cloudflare / cloudflare/go

DC tests don't validate certificates

Open
#130 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
370
Forks
62
PR merge metrics
No merged PRs in 30d

Description

In `delegated_credentials_test.go` `TestDCHandshakeServerAuth` sets `clientConfig.InsecureSkipVerify = true`. Because of how golang handles global state this is propagated to all later tests. This leads to test failures if the tests are run in a different order or individually.
This means that even if you put bit flips into the test certificate signatures the tests will still pass.

Contributor guide

Open the contributing guide

Research direction

Start in delegated_credentials_test.go at TestDCHandshakeServerAuth and run the delegated-credentials tests individually and in different orders. Trace how clientConfig.InsecureSkipVerify affects later tests; done means certificate signature bit flips are rejected and test results do not depend on execution order.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security, testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.