72 lines
2.4 KiB
Go
72 lines
2.4 KiB
Go
package certificate
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.pcux.cn/xuans/Scert/backend/internal/config"
|
|
)
|
|
|
|
func testResourceRoots(t *testing.T, resource Resource) *x509.CertPool {
|
|
t.Helper()
|
|
roots := x509.NewCertPool()
|
|
if !roots.AppendCertsFromPEM(resource.Certificate) {
|
|
t.Fatal("测试证书无法加入专用测试信任库")
|
|
}
|
|
return roots
|
|
}
|
|
|
|
func TestACMETrustRootsAreEnvironmentIsolated(t *testing.T) {
|
|
staging, err := acmeTrustRoots("staging")
|
|
if err != nil || staging == nil {
|
|
t.Fatalf("测试环境根加载失败：%v", err)
|
|
}
|
|
production, err := acmeTrustRoots("production")
|
|
if err != nil || production != nil {
|
|
t.Fatal("正式环境必须使用系统信任库，不能继承测试根")
|
|
}
|
|
entries, err := stagingTrust.ReadDir("trust")
|
|
if err != nil || len(entries) != 4 {
|
|
t.Fatalf("必须包含四个官方测试根：%v", err)
|
|
}
|
|
for _, entry := range entries {
|
|
data, err := stagingTrust.ReadFile("trust/" + entry.Name())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
certs, err := parseCertificates(data)
|
|
if err != nil || len(certs) != 1 {
|
|
t.Fatalf("测试根文件无效：%s", entry.Name())
|
|
}
|
|
root := certs[0]
|
|
if !root.IsCA || !strings.Contains(root.Subject.CommonName, "(STAGING)") || root.CheckSignatureFrom(root) != nil {
|
|
t.Fatalf("测试根身份或自签名无效：%s", entry.Name())
|
|
}
|
|
if err := verifyChain(certs, staging, time.Now()); err != nil {
|
|
t.Fatalf("官方测试根应受测试信任库信任：%v", err)
|
|
}
|
|
if err := verifyChain(certs, production, time.Now()); err == nil {
|
|
t.Fatal("官方测试根不能受正式信任库信任")
|
|
}
|
|
}
|
|
if _, err := acmeTrustRoots("unknown"); err == nil {
|
|
t.Fatal("未知环境必须失败关闭")
|
|
}
|
|
}
|
|
|
|
func TestACMERejectsUntrustedLeafEvenWithoutSeparateIssuer(t *testing.T) {
|
|
service := NewService(config.Default(t.TempDir()), nil, nil, nil, nil)
|
|
resource := testResource(t, "example.com")
|
|
for _, environment := range []string{"production", "staging"} {
|
|
if err := service.validateACMEResource(t.Context(), resource, []string{"example.com"}, environment); err == nil {
|
|
t.Fatalf("%s 不得因 issuer 字段为空而接受任意自签证书", environment)
|
|
}
|
|
}
|
|
service.acmeRoots = testResourceRoots(t, resource)
|
|
if err := service.validateACMEResource(t.Context(), resource, []string{"example.com"}, "staging"); err != nil {
|
|
t.Fatalf("专用测试根验证失败：%v", err)
|
|
}
|
|
}
|