Todd
b58dada40d
* Move the server daemons into their own package With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons. The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.
62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
package credentialstores
|
|
|
|
import (
|
|
"encoding/pem"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/boundary/internal/credential/vault"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestPkAndClientCerts(t *testing.T) {
|
|
s := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
|
|
|
|
t.Run("seperate client cert and key", func(t *testing.T) {
|
|
c, k, err := extractClientCertAndPk(string(s.ClientCert), string(s.ClientKey))
|
|
assert.NoError(t, err)
|
|
require.NotNil(t, k)
|
|
assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
|
|
require.Len(t, c, 1)
|
|
assert.Equal(t, s.ClientCert, pem.EncodeToMemory(c[0]))
|
|
})
|
|
|
|
t.Run("client cert and key bundled in cert", func(t *testing.T) {
|
|
c, k, err := extractClientCertAndPk(string(s.ClientCert)+string(s.ClientKey), "")
|
|
assert.NoError(t, err)
|
|
require.NotNil(t, k)
|
|
assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
|
|
require.Len(t, c, 1)
|
|
assert.Equal(t, s.ClientCert, pem.EncodeToMemory(c[0]))
|
|
})
|
|
|
|
t.Run("cert with no private key", func(t *testing.T) {
|
|
c, k, err := extractClientCertAndPk(string(s.ClientCert), "")
|
|
assert.NoError(t, err)
|
|
assert.Nil(t, k)
|
|
require.Len(t, c, 1)
|
|
assert.Equal(t, s.ClientCert, pem.EncodeToMemory(c[0]))
|
|
})
|
|
|
|
t.Run("private key with no cert", func(t *testing.T) {
|
|
c, k, err := extractClientCertAndPk("", string(s.ClientKey))
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, k)
|
|
assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
|
|
require.Empty(t, c)
|
|
})
|
|
|
|
t.Run("error cases", func(t *testing.T) {
|
|
_, _, err := extractClientCertAndPk(string(s.ClientCert), "invalid key")
|
|
assert.Error(t, err)
|
|
_, _, err = extractClientCertAndPk("invalid cert", string(s.ClientKey))
|
|
assert.Error(t, err)
|
|
|
|
// private key with the cert and the private key
|
|
c, k, err := extractClientCertAndPk(string(s.ClientCert)+string(s.ClientKey), string(s.ClientKey))
|
|
assert.Error(t, err)
|
|
assert.Nil(t, k)
|
|
assert.Empty(t, c)
|
|
})
|
|
}
|