优化

2026-09-29 03:26:37 +08:00 · 2026-08-25 14:12:59 +08:00
parent eb09251424
commit da1fb02c9d
18 changed files with 1011 additions and 86 deletions
@@ -0,0 +1,121 @@
+package service
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func makeTestKeyPair(t *testing.T) (certPEM, keyPEM string) {
+	t.Helper()
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "localhost"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"localhost"},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &priv.PublicKey, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyDER, err := x509.MarshalECPrivateKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPEM = strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})))
+	keyPEM = strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})))
+	return certPEM, keyPEM
+}
+
+func TestResolveSSLMaterial(t *testing.T) {
+	dir := t.TempDir()
+	certPEM, _ := makeTestKeyPair(t)
+	path := filepath.Join(dir, "cert.pem")
+	if err := os.WriteFile(path, []byte(certPEM), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	cases := []struct {
+		name   string
+		content string
+		path   string
+		want   string
+		err    bool
+	}{
+		{name: "content only", content: certPEM, want: certPEM},
+		{name: "path only", path: path, want: certPEM},
+		{name: "path wins over content", content: "bogus", path: path, want: certPEM},
+		{name: "both empty", err: true},
+		{name: "missing file", path: filepath.Join(dir, "missing.pem"), err: true},
+		{name: "path is dir", path: dir, err: true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := ResolveSSLMaterial(tc.content, tc.path, "证书")
+			if tc.err {
+				if err == nil {
+					t.Fatalf("expected error, got %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tc.want {
+				t.Fatalf("got %q want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestResolveSSLKeyPair(t *testing.T) {
+	dir := t.TempDir()
+	certPEM, keyPEM := makeTestKeyPair(t)
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	if err := os.WriteFile(certPath, []byte(certPEM), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(keyPath, []byte(keyPEM), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := ResolveSSLKeyPair(certPEM, "", keyPEM, ""); err != nil {
+		t.Fatalf("content pair: %v", err)
+	}
+	if _, err := ResolveSSLKeyPair("", certPath, "", keyPath); err != nil {
+		t.Fatalf("path pair: %v", err)
+	}
+	if _, err := ResolveSSLKeyPair(certPEM, "", "", keyPath); err != nil {
+		t.Fatalf("mixed pair: %v", err)
+	}
+
+	otherCert, _ := makeTestKeyPair(t)
+	if _, err := ResolveSSLKeyPair(otherCert, "", keyPEM, ""); err == nil {
+		t.Fatal("expected mismatch error")
+	}
+
+	if got, ok := PathFingerprint(certPath); !ok || got == "" {
+		t.Fatalf("PathFingerprint failed: got=%q ok=%v", got, ok)
+	}
+	if _, ok := PathFingerprint(filepath.Join(dir, "missing.pem")); ok {
+		t.Fatal("PathFingerprint should report missing file")
+	}
+	if _, ok := PathFingerprint("   "); ok {
+		t.Fatal("empty PathFingerprint should not be ok")
+	}
+}