443 lines
17 KiB
Go
443 lines
17 KiB
Go
package certificate
|
||
|
||
import (
|
||
"context"
|
||
"crypto/rand"
|
||
"crypto/rsa"
|
||
"crypto/x509"
|
||
"crypto/x509/pkix"
|
||
"encoding/pem"
|
||
"errors"
|
||
"math/big"
|
||
"os"
|
||
"path/filepath"
|
||
"testing"
|
||
"time"
|
||
|
||
"github.com/go-acme/lego/v5/challenge"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/config"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/domain"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/secretstore"
|
||
)
|
||
|
||
type serviceRepository struct {
|
||
item domain.Domain
|
||
states []string
|
||
updateErr error
|
||
updateCalls int
|
||
}
|
||
|
||
func (r *serviceRepository) GetByID(_ context.Context, _ string) (domain.Domain, error) {
|
||
return r.item, nil
|
||
}
|
||
|
||
func (r *serviceRepository) UpdateCertificateState(_ context.Context, _ string, status string, expiresAt *time.Time) error {
|
||
r.updateCalls++
|
||
if status == "valid" && r.updateErr != nil {
|
||
return r.updateErr
|
||
}
|
||
r.states = append(r.states, status)
|
||
r.item.Status = status
|
||
r.item.ExpiresAt = expiresAt
|
||
return nil
|
||
}
|
||
|
||
type serviceCredentials struct{}
|
||
|
||
func (serviceCredentials) Get(context.Context, string) (map[string]string, error) {
|
||
return map[string]string{"api_token": "test-token"}, nil
|
||
}
|
||
|
||
type serviceProvider struct{}
|
||
|
||
func (serviceProvider) Present(context.Context, string, string, string) error { return nil }
|
||
func (serviceProvider) CleanUp(context.Context, string, string, string) error { return nil }
|
||
|
||
type serviceProviderFactory struct{}
|
||
|
||
func (serviceProviderFactory) Create(string, map[string]string) (challenge.Provider, error) {
|
||
return serviceProvider{}, nil
|
||
}
|
||
|
||
type serviceAuthorizationChecker struct {
|
||
verifyCalls int
|
||
invalidateCalls int
|
||
}
|
||
|
||
func (c *serviceAuthorizationChecker) VerifyDomain(context.Context, string, string, map[string]string) error {
|
||
c.verifyCalls++
|
||
return nil
|
||
}
|
||
|
||
func (c *serviceAuthorizationChecker) InvalidateDomain(string, string, map[string]string) {
|
||
c.invalidateCalls++
|
||
}
|
||
|
||
type recordingProviderFactory struct {
|
||
providerID string
|
||
credentials map[string]string
|
||
}
|
||
|
||
func (f *recordingProviderFactory) Create(providerID string, credentials map[string]string) (challenge.Provider, error) {
|
||
f.providerID = providerID
|
||
f.credentials = credentials
|
||
return serviceProvider{}, nil
|
||
}
|
||
|
||
type serviceAccounts struct{}
|
||
|
||
func (serviceAccounts) LoadOrCreate(context.Context, string, string) (*AccountUser, error) {
|
||
return &AccountUser{}, nil
|
||
}
|
||
|
||
func (serviceAccounts) Save(context.Context, string, *AccountUser) error { return nil }
|
||
|
||
type serviceIssuer struct {
|
||
request ObtainRequest
|
||
resource Resource
|
||
err error
|
||
}
|
||
|
||
func (i *serviceIssuer) Obtain(_ context.Context, request ObtainRequest) (Resource, error) {
|
||
i.request = request
|
||
return i.resource, i.err
|
||
}
|
||
|
||
func TestServiceIssuesSANCertificateAndUpdatesState(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSAN, []string{"example.com", "www.example.com"}, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item}
|
||
issuer := &serviceIssuer{resource: testResourceForDomains(t, []string{"example.com", "www.example.com"})}
|
||
service := NewService(cfg, repository, serviceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.acmeRoots = testResourceRoots(t, issuer.resource)
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
||
|
||
result, err := service.Issue(context.Background(), item.ID)
|
||
if err != nil {
|
||
t.Fatalf("申请 SAN 证书失败：%v", err)
|
||
}
|
||
if len(issuer.request.Domains) != 2 {
|
||
t.Fatalf("SAN 申请域名错误：%v", issuer.request.Domains)
|
||
}
|
||
if len(repository.states) != 2 || repository.states[0] != "issuing" || repository.states[1] != "valid" {
|
||
t.Fatalf("证书状态流转错误：%v", repository.states)
|
||
}
|
||
if _, err := os.Stat(result.Saved.PrivateKeyPath); err != nil {
|
||
t.Fatalf("证书私钥未保存：%v", err)
|
||
}
|
||
}
|
||
|
||
func TestServiceFailureKeepsExistingCertificate(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
oldExpiry := time.Now().UTC().Add(10 * 24 * time.Hour)
|
||
item.ExpiresAt = &oldExpiry
|
||
store := FileStore{Root: cfg.Paths.Certificate, BackupRoot: cfg.Paths.Backup}
|
||
oldResource := testResource(t, "example.com")
|
||
saved, err := store.Save(context.Background(), item.Name, oldResource)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
before, err := os.ReadFile(saved.CertificatePath)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item}
|
||
issuer := &serviceIssuer{err: errors.New("模拟 ACME 申请失败")}
|
||
service := NewService(cfg, repository, serviceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
||
|
||
if _, err := service.Issue(context.Background(), item.ID); err == nil {
|
||
t.Fatal("ACME 申请失败时应返回错误")
|
||
}
|
||
after, err := os.ReadFile(saved.CertificatePath)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
if string(after) != string(before) {
|
||
t.Fatal("申请失败时不应覆盖现有证书")
|
||
}
|
||
if len(repository.states) != 2 || repository.states[1] != "failed" {
|
||
t.Fatalf("失败状态未正确记录：%v", repository.states)
|
||
}
|
||
if repository.item.ExpiresAt == nil || !repository.item.ExpiresAt.Equal(oldExpiry) {
|
||
t.Fatal("申请失败时应保留原证书到期时间")
|
||
}
|
||
}
|
||
|
||
func TestServiceInvalidatesDNSAuthorizationAfterACMEFailure(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item}
|
||
issuer := &serviceIssuer{err: errors.New("模拟 DNS 权限已被收回")}
|
||
authorization := &serviceAuthorizationChecker{}
|
||
service := NewService(cfg, repository, serviceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.SetDNSAuthorizationChecker(authorization)
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
||
|
||
if _, err := service.Issue(context.Background(), item.ID); err == nil {
|
||
t.Fatal("ACME 申请失败时应返回错误")
|
||
}
|
||
if authorization.verifyCalls != 1 || authorization.invalidateCalls != 1 {
|
||
t.Fatalf("ACME 失败后的授权缓存处理错误：verify=%d invalidate=%d", authorization.verifyCalls, authorization.invalidateCalls)
|
||
}
|
||
}
|
||
|
||
func TestServiceDoesNotInvalidateDNSAuthorizationForUnrelatedACMEFailure(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item}
|
||
issuer := &serviceIssuer{err: errors.New("ACME 服务暂时不可用")}
|
||
authorization := &serviceAuthorizationChecker{}
|
||
service := NewService(cfg, repository, serviceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.SetDNSAuthorizationChecker(authorization)
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
||
|
||
if _, err := service.Issue(context.Background(), item.ID); err == nil {
|
||
t.Fatal("ACME 申请失败时应返回错误")
|
||
}
|
||
if authorization.invalidateCalls != 0 {
|
||
t.Fatalf("无关的 ACME 错误不应清除授权缓存：invalidate=%d", authorization.invalidateCalls)
|
||
}
|
||
}
|
||
|
||
func TestServiceImportsOwnedCertificate(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSAN, []string{"example.com", "api.example.com"}, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
resource := testResourceForDomains(t, []string{"example.com", "api.example.com"})
|
||
certificatePath := filepath.Join(root, "owned-cert.pem")
|
||
privateKeyPath := filepath.Join(root, "owned-key.pem")
|
||
if err := os.WriteFile(certificatePath, resource.Certificate, 0o600); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
if err := os.WriteFile(privateKeyPath, resource.PrivateKey, 0o600); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item}
|
||
service := NewService(cfg, repository, nil, nil, nil)
|
||
result, err := service.Import(context.Background(), ImportRequest{
|
||
DomainID: item.ID, Certificate: certificatePath, PrivateKey: privateKeyPath,
|
||
})
|
||
if err != nil {
|
||
t.Fatalf("导入自有证书失败：%v", err)
|
||
}
|
||
if len(result.Domains) != 2 || repository.item.Status != "valid" {
|
||
t.Fatalf("导入结果错误：%+v，状态：%s", result, repository.item.Status)
|
||
}
|
||
if _, err := os.Stat(result.Saved.FullChainPath); err != nil {
|
||
t.Fatalf("导入证书未保存：%v", err)
|
||
}
|
||
}
|
||
|
||
func TestServiceRejectsOwnedCertificateForWrongDomain(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
resource := testResource(t, "other.example.com")
|
||
certificatePath := filepath.Join(root, "wrong-cert.pem")
|
||
privateKeyPath := filepath.Join(root, "wrong-key.pem")
|
||
if err := os.WriteFile(certificatePath, resource.Certificate, 0o600); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
if err := os.WriteFile(privateKeyPath, resource.PrivateKey, 0o600); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
service := NewService(cfg, &serviceRepository{item: item}, nil, nil, nil)
|
||
if _, err := service.Import(context.Background(), ImportRequest{
|
||
DomainID: item.ID, Certificate: certificatePath, PrivateKey: privateKeyPath,
|
||
}); err == nil {
|
||
t.Fatal("证书不覆盖托管域名时应拒绝导入")
|
||
}
|
||
if _, err := os.Stat(filepath.Join(cfg.Paths.Certificate, "example.com", "cert.pem")); !errors.Is(err, os.ErrNotExist) {
|
||
t.Fatalf("导入失败时不应写入证书：%v", err)
|
||
}
|
||
}
|
||
|
||
func TestServiceRestoreVersionRollsBackFilesWhenStateUpdateFails(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
store := FileStore{Root: cfg.Paths.Certificate, BackupRoot: cfg.Paths.Backup}
|
||
first, err := store.SaveForType(context.Background(), item.Name, "single", testResource(t, "example.com"))
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
second, err := store.SaveForType(context.Background(), item.Name, "single", testResource(t, "example.com"))
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
beforeCertificate, err := os.ReadFile(second.CertificatePath)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
beforeKey, err := os.ReadFile(second.PrivateKeyPath)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item, updateErr: errors.New("simulated state update failure")}
|
||
service := NewService(cfg, repository, nil, nil, nil)
|
||
if _, err := service.RestoreVersion(context.Background(), item.ID, first.Version); !errors.Is(err, repository.updateErr) {
|
||
t.Fatalf("必须实际到达状态更新并返回注入的错误：%v", err)
|
||
}
|
||
if repository.updateCalls != 1 {
|
||
t.Fatalf("恢复未实际到达状态更新：调用次数=%d", repository.updateCalls)
|
||
}
|
||
afterCertificate, err := os.ReadFile(second.CertificatePath)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
afterKey, err := os.ReadFile(second.PrivateKeyPath)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
if string(afterCertificate) != string(beforeCertificate) || string(afterKey) != string(beforeKey) {
|
||
t.Fatal("certificate files were not rolled back after state update failure")
|
||
}
|
||
current, _, err := store.LoadCurrent(context.Background(), item.Name, string(item.CertificateType))
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
if current.Version != second.Version {
|
||
t.Fatalf("current metadata was not rolled back: got=%s want=%s", current.Version, second.Version)
|
||
}
|
||
}
|
||
|
||
func certificateTestConfig(root string) config.Config {
|
||
cfg := config.Default(root)
|
||
cfg.Paths.Config = filepath.Join(root, "conf")
|
||
cfg.Paths.Certificate = filepath.Join(root, "ssl")
|
||
cfg.Paths.Backup = filepath.Join(root, "backups")
|
||
cfg.DNS.Provider = "cloudflare"
|
||
cfg.DNS.CredentialRef = "secret://dns/cloudflare/test"
|
||
cfg.DNS.VerificationState = "verified"
|
||
cfg.Notification.Recipients = []string{"admin@example.com"}
|
||
return cfg
|
||
}
|
||
|
||
func testResourceForDomains(t *testing.T, names []string) Resource {
|
||
t.Helper()
|
||
key, err := rsa.GenerateKey(rand.Reader, 2048)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
now := time.Now().UTC()
|
||
template := &x509.Certificate{
|
||
SerialNumber: big.NewInt(2), Subject: pkix.Name{CommonName: names[0]}, DNSNames: names,
|
||
NotBefore: now.Add(-time.Minute), NotAfter: now.Add(90 * 24 * time.Hour),
|
||
KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||
}
|
||
der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
return Resource{
|
||
Domains: names, Certificate: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}),
|
||
PrivateKey: pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}),
|
||
}
|
||
}
|
||
|
||
func TestServiceIssuesSetupCertificateWithTypedLayout(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
issuer := &serviceIssuer{resource: testResource(t, "scert.example.com")}
|
||
service := NewService(cfg, nil, serviceCredentials{}, serviceProviderFactory{}, serviceAccounts{})
|
||
service.acmeRoots = testResourceRoots(t, issuer.resource)
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
||
|
||
saved, err := service.IssueForSetup(context.Background(), SetupCertificateRequest{
|
||
Domains: []string{"scert.example.com"}, CertificateType: "single",
|
||
ProviderID: "cloudflare", CredentialRef: "secret://dns/cloudflare/test",
|
||
AccountEmail: "admin@example.com", Environment: "staging",
|
||
CertificateRoot: cfg.Paths.Certificate, BackupRoot: cfg.Paths.Backup,
|
||
})
|
||
if err != nil {
|
||
t.Fatalf("申请初始化证书失败：%v", err)
|
||
}
|
||
wantDirectory := filepath.Join(cfg.Paths.Certificate, "management-domain", "scert.example.com", "single", saved.Version)
|
||
if saved.Directory != wantDirectory {
|
||
t.Fatalf("初始化证书目录错误：got=%q want=%q", saved.Directory, wantDirectory)
|
||
}
|
||
if issuer.request.AccountEmail != "admin@example.com" || len(issuer.request.Domains) != 1 {
|
||
t.Fatalf("初始化证书申请参数错误：%+v", issuer.request)
|
||
}
|
||
for _, path := range []string{saved.CertificatePath, saved.FullChainPath, saved.PrivateKeyPath} {
|
||
if _, err := os.Stat(path); err != nil {
|
||
t.Fatalf("初始化证书文件不存在：%s：%v", path, err)
|
||
}
|
||
}
|
||
}
|
||
|
||
func TestServiceDecryptsCredentialReferenceBeforeCreatingProvider(t *testing.T) {
|
||
root := t.TempDir()
|
||
cfg := certificateTestConfig(root)
|
||
store, err := secretstore.Open(cfg.Paths.Config)
|
||
if err != nil {
|
||
t.Fatalf("打开敏感信息存储失败：%v", err)
|
||
}
|
||
credentialRef := "secret://dns/cloudflare/service-test"
|
||
if err := store.Put(context.Background(), credentialRef, map[string]string{
|
||
"api_token": "test-dns-token",
|
||
}); err != nil {
|
||
t.Fatalf("保存测试 DNS 凭据失败：%v", err)
|
||
}
|
||
cfg.DNS.CredentialRef = credentialRef
|
||
item, err := domain.NewDomainWithOptions("example.com", domain.CertificateSingle, nil, true, domain.ACMEEnvironmentStaging, "cloudflare")
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
repository := &serviceRepository{item: item}
|
||
factory := &recordingProviderFactory{}
|
||
issuer := &serviceIssuer{resource: testResource(t, "example.com")}
|
||
service := NewService(cfg, repository, store, factory, serviceAccounts{})
|
||
service.acmeRoots = testResourceRoots(t, issuer.resource)
|
||
service.newIssuer = func(*AccountUser, challenge.Provider, string) Issuer { return issuer }
|
||
|
||
if _, err := service.Issue(context.Background(), item.ID); err != nil {
|
||
t.Fatalf("使用加密凭据引用申请证书失败：%v", err)
|
||
}
|
||
if factory.providerID != "cloudflare" || factory.credentials["api_token"] != "test-dns-token" {
|
||
t.Fatalf("创建 DNS Provider 时未正确解密凭据：provider=%q credentials=%v", factory.providerID, factory.credentials)
|
||
}
|
||
}
|
||
|
||
func TestNewServiceInjectsPropagationSettings(t *testing.T) {
|
||
cfg := certificateTestConfig(t.TempDir())
|
||
cfg.ACME.PropagationTimeoutSecs = 1200
|
||
cfg.ACME.PropagationPollingIntervalSecs = 15
|
||
service := NewService(cfg, nil, nil, nil, nil)
|
||
issuer, ok := service.newIssuer(&AccountUser{}, serviceProvider{}, "staging").(*LegoIssuer)
|
||
if !ok {
|
||
t.Fatal("创建的 Issuer 类型不正确")
|
||
}
|
||
if issuer.PropagationTimeout != 1200*time.Second || issuer.PropagationInterval != 15*time.Second {
|
||
t.Fatalf("DNS 传播参数注入不正确：timeout=%s interval=%s", issuer.PropagationTimeout, issuer.PropagationInterval)
|
||
}
|
||
}
|