(t *testing.T)
| 150 | } |
| 151 | |
| 152 | func TestSignCSR_BadSignature(t *testing.T) { |
| 153 | dir := t.TempDir() |
| 154 | ca, err := LoadOrCreateNodeCA(filepath.Join(dir, "c.pem"), filepath.Join(dir, "k.pem")) |
| 155 | if err != nil { |
| 156 | t.Fatalf("create CA: %v", err) |
| 157 | } |
| 158 | |
| 159 | csrPEM, _ := mustGenCSR(t, "node-1") |
| 160 | block, _ := pem.Decode(csrPEM) |
| 161 | tampered := make([]byte, len(block.Bytes)) |
| 162 | copy(tampered, block.Bytes) |
| 163 | // flip a byte in the signature region (last bytes of the DER) |
| 164 | tampered[len(tampered)-1] ^= 0xFF |
| 165 | tamperedPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: tampered}) |
| 166 | |
| 167 | _, err = ca.SignCSR(tamperedPEM, "node-1", time.Hour) |
| 168 | if err == nil { |
| 169 | t.Fatalf("expected signature verification failure") |
| 170 | } |
| 171 | if !strings.Contains(strings.ToLower(err.Error()), "csr") { |
| 172 | t.Fatalf("unexpected error: %v", err) |
| 173 | } |
| 174 | } |
| 175 | |
| 176 | func TestSignCSR_VerifiesAgainstClientCAPool(t *testing.T) { |
| 177 | dir := t.TempDir() |
nothing calls this directly
no test coverage detected