From 36e2b9ff890550303c99335e4a9f05bb4967f593 Mon Sep 17 00:00:00 2001
From: Denis Voytyuk <5462781+denisvmedia@users.noreply.github.com>
Date: Sat, 15 Apr 2023 01:56:46 +0200
Subject: [PATCH] test(general): added tests for tlsutil (#2933)

---
 internal/tlsutil/tlsutil_test.go | 68 ++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 internal/tlsutil/tlsutil_test.go

diff --git a/internal/tlsutil/tlsutil_test.go b/internal/tlsutil/tlsutil_test.go
new file mode 100644
index 000000000..e9aa27067
--- /dev/null
+++ b/internal/tlsutil/tlsutil_test.go
@@ -0,0 +1,68 @@
+package tlsutil_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/kopia/kopia/internal/clock"
+	"github.com/kopia/kopia/internal/tlsutil"
+)
+
+func TestGenerateServerCertificate(t *testing.T) {
+	ctx := context.Background()
+	certValid := 24 * time.Hour
+	names := []string{"127.0.0.1", "localhost"}
+
+	cert, priv, err := tlsutil.GenerateServerCertificate(ctx, 2048, certValid, names)
+	require.NoError(t, err)
+	require.NotNil(t, cert, "expected non-nil certificate")
+	require.NotNil(t, priv, "expected non-nil private key")
+	require.Len(t, cert.IPAddresses, 1)
+	require.Equal(t, cert.IPAddresses[0].String(), "127.0.0.1")
+	require.Len(t, cert.DNSNames, 1)
+	require.Equal(t, cert.DNSNames[0], "localhost")
+	require.False(t, cert.NotBefore.After(clock.Now()), "certificate NotBefore is in the future")
+	require.False(t, cert.NotAfter.Before(clock.Now().Add(certValid-time.Minute)), "certificate NotAfter is too early")
+}
+
+func TestTransportTrustingSingleCertificate(t *testing.T) {
+	ctx := context.Background()
+	certValid := 24 * time.Hour
+	names := []string{"127.0.0.1", "localhost"}
+
+	cert, _, err := tlsutil.GenerateServerCertificate(ctx, 2048, certValid, names)
+	if err != nil {
+		t.Fatalf("failed to generate server certificate: %v", err)
+	}
+
+	h := sha256.Sum256(cert.Raw)
+	fingerprint := hex.EncodeToString(h[:])
+
+	transport := tlsutil.TransportTrustingSingleCertificate(fingerprint)
+	require.NotNil(t, transport)
+
+	// Testing the VerifyPeerCertificate function
+	verifyPeerCertificate := transport.(*http.Transport).TLSClientConfig.VerifyPeerCertificate //nolint:forcetypeassert
+
+	t.Run("Test with the correct certificate", func(t *testing.T) {
+		rawCerts := [][]byte{cert.Raw}
+		err := verifyPeerCertificate(rawCerts, nil)
+		require.NoError(t, err)
+	})
+
+	t.Run("Test with an incorrect certificate", func(t *testing.T) {
+		invalidCert, _, err := tlsutil.GenerateServerCertificate(ctx, 2048, certValid, names)
+		require.NoError(t, err)
+
+		rawCerts := [][]byte{invalidCert.Raw}
+		err = verifyPeerCertificate(rawCerts, nil)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "can't find certificate matching SHA256 fingerprint")
+	})
+}