From 8169bd63e93470d751dfd6c2c366bbbe701b129f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=AE=89=E6=AD=A3=E8=B6=85?= Date: Tue, 12 May 2026 10:50:49 +0800 Subject: [PATCH] test(protocols): cover TLS reload fingerprint ordering (#2927) --- crates/protocols/src/tls_hot_reload.rs | 38 ++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/crates/protocols/src/tls_hot_reload.rs b/crates/protocols/src/tls_hot_reload.rs index 7209b44c7..f1dd2f1d7 100644 --- a/crates/protocols/src/tls_hot_reload.rs +++ b/crates/protocols/src/tls_hot_reload.rs @@ -237,6 +237,20 @@ mod tests { use std::fs; use tempfile::TempDir; + fn cert_key_pair(san: &str) -> (Vec>, PrivateKeyDer<'static>) { + let cert = generate_simple_self_signed(vec![san.to_string()]).unwrap(); + ( + vec![cert.cert.der().clone()], + PrivateKeyDer::try_from(cert.signing_key.serialize_der()).unwrap(), + ) + } + + fn clone_cert_key_pair( + cert_key_pair: &(Vec>, PrivateKeyDer<'static>), + ) -> (Vec>, PrivateKeyDer<'static>) { + (cert_key_pair.0.clone(), cert_key_pair.1.clone_key()) + } + fn write_default_cert(dir: &std::path::Path, san: &str) { let cert = generate_simple_self_signed(vec![san.to_string()]).unwrap(); fs::write(dir.join(RUSTFS_TLS_CERT), cert.cert.pem()).unwrap(); @@ -276,4 +290,28 @@ mod tests { let outcome = resolver.reload_from_directory(temp_dir.path().to_str().unwrap()).unwrap(); assert_eq!(outcome, None); } + + #[test] + fn resolver_state_fingerprint_is_stable_across_domain_ordering() { + let default_cert = cert_key_pair("localhost"); + let api_cert = cert_key_pair("api.example.com"); + let web_cert = cert_key_pair("web.example.com"); + + let mut first = HashMap::new(); + first.insert("default".to_string(), clone_cert_key_pair(&default_cert)); + first.insert("api.example.com".to_string(), clone_cert_key_pair(&api_cert)); + first.insert("web.example.com".to_string(), clone_cert_key_pair(&web_cert)); + + let mut second = HashMap::new(); + second.insert("web.example.com".to_string(), clone_cert_key_pair(&web_cert)); + second.insert("default".to_string(), clone_cert_key_pair(&default_cert)); + second.insert("api.example.com".to_string(), clone_cert_key_pair(&api_cert)); + + let first_state = ResolverState::from_cert_key_pairs(first).unwrap(); + let second_state = ResolverState::from_cert_key_pairs(second).unwrap(); + + assert_eq!(first_state.cert_count, 3); + assert_eq!(second_state.cert_count, 3); + assert_eq!(first_state.fingerprint, second_state.fingerprint); + } }