<commit_before>// +build security

package riak

import (
	"crypto/tls"
	"crypto/x509"
	"io/ioutil"
	"testing"
)

func TestExecuteCommandOnClusterWithSecurity(t *testing.T) {
	var err error
	var pemData []byte
	if pemData, err = ioutil.ReadFile("./tools/test-ca/certs/cacert.pem"); err != nil {
		t.Fatal(err.Error())
	}
	caCertPool := x509.NewCertPool()
	if ok := caCertPool.AppendCertsFromPEM(pemData); !ok {
		t.Fatal("could not append PEM cert data")
	}
	tlsConfig := &tls.Config{
		ServerName:         "riak-test",
		InsecureSkipVerify: false, // set to 'true' to not require CA certs
		ClientCAs:          caCertPool,
	}
	authOptions := &AuthOptions{
		User:      "riakpass",
		Password:  "<PASSWORD>",
		TlsConfig: tlsConfig,
	}
	nodeOptions := &NodeOptions{
		RemoteAddress: remoteAddress,
		AuthOptions:   authOptions,
	}

	var node *Node
	if node, err = NewNode(nodeOptions); err != nil {
		t.Error(err.Error())
	}
	if node == nil {
		t.FailNow()
	}

	nodes := []*Node{node}
	opts := &ClusterOptions{
		Nodes: nodes,
	}

	if expected, actual := 1, len(opts.Nodes); expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}
	if expected, actual := node, opts.Nodes[0]; expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}

	cluster, err := NewCluster(opts)
	if err != nil {
		t.Error(err.Error())
	}

	defer func() {
		if err := cluster.Stop(); err != nil {
			t.Error(err.Error())
		}
	}()

	if expected, actual := node, cluster.nodes[0]; expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}

	if err := cluster.Start(); err != nil {
		t.Error(err.Error())
	}

	command := &PingCommand{}
	if err := cluster.Execute(command); err != nil {
		t.Error(err.Error())
	}

	if expected, actual := true, command.Successful(); expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}
}<commit_msg>Add security test using a client certificate.<commit_after>// +build security

package riak

import (
	"crypto/tls"
	"crypto/x509"
	"io/ioutil"
	"testing"
)

func buildClusterAndRunTest(t *testing.T, nodeOptions *NodeOptions) {
	var err error
	var node *Node
	if node, err = NewNode(nodeOptions); err != nil {
		t.Error(err.Error())
	}
	if node == nil {
		t.FailNow()
	}

	nodes := []*Node{node}
	opts := &ClusterOptions{
		Nodes: nodes,
	}

	if expected, actual := 1, len(opts.Nodes); expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}
	if expected, actual := node, opts.Nodes[0]; expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}

	cluster, err := NewCluster(opts)
	if err != nil {
		t.Error(err.Error())
	}

	defer func() {
		if err := cluster.Stop(); err != nil {
			t.Error(err.Error())
		}
	}()

	if expected, actual := node, cluster.nodes[0]; expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}

	if err := cluster.Start(); err != nil {
		t.Error(err.Error())
	}

	command := &PingCommand{}
	if err := cluster.Execute(command); err != nil {
		t.Error(err.Error())
	}

	if expected, actual := true, command.Successful(); expected != actual {
		t.Errorf("expected %v, got %v", expected, actual)
	}
}

func TestExecuteCommandOnClusterWithSecurity(t *testing.T) {
	var err error
	var pemData []byte
	if pemData, err = ioutil.ReadFile("./tools/test-ca/certs/cacert.pem"); err != nil {
		t.Fatal(err.Error())
	}
	caCertPool := x509.NewCertPool()
	if ok := caCertPool.AppendCertsFromPEM(pemData); !ok {
		t.Fatal("could not append PEM cert data")
	}
	tlsConfig := &tls.Config{
		ServerName:         "riak-test",
		InsecureSkipVerify: false, // set to 'true' to not require CA certs
		ClientCAs:          caCertPool,
	}
	authOptions := &AuthOptions{
		User:      "riakpass",
		Password:  "<PASSWORD>",
		TlsConfig: tlsConfig,
	}
	nodeOptions := &NodeOptions{
		RemoteAddress: remoteAddress,
		AuthOptions:   authOptions,
	}
	buildClusterAndRunTest(t, nodeOptions)
}

func TestExecuteCommandOnClusterWithSecurityAndClientCertificate(t *testing.T) {
	var err error
	var caCertPemData []byte
	if caCertPemData, err = ioutil.ReadFile("./tools/test-ca/certs/cacert.pem"); err != nil {
		t.Fatal(err.Error())
	}
	var cert tls.Certificate
	if cert, err = tls.LoadX509KeyPair(
		"./tools/test-ca/certs/riakuser-client-cert.pem",
		"./tools/test-ca/private/riakuser-client-cert-key.pem"); err != nil {
		t.Fatal(err.Error())
	}
	caCertPool := x509.NewCertPool()
	if ok := caCertPool.AppendCertsFromPEM(caCertPemData); !ok {
		t.Fatal("could not append PEM cert data")
	}
	tlsConfig := &tls.Config{
		ServerName:         "riak-test",
		InsecureSkipVerify: false, // set to 'true' to not require CA certs
		ClientCAs:          caCertPool,
		Certificates:       []tls.Certificate{cert},
	}
	authOptions := &AuthOptions{
		User:      "riakuser",
		TlsConfig: tlsConfig,
	}
	nodeOptions := &NodeOptions{
		RemoteAddress: remoteAddress,
		AuthOptions:   authOptions,
	}
	buildClusterAndRunTest(t, nodeOptions)
}
{'fraction_non_alphanumeric': 0.15838383838383838, 'fraction_numerical': 0.0048484848484848485, 'mean_word_length': 3.7605769230769233, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '607339', 'n_tokens_mistral': 1895, 'n_tokens_neox': 1799, 'n_words': 426}