tls_manager_test.go: reproduce partial tls files handling
What the developer wrote
Authored by Mohamed Awnallah
tls_manager_test.go: reproduce partial tls files handling
When there is only one of the tls pairs (key/certificate) and the
other is missing, the TLS manager currently assumes it exists
and ignore generating them. This results in error propgated to user
that the other tls pair file is missing/not found.
What changed, and why it matters
This commit only adds a new test file that reproduces a bug: when LND's TLS manager finds only one of its two TLS files (either the certificate or the private key) on disk, it wrongly assumes the other file also exists and skips generating a fresh pair. That leaves the node unable to start or serve TLS correctly. The commit does not include the actual fix, only the failing/regression test.
Review the companion fix commit that updates tls_manager.go to detect partial TLS file pairs and regenerate both certificate and key when only one exists. Run the new test to confirm it passes after the fix. Consider adding a release-note or security note if nodes could fail to start after interrupted certificate generation.
Security signals we found
Partial TLS material on disk causes startup/availability failure rather than silent regeneration
Could lead to operator confusion or manual workarounds that may weaken TLS configuration
Test-only commit; actual fix not present, so security impact is latent/potential
Evidence from the diff
The diff adds TestGenerateCertPairWithPartialFiles in tls_manager_test.go. It creates two scenarios—only tls.key exists, or only tls.cert exists—and then calls TLSManager.generateCertPair expecting it to regenerate the missing file. The test asserts no error and that the resulting pair can be loaded. The commit message confirms the current behavior is broken: the manager ignores generation when one file is missing, propagating a ‘file not found’ error to the user. No production code is changed.
Changed components
lnd/tls_manager.go (behavior under test, not modified)lnd/tls_manager_test.goInspect captured patch +89 / −0
diff --git a/tls_manager_test.go b/tls_manager_test.go
index 42f0104..541b123 100644
--- a/tls_manager_test.go
+++ b/tls_manager_test.go
@@ -369,3 +369,92 @@ func newTestDirectory(t *testing.T) (string, string, string) {
return tempDir, certPath, keyPath
}
+
+// TestGenerateCertPairWithPartialFiles tests that generateCertPair regenerates
+// a cert/key pair when only one file exists.
+func TestGenerateCertPairWithPartialFiles(t *testing.T) {
+ t.Parallel()
+
+ keyRing := &mock.SecretKeyRing{
+ RootKey: privKey,
+ }
+
+ testCases := []struct {
+ name string
+ setup func(t *testing.T, certPath, keyPath string)
+ }{
+ {
+ name: "only key exists",
+ setup: func(t *testing.T, certPath, keyPath string) {
+ // Create only a key file. It simulates leftover
+ // from previous run.
+ _, keyBytes := genCertPair(t, false)
+ keyBuf := &bytes.Buffer{}
+ err := pem.Encode(
+ keyBuf, &pem.Block{
+ Type: "EC PRIVATE KEY",
+ Bytes: keyBytes,
+ },
+ )
+ require.NoError(t, err)
+
+ err = os.WriteFile(
+ keyPath, keyBuf.Bytes(), 0600,
+ )
+ require.NoError(t, err)
+ },
+ },
+ {
+ name: "only cert exists",
+ setup: func(t *testing.T, certPath, keyPath string) {
+ // Create only a cert file. It simulates
+ // leftover from previous run.
+ certBytes, _ := genCertPair(t, false)
+ certBuf := &bytes.Buffer{}
+ err := pem.Encode(
+ certBuf, &pem.Block{
+ Type: "CERTIFICATE",
+ Bytes: certBytes,
+ },
+ )
+ require.NoError(t, err)
+
+ err = os.WriteFile(
+ certPath, certBuf.Bytes(), 0644,
+ )
+ require.NoError(t, err)
+ },
+ },
+ }
+
+ for _, tc := range testCases {
+ tc := tc
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ tempDir := t.TempDir()
+ certPath := tempDir + "/tls.cert"
+ keyPath := tempDir + "/tls.key"
+
+ tc.setup(t, certPath, keyPath)
+
+ cfg := &TLSManagerCfg{
+ TLSCertPath: certPath,
+ TLSKeyPath: keyPath,
+ TLSCertDuration: testTLSCertDuration,
+ }
+ tlsManager := NewTLSManager(cfg)
+
+ err := tlsManager.generateCertPair(keyRing)
+ require.NoError(
+ t, err, "should generate new cert pair when %s",
+ tc.name,
+ )
+
+ _, _, err = cert.GetCertBytesFromPath(certPath, keyPath)
+ require.NoError(
+ t, err, "should be able to load cert pair",
+ )
+ })
+ }
+}
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.