120 lines
4.0 KiB
Go
120 lines
4.0 KiB
Go
package dtls
|
|
|
|
import (
|
|
"crypto/dsa" //nolint
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/tls"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/pion/dtls/v2/pkg/crypto/selfsign"
|
|
)
|
|
|
|
func TestValidateConfig(t *testing.T) {
|
|
// Empty config
|
|
if err := validateConfig(nil); !errors.Is(err, errNoConfigProvided) {
|
|
t.Fatalf("TestValidateConfig: Config validation error exp(%v) failed(%v)", errNoConfigProvided, err)
|
|
}
|
|
|
|
// PSK and Certificate, valid cipher suites
|
|
cert, err := selfsign.GenerateSelfSigned()
|
|
if err != nil {
|
|
t.Fatalf("TestValidateConfig: Config validation error(%v), self signed certificate not generated", err)
|
|
return
|
|
}
|
|
config := &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_PSK_WITH_AES_128_CCM_8, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
PSK: func(hint []byte) ([]byte, error) {
|
|
return nil, nil
|
|
},
|
|
Certificates: []tls.Certificate{cert},
|
|
}
|
|
if err = validateConfig(config); err != nil {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", nil, err)
|
|
}
|
|
|
|
// PSK and Certificate, no PSK cipher suite
|
|
config = &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
PSK: func(hint []byte) ([]byte, error) {
|
|
return nil, nil
|
|
},
|
|
Certificates: []tls.Certificate{cert},
|
|
}
|
|
if err = validateConfig(config); !errors.Is(errNoAvailablePSKCipherSuite, err) {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", errNoAvailablePSKCipherSuite, err)
|
|
}
|
|
|
|
// PSK and Certificate, no non-PSK cipher suite
|
|
config = &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_PSK_WITH_AES_128_CCM_8},
|
|
PSK: func(hint []byte) ([]byte, error) {
|
|
return nil, nil
|
|
},
|
|
Certificates: []tls.Certificate{cert},
|
|
}
|
|
if err = validateConfig(config); !errors.Is(errNoAvailableCertificateCipherSuite, err) {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", errNoAvailableCertificateCipherSuite, err)
|
|
}
|
|
|
|
// PSK identity hint with not PSK
|
|
config = &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
PSK: nil,
|
|
PSKIdentityHint: []byte{},
|
|
}
|
|
if err = validateConfig(config); !errors.Is(err, errIdentityNoPSK) {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", errIdentityNoPSK, err)
|
|
}
|
|
|
|
// Invalid private key
|
|
dsaPrivateKey := &dsa.PrivateKey{}
|
|
err = dsa.GenerateParameters(&dsaPrivateKey.Parameters, rand.Reader, dsa.L1024N160)
|
|
if err != nil {
|
|
t.Fatalf("TestValidateConfig: Config validation error(%v), DSA parameters not generated", err)
|
|
return
|
|
}
|
|
err = dsa.GenerateKey(dsaPrivateKey, rand.Reader)
|
|
if err != nil {
|
|
t.Fatalf("TestValidateConfig: Config validation error(%v), DSA private key not generated", err)
|
|
return
|
|
}
|
|
config = &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
Certificates: []tls.Certificate{{Certificate: cert.Certificate, PrivateKey: dsaPrivateKey}},
|
|
}
|
|
if err = validateConfig(config); !errors.Is(err, errInvalidPrivateKey) {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", errInvalidPrivateKey, err)
|
|
}
|
|
|
|
// PrivateKey without Certificate
|
|
config = &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
Certificates: []tls.Certificate{{PrivateKey: cert.PrivateKey}},
|
|
}
|
|
if err = validateConfig(config); !errors.Is(err, errInvalidCertificate) {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", errInvalidCertificate, err)
|
|
}
|
|
|
|
// Invalid cipher suites
|
|
config = &Config{CipherSuites: []CipherSuiteID{0x0000}}
|
|
if err = validateConfig(config); err == nil {
|
|
t.Fatal("TestValidateConfig: Client error expected with invalid CipherSuiteID")
|
|
}
|
|
|
|
// Valid config
|
|
rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
|
|
if err != nil {
|
|
t.Fatalf("TestValidateConfig: Config validation error(%v), RSA private key not generated", err)
|
|
return
|
|
}
|
|
config = &Config{
|
|
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
Certificates: []tls.Certificate{cert, {Certificate: cert.Certificate, PrivateKey: rsaPrivateKey}},
|
|
}
|
|
if err = validateConfig(config); err != nil {
|
|
t.Fatalf("TestValidateConfig: Client error exp(%v) failed(%v)", nil, err)
|
|
}
|
|
}
|