Graham McIntire
321c701fd7
sync.Once contains sync.noCopy and cannot be assigned by value.
Reset with a fresh sync.Once{} in defer instead of save/restore.
Also gitignore known_hosts.json runtime data.
122 lines
3 KiB
Go
122 lines
3 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"sync"
|
|
"testing"
|
|
)
|
|
|
|
func TestHostKeyStoreTOFU(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "known_hosts.json")
|
|
s := newHostKeyStore(path)
|
|
|
|
// First connection should succeed (trust on first use)
|
|
if err := s.verify("10.0.0.1:22", "abc123"); err != nil {
|
|
t.Fatalf("first connect should succeed: %v", err)
|
|
}
|
|
|
|
// Same key should succeed
|
|
if err := s.verify("10.0.0.1:22", "abc123"); err != nil {
|
|
t.Fatalf("same key should succeed: %v", err)
|
|
}
|
|
|
|
// Different key should fail
|
|
if err := s.verify("10.0.0.1:22", "different"); err == nil {
|
|
t.Fatal("changed key should fail")
|
|
}
|
|
|
|
// New host should succeed
|
|
if err := s.verify("10.0.0.2:22", "def456"); err != nil {
|
|
t.Fatalf("new host should succeed: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestHostKeyStorePersistence(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "known_hosts.json")
|
|
|
|
s1 := newHostKeyStore(path)
|
|
_ = s1.verify("host1:22", "fp1")
|
|
|
|
// Load from same file
|
|
s2 := newHostKeyStore(path)
|
|
if err := s2.verify("host1:22", "fp1"); err != nil {
|
|
t.Fatalf("persisted key should match: %v", err)
|
|
}
|
|
if err := s2.verify("host1:22", "changed"); err == nil {
|
|
t.Fatal("changed key should fail after reload")
|
|
}
|
|
}
|
|
|
|
func TestHostKeyStoreMissingFile(t *testing.T) {
|
|
s := newHostKeyStore("/nonexistent/path/known_hosts.json")
|
|
// Should work in memory even if file can't be read
|
|
if err := s.verify("host:22", "fp"); err != nil {
|
|
t.Fatalf("should work without file: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestHostKeyStoreConcurrency(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "known_hosts.json")
|
|
s := newHostKeyStore(path)
|
|
|
|
var wg sync.WaitGroup
|
|
for i := 0; i < 50; i++ {
|
|
wg.Add(1)
|
|
go func() {
|
|
defer wg.Done()
|
|
_ = s.verify("host:22", "fp1")
|
|
}()
|
|
}
|
|
wg.Wait()
|
|
}
|
|
|
|
func TestGetHostKeyStoreDefault(t *testing.T) {
|
|
// Reset the once for testing
|
|
origStore := globalHostKeys
|
|
defer func() {
|
|
hostKeysOnce = sync.Once{}
|
|
globalHostKeys = origStore
|
|
}()
|
|
hostKeysOnce = sync.Once{}
|
|
|
|
t.Setenv("TOWEROPS_HOST_KEYS_FILE", filepath.Join(t.TempDir(), "test_hosts.json"))
|
|
store := getHostKeyStore()
|
|
if store == nil {
|
|
t.Fatal("expected non-nil store")
|
|
}
|
|
}
|
|
|
|
func TestSSHHostKeyCallback(t *testing.T) {
|
|
// Reset global state
|
|
origStore := globalHostKeys
|
|
defer func() {
|
|
hostKeysOnce = sync.Once{}
|
|
globalHostKeys = origStore
|
|
}()
|
|
hostKeysOnce = sync.Once{}
|
|
t.Setenv("TOWEROPS_HOST_KEYS_FILE", filepath.Join(t.TempDir(), "hosts.json"))
|
|
|
|
cb := sshHostKeyCallback()
|
|
if cb == nil {
|
|
t.Fatal("expected non-nil callback")
|
|
}
|
|
}
|
|
|
|
func TestHostKeyStoreSaveError(t *testing.T) {
|
|
// Use a path in a non-existent directory
|
|
s := newHostKeyStore("/nonexistent/dir/hosts.json")
|
|
// verify should not error even if save fails (it logs instead)
|
|
if err := s.verify("host:22", "fp"); err != nil {
|
|
t.Fatalf("should succeed even if save fails: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestTlsCertFingerprint(t *testing.T) {
|
|
// Just verify it doesn't panic with nil - we test with real certs in integration
|
|
// The function is simple enough: sha256 of cert.Raw
|
|
_ = os.Getenv("dummy") // placeholder
|
|
}
|