101 lines
2.7 KiB
Go
101 lines
2.7 KiB
Go
|
package tlsconfig
|
||
|
|
|
||
|
|
import (
|
||
|
|
"crypto/sha256"
|
||
|
|
"crypto/tls"
|
||
|
|
"encoding/base64"
|
||
|
|
"io"
|
||
|
|
"net/http"
|
||
|
|
"net/http/httptest"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func pinForCertificate(certificate *tls.Certificate) string {
|
||
|
|
sum := sha256.Sum256(certificate.Leaf.RawSubjectPublicKeyInfo)
|
||
|
|
return base64.StdEncoding.EncodeToString(sum[:])
|
||
|
|
}
|
||
|
|
|
||
|
|
func clientForConfig(config *tls.Config) *http.Client {
|
||
|
|
return &http.Client{
|
||
|
|
Transport: &http.Transport{TLSClientConfig: config},
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestPinnedServerIdentity(t *testing.T) {
|
||
|
|
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||
|
|
_, _ = io.WriteString(w, "ok")
|
||
|
|
}))
|
||
|
|
defer server.Close()
|
||
|
|
|
||
|
|
correctPin := pinForCertificate(&server.TLS.Certificates[0])
|
||
|
|
config, err := Build(Options{SPKIPins: []string{correctPin}})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Build failed: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
response, err := clientForConfig(config).Get(server.URL)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("pinned request failed: %v", err)
|
||
|
|
}
|
||
|
|
defer response.Body.Close()
|
||
|
|
if response.StatusCode != http.StatusOK {
|
||
|
|
t.Fatalf("unexpected status: %d", response.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestPinnedServerRejectsRogueKey(t *testing.T) {
|
||
|
|
server := httptest.NewTLSServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
|
||
|
|
defer server.Close()
|
||
|
|
|
||
|
|
roguePin := base64.StdEncoding.EncodeToString(bytesOf(sha256.Size, 0x42))
|
||
|
|
config, err := Build(Options{SPKIPins: []string{roguePin}})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Build failed: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
_, err = clientForConfig(config).Get(server.URL)
|
||
|
|
if err == nil || !strings.Contains(err.Error(), "identity pin mismatch") {
|
||
|
|
t.Fatalf("expected pin mismatch, got %v", err)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestInvalidPinFailsClosed(t *testing.T) {
|
||
|
|
if _, err := Build(Options{SPKIPins: []string{"not-a-pin"}}); err == nil {
|
||
|
|
t.Fatal("expected invalid pin to be rejected")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestExplicitInsecureModeRemainsOptIn(t *testing.T) {
|
||
|
|
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||
|
|
w.WriteHeader(http.StatusNoContent)
|
||
|
|
}))
|
||
|
|
defer server.Close()
|
||
|
|
|
||
|
|
secureConfig, err := Build(Options{})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Build secure config failed: %v", err)
|
||
|
|
}
|
||
|
|
if _, err := clientForConfig(secureConfig).Get(server.URL); err == nil {
|
||
|
|
t.Fatal("untrusted self-signed certificate unexpectedly succeeded")
|
||
|
|
}
|
||
|
|
|
||
|
|
insecureConfig, err := Build(Options{InsecureSkipVerify: true})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Build insecure config failed: %v", err)
|
||
|
|
}
|
||
|
|
response, err := clientForConfig(insecureConfig).Get(server.URL)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("explicit insecure request failed: %v", err)
|
||
|
|
}
|
||
|
|
response.Body.Close()
|
||
|
|
}
|
||
|
|
|
||
|
|
func bytesOf(count int, value byte) []byte {
|
||
|
|
result := make([]byte, count)
|
||
|
|
for i := range result {
|
||
|
|
result[i] = value
|
||
|
|
}
|
||
|
|
return result
|
||
|
|
}
|