utils_test.go

package tls //nolint:revive // pre-existing package name

import (
	"crypto/ecdsa"
	"crypto/rsa"
	"crypto/x509"
	"encoding/pem"
	"testing"

	"github.com/stretchr/testify/assert"

	"github.com/openshift/installer/pkg/types"
)

func marshalPKCS8(t *testing.T, key interface{}) []byte {
	t.Helper()
	der, err := x509.MarshalPKCS8PrivateKey(key)
	if !assert.NoError(t, err, "failed to marshal key to PKCS#8") {
		return nil
	}
	return der
}

func TestPrivateKeyToPemRoundtrip(t *testing.T) {
	cases := []struct {
		name       string
		genFunc    func() (interface{}, error)
		expectType interface{}
	}{
		{
			name: "RSA key",
			genFunc: func() (interface{}, error) {
				return GenerateRSAPrivateKey(2048)
			},
			expectType: &rsa.PrivateKey{},
		},
		{
			name: "ECDSA P256 key",
			genFunc: func() (interface{}, error) {
				return GenerateECDSAPrivateKey(types.ECDSACurveP256)
			},
			expectType: &ecdsa.PrivateKey{},
		},
		{
			name: "ECDSA P384 key",
			genFunc: func() (interface{}, error) {
				return GenerateECDSAPrivateKey(types.ECDSACurveP384)
			},
			expectType: &ecdsa.PrivateKey{},
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			key, err := tc.genFunc()
			if !assert.NoError(t, err) {
				return
			}

			pemBytes, err := PrivateKeyToPem(key)
			if !assert.NoError(t, err) || !assert.NotEmpty(t, pemBytes) {
				return
			}

			decoded, err := PemToPrivateKey(pemBytes)
			if !assert.NoError(t, err) {
				return
			}
			assert.IsType(t, tc.expectType, decoded)
			assert.Equal(t, marshalPKCS8(t, key), marshalPKCS8(t, decoded), "round-tripped key material must match original")
		})
	}
}

func TestPemToPrivateKeyFormats(t *testing.T) {
	t.Run("invalid PEM", func(t *testing.T) {
		_, err := PemToPrivateKey([]byte("not a PEM"))
		assert.Error(t, err)
	})

	t.Run("empty data", func(t *testing.T) {
		_, err := PemToPrivateKey([]byte{})
		assert.Error(t, err)
	})

	t.Run("RSA PEM block", func(t *testing.T) {
		key, err := GenerateRSAPrivateKey(2048)
		if !assert.NoError(t, err) {
			return
		}
		pemBytes, pemErr := PrivateKeyToPem(key)
		if !assert.NoError(t, pemErr) {
			return
		}

		decoded, err := PemToPrivateKey(pemBytes)
		if !assert.NoError(t, err) {
			return
		}
		_, ok := decoded.(*rsa.PrivateKey)
		assert.True(t, ok, "expected *rsa.PrivateKey")
	})

	t.Run("EC PEM block", func(t *testing.T) {
		key, err := GenerateECDSAPrivateKey(types.ECDSACurveP256)
		if !assert.NoError(t, err) {
			return
		}
		pemBytes, pemErr := PrivateKeyToPem(key)
		if !assert.NoError(t, pemErr) {
			return
		}

		decoded, err := PemToPrivateKey(pemBytes)
		if !assert.NoError(t, err) {
			return
		}
		_, ok := decoded.(*ecdsa.PrivateKey)
		assert.True(t, ok, "expected *ecdsa.PrivateKey")
	})

	t.Run("PKCS#8 PEM block", func(t *testing.T) {
		key, err := GenerateRSAPrivateKey(2048)
		if !assert.NoError(t, err) {
			return
		}
		pkcs8Bytes, err := x509.MarshalPKCS8PrivateKey(key)
		if !assert.NoError(t, err) {
			return
		}
		pemBytes := pem.EncodeToMemory(&pem.Block{
			Type:  "PRIVATE KEY",
			Bytes: pkcs8Bytes,
		})

		decoded, err := PemToPrivateKey(pemBytes)
		if !assert.NoError(t, err) {
			return
		}
		_, ok := decoded.(*rsa.PrivateKey)
		assert.True(t, ok, "expected *rsa.PrivateKey")
	})
}