go
go copied to clipboard
DC tests don't validate certificates
In delegated_credentials_test.go TestDCHandshakeServerAuth sets clientConfig.InsecureSkipVerify = true. Because of how golang handles global state this is propagated to all later tests. This leads to test failures if the tests are run in a different order or individually.
This means that even if you put bit flips into the test certificate signatures the tests will still pass.
This was fixed in the kemtls branch. There was also another bug that was also fixed on that branch (I can't remember it anymore as it was a year ago). I also changed the API to something way nicer there, so that is def the code to use. It never got merged due to the debate of if kemtls should be in the main branch or not.
I'll take a look tomorrow and compare the code.. and let you know if there is a bug that needs solving in main branch.