Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
1.9 kB · 62 lines
Go
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263package moq
import ( "crypto/tls" "encoding/pem" "errors" "os" "path/filepath" "testing" "time"
"github.com/stretchr/testify/require")
// The advertised hash is the fingerprint the transport pins: the SHA-256// of the leaf's DER, hex. The files a listener reads carry exactly the// certificate the hash names, and a rotation rewrites them with the new// one while the hash changes with it.func TestManagedTLSFilesFollowRotation(t *testing.T) { cert, err := NewSelfSignedCert() require.NoError(t, err) dir := filepath.Join(t.TempDir(), "moq") // A source with no certificate yet, a new node's ACME one, is no error // until the files are synced. ready := false files, err := ManagedTLSFiles(dir, func() (*tls.Certificate, error) { if !ready { return nil, errors.New("certificate not obtained yet") } return cert.Certificate() }) require.NoError(t, err) require.Error(t, files.Sync()) ready = true require.NoError(t, files.Sync())
leaf := func() string { pemBytes, err := os.ReadFile(files.CertPath) require.NoError(t, err) block, _ := pem.Decode(pemBytes) require.NotNil(t, block) return certHash(block.Bytes) } require.Equal(t, cert.Hash(), leaf()) keyInfo, err := os.Stat(files.KeyPath) require.NoError(t, err) require.Equal(t, os.FileMode(0o600), keyInfo.Mode().Perm()) _, err = tls.LoadX509KeyPair(files.CertPath, files.KeyPath) require.NoError(t, err)
// Age the certificate past the rotation point. Reading the advertised // hash alone must not rotate an identity the listener has not prepared. cert.mu.Lock() cert.exp = time.Now().Add(selfSignedLifetime - selfSignedRotate - time.Hour) cert.mu.Unlock() before := cert.Hash() require.Equal(t, leaf(), before) require.NoError(t, files.Sync()) require.NotEqual(t, before, leaf()) require.Equal(t, cert.Hash(), leaf()) require.NoError(t, files.Sync(), "an unchanged leaf is not rewritten")}