
|
}
|
|
}
|
|
|
|
func TestTLSConfigFromVerifyCAWithPEM(t *testing.T) {
|
|
dir := t.TempDir()
|
|
caPath := filepath.Join(dir, "ca.pem")
|
|
if err := writeTestCA(caPath); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
cfg, err := tlsConfigFrom(ConnReq{SSLMode: "verify-ca", SSLCA: caPath, Host: "127.0.0.1"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if cfg == nil || cfg.RootCAs == nil {
|
|
t.Fatal("expected RootCAs")
|
|
}
|
|
if cfg.VerifyPeerCertificate == nil {
|
|
t.Fatal("expected custom verify for verify-ca")
|
|
}
|
|
}
|
|
|
|
func TestTLSConfigFromBadCAPath(t *testing.T) {
|
|
_, err := tlsConfigFrom(ConnReq{SSLMode: "require", SSLCA: "/no/such/ca.pem"})
|
|
if err == nil {
|
|
t.Fatal("expected read error")
|
|
}
|
|
}
|
|
|
|
func writeTestCA(path string) error {
|
|
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
tmpl := &x509.Certificate{
|
|
SerialNumber: big.NewInt(1),
|
|
Subject: pkix.Name{CommonName: "opsxdb-test-ca"},
|
|
NotBefore: time.Now().Add(-time.Hour),
|
|
NotAfter: time.Now().Add(24 * time.Hour),
|
|
IsCA: true,
|
|
KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
|
|
BasicConstraintsValid: true,
|
|
}
|
|
der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
f, err := os.Create(path)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer f.Close()
|
|
return pem.Encode(f, &pem.Block{Type: "CERTIFICATE", Bytes: der})
|
|
}
|