mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-21 22:29:08 +02:00
88 lines
2.5 KiB
Go
88 lines
2.5 KiB
Go
package pkcs11
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestParseURI(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
raw string
|
|
wantToken string
|
|
wantModule string
|
|
wantPIN []byte
|
|
}{
|
|
{
|
|
name: "token with module path and pin value",
|
|
raw: "pkcs11:token=netbird?module-path=/usr/lib/libtpm2_pkcs11.so&pin-value=1234",
|
|
wantToken: "netbird",
|
|
wantModule: "/usr/lib/libtpm2_pkcs11.so",
|
|
wantPIN: []byte("1234"),
|
|
},
|
|
{
|
|
name: "module name becomes a library file",
|
|
raw: "pkcs11:token=netbird?module-name=tpm2_pkcs11",
|
|
wantToken: "netbird",
|
|
wantModule: "libtpm2_pkcs11.so",
|
|
},
|
|
{
|
|
name: "percent encoding and unknown attributes",
|
|
raw: "pkcs11:model=SoftHSM%20v2;token=my%20token;serial=1?max-sessions=1",
|
|
wantToken: "my token",
|
|
wantModule: DefaultModule,
|
|
},
|
|
{
|
|
name: "bare scheme uses the p11-kit proxy and no login",
|
|
raw: "pkcs11:",
|
|
wantModule: DefaultModule,
|
|
},
|
|
{
|
|
name: "empty pin value still logs in",
|
|
raw: "pkcs11:?pin-value=",
|
|
wantModule: DefaultModule,
|
|
wantPIN: []byte{},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
uri, err := ParseURI(tt.raw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tt.wantToken, uri.Token, "token label")
|
|
assert.Equal(t, tt.wantModule, uri.Module(), "module to load")
|
|
pin, err := uri.PIN()
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tt.wantPIN, pin, "PIN, nil meaning no login")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseURI_Rejections(t *testing.T) {
|
|
for _, raw := range []string{"pkcs11", "https://example.com", "pkcs11:token", "pkcs11:token=%zz"} {
|
|
_, err := ParseURI(raw)
|
|
assert.Error(t, err, raw)
|
|
}
|
|
}
|
|
|
|
func TestURI_PINFromFile(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "pin")
|
|
require.NoError(t, os.WriteFile(path, []byte("secret\n"), 0o600))
|
|
|
|
for _, source := range []string{path, "file:" + path, "file://" + path} {
|
|
uri, err := ParseURI("pkcs11:token=netbird?pin-source=" + source)
|
|
require.NoError(t, err)
|
|
pin, err := uri.PIN()
|
|
require.NoError(t, err)
|
|
assert.Equal(t, []byte("secret"), pin, "PIN from %s must drop the trailing newline", source)
|
|
}
|
|
|
|
uri, err := ParseURI("pkcs11:?pin-source=" + filepath.Join(t.TempDir(), "missing"))
|
|
require.NoError(t, err)
|
|
_, err = uri.PIN()
|
|
assert.Error(t, err, "a missing PIN file must fail loudly instead of logging in without a PIN")
|
|
}
|