environs/httpstorage: authentication support

cert/cert_test.go

Index: cert/cert_test.go
=== modified file 'cert/cert_test.go'
--- cert/cert_test.go	2013-09-13 14:48:13 +0000
+++ cert/cert_test.go	2013-09-24 05:42:43 +0000
@@ -76,12 +76,12 @@
 	caCert, _, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
 	c.Assert(err, gc.IsNil)
 
-	srvCertPEM, srvKeyPEM, err := cert.NewServer("juju test", caCertPEM, caKeyPEM, expiry)
+	var noHostnames []string
+	srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, noHostnames)
 	c.Assert(err, gc.IsNil)
 
 	srvCert, srvKey, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
 	c.Assert(err, gc.IsNil)
-	c.Assert(err, gc.IsNil)
 	c.Assert(srvCert.Subject.CommonName, gc.Equals, "*")
 	c.Assert(srvCert.NotAfter.Equal(expiry), gc.Equals, true)
 	c.Assert(srvCert.BasicConstraintsValid, gc.Equals, false)
@@ -90,6 +90,41 @@
 	checkTLSConnection(c, caCert, srvCert, srvKey)
 }
 
+func (certSuite) TestNewServerHostnames(c *gc.C) {
+	type test struct {
+		hostnames           []string
+		expectedDNSNames    []string
+		expectedIPAddresses []net.IP
+	}
+	tests := []test{{
+		[]string{},
+		nil,
+		nil,
+	}, {
+		[]string{"example.com"},
+		[]string{"example.com"},
+		nil,
+	}, {
+		[]string{"example.com", "127.0.0.1"},
+		[]string{"example.com"},
+		[]net.IP{net.IPv4(127, 0, 0, 1).To4()},
+	}, {
+		[]string{"::1"},
+		nil,
+		[]net.IP{net.IPv6loopback},
+	}}
+	for i, t := range tests {
+		c.Logf("test %d: %v", i, t.hostnames)
+		expiry := roundTime(time.Now().AddDate(1, 0, 0))
+		srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, t.hostnames)
+		c.Assert(err, gc.IsNil)
+		srvCert, _, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
+		c.Assert(err, gc.IsNil)
+		c.Assert(srvCert.DNSNames, gc.DeepEquals, t.expectedDNSNames)
+		c.Assert(srvCert.IPAddresses, gc.DeepEquals, t.expectedIPAddresses)
+	}
+}
+
 func (certSuite) TestWithNonUTCExpiry(c *gc.C) {
 	expiry, err := time.Parse("2006-01-02 15:04:05.999999999 -0700 MST", "2012-11-28 15:53:57 +0100 CET")
 	c.Assert(err, gc.IsNil)
@@ -98,14 +133,16 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(xcert.NotAfter.Equal(expiry), gc.Equals, true)
 
-	certPEM, _, err = cert.NewServer("foo", certPEM, keyPEM, expiry)
+	var noHostnames []string
+	certPEM, _, err = cert.NewServer(certPEM, keyPEM, expiry, noHostnames)
 	xcert, err = cert.ParseCert(certPEM)
 	c.Assert(err, gc.IsNil)
 	c.Assert(xcert.NotAfter.Equal(expiry), gc.Equals, true)
 }
 
 func (certSuite) TestNewServerWithInvalidCert(c *gc.C) {
-	srvCert, srvKey, err := cert.NewServer("foo", nonCACert, nonCAKey, time.Now())
+	var noHostnames []string
+	srvCert, srvKey, err := cert.NewServer(nonCACert, nonCAKey, time.Now(), noHostnames)
 	c.Check(srvCert, gc.IsNil)
 	c.Check(srvKey, gc.IsNil)
 	c.Assert(err, gc.ErrorMatches, "CA certificate is not a valid CA")
@@ -116,7 +153,8 @@
 	caCert, caKey, err := cert.NewCA("foo", now.Add(1*time.Minute))
 	c.Assert(err, gc.IsNil)
 
-	srvCert, _, err := cert.NewServer("foo", caCert, caKey, now.Add(3*time.Minute))
+	var noHostnames []string
+	srvCert, _, err := cert.NewServer(caCert, caKey, now.Add(3*time.Minute), noHostnames)
 	c.Assert(err, gc.IsNil)
 
 	err = cert.Verify(srvCert, caCert, now)
@@ -139,7 +177,7 @@
 	err = cert.Verify(srvCert, caCert2, now)
 	c.Check(err, gc.ErrorMatches, "x509: certificate signed by unknown authority")
 
-	srvCert2, _, err := cert.NewServer("bar", caCert2, caKey2, now.Add(1*time.Minute))
+	srvCert2, _, err := cert.NewServer(caCert2, caKey2, now.Add(1*time.Minute), noHostnames)
 	c.Assert(err, gc.IsNil)
 
 	// Check new server certificate against original CA.