59 lines
2.4 KiB
Go
59 lines
2.4 KiB
Go
package dnsprovider
|
||
|
||
import (
|
||
"encoding/base64"
|
||
"encoding/hex"
|
||
"errors"
|
||
"strings"
|
||
"testing"
|
||
)
|
||
|
||
func TestAliyunAuthorizationRecordLabelUsesSafeRandomSuffix(t *testing.T) {
|
||
for _, name := range []string{"example.com", "web.example.com", "*.web.example.com", "www.sub.example.com"} {
|
||
t.Run(name, func(t *testing.T) {
|
||
seen := make(map[string]bool)
|
||
for attempt := 0; attempt < 32; attempt++ {
|
||
api := &authorizationRecordAPI{}
|
||
report, err := newAuthorizationCheckerForTest(api).Verify(t.Context(), name, scopeCredentials())
|
||
if err != nil || !report.Verified {
|
||
t.Fatalf("授权闭环验证失败：report=%+v err=%v", report, err)
|
||
}
|
||
label := strings.SplitN(api.rr, ".", 2)[0]
|
||
const prefix = "_scert-authorization-"
|
||
suffix := strings.TrimPrefix(label, prefix)
|
||
if !strings.HasPrefix(label, prefix) || len(label) > 63 || len(suffix) != 36 {
|
||
t.Fatalf("随机主机记录标签必须使用固定长度安全后缀：%q", label)
|
||
}
|
||
decoded, err := hex.DecodeString(suffix)
|
||
if err != nil || len(decoded) != 18 || suffix != strings.ToLower(suffix) {
|
||
t.Fatalf("随机后缀必须完整编码十八字节随机数且只使用小写十六进制：%q", suffix)
|
||
}
|
||
if seen[suffix] {
|
||
t.Fatalf("不同请求复用了随机探测后缀：%q", suffix)
|
||
}
|
||
seen[suffix] = true
|
||
targetSuffix := strings.TrimSuffix(strings.TrimPrefix(name, "*."), ".example.com")
|
||
if name == "example.com" {
|
||
targetSuffix = ""
|
||
} else {
|
||
targetSuffix = "." + targetSuffix
|
||
}
|
||
if api.rr != label+targetSuffix || report.RecordName != api.rr+".example.com." {
|
||
t.Fatalf("探测记录越出指定域名范围：rr=%q record=%q", api.rr, report.RecordName)
|
||
}
|
||
value, err := base64.RawURLEncoding.DecodeString(api.value)
|
||
if err != nil || len(value) != 32 || callNames(api.calls) != "add,describe,delete" {
|
||
t.Fatalf("记录名修复不应改变 TXT 随机强度或写读清理闭环：value=%q calls=%v", api.value, api.calls)
|
||
}
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestAliyunInvalidRecordFormatDiagnosisDoesNotSuggestPermissionChange(t *testing.T) {
|
||
message := DiagnoseAliyunError(errors.New("SDKError: Code: InvalidRR.Format secret-provider-detail"), "web.example.com")
|
||
if !strings.Contains(message, "记录名格式") || !strings.Contains(message, "权限不足") || strings.Contains(message, "secret-provider-detail") {
|
||
t.Fatalf("随机记录名格式错误应提供脱敏且不误导扩权的说明：%s", message)
|
||
}
|
||
}
|