200 lines
7.1 KiB
Go
200 lines
7.1 KiB
Go
|
package cipherx_test
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"bytes"
|
|||
|
|
"crypto/aes"
|
|||
|
|
"errors"
|
|||
|
|
"testing"
|
|||
|
|
|
|||
|
|
"code.yun.ink/pkg/encryptx/cipherx"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
// testSuite 返回一个以 AES 为实现、覆盖两种密钥长度的套件。
|
|||
|
|
func testSuite() *cipherx.Suite {
|
|||
|
|
return cipherx.NewSuite("TEST", aes.NewCipher, 16, 16, 32)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestSuiteMetadata(t *testing.T) {
|
|||
|
|
suite := testSuite()
|
|||
|
|
|
|||
|
|
if got := suite.Name(); got != "TEST" {
|
|||
|
|
t.Errorf("Name() = %q, 期望 TEST", got)
|
|||
|
|
}
|
|||
|
|
if got := suite.BlockSize(); got != 16 {
|
|||
|
|
t.Errorf("BlockSize() = %d, 期望 16", got)
|
|||
|
|
}
|
|||
|
|
sizes := suite.KeySizes()
|
|||
|
|
if len(sizes) != 2 || sizes[0] != 16 || sizes[1] != 32 {
|
|||
|
|
t.Errorf("KeySizes() = %v, 期望 [16 32]", sizes)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// KeySizes 必须返回副本，改动它不应影响套件本身
|
|||
|
|
sizes[0] = 999
|
|||
|
|
if again := suite.KeySizes(); again[0] != 16 {
|
|||
|
|
t.Error("KeySizes 返回了内部切片，调用方可意外篡改套件配置")
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestSuiteNewBlockValidatesKeyLength(t *testing.T) {
|
|||
|
|
suite := testSuite()
|
|||
|
|
|
|||
|
|
for _, size := range []int{16, 32} {
|
|||
|
|
key := bytes.Repeat([]byte{0x11}, size)
|
|||
|
|
if _, err := suite.NewBlock(key); err != nil {
|
|||
|
|
t.Errorf("NewBlock(密钥长度 %d) 失败: %v", size, err)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
for _, size := range []int{0, 8, 15, 17, 24, 31, 64} {
|
|||
|
|
key := bytes.Repeat([]byte{0x11}, size)
|
|||
|
|
if _, err := suite.NewBlock(key); !errors.Is(err, cipherx.ErrInvalidKeySize) {
|
|||
|
|
t.Errorf("NewBlock(密钥长度 %d): 期望 ErrInvalidKeySize, 得到 %v", size, err)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// TestSuiteWithoutKeySizes 验证未声明密钥长度时由底层实现校验，
|
|||
|
|
// 且失败仍被统一归类为 ErrInvalidKeySize（Blowfish 走的就是这条路径）。
|
|||
|
|
func TestSuiteWithoutKeySizes(t *testing.T) {
|
|||
|
|
suite := cipherx.NewSuite("NOCHECK", aes.NewCipher, 16)
|
|||
|
|
|
|||
|
|
if _, err := suite.NewBlock(bytes.Repeat([]byte{0x11}, 16)); err != nil {
|
|||
|
|
t.Fatalf("合法的 16 字节密钥被拒绝: %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.NewBlock(bytes.Repeat([]byte{0x11}, 17)); !errors.Is(err, cipherx.ErrInvalidKeySize) {
|
|||
|
|
t.Errorf("非法密钥长度: 期望 ErrInvalidKeySize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestSuiteEncryptDecryptAllModes(t *testing.T) {
|
|||
|
|
suite := testSuite()
|
|||
|
|
key := bytes.Repeat([]byte{0x42}, 32)
|
|||
|
|
plaintext := []byte("suite 往返测试 payload")
|
|||
|
|
|
|||
|
|
modes := []cipherx.Mode{cipherx.ECB, cipherx.CBC, cipherx.CFB, cipherx.OFB, cipherx.CTR}
|
|||
|
|
for _, mode := range modes {
|
|||
|
|
ciphertext, err := suite.Encrypt(mode, plaintext, key)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: Encrypt 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
decrypted, err := suite.Decrypt(mode, ciphertext, key)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: Decrypt 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
if !bytes.Equal(decrypted, plaintext) {
|
|||
|
|
t.Errorf("%s: 往返不一致", mode)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 密钥长度非法时必须在构造阶段就失败
|
|||
|
|
if _, err := suite.Encrypt(cipherx.CBC, plaintext, []byte("short")); !errors.Is(err, cipherx.ErrInvalidKeySize) {
|
|||
|
|
t.Errorf("Encrypt 非法密钥: 期望 ErrInvalidKeySize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.Decrypt(cipherx.CBC, []byte("x"), []byte("short")); !errors.Is(err, cipherx.ErrInvalidKeySize) {
|
|||
|
|
t.Errorf("Decrypt 非法密钥: 期望 ErrInvalidKeySize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestSuiteWithIV(t *testing.T) {
|
|||
|
|
suite := testSuite()
|
|||
|
|
key := bytes.Repeat([]byte{0x42}, 16)
|
|||
|
|
iv := bytes.Repeat([]byte{0x7E}, 16)
|
|||
|
|
plaintext := []byte("explicit iv via suite")
|
|||
|
|
|
|||
|
|
for _, mode := range []cipherx.Mode{cipherx.CBC, cipherx.CFB, cipherx.OFB, cipherx.CTR} {
|
|||
|
|
ciphertext, err := suite.EncryptWithIV(mode, plaintext, key, iv)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: EncryptWithIV 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
decrypted, err := suite.DecryptWithIV(mode, ciphertext, key, iv)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: DecryptWithIV 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
if !bytes.Equal(decrypted, plaintext) {
|
|||
|
|
t.Errorf("%s: WithIV 往返不一致", mode)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if _, err := suite.EncryptWithIV(cipherx.CBC, plaintext, key, []byte("bad")); !errors.Is(err, cipherx.ErrInvalidIVSize) {
|
|||
|
|
t.Errorf("非法 IV 长度: 期望 ErrInvalidIVSize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.EncryptWithIV(cipherx.ECB, plaintext, key, iv); !errors.Is(err, cipherx.ErrInvalidMode) {
|
|||
|
|
t.Errorf("ECB 传 IV: 期望 ErrInvalidMode, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestSuiteHexHelpers(t *testing.T) {
|
|||
|
|
suite := testSuite()
|
|||
|
|
key := bytes.Repeat([]byte{0x42}, 16)
|
|||
|
|
iv := bytes.Repeat([]byte{0x7E}, 16)
|
|||
|
|
plaintext := []byte("hex 辅助函数")
|
|||
|
|
|
|||
|
|
for _, mode := range []cipherx.Mode{cipherx.ECB, cipherx.CBC, cipherx.CFB, cipherx.OFB, cipherx.CTR} {
|
|||
|
|
hexStr, err := suite.EncryptHex(mode, plaintext, key)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: EncryptHex 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
decrypted, err := suite.DecryptHex(mode, hexStr, key)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: DecryptHex 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
if !bytes.Equal(decrypted, plaintext) {
|
|||
|
|
t.Errorf("%s: Hex 往返不一致", mode)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 带显式 IV 的十六进制辅助函数
|
|||
|
|
for _, mode := range []cipherx.Mode{cipherx.CBC, cipherx.CFB, cipherx.OFB, cipherx.CTR} {
|
|||
|
|
hexStr, err := suite.EncryptWithIVHex(mode, plaintext, key, iv)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: EncryptWithIVHex 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
decrypted, err := suite.DecryptWithIVHex(mode, hexStr, key, iv)
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("%s: DecryptWithIVHex 失败: %v", mode, err)
|
|||
|
|
}
|
|||
|
|
if !bytes.Equal(decrypted, plaintext) {
|
|||
|
|
t.Errorf("%s: WithIVHex 往返不一致", mode)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 非法十六进制
|
|||
|
|
if _, err := suite.DecryptHex(cipherx.CBC, "zz", key); err == nil {
|
|||
|
|
t.Error("非法十六进制期望错误")
|
|||
|
|
}
|
|||
|
|
if _, err := suite.EncryptWithIVHex(cipherx.CBC, plaintext, []byte("short"), iv); !errors.Is(err, cipherx.ErrInvalidKeySize) {
|
|||
|
|
t.Errorf("非法密钥: 期望 ErrInvalidKeySize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.DecryptWithIVHex(cipherx.CBC, "zz", key, iv); err == nil {
|
|||
|
|
t.Error("非法十六进制期望错误")
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// TestSuiteMemberVariants 覆盖 Suite 各方法的失败分支，确保错误在
|
|||
|
|
// 构造阶段就被发现，而不是留到更难排查的位置。
|
|||
|
|
func TestSuiteMemberVariants(t *testing.T) {
|
|||
|
|
suite := testSuite()
|
|||
|
|
key := bytes.Repeat([]byte{0x42}, 16)
|
|||
|
|
iv := bytes.Repeat([]byte{0x7E}, 16)
|
|||
|
|
|
|||
|
|
if _, err := suite.Encrypt(cipherx.Mode(99), []byte("x"), key); !errors.Is(err, cipherx.ErrInvalidMode) {
|
|||
|
|
t.Errorf("Encrypt 非法模式: 期望 ErrInvalidMode, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.Decrypt(cipherx.Mode(99), []byte("x"), key); !errors.Is(err, cipherx.ErrInvalidMode) {
|
|||
|
|
t.Errorf("Decrypt 非法模式: 期望 ErrInvalidMode, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.EncryptWithIV(cipherx.Mode(99), []byte("x"), key, iv); !errors.Is(err, cipherx.ErrInvalidMode) {
|
|||
|
|
t.Errorf("EncryptWithIV 非法模式: 期望 ErrInvalidMode, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.DecryptWithIV(cipherx.Mode(99), []byte("x"), key, iv); !errors.Is(err, cipherx.ErrInvalidMode) {
|
|||
|
|
t.Errorf("DecryptWithIV 非法模式: 期望 ErrInvalidMode, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if _, err := suite.EncryptHex(cipherx.CBC, []byte("x"), []byte("short")); !errors.Is(err, cipherx.ErrInvalidKeySize) {
|
|||
|
|
t.Errorf("EncryptHex 非法密钥: 期望 ErrInvalidKeySize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
if _, err := suite.DecryptWithIV(cipherx.CBC, []byte("x"), key, []byte("bad")); !errors.Is(err, cipherx.ErrInvalidIVSize) {
|
|||
|
|
t.Errorf("DecryptWithIV 非法 IV: 期望 ErrInvalidIVSize, 得到 %v", err)
|
|||
|
|
}
|
|||
|
|
}
|