smallstep-certificates/ca/identity/client_test.go

package identity

import (
	"crypto/tls"
	"crypto/x509"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"reflect"
	"sort"
	"testing"
)

func returnInput(val string) func() string {
	return func() string {
		return val
	}
}

func TestClient(t *testing.T) {
	oldIdentityFile := IdentityFile
	oldDefaultsFile := DefaultsFile
	defer func() {
		IdentityFile = oldIdentityFile
		DefaultsFile = oldDefaultsFile
	}()

	IdentityFile = returnInput("testdata/config/identity.json")
	DefaultsFile = returnInput("testdata/config/defaults.json")

	client, err := LoadClient()
	if err != nil {
		t.Fatal(err)
	}

	okServer := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
			w.WriteHeader(http.StatusUnauthorized)
		} else {
			w.WriteHeader(http.StatusOK)
		}
	}))
	defer okServer.Close()

	crt, err := tls.LoadX509KeyPair("testdata/certs/server.crt", "testdata/secrets/server_key")
	if err != nil {
		t.Fatal(err)
	}
	b, err := os.ReadFile("testdata/certs/root_ca.crt")
	if err != nil {
		t.Fatal(err)
	}
	pool := x509.NewCertPool()
	pool.AppendCertsFromPEM(b)

	okServer.TLS = &tls.Config{
		Certificates: []tls.Certificate{crt},
		ClientCAs:    pool,
		ClientAuth:   tls.VerifyClientCertIfGiven,
		MinVersion:   tls.VersionTLS12,
	}
	okServer.StartTLS()

	badServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("ok"))
	}))
	defer badServer.Close()

	if resp, err := client.Get(okServer.URL); err != nil {
		t.Errorf("client.Get() error = %v", err)
	} else {
		resp.Body.Close()
		if resp.StatusCode != http.StatusOK {
			t.Errorf("client.Get() = %d, want %d", resp.StatusCode, http.StatusOK)
		}
	}

	if _, err := client.Get(badServer.URL); err == nil {
		t.Errorf("client.Get() error = %v, wantErr true", err)
	}
}

func TestClient_ResolveReference(t *testing.T) {
	type fields struct {
		CaURL *url.URL
	}
	type args struct {
		ref *url.URL
	}
	tests := []struct {
		name   string
		fields fields
		args   args
		want   *url.URL
	}{
		{"ok", fields{&url.URL{Scheme: "https", Host: "localhost"}}, args{&url.URL{Path: "/foo"}}, &url.URL{Scheme: "https", Host: "localhost", Path: "/foo"}},
		{"ok", fields{&url.URL{Scheme: "https", Host: "localhost", Path: "/bar"}}, args{&url.URL{Path: "/foo"}}, &url.URL{Scheme: "https", Host: "localhost", Path: "/foo"}},
		{"ok", fields{&url.URL{Scheme: "https", Host: "localhost"}}, args{&url.URL{Path: "/foo", RawQuery: "foo=bar"}}, &url.URL{Scheme: "https", Host: "localhost", Path: "/foo", RawQuery: "foo=bar"}},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &Client{
				CaURL: tt.fields.CaURL,
			}
			if got := c.ResolveReference(tt.args.ref); !reflect.DeepEqual(got, tt.want) {
				t.Errorf("Client.ResolveReference() = %v, want %v", got, tt.want)
			}
		})
	}
}

func TestLoadClient(t *testing.T) {
	oldIdentityFile := IdentityFile
	oldDefaultsFile := DefaultsFile
	defer func() {
		IdentityFile = oldIdentityFile
		DefaultsFile = oldDefaultsFile
	}()

	crt, err := tls.LoadX509KeyPair("testdata/identity/identity.crt", "testdata/identity/identity_key")
	if err != nil {
		t.Fatal(err)
	}
	b, err := os.ReadFile("testdata/certs/root_ca.crt")
	if err != nil {
		t.Fatal(err)
	}
	pool := x509.NewCertPool()
	pool.AppendCertsFromPEM(b)

	tr := http.DefaultTransport.(*http.Transport).Clone()
	tr.TLSClientConfig = &tls.Config{
		Certificates: []tls.Certificate{crt},
		RootCAs:      pool,
		MinVersion:   tls.VersionTLS12,
	}
	expected := &Client{
		CaURL: &url.URL{Scheme: "https", Host: "127.0.0.1"},
		Client: &http.Client{
			Transport: tr,
		},
	}

	tests := []struct {
		name    string
		prepare func()
		want    *Client
		wantErr bool
	}{
		{"ok", func() {
			IdentityFile = returnInput("testdata/config/identity.json")
			DefaultsFile = returnInput("testdata/config/defaults.json")
		}, expected, false},
		{"fail identity", func() {
			IdentityFile = returnInput("testdata/config/missing.json")
			DefaultsFile = returnInput("testdata/config/defaults.json")
		}, nil, true},
		{"fail identity", func() {
			IdentityFile = returnInput("testdata/config/fail.json")
			DefaultsFile = returnInput("testdata/config/defaults.json")
		}, nil, true},
		{"fail defaults", func() {
			IdentityFile = returnInput("testdata/config/identity.json")
			DefaultsFile = returnInput("testdata/config/missing.json")
		}, nil, true},
		{"fail defaults", func() {
			IdentityFile = returnInput("testdata/config/identity.json")
			DefaultsFile = returnInput("testdata/config/fail.json")
		}, nil, true},
		{"fail ca", func() {
			IdentityFile = returnInput("testdata/config/identity.json")
			DefaultsFile = returnInput("testdata/config/badca.json")
		}, nil, true},
		{"fail root", func() {
			IdentityFile = returnInput("testdata/config/identity.json")
			DefaultsFile = returnInput("testdata/config/badroot.json")
		}, nil, true},
		{"fail type", func() {
			IdentityFile = returnInput("testdata/config/badIdentity.json")
			DefaultsFile = returnInput("testdata/config/defaults.json")
		}, nil, true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			tt.prepare()
			got, err := LoadClient()
			if (err != nil) != tt.wantErr {
				t.Errorf("LoadClient() error = %v, wantErr %v", err, tt.wantErr)
				return
			}
			if tt.want == nil {
				if !reflect.DeepEqual(got, tt.want) {
					t.Errorf("LoadClient() = %#v, want %#v", got, tt.want)
				}
			} else {
				gotTransport := got.Client.Transport.(*http.Transport)
				wantTransport := tt.want.Client.Transport.(*http.Transport)
				switch {
				case gotTransport.TLSClientConfig.GetClientCertificate == nil:
					t.Error("LoadClient() transport does not define GetClientCertificate")
				case !reflect.DeepEqual(got.CaURL, tt.want.CaURL) || !equalPools(gotTransport.TLSClientConfig.RootCAs, wantTransport.TLSClientConfig.RootCAs):
					t.Errorf("LoadClient() = %#v, want %#v", got, tt.want)
				default:
					crt, err := gotTransport.TLSClientConfig.GetClientCertificate(nil)
					if err != nil {
						t.Errorf("LoadClient() GetClientCertificate error = %v", err)
					} else if !reflect.DeepEqual(*crt, wantTransport.TLSClientConfig.Certificates[0]) {
						t.Errorf("LoadClient() GetClientCertificate crt = %#v, want %#v", *crt, wantTransport.TLSClientConfig.Certificates[0])
					}
				}

			}
		})
	}
}

func Test_defaultsConfig_Validate(t *testing.T) {
	type fields struct {
		CaURL string
		Root  string
	}
	tests := []struct {
		name    string
		fields  fields
		wantErr bool
	}{
		{"ok", fields{"https://127.0.0.1", "root_ca.crt"}, false},
		{"fail ca-url", fields{"", "root_ca.crt"}, true},
		{"fail root", fields{"https://127.0.0.1", ""}, true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &defaultsConfig{
				CaURL: tt.fields.CaURL,
				Root:  tt.fields.Root,
			}
			if err := c.Validate(); (err != nil) != tt.wantErr {
				t.Errorf("defaultsConfig.Validate() error = %v, wantErr %v", err, tt.wantErr)
			}
		})
	}
}

// nolint:staticcheck,gocritic
func equalPools(a, b *x509.CertPool) bool {
	if reflect.DeepEqual(a, b) {
		return true
	}
	subjects := a.Subjects()
	sA := make([]string, len(subjects))
	for i := range subjects {
		sA[i] = string(subjects[i])
	}
	subjects = b.Subjects()
	sB := make([]string, len(subjects))
	for i := range subjects {
		sB[i] = string(subjects[i])
	}
	sort.Strings(sA)
	sort.Strings(sB)
	return reflect.DeepEqual(sA, sB)
}