encryptx/blowfishx/blowfishx_test.go

package blowfishx_test

import (
	"bytes"
	"errors"
	"testing"

	"code.yun.ink/pkg/encryptx/blowfishx"
	"code.yun.ink/pkg/encryptx/cipherx"
)

func TestGenerateKey(t *testing.T) {
	for _, size := range []int{blowfishx.MinKeySize, 16, blowfishx.DefaultKeySize, blowfishx.MaxKeySize} {
		key, err := blowfishx.GenerateKey(size)
		if err != nil {
			t.Fatalf("GenerateKey(%d) 失败: %v", size, err)
		}
		if len(key) != size {
			t.Fatalf("GenerateKey(%d) 返回长度 %d", size, len(key))
		}
	}

	// 超出范围必须被拒绝
	for _, size := range []int{-1, 0, 1, 3, 57, 64, 128} {
		if _, err := blowfishx.GenerateKey(size); !errors.Is(err, cipherx.ErrInvalidKeySize) {
			t.Errorf("GenerateKey(%d): 期望 ErrInvalidKeySize, 得到 %v", size, err)
		}
	}

	key1, _ := blowfishx.GenerateKey(blowfishx.DefaultKeySize)
	key2, _ := blowfishx.GenerateKey(blowfishx.DefaultKeySize)
	if bytes.Equal(key1, key2) {
		t.Error("两次 GenerateKey 产生了相同密钥")
	}

	hexKey, err := blowfishx.GenerateKeyHex(16)
	if err != nil {
		t.Fatalf("GenerateKeyHex 失败: %v", err)
	}
	if len(hexKey) != 32 {
		t.Errorf("GenerateKeyHex(16) 长度 = %d, 期望 32", len(hexKey))
	}
	if _, err := blowfishx.GenerateKeyHex(100); err == nil {
		t.Error("GenerateKeyHex(100): 期望错误")
	}
}

// TestInvalidKeySizeRejected 验证底层 blowfish 的密钥长度限制被正确包装为
// cipherx.ErrInvalidKeySize，而不是泄漏一个难以判断的裸错误。
func TestInvalidKeySizeRejected(t *testing.T) {
	plaintext := []byte("hello")
	for _, wrongLen := range []int{0, 57, 100} {
		key := bytes.Repeat([]byte{0x01}, wrongLen)
		if _, err := blowfishx.EncryptCBC(plaintext, key); !errors.Is(err, cipherx.ErrInvalidKeySize) {
			t.Errorf("密钥长度 %d: 期望 ErrInvalidKeySize, 得到 %v", wrongLen, err)
		}
	}
}

func TestAllModesRoundTrip(t *testing.T) {
	key, err := blowfishx.GenerateKey(blowfishx.DefaultKeySize)
	if err != nil {
		t.Fatalf("GenerateKey 失败: %v", err)
	}

	encryptors := map[string]func([]byte, []byte) ([]byte, error){
		"ECB": blowfishx.EncryptECB, "CBC": blowfishx.EncryptCBC, "CFB": blowfishx.EncryptCFB,
		"OFB": blowfishx.EncryptOFB, "CTR": blowfishx.EncryptCTR,
	}
	decryptors := map[string]func([]byte, []byte) ([]byte, error){
		"ECB": blowfishx.DecryptECB, "CBC": blowfishx.DecryptCBC, "CFB": blowfishx.DecryptCFB,
		"OFB": blowfishx.DecryptOFB, "CTR": blowfishx.DecryptCTR,
	}
	plaintexts := [][]byte{
		{}, []byte("a"), []byte("1234567"), []byte("12345678"), []byte("123456789"),
		bytes.Repeat([]byte("BF"), 200),
	}

	for name, encrypt := range encryptors {
		for i, plaintext := range plaintexts {
			ciphertext, err := encrypt(plaintext, key)
			if err != nil {
				t.Fatalf("%s 明文#%d 加密失败: %v", name, i, err)
			}
			decrypted, err := decryptors[name](ciphertext, key)
			if err != nil {
				t.Fatalf("%s 明文#%d 解密失败: %v", name, i, err)
			}
			if !bytes.Equal(decrypted, plaintext) {
				t.Errorf("%s 明文#%d 往返不一致", name, i)
			}
		}
	}
}

// TestVariableKeyLength 验证 Blowfish 支持的多种密钥长度都能正常工作。
func TestVariableKeyLength(t *testing.T) {
	plaintext := []byte("variable key length")
	for _, size := range []int{blowfishx.MinKeySize, 8, 16, 32, 56} {
		key, err := blowfishx.GenerateKey(size)
		if err != nil {
			t.Fatalf("GenerateKey(%d) 失败: %v", size, err)
		}
		ciphertext, err := blowfishx.EncryptCBC(plaintext, key)
		if err != nil {
			t.Fatalf("密钥长度 %d 加密失败: %v", size, err)
		}
		decrypted, err := blowfishx.DecryptCBC(ciphertext, key)
		if err != nil {
			t.Fatalf("密钥长度 %d 解密失败: %v", size, err)
		}
		if !bytes.Equal(decrypted, plaintext) {
			t.Errorf("密钥长度 %d 往返不一致", size)
		}
	}
}

func TestHexAPIRoundTrip(t *testing.T) {
	key, _ := blowfishx.GenerateKey(16)
	plaintext := []byte("十六进制往返")

	cases := []struct {
		name    string
		encrypt func([]byte, []byte) (string, error)
		decrypt func(string, []byte) ([]byte, error)
	}{
		{"ECB", blowfishx.EncryptECBHex, blowfishx.DecryptECBHex},
		{"CBC", blowfishx.EncryptCBCHex, blowfishx.DecryptCBCHex},
		{"CFB", blowfishx.EncryptCFBHex, blowfishx.DecryptCFBHex},
		{"OFB", blowfishx.EncryptOFBHex, blowfishx.DecryptOFBHex},
		{"CTR", blowfishx.EncryptCTRHex, blowfishx.DecryptCTRHex},
	}
	for _, c := range cases {
		hexStr, err := c.encrypt(plaintext, key)
		if err != nil {
			t.Fatalf("%s Hex 加密失败: %v", c.name, err)
		}
		if bytes.ContainsAny([]byte(hexStr), "\n\r \t") {
			t.Errorf("%s Hex 输出含空白字符", c.name)
		}
		decrypted, err := c.decrypt(hexStr, key)
		if err != nil {
			t.Fatalf("%s Hex 解密失败: %v", c.name, err)
		}
		if !bytes.Equal(decrypted, plaintext) {
			t.Errorf("%s Hex 往返不一致", c.name)
		}
	}
}

func TestWithIVRoundTrip(t *testing.T) {
	key, _ := blowfishx.GenerateKey(16)
	iv := bytes.Repeat([]byte{0x5A}, blowfishx.BlockSize)
	plaintext := []byte("fixed iv")

	cases := []struct {
		name    string
		encrypt func([]byte, []byte, []byte) ([]byte, error)
		decrypt func([]byte, []byte, []byte) ([]byte, error)
	}{
		{"CBC", blowfishx.EncryptCBCWithIV, blowfishx.DecryptCBCWithIV},
		{"CFB", blowfishx.EncryptCFBWithIV, blowfishx.DecryptCFBWithIV},
		{"OFB", blowfishx.EncryptOFBWithIV, blowfishx.DecryptOFBWithIV},
		{"CTR", blowfishx.EncryptCTRWithIV, blowfishx.DecryptCTRWithIV},
	}
	for _, c := range cases {
		ciphertext, err := c.encrypt(plaintext, key, iv)
		if err != nil {
			t.Fatalf("%s WithIV 加密失败: %v", c.name, err)
		}
		decrypted, err := c.decrypt(ciphertext, key, iv)
		if err != nil {
			t.Fatalf("%s WithIV 解密失败: %v", c.name, err)
		}
		if !bytes.Equal(decrypted, plaintext) {
			t.Errorf("%s WithIV 往返不一致", c.name)
		}
	}
}

// TestMalformedCiphertextNeverPanics 是 P0-3 在 Blowfish 上的回归测试。
func TestMalformedCiphertextNeverPanics(t *testing.T) {
	key, _ := blowfishx.GenerateKey(16)
	decryptors := map[string]func([]byte, []byte) ([]byte, error){
		"ECB": blowfishx.DecryptECB, "CBC": blowfishx.DecryptCBC, "CFB": blowfishx.DecryptCFB,
		"OFB": blowfishx.DecryptOFB, "CTR": blowfishx.DecryptCTR,
	}
	for _, decrypt := range decryptors {
		for n := 0; n <= 24; n++ {
			_, _ = decrypt(bytes.Repeat([]byte{0x7F}, n), key)
		}
	}

	nonAligned := bytes.Repeat([]byte{0xAB}, 12)
	if _, err := blowfishx.DecryptECB(nonAligned, key); !errors.Is(err, cipherx.ErrNotBlockAligned) {
		t.Errorf("ECB 非对齐: 期望 ErrNotBlockAligned, 得到 %v", err)
	}
	if _, err := blowfishx.DecryptCBC(nonAligned, key); !errors.Is(err, cipherx.ErrNotBlockAligned) {
		t.Errorf("CBC 非对齐: 期望 ErrNotBlockAligned, 得到 %v", err)
	}
}