Function TestFingerprint

elasticsearch_internal_test.go:567–635

(t *testing.T)

}

func TestFingerprint(t *testing.T) {
	body := []byte(`{"body": true"}"`)

	// Generate a self-signed certificate at test time to avoid expiry issues.
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	template := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject:      pkix.Name{CommonName: "instance"},
		NotBefore:    time.Now().Add(-1 * time.Hour),
		NotAfter:     time.Now().Add(1 * time.Hour),
		IPAddresses:  []net.IP{net.IPv4(127, 0, 0, 1), net.IPv6loopback},
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	}
	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
	if err != nil {
		t.Fatal(err)
	}
	cert := tls.Certificate{
		Certificate: [][]byte{certDER},
		PrivateKey:  key,
	}

	// Compute the SHA-256 fingerprint of the leaf certificate.
	fingerprint := sha256.Sum256(certDER)
	fingerprintHex := strings.ToUpper(hex.EncodeToString(fingerprint[:]))

	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("X-Elastic-Product", "Elasticsearch")
		_, _ = w.Write(body)
	}))
	server.TLS = new(tls.Config)
	server.TLS.Certificates = []tls.Certificate{cert}
	server.StartTLS()

	defer server.Close()

	baseOpts := []Option{
		WithAddresses(server.URL),
		WithTransportOptions(elastictransport.WithDisableRetry()),
	}

	// Without certificate and authority, client should fail on TLS
	client, _ := New(baseOpts...)
	_, err = client.Info()

	if ok := errors.As(err, &x509.UnknownAuthorityError{}); !ok {
		t.Fatalf("expected UnknownAuthorityError, got: %s", err)
	}

	// We add the fingerprint of the generated certificate
	client, _ = New(append(baseOpts, WithCertificateFingerprint(fingerprintHex))...)
	res, err := client.Info()
	if err != nil {
		t.Fatal(err)