87 lines
4.2 KiB
Go
87 lines
4.2 KiB
Go
package config
|
||
|
||
import (
|
||
"testing"
|
||
"time"
|
||
)
|
||
|
||
func TestSSLPolicyFollowsManagement(t *testing.T) {
|
||
for _, test := range []struct {
|
||
name string
|
||
cfg *Config
|
||
want string
|
||
}{
|
||
{name: "nil", want: SSLTypeUser},
|
||
{name: "empty", cfg: &Config{}, want: SSLTypeUser},
|
||
{name: "legacy_http", cfg: &Config{SSLType: SSLTypeAutoHTTP}, want: SSLTypeAutoHTTP},
|
||
{name: "legacy_dns", cfg: &Config{SSLType: SSLTypeAutoDNS}, want: SSLTypeAutoDNS},
|
||
{name: "legacy_manual", cfg: &Config{SSLType: SSLTypeUser}, want: SSLTypeUser},
|
||
{name: "legacy_upload", cfg: &Config{SSLType: SSLTypeAutoHTTP, SSL: SSLConfig{Mode: ManagedSSLModeUpload}}, want: SSLTypeUser},
|
||
{name: "legacy_default", cfg: &Config{SSLType: SSLTypeUser, SSL: SSLConfig{Mode: ManagedSSLModeDefault}}, want: SSLTypeAutoHTTP},
|
||
{name: "project_http", cfg: &Config{SSLType: SSLTypeAutoDNS, SSL: SSLConfig{Management: SSLManagementProject, Challenge: SSLChallengeHTTP}}, want: SSLTypeAutoHTTP},
|
||
{name: "project_dns", cfg: &Config{SSLType: SSLTypeUser, SSL: SSLConfig{Management: SSLManagementProject, Challenge: SSLChallengeDNS}}, want: SSLTypeAutoDNS},
|
||
{name: "project_transition", cfg: &Config{SSLType: SSLTypeUser, SSL: SSLConfig{Management: SSLManagementProject, Mode: ManagedSSLModeUpload}}, want: SSLTypeAutoHTTP},
|
||
{name: "project_legacy_dns", cfg: &Config{SSLType: SSLTypeAutoDNS, SSL: SSLConfig{Management: SSLManagementProject}}, want: SSLTypeAutoDNS},
|
||
{name: "custom_stale_auto", cfg: &Config{SSLType: SSLTypeAutoHTTP, SSL: SSLConfig{Management: SSLManagementCustom, Mode: ManagedSSLModeDefault}}, want: SSLTypeUser},
|
||
{name: "web_server_stale_auto", cfg: &Config{SSLType: SSLTypeAutoDNS, SSL: SSLConfig{Management: SSLManagementWebServer}}, want: SSLTypeUser},
|
||
{name: "proxy_project", cfg: &Config{TLSMode: " PROXY ", SSL: SSLConfig{Management: SSLManagementProject}}, want: SSLTypeUser},
|
||
{name: "invalid_management", cfg: &Config{SSLType: SSLTypeAutoHTTP, SSL: SSLConfig{Management: "invalid"}}, want: SSLTypeUser},
|
||
} {
|
||
t.Run(test.name, func(t *testing.T) {
|
||
if got := test.cfg.EffectiveSSLType(); got != test.want {
|
||
t.Fatalf("证书策略错误：got=%s want=%s", got, test.want)
|
||
}
|
||
if test.cfg.AutomaticSSLEnabled() != (test.want != SSLTypeUser) {
|
||
t.Fatal("自动续期开关与托管策略不一致")
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestSSLPolicyFollowsRuntimeTLSOverride(t *testing.T) {
|
||
for _, test := range []struct {
|
||
name string
|
||
stored string
|
||
override string
|
||
wantProxy bool
|
||
}{
|
||
{name: "bootstrap_proxy", override: HTTPSTLSModeProxy, wantProxy: true},
|
||
{name: "direct_to_proxy", stored: HTTPSTLSModeDirect, override: " PROXY ", wantProxy: true},
|
||
{name: "proxy_to_direct", stored: HTTPSTLSModeProxy, override: HTTPSTLSModeDirect},
|
||
{name: "invalid_override", stored: HTTPSTLSModeProxy, override: "invalid", wantProxy: true},
|
||
} {
|
||
t.Run(test.name, func(t *testing.T) {
|
||
t.Setenv("SMAIL_HTTP_TLS_MODE_OVERRIDE", test.override)
|
||
cfg := &Config{TLSMode: test.stored, SSLType: SSLTypeAutoHTTP}
|
||
if got := cfg.UsesProxyHTTPS(); got != test.wantProxy {
|
||
t.Fatalf("proxy policy = %t, want %t", got, test.wantProxy)
|
||
}
|
||
if cfg.AutomaticSSLEnabled() == test.wantProxy {
|
||
t.Fatal("certificate policy disagrees with effective TLS mode")
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestExternalCertificateReloadIgnoresLegacyDNSMode(t *testing.T) {
|
||
previousRoot := ROOT_PATH
|
||
ROOT_PATH = t.TempDir()
|
||
t.Cleanup(func() { ROOT_PATH = previousRoot })
|
||
key, cert := testManagedCertificate(t, "mail.example.com", time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour), 2048)
|
||
reference, err := ImportManagedSSL(ManagedSSLModeUpload, key, cert, nil, []string{"mail.example.com"})
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
defer ReleaseStagedSSL(reference)
|
||
for _, management := range []string{SSLManagementCustom, SSLManagementWebServer} {
|
||
cfg := &Config{
|
||
Domain: "mail.example.com", WebDomain: "mail.example.com", SSLType: SSLTypeAutoDNS,
|
||
SSL: SSLConfig{Management: management, Mode: reference.Mode,
|
||
CertificateRef: reference.CertificateRef, PrivateKeyRef: reference.PrivateKeyRef},
|
||
}
|
||
if _, err := loadValidatedRuntimeCertificate(cfg); err != nil {
|
||
t.Fatalf("外部证书被旧 DNS 类型错误拒绝：management=%s err=%v", management, err)
|
||
}
|
||
}
|
||
}
|