File Manager

✏️ /

// Copyright 2013 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package x509_test

import (
	"crypto/tls"
	"crypto/x509"
	"internal/testenv"
	"testing"
	"time"
)

func TestPlatformVerifierLegacy(t *testing.T) {
	// TODO(#52108): This can be removed once the synthetic test root is deployed on
	// builders.
	if !testenv.HasExternalNetwork() {
		t.Skip()
	}

getChain := func(host string) []*x509.Certificate {
		t.Helper()
		c, err := tls.Dial("tcp", host+":443", &tls.Config{InsecureSkipVerify: true})
		if err != nil {
			t.Fatalf("tls connection failed: %s", err)
		}
		return c.ConnectionState().PeerCertificates
	}

tests := []struct {
		name        string
		host        string
		verifyName  string
		verifyTime  time.Time
		verifyEKU   []x509.ExtKeyUsage
		expectedErr string
		skip        string
	}{
		{
			// whatever google.com serves should, hopefully, be trusted
			name: "valid chain",
			host: "google.com",
		},
		{
			name:        "expired leaf",
			host:        "expired.badssl.com",
			expectedErr: "x509: certificate has expired or is not yet valid: “*.badssl.com” certificate is expired",
		},
		{
			name:        "wrong host for leaf",
			host:        "wrong.host.badssl.com",
			verifyName:  "wrong.host.badssl.com",
			expectedErr: "x509: certificate is valid for *.badssl.com, badssl.com, not wrong.host.badssl.com",
		},
		{
			name:        "self-signed leaf",
			host:        "self-signed.badssl.com",
			expectedErr: "x509: certificate signed by unknown authority",
		},
		{
			name:        "untrusted root",
			host:        "untrusted-root.badssl.com",
			expectedErr: "x509: certificate signed by unknown authority",
		},
		{
			name:        "revoked leaf",
			host:        "revoked.badssl.com",
			expectedErr: "x509: “revoked.badssl.com” certificate is revoked",
			skip:        "skipping; broken on recent versions of macOS. See issue 57428.",
		},
		{
			name:        "leaf missing SCTs",
			host:        "no-sct.badssl.com",
			expectedErr: "x509: “no-sct.badssl.com” certificate is not standards compliant",
			skip:        "skipping; broken on recent versions of macOS. See issue 57428.",
		},
		{
			name:        "expired leaf (custom time)",
			host:        "google.com",
			verifyTime:  time.Time{}.Add(time.Hour),
			expectedErr: "x509: certificate has expired or is not yet valid: “*.google.com” certificate is expired",
		},
		{
			name:       "valid chain (custom time)",
			host:       "google.com",
			verifyTime: time.Now(),
		},
		{
			name:        "leaf doesn't have acceptable ExtKeyUsage",
			host:        "google.com",
			expectedErr: "x509: certificate specifies an incompatible key usage",
			verifyEKU:   []x509.ExtKeyUsage{x509.ExtKeyUsageEmailProtection},
		},
	}

for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			if tc.skip != "" {
				t.Skip(tc.skip)
			}

chain := getChain(tc.host)
			var opts x509.VerifyOptions
			if len(chain) > 1 {
				opts.Intermediates = x509.NewCertPool()
				for _, c := range chain[1:] {
					opts.Intermediates.AddCert(c)
				}
			}
			if tc.verifyName != "" {
				opts.DNSName = tc.verifyName
			}
			if !tc.verifyTime.IsZero() {
				opts.CurrentTime = tc.verifyTime
			}
			if len(tc.verifyEKU) > 0 {
				opts.KeyUsages = tc.verifyEKU
			}

_, err := chain[0].Verify(opts)
			if err != nil && tc.expectedErr == "" {
				t.Errorf("unexpected verification error: %s", err)
			} else if err != nil && err.Error() != tc.expectedErr {
				t.Errorf("unexpected verification error: got %q, want %q", err.Error(), tc.expectedErr)
			} else if err == nil && tc.expectedErr != "" {
				t.Errorf("unexpected verification success: want %q", tc.expectedErr)
			}
		})
	}
}

Batal

⬅ crypto 45 item

Nama	Tipe	Ukuran	Diubah	Aksi
📁internal	dir	—	2024-02-02 18:09	📂 Buka
📁pkix	dir	—	2024-02-02 18:09	📂 Buka
📁testdata	dir	—	2024-02-02 18:09	📂 Buka
🔵boring.go	go	993 B	2024-02-02 18:09	✏️ 👁️
🔵boring_test.go	go	3.7 KB	2024-02-02 18:09	✏️ 👁️
🔵cert_pool.go	go	8.9 KB	2024-02-02 18:09	✏️ 👁️
🔵cert_pool_test.go	go	2.3 KB	2024-02-02 18:09	✏️ 👁️
🔵example_test.go	go	5.3 KB	2024-02-02 18:09	✏️ 👁️
🔵hybrid_pool_test.go	go	3.7 KB	2024-02-02 18:09	✏️ 👁️
🔵name_constraints_test.go	go	44.9 KB	2024-02-02 18:09	✏️ 👁️
🔵notboring.go	go	258 B	2024-02-02 18:09	✏️ 👁️
🔵oid.go	go	5.8 KB	2024-02-02 18:09	✏️ 👁️
🔵oid_test.go	go	3.7 KB	2024-02-02 18:09	✏️ 👁️
🔵parser.go	go	36.6 KB	2024-02-02 18:09	✏️ 👁️
🔵parser_test.go	go	2.6 KB	2024-02-02 18:09	✏️ 👁️
🔵pem_decrypt.go	go	7.2 KB	2024-02-02 18:09	✏️ 👁️
🔵pem_decrypt_test.go	go	8.9 KB	2024-02-02 18:09	✏️ 👁️
🔵pkcs1.go	go	4.7 KB	2024-02-02 18:09	✏️ 👁️
🔵pkcs8.go	go	5.8 KB	2024-02-02 18:09	✏️ 👁️
🔵pkcs8_test.go	go	9 KB	2024-02-02 18:09	✏️ 👁️
📄platform_root_cert.pem	pem	749 B	2024-02-02 18:09	✏️ 👁️
📄platform_root_key.pem	pem	227 B	2024-02-02 18:09	✏️ 👁️
🔵platform_test.go	go	7.3 KB	2024-02-02 18:09	✏️ 👁️
🔵root.go	go	2 KB	2024-02-02 18:09	✏️ 👁️
🔵root_aix.go	go	410 B	2024-02-02 18:09	✏️ 👁️
🔵root_bsd.go	go	748 B	2024-02-02 18:09	✏️ 👁️
🔵root_darwin.go	go	3.5 KB	2024-02-02 18:09	✏️ 👁️
🔵root_darwin_test.go	go	3.7 KB	2024-02-02 18:09	✏️ 👁️
🔵root_linux.go	go	1.1 KB	2024-02-02 18:09	✏️ 👁️
🔵root_plan9.go	go	828 B	2024-02-02 18:09	✏️ 👁️
🔵root_solaris.go	go	538 B	2024-02-02 18:09	✏️ 👁️
🔵root_test.go	go	2.6 KB	2024-02-02 18:09	✏️ 👁️
🔵root_unix.go	go	2.7 KB	2024-02-02 18:09	✏️ 👁️
🔵root_unix_test.go	go	6.1 KB	2024-02-02 18:09	✏️ 👁️
🔵root_wasm.go	go	373 B	2024-02-02 18:09	✏️ 👁️
🔵root_windows.go	go	8.7 KB	2024-02-02 18:09	✏️ 👁️
🔵root_windows_test.go	go	3.4 KB	2024-02-02 18:09	✏️ 👁️
🔵sec1.go	go	4.6 KB	2024-02-02 18:09	✏️ 👁️
🔵sec1_test.go	go	5.4 KB	2024-02-02 18:09	✏️ 👁️
📄test-file.crt	crt	1.9 KB	2024-02-02 18:09	✏️ 👁️
🔵verify.go	go	35.3 KB	2024-02-02 18:09	✏️ 👁️
🔵verify_test.go	go	109 KB	2024-02-02 18:09	✏️ 👁️
🔵x509.go	go	82.3 KB	2024-02-02 18:09	✏️ 👁️
🔵x509_test.go	go	160 KB	2024-02-02 18:09	✏️ 👁️
🔵x509_test_import.go	go	1.7 KB	2024-02-02 18:09	✏️ 👁️

✏️ Rename