Skip to content

Commit b5b33be

Browse files
kruskallkruskall
authored
fix: do not leak testify package in tlscommon (#271)
* fix: do not leak testify package in tlscommon move testify methods to a separate test package to avoid polluting the module graph for downstream clients and leaking the dependency * test: fix compile error
1 parent e8b8e7b commit b5b33be

File tree

4 files changed

+28
-25
lines changed

4 files changed

+28
-25
lines changed

‎transport/tlscommon/ca_pinning_test.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232

3333
"github.com/elastic/elastic-agent-libs/config"
3434
"github.com/elastic/elastic-agent-libs/iobuf"
35+
"github.com/elastic/elastic-agent-libs/transport/tlscommontest"
3536
)
3637

3738
func TestCAPinning(t *testing.T) {
@@ -83,10 +84,10 @@ func TestCAPinning(t *testing.T) {
8384
t.Run(mode.String(), func(t *testing.T) {
8485
msg := []byte("OK received message")
8586

86-
ca, err := genCA()
87+
ca, err := tlscommontest.GenCA()
8788
require.NoError(t, err)
8889

89-
serverCert, err := genSignedCert(ca, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
90+
serverCert, err := tlscommontest.GenSignedCert(ca, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
9091
require.NoError(t, err)
9192

9293
mux := http.NewServeMux()
@@ -161,13 +162,13 @@ func TestCAPinning(t *testing.T) {
161162
t.Run("CA Root -> Intermediate -> Certificate and we receive the CA Root Pin", func(t *testing.T) {
162163
msg := []byte("OK received message")
163164

164-
ca, err := genCA()
165+
ca, err := tlscommontest.GenCA()
165166
require.NoError(t, err)
166167

167-
intermediate, err := genSignedCert(ca, x509.KeyUsageDigitalSignature|x509.KeyUsageCertSign, true, "localhost", []string{"localhost"}, nil, false)
168+
intermediate, err := tlscommontest.GenSignedCert(ca, x509.KeyUsageDigitalSignature|x509.KeyUsageCertSign, true, "localhost", []string{"localhost"}, nil, false)
168169
require.NoError(t, err)
169170

170-
serverCert, err := genSignedCert(intermediate, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
171+
serverCert, err := tlscommontest.GenSignedCert(intermediate, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
171172
require.NoError(t, err)
172173

173174
mux := http.NewServeMux()
@@ -235,13 +236,13 @@ func TestCAPinning(t *testing.T) {
235236
t.Run("When we have the wrong pin we refuse to connect", func(t *testing.T) {
236237
msg := []byte("OK received message")
237238

238-
ca, err := genCA()
239+
ca, err := tlscommontest.GenCA()
239240
require.NoError(t, err)
240241

241-
intermediate, err := genSignedCert(ca, x509.KeyUsageDigitalSignature|x509.KeyUsageCertSign, true, "localhost", []string{"localhost"}, nil, false)
242+
intermediate, err := tlscommontest.GenSignedCert(ca, x509.KeyUsageDigitalSignature|x509.KeyUsageCertSign, true, "localhost", []string{"localhost"}, nil, false)
242243
require.NoError(t, err)
243244

244-
serverCert, err := genSignedCert(intermediate, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
245+
serverCert, err := tlscommontest.GenSignedCert(intermediate, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
245246
require.NoError(t, err)
246247

247248
mux := http.NewServeMux()

‎transport/tlscommon/diag_test.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"encoding/pem"
2525
"testing"
2626

27+
"github.com/elastic/elastic-agent-libs/transport/tlscommontest"
2728
"github.com/stretchr/testify/require"
2829
)
2930

@@ -95,7 +96,7 @@ func Test_ServerConfig_DiagCerts(t *testing.T) {
9596

9697
func makeCAs(t *testing.T) (tls.Certificate, []string) {
9798
t.Helper()
98-
ca, err := genCA()
99+
ca, err := tlscommontest.GenCA()
99100
require.NoError(t, err)
100101
p := pem.EncodeToMemory(&pem.Block{
101102
Type: "CERTIFICATE",
@@ -108,7 +109,7 @@ func makeCAs(t *testing.T) (tls.Certificate, []string) {
108109

109110
func makeCertificateConfig(t *testing.T, ca tls.Certificate) CertificateConfig {
110111
t.Helper()
111-
crt, err := genSignedCert(ca, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
112+
crt, err := tlscommontest.GenSignedCert(ca, x509.KeyUsageDigitalSignature, false, "localhost", []string{"localhost"}, nil, false)
112113
require.NoError(t, err)
113114
crtBytes := pem.EncodeToMemory(&pem.Block{
114115
Type: "CERTIFICATE",

‎transport/tlscommon/tls_config_test.go‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,13 @@ import (
2626
"net/url"
2727
"testing"
2828

29+
"github.com/elastic/elastic-agent-libs/transport/tlscommontest"
2930
"github.com/stretchr/testify/assert"
3031
"github.com/stretchr/testify/require"
3132
)
3233

3334
func TestMakeVerifyServerConnection(t *testing.T) {
34-
testCerts := GenTestCerts(t)
35+
testCerts := tlscommontest.GenTestCerts(t)
3536

3637
certPool := x509.NewCertPool()
3738
certPool.AddCert(testCerts["ca"])
@@ -183,13 +184,13 @@ func TestMakeVerifyServerConnection(t *testing.T) {
183184
}
184185

185186
func TestTrustRootCA(t *testing.T) {
186-
certs := GenTestCerts(t)
187+
certs := tlscommontest.GenTestCerts(t)
187188

188189
nonEmptyCertPool := x509.NewCertPool()
189190
nonEmptyCertPool.AddCert(certs["wildcard"])
190191
nonEmptyCertPool.AddCert(certs["unknown_authority"])
191192

192-
fingerprint := GetCertFingerprint(certs["ca"])
193+
fingerprint := tlscommontest.GetCertFingerprint(certs["ca"])
193194

194195
testCases := []struct {
195196
name string
@@ -258,8 +259,8 @@ func TestTrustRootCA(t *testing.T) {
258259
}
259260

260261
func TestMakeVerifyConnectionUsesCATrustedFingerprint(t *testing.T) {
261-
testCerts := GenTestCerts(t)
262-
fingerprint := GetCertFingerprint(testCerts["ca"])
262+
testCerts := tlscommontest.GenTestCerts(t)
263+
fingerprint := tlscommontest.GetCertFingerprint(testCerts["ca"])
263264

264265
testcases := map[string]struct {
265266
verificationMode TLSVerificationMode
@@ -390,7 +391,7 @@ func TestMakeVerifyServerConnectionForIPs(t *testing.T) {
390391
},
391392
}
392393

393-
ca, err := genCA()
394+
ca, err := tlscommontest.GenCA()
394395
if err != nil {
395396
t.Fatalf("cannot generate CA certificate: %s", err)
396397
}
@@ -400,7 +401,7 @@ func TestMakeVerifyServerConnectionForIPs(t *testing.T) {
400401

401402
for name, test := range testcases {
402403
t.Run(name, func(t *testing.T) {
403-
peerCerts, err := genSignedCert(
404+
peerCerts, err := tlscommontest.GenSignedCert(
404405
ca,
405406
x509.KeyUsageCertSign,
406407
false,
@@ -572,7 +573,7 @@ func TestVerificationMode(t *testing.T) {
572573
ignoreCerts: true,
573574
},
574575
}
575-
caCert, err := genCA()
576+
caCert, err := tlscommontest.GenCA()
576577
if err != nil {
577578
t.Fatalf("could not generate root CA certificate: %s", err)
578579
}
@@ -582,7 +583,7 @@ func TestVerificationMode(t *testing.T) {
582583

583584
for name, test := range testcases {
584585
t.Run(name, func(t *testing.T) {
585-
certs, err := genSignedCert(caCert, x509.KeyUsageCertSign, false, test.commonName, test.dnsNames, test.ips, false)
586+
certs, err := tlscommontest.GenSignedCert(caCert, x509.KeyUsageCertSign, false, test.commonName, test.dnsNames, test.ips, false)
586587
if err != nil {
587588
t.Fatalf("could not generate certificates: %s", err)
588589
}

‎transport/tlscommon/test_helper.go‎ renamed to ‎transport/tlscommontest/test_helper.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
// specific language governing permissions and limitations
1616
// under the License.
1717

18-
package tlscommon
18+
package tlscommontest
1919

2020
import (
2121
"bytes"
@@ -49,12 +49,12 @@ func GetCertFingerprint(cert *x509.Certificate) string {
4949

5050
func GenTestCerts(t *testing.T) map[string]*x509.Certificate {
5151
t.Helper()
52-
ca, err := genCA()
52+
ca, err := GenCA()
5353
if err != nil {
5454
t.Fatalf("cannot generate root CA: %s", err)
5555
}
5656

57-
unknownCA, err := genCA()
57+
unknownCA, err := GenCA()
5858
if err != nil {
5959
t.Fatalf("cannot generate second root CA: %s", err)
6060
}
@@ -106,7 +106,7 @@ func GenTestCerts(t *testing.T) map[string]*x509.Certificate {
106106

107107
tmpDir := t.TempDir()
108108
for certName, data := range certData {
109-
cert, err := genSignedCert(
109+
cert, err := GenSignedCert(
110110
data.ca,
111111
data.keyUsage,
112112
data.isCA,
@@ -156,7 +156,7 @@ func GenTestCerts(t *testing.T) map[string]*x509.Certificate {
156156
return certs
157157
}
158158

159-
func genCA() (tls.Certificate, error) {
159+
func GenCA() (tls.Certificate, error) {
160160
ca := &x509.Certificate{
161161
SerialNumber: serial(),
162162
Subject: pkix.Name{
@@ -225,7 +225,7 @@ func generateSubjectKeyID(publicKey *rsa.PublicKey) []byte {
225225
}
226226

227227
// genSignedCert generates a CA and KeyPair and remove the need to depends on code of agent.
228-
func genSignedCert(
228+
func GenSignedCert(
229229
ca tls.Certificate,
230230
keyUsage x509.KeyUsage,
231231
isCA bool,

0 commit comments

Comments
 (0)