Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generate certificates at runtime for runner test #3527

Merged
merged 3 commits into from
Jan 11, 2024
Merged

Generate certificates at runtime for runner test #3527

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
057477b
Generate certificates at runtime for runner test
joanlopez Jan 10, 2024
872a23b
Use 127.0.0.1 as certificate address
joanlopez Jan 10, 2024
d8427ae
Unexport test helpers
joanlopez Jan 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 40 additions & 66 deletions js/runner_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -910,7 +910,15 @@ func TestVUIntegrationMetrics(t *testing.T) {
}
}

func GenerateTLSCertificateWithCA(t *testing.T, host string, notBefore time.Time, validFor time.Duration, caCert *x509.Certificate, caKey *rsa.PrivateKey) ([]byte, []byte) {
codebien marked this conversation as resolved.
Show resolved Hide resolved
return generateTLSCertificate(t, host, notBefore, validFor, caCert, caKey)
}

func GenerateTLSCertificate(t *testing.T, host string, notBefore time.Time, validFor time.Duration) ([]byte, []byte) {
return generateTLSCertificate(t, host, notBefore, validFor, nil, nil)
}

func generateTLSCertificate(t *testing.T, host string, notBefore time.Time, validFor time.Duration, parent *x509.Certificate, ppriv *rsa.PrivateKey) ([]byte, []byte) {
priv, err := rsa.GenerateKey(rand.Reader, 2048)
require.NoError(t, err)

Expand All @@ -937,7 +945,6 @@ func GenerateTLSCertificate(t *testing.T, host string, notBefore time.Time, vali
NotAfter: notAfter,

KeyUsage: keyUsage,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beyond the new logic to have support for CA cert & key (if parent == nil { ... }), this is the only line from the original method that I have modified (removed), because with this line the test doesn't work (because the generated cert cannot be used to sign later) and without it everything works as expected, so 👌🏻

BasicConstraintsValid: true,
SignatureAlgorithm: x509.SHA256WithRSA,
}
Expand All @@ -951,10 +958,14 @@ func GenerateTLSCertificate(t *testing.T, host string, notBefore time.Time, vali
}
}

template.IsCA = true
template.KeyUsage |= x509.KeyUsageCertSign
if parent == nil {
template.IsCA = true
template.KeyUsage |= x509.KeyUsageCertSign
parent = &template
ppriv = priv
}

derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
derBytes, err := x509.CreateCertificate(rand.Reader, &template, parent, &priv.PublicKey, ppriv)
require.NoError(t, err)

certPem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
Expand Down Expand Up @@ -1699,56 +1710,32 @@ func TestVUIntegrationVUID(t *testing.T) {
}
}

/*
CA key:
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIDEm8bxihqYfAsWP39o5DpkAksPBw+3rlDHNX+d69oYGoAoGCCqGSM49
AwEHoUQDQgAEeeuCFQsdraFJr8JaKbAKfjYpZ2U+p3r/OzcmAsjFO8EckmV9uFZs
Gq3JurKi9Z3dDKQcwinHQ1malicbwWhamQ==
-----END EC PRIVATE KEY-----
*/
func TestVUIntegrationClientCerts(t *testing.T) {
t.Parallel()

// Generate CA key and certificate
caCertPem, caKeyPem := GenerateTLSCertificate(t, "ca.localhost", time.Now(), time.Hour)

caCertBlock, _ := pem.Decode(caCertPem)
caCert, err := x509.ParseCertificate(caCertBlock.Bytes)
require.NoError(t, err)

caKeyBlock, _ := pem.Decode(caKeyPem)
caKeyAny, err := x509.ParsePKCS8PrivateKey(caKeyBlock.Bytes)
require.NoError(t, err)
caKey, ok := caKeyAny.(*rsa.PrivateKey)
require.True(t, ok)

// Generate server key and certificate
srvCertPem, srvKeyPem := GenerateTLSCertificateWithCA(t, "server.localhost", time.Now(), time.Hour, caCert, caKey)

// Generate client Key and Certificate
clCertPem, clKeyPem := GenerateTLSCertificateWithCA(t, "client.localhost", time.Now(), time.Hour, caCert, caKey)

clientCAPool := x509.NewCertPool()
assert.True(t, clientCAPool.AppendCertsFromPEM(
[]byte("-----BEGIN CERTIFICATE-----\n"+
"MIIBWzCCAQGgAwIBAgIJAIQMBgLi+DV6MAoGCCqGSM49BAMCMBAxDjAMBgNVBAMM\n"+
"BU15IENBMCAXDTIyMDEyMTEyMjkzNloYDzMwMjEwNTI0MTIyOTM2WjAQMQ4wDAYD\n"+
"VQQDDAVNeSBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHnrghULHa2hSa/C\n"+
"WimwCn42KWdlPqd6/zs3JgLIxTvBHJJlfbhWbBqtybqyovWd3QykHMIpx0NZmpYn\n"+
"G8FoWpmjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud\n"+
"DgQWBBSkukBA8lgFvvBJAYKsoSUR+PX71jAKBggqhkjOPQQDAgNIADBFAiEAiFF7\n"+
"Y54CMNRSBSVMgd4mQgrzJInRH88KpLsQ7VeOAaQCIEa0vaLln9zxIDZQKocml4Db\n"+
"AEJr8tDzMKIds6sRTBT4\n"+
"-----END CERTIFICATE-----"),
))
serverCert, err := tls.X509KeyPair(
[]byte("-----BEGIN CERTIFICATE-----\n"+
"MIIBcTCCARigAwIBAgIJAIP0njRt16gbMAoGCCqGSM49BAMCMBAxDjAMBgNVBAMM\n"+
"BU15IENBMCAXDTIyMDEyMTE1MTA0OVoYDzMwMjEwNTI0MTUxMDQ5WjAZMRcwFQYD\n"+
"VQQDDA4xMjcuMC4wLjE6Njk2OTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABH8Y\n"+
"exy5LI9r+RNwVpf/5ZX86EigMYHp9YOyiUMmfUfvDig+BGhlwjm7Lh2941Gz4amO\n"+
"lpN2YAkcd0wnNLHkVOmjUDBOMA4GA1UdDwEB/wQEAwIBBjAMBgNVHRMBAf8EAjAA\n"+
"MB0GA1UdDgQWBBQ9cIYUwwzfzBXPyRGB5tNpAgHWujAPBgNVHREECDAGhwR/AAAB\n"+
"MAoGCCqGSM49BAMCA0cAMEQCIDjRZlg+jKgI9K99HOM2wS9+URr6R1/FYLZYBtMc\n"+
"pq3hAiB9NQxNqV459fgN0BpbiLrEvJjquRFoUr9BWsG+hHrHtQ==\n"+
"-----END CERTIFICATE-----\n"+
"-----BEGIN CERTIFICATE-----\n"+
"MIIBWzCCAQGgAwIBAgIJAIQMBgLi+DV6MAoGCCqGSM49BAMCMBAxDjAMBgNVBAMM\n"+
"BU15IENBMCAXDTIyMDEyMTEyMjkzNloYDzMwMjEwNTI0MTIyOTM2WjAQMQ4wDAYD\n"+
"VQQDDAVNeSBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHnrghULHa2hSa/C\n"+
"WimwCn42KWdlPqd6/zs3JgLIxTvBHJJlfbhWbBqtybqyovWd3QykHMIpx0NZmpYn\n"+
"G8FoWpmjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud\n"+
"DgQWBBSkukBA8lgFvvBJAYKsoSUR+PX71jAKBggqhkjOPQQDAgNIADBFAiEAiFF7\n"+
"Y54CMNRSBSVMgd4mQgrzJInRH88KpLsQ7VeOAaQCIEa0vaLln9zxIDZQKocml4Db\n"+
"AEJr8tDzMKIds6sRTBT4\n"+
"-----END CERTIFICATE-----"),
[]byte("-----BEGIN EC PRIVATE KEY-----\n"+
"MHcCAQEEIHNpjs0P9/ejoUYF5Agzf9clHR4PwBsVfZ+JgslfuBg1oAoGCCqGSM49\n"+
"AwEHoUQDQgAEfxh7HLksj2v5E3BWl//llfzoSKAxgen1g7KJQyZ9R+8OKD4EaGXC\n"+
"ObsuHb3jUbPhqY6Wk3ZgCRx3TCc0seRU6Q==\n"+
"-----END EC PRIVATE KEY-----"),
)
assert.True(t, clientCAPool.AppendCertsFromPEM(caCertPem))

serverCert, err := tls.X509KeyPair(append(srvCertPem, caCertPem...), srvKeyPem)
require.NoError(t, err)

testdata := map[string]struct {
Expand Down Expand Up @@ -1806,21 +1793,8 @@ func TestVUIntegrationClientCerts(t *testing.T) {
opt.TLSAuth = []*lib.TLSAuth{
{
TLSAuthFields: lib.TLSAuthFields{
Cert: "-----BEGIN CERTIFICATE-----\n" +
"MIIBVzCB/6ADAgECAgkAg/SeNG3XqB0wCgYIKoZIzj0EAwIwEDEOMAwGA1UEAwwF\n" +
"TXkgQ0EwIBcNMjIwMTIxMTUxMjM0WhgPMzAyMTA1MjQxNTEyMzRaMBExDzANBgNV\n" +
"BAMMBmNsaWVudDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKM7OJQMYG4KLtDA\n" +
"gZ8zOg2PimHMmQnjD2HtI4cSwIUJJnvHWLowbFe9fk6XeP9b3dK1ImUI++/EZdVr\n" +
"ABAcngejPzA9MA4GA1UdDwEB/wQEAwIBBjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQW\n" +
"BBSttJe1mcPEnBOZ6wvKPG4zL0m1CzAKBggqhkjOPQQDAgNHADBEAiBPSLgKA/r9\n" +
"u/FW6W+oy6Odm1kdNMGCI472iTn545GwJgIgb3UQPOUTOj0IN4JLJYfmYyXviqsy\n" +
"zk9eWNHFXDA9U6U=\n" +
"-----END CERTIFICATE-----",
Key: "-----BEGIN EC PRIVATE KEY-----\n" +
"MHcCAQEEINDaMGkOT3thu1A0LfLJr3Jd011/aEG6OArmEQaujwgpoAoGCCqGSM49\n" +
"AwEHoUQDQgAEozs4lAxgbgou0MCBnzM6DY+KYcyZCeMPYe0jhxLAhQkme8dYujBs\n" +
"V71+Tpd4/1vd0rUiZQj778Rl1WsAEByeBw==\n" +
"-----END EC PRIVATE KEY-----",
Cert: string(clCertPem),
Key: string(clKeyPem),
},
},
}
Expand Down
Loading