Fix error assertion in IsCertificateUntrusted

chrischdi · dougm · commit 0ed140ee07e2 · 2024-10-23T11:05:19.000-07:00
diff --git a/vim25/soap/error.go b/vim25/soap/error.go
@@ -121,11 +121,11 @@ func IsCertificateUntrusted(err error) bool {
 	// golang 1.20 introduce a new type to wrap 509 errors. So instead of
 	// casting the type, now we check the error chain contains the
 	// x509 error or not.
-	if errors.Is(err, &x509.UnknownAuthorityError{}) {
+	if errors.As(err, &x509.UnknownAuthorityError{}) {
 		return true
 	}
 
-	if errors.Is(err, &x509.HostnameError{}) {
+	if errors.As(err, &x509.HostnameError{}) {
 		return true
 	}
 
diff --git a/vim25/soap/error_test.go b/vim25/soap/error_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package soap
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"testing"
+)
+
+func TestIsCertificateUntrusted(t *testing.T) {
+	type args struct {
+	}
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "tls.CertificateVerificationError",
+			err: x509.HostnameError{
+				Certificate: &x509.Certificate{},
+				Host:        "1.2.3.4",
+			},
+			want: true,
+		},
+		{
+			name: "tls.CertificateVerificationError",
+			err: &tls.CertificateVerificationError{
+				UnverifiedCertificates: []*x509.Certificate{
+					&x509.Certificate{},
+				},
+				Err: x509.HostnameError{
+					Certificate: &x509.Certificate{},
+					Host:        "5.6.7.8",
+				},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := IsCertificateUntrusted(tt.err); got != tt.want {
+				t.Errorf("IsCertificateUntrusted() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

Original file line number	Diff line number	Diff line change
`@@ -121,11 +121,11 @@ func IsCertificateUntrusted(err error) bool {`
`121`	`121`	`// golang 1.20 introduce a new type to wrap 509 errors. So instead of`
`122`	`122`	`// casting the type, now we check the error chain contains the`
`123`	`123`	`// x509 error or not.`
`124`		`- if errors.Is(err, &x509.UnknownAuthorityError{}) {`
	`124`	`+ if errors.As(err, &x509.UnknownAuthorityError{}) {`
`125`	`125`	`return true`
`126`	`126`	`}`
`127`	`127`
`128`		`- if errors.Is(err, &x509.HostnameError{}) {`
	`128`	`+ if errors.As(err, &x509.HostnameError{}) {`
`129`	`129`	`return true`
`130`	`130`	`}`
`131`	`131`