test: add CurvePreferences tests for NewTLSConfigFromProfile

Author: damdo

pkg/tls/tls_test.go

@@ -291,4 +291,80 @@ var _ = Describe("NewTLSConfigFromProfile", func() {
 			Expect(tlsConf.CipherSuites).To(BeNil())
 		})
 	})
+
+	Context("when profile contains Groups", func() {
+		It("should set CurvePreferences for supported groups", func() {
+			profile := configv1.TLSProfileSpec{
+				MinTLSVersion: configv1.VersionTLS12,
+				Groups: []configv1.TLSGroup{
+					configv1.TLSGroupX25519,
+					configv1.TLSGroupSecP256r1,
+				},
+			}
+
+			tlsConfigFn, unsupported := NewTLSConfigFromProfile(profile)
+			Expect(unsupported).To(BeEmpty())
+
+			tlsConf := &tls.Config{}
+			tlsConfigFn(tlsConf)
+
+			Expect(tlsConf.CurvePreferences).To(HaveLen(2))
+			Expect(tlsConf.CurvePreferences).To(ContainElement(tls.X25519))
+			Expect(tlsConf.CurvePreferences).To(ContainElement(tls.CurveP256))
+		})
+	})
+
+	Context("when profile contains unsupported Groups", func() {
+		It("should return unsupported groups and set only supported curves", func() {
+			profile := configv1.TLSProfileSpec{
+				MinTLSVersion: configv1.VersionTLS12,
+				Groups: []configv1.TLSGroup{
+					configv1.TLSGroupX25519,
+					configv1.TLSGroup("unsupported_group"),
+				},
+			}
+
+			tlsConfigFn, unsupported := NewTLSConfigFromProfile(profile)
+			Expect(unsupported).To(ConsistOf("unsupported_group"))
+
+			tlsConf := &tls.Config{}
+			tlsConfigFn(tlsConf)
+
+			Expect(tlsConf.CurvePreferences).To(HaveLen(1))
+			Expect(tlsConf.CurvePreferences).To(ContainElement(tls.X25519))
+		})
+	})
+
+	Context("when profile has empty Groups", func() {
+		It("should not set CurvePreferences", func() {
+			profile := configv1.TLSProfileSpec{
+				MinTLSVersion: configv1.VersionTLS12,
+				Groups:        []configv1.TLSGroup{},
+			}
+
+			tlsConfigFn, unsupported := NewTLSConfigFromProfile(profile)
+			Expect(unsupported).To(BeEmpty())
+
+			tlsConf := &tls.Config{}
+			tlsConfigFn(tlsConf)
+
+			Expect(tlsConf.CurvePreferences).To(BeNil())
+		})
+	})
+
+	Context("when using Intermediate profile with Groups", func() {
+		It("should set CurvePreferences from the profile", func() {
+			profile := *configv1.TLSProfiles[configv1.TLSProfileIntermediateType]
+
+			tlsConfigFn, _ := NewTLSConfigFromProfile(profile)
+
+			tlsConf := &tls.Config{}
+			tlsConfigFn(tlsConf)
+
+			// Intermediate profile now includes Groups
+			if len(profile.Groups) > 0 {
+				Expect(tlsConf.CurvePreferences).NotTo(BeNil())
+			}
+		})
+	})
 })