Full web : clusters gérés dans l'UI, primaire et cibles, comptes pve

internal/service/check_test.go

@@ -0,0 +1,39 @@
+package service
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/ssh"
+
+	"pve-confsync/internal/config"
+	"pve-confsync/internal/pve/pvetest"
+)
+
+// A node that presents another SSH host key than the recorded one is refused,
+// until the new key is explicitly trusted.
+func TestCheckSSHHostKeyMismatch(t *testing.T) {
+	s := pvetest.New("9.1.4")
+	defer s.Close()
+	pub, _, _ := ed25519.GenerateKey(rand.Reader)
+	other, _ := ssh.NewPublicKey(pub)
+	sum := sha256.Sum256(s.Certificate().Raw)
+	host, port := s.SSHAddr()
+	cl := config.Cluster{Name: "c", URL: s.URL, User: "root@pam", Password: pvetest.Password,
+		Fingerprint: hex.EncodeToString(sum[:]), SSHHost: host, SSHPort: port,
+		SSHHostKey: strings.TrimSpace(string(ssh.MarshalAuthorizedKey(other)))}
+
+	res := CheckCluster(context.Background(), cl, false, false)
+	if res.OK || !res.SSHMismatch || !res.API || res.SSHHostKey != "" || !strings.Contains(res.Error, "clé d'hôte") {
+		t.Fatalf("mismatch expected: %+v", res)
+	}
+	res = CheckCluster(context.Background(), cl, false, true)
+	if !res.OK || res.SSHHostKey != s.SSHHostKey() {
+		t.Fatalf("trusted key expected: %+v", res)
+	}
+}