sub2api/backend/internal/pkg/tlsfingerprint/dialer_capture_test.go

//go:build integration

package tlsfingerprint

import (
	"context"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strings"
	"testing"
	"time"

	utls "github.com/refraction-networking/utls"
)

// CapturedFingerprint 对应 tls-fingerprint-web 返回的 Fingerprint 结构。
// 用于反序列化 capture server 的 JSON 响应。
type CapturedFingerprint struct {
	JA3Raw              string   `json:"ja3_raw"`
	JA3Hash             string   `json:"ja3_hash"`
	JA4                 string   `json:"ja4"`
	HTTP2               string   `json:"http2"`
	CipherSuites        []int    `json:"cipher_suites"`
	Curves              []int    `json:"curves"`
	PointFormats        []int    `json:"point_formats"`
	Extensions          []int    `json:"extensions"`
	SignatureAlgorithms []int    `json:"signature_algorithms"`
	ALPNProtocols       []string `json:"alpn_protocols"`
	SupportedVersions   []int    `json:"supported_versions"`
	KeyShareGroups      []int    `json:"key_share_groups"`
	PSKModes            []int    `json:"psk_modes"`
	CompressCertAlgos   []int    `json:"compress_cert_algos"`
	EnableGREASE        bool     `json:"enable_grease"`
}

// TestDialerAgainstCaptureServer 连接 tls-fingerprint-web capture server，
// 验证 Dialer 的 TLS 指纹是否匹配配置的 Profile。
//
// 该测试依赖外部服务，默认跳过。需要手动验证时设置：
// TLSFINGERPRINT_CAPTURE_URL=https://localhost:8443
//
// 运行方式：go test -tags=integration -v -run TestDialerAgainstCaptureServer ./internal/pkg/tlsfingerprint/...
func TestDialerAgainstCaptureServer(t *testing.T) {
	captureURL := strings.TrimSpace(os.Getenv("TLSFINGERPRINT_CAPTURE_URL"))
	if captureURL == "" {
		t.Skip("跳过外部 TLS 指纹 capture 测试：未设置 TLSFINGERPRINT_CAPTURE_URL")
	}

	tests := []struct {
		name    string
		profile *Profile
	}{
		{
			name: "default_profile",
			profile: &Profile{
				Name:         "default",
				EnableGREASE: false,
				// 全部留空时使用内置默认值
			},
		},
		{
			name: "linux_x64_node_v22171",
			profile: &Profile{
				Name:                "linux_x64_node_v22171",
				EnableGREASE:        false,
				CipherSuites:        []uint16{4866, 4867, 4865, 49199, 49195, 49200, 49196, 158, 49191, 103, 49192, 107, 163, 159, 52393, 52392, 52394, 49327, 49325, 49315, 49311, 49245, 49249, 49239, 49235, 162, 49326, 49324, 49314, 49310, 49244, 49248, 49238, 49234, 49188, 106, 49187, 64, 49162, 49172, 57, 56, 49161, 49171, 51, 50, 157, 49313, 49309, 49233, 156, 49312, 49308, 49232, 61, 60, 53, 47, 255},
				Curves:              []uint16{29, 23, 30, 25, 24, 256, 257, 258, 259, 260},
				PointFormats:        []uint16{0, 1, 2},
				SignatureAlgorithms: []uint16{0x0403, 0x0503, 0x0603, 0x0807, 0x0808, 0x0809, 0x080a, 0x080b, 0x0804, 0x0805, 0x0806, 0x0401, 0x0501, 0x0601, 0x0303, 0x0301, 0x0302, 0x0402, 0x0502, 0x0602},
				ALPNProtocols:       []string{"http/1.1"},
				SupportedVersions:   []uint16{0x0304, 0x0303},
				KeyShareGroups:      []uint16{29},
				PSKModes:            []uint16{1},
				Extensions:          []uint16{0, 11, 10, 35, 16, 22, 23, 13, 43, 45, 51},
			},
		},
		{
			name: "macos_arm64_node_v2430",
			profile: &Profile{
				Name:                "MacOS_arm64_node_v2430",
				EnableGREASE:        false,
				CipherSuites:        []uint16{4865, 4866, 4867, 49195, 49199, 49196, 49200, 52393, 52392, 49161, 49171, 49162, 49172, 156, 157, 47, 53},
				Curves:              []uint16{29, 23, 24},
				PointFormats:        []uint16{0},
				SignatureAlgorithms: []uint16{0x0403, 0x0804, 0x0401, 0x0503, 0x0805, 0x0501, 0x0806, 0x0601, 0x0201},
				ALPNProtocols:       []string{"http/1.1"},
				SupportedVersions:   []uint16{0x0304, 0x0303},
				KeyShareGroups:      []uint16{29},
				PSKModes:            []uint16{1},
				Extensions:          []uint16{0, 65037, 23, 65281, 10, 11, 35, 16, 5, 13, 18, 51, 45, 43},
			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			captured := fetchCapturedFingerprint(t, captureURL, tc.profile)
			if captured == nil {
				return
			}

			t.Logf("JA3 Hash: %s", captured.JA3Hash)
			t.Logf("JA4:      %s", captured.JA4)

			// 解析实际生效的 Profile 值，也就是 Dialer 最终使用的值。
			effectiveCipherSuites := tc.profile.CipherSuites
			if len(effectiveCipherSuites) == 0 {
				effectiveCipherSuites = defaultCipherSuites
			}
			effectiveCurves := tc.profile.Curves
			if len(effectiveCurves) == 0 {
				effectiveCurves = make([]uint16, len(defaultCurves))
				for i, c := range defaultCurves {
					effectiveCurves[i] = uint16(c)
				}
			}
			effectivePointFormats := tc.profile.PointFormats
			if len(effectivePointFormats) == 0 {
				effectivePointFormats = defaultPointFormats
			}
			effectiveSigAlgs := tc.profile.SignatureAlgorithms
			if len(effectiveSigAlgs) == 0 {
				effectiveSigAlgs = make([]uint16, len(defaultSignatureAlgorithms))
				for i, s := range defaultSignatureAlgorithms {
					effectiveSigAlgs[i] = uint16(s)
				}
			}
			effectiveALPN := tc.profile.ALPNProtocols
			if len(effectiveALPN) == 0 {
				effectiveALPN = []string{"http/1.1"}
			}
			effectiveVersions := tc.profile.SupportedVersions
			if len(effectiveVersions) == 0 {
				effectiveVersions = []uint16{0x0304, 0x0303}
			}
			effectiveKeyShare := tc.profile.KeyShareGroups
			if len(effectiveKeyShare) == 0 {
				effectiveKeyShare = []uint16{29} // X25519
			}
			effectivePSKModes := tc.profile.PSKModes
			if len(effectivePSKModes) == 0 {
				effectivePSKModes = []uint16{1} // psk_dhe_ke
			}

			// 校验每个指纹字段
			assertIntSliceEqual(t, "cipher_suites", uint16sToInts(effectiveCipherSuites), captured.CipherSuites)
			assertIntSliceEqual(t, "curves", uint16sToInts(effectiveCurves), captured.Curves)
			assertIntSliceEqual(t, "point_formats", uint16sToInts(effectivePointFormats), captured.PointFormats)
			assertIntSliceEqual(t, "signature_algorithms", uint16sToInts(effectiveSigAlgs), captured.SignatureAlgorithms)
			assertStringSliceEqual(t, "alpn_protocols", effectiveALPN, captured.ALPNProtocols)
			assertIntSliceEqual(t, "supported_versions", uint16sToInts(effectiveVersions), captured.SupportedVersions)
			assertIntSliceEqual(t, "key_share_groups", uint16sToInts(effectiveKeyShare), captured.KeyShareGroups)
			assertIntSliceEqual(t, "psk_modes", uint16sToInts(effectivePSKModes), captured.PSKModes)

			if captured.EnableGREASE != tc.profile.EnableGREASE {
				t.Errorf("enable_grease: got %v, want %v", captured.EnableGREASE, tc.profile.EnableGREASE)
			} else {
				t.Logf("  enable_grease: %v OK", captured.EnableGREASE)
			}

			// 校验扩展顺序；如果 Profile 显式配置了 Extensions 就使用配置值，
			// 否则使用默认顺序（Node.js 24.x）。
			expectedExtOrder := uint16sToInts(defaultExtensionOrder)
			if len(tc.profile.Extensions) > 0 {
				expectedExtOrder = uint16sToInts(tc.profile.Extensions)
			}
			// 比较前从期望值和采集值中剔除 GREASE。
			var filteredExpected, filteredActual []int
			for _, e := range expectedExtOrder {
				if !isGREASEValue(uint16(e)) {
					filteredExpected = append(filteredExpected, e)
				}
			}
			for _, e := range captured.Extensions {
				if !isGREASEValue(uint16(e)) {
					filteredActual = append(filteredActual, e)
				}
			}
			assertIntSliceEqual(t, "extensions (order, non-GREASE)", filteredExpected, filteredActual)

			// 打印完整采集结果，便于排查指纹差异。
			capturedJSON, _ := json.MarshalIndent(captured, "  ", "  ")
			t.Logf("Full captured fingerprint:\n  %s", string(capturedJSON))
		})
	}
}

func fetchCapturedFingerprint(t *testing.T, captureURL string, profile *Profile) *CapturedFingerprint {
	t.Helper()

	dialer := NewDialer(profile, nil)
	client := &http.Client{
		Transport: &http.Transport{
			DialTLSContext: dialer.DialTLSContext,
		},
		Timeout: 10 * time.Second,
	}

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	req, err := http.NewRequestWithContext(ctx, "POST", captureURL, strings.NewReader(`{"model":"test"}`))
	if err != nil {
		t.Fatalf("create request: %v", err)
		return nil
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer test-token")

	resp, err := client.Do(req)
	if err != nil {
		t.Fatalf("request failed: %v", err)
		return nil
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		t.Fatalf("read body: %v", err)
		return nil
	}

	var fp CapturedFingerprint
	if err := json.Unmarshal(body, &fp); err != nil {
		t.Logf("Response body: %s", string(body))
		t.Fatalf("parse response: %v", err)
		return nil
	}

	return &fp
}

func uint16sToInts(vals []uint16) []int {
	result := make([]int, len(vals))
	for i, v := range vals {
		result[i] = int(v)
	}
	return result
}

func assertIntSliceEqual(t *testing.T, name string, expected, actual []int) {
	t.Helper()
	if len(expected) != len(actual) {
		t.Errorf("%s: length mismatch: got %d, want %d", name, len(actual), len(expected))
		if len(actual) < 20 && len(expected) < 20 {
			t.Errorf("  got:  %v", actual)
			t.Errorf("  want: %v", expected)
		}
		return
	}
	mismatches := 0
	for i := range expected {
		if expected[i] != actual[i] {
			if mismatches < 5 {
				t.Errorf("%s[%d]: got %d (0x%04x), want %d (0x%04x)", name, i, actual[i], actual[i], expected[i], expected[i])
			}
			mismatches++
		}
	}
	if mismatches == 0 {
		t.Logf("  %s: %d items OK", name, len(expected))
	} else if mismatches > 5 {
		t.Errorf("  %s: %d/%d mismatches (showing first 5)", name, mismatches, len(expected))
	}
}

func assertStringSliceEqual(t *testing.T, name string, expected, actual []string) {
	t.Helper()
	if len(expected) != len(actual) {
		t.Errorf("%s: length mismatch: got %d (%v), want %d (%v)", name, len(actual), actual, len(expected), expected)
		return
	}
	for i := range expected {
		if expected[i] != actual[i] {
			t.Errorf("%s[%d]: got %q, want %q", name, i, actual[i], expected[i])
			return
		}
	}
	t.Logf("  %s: %v OK", name, expected)
}

// TestBuildClientHelloSpecNewFields tests that new Profile fields are correctly applied.
func TestBuildClientHelloSpecNewFields(t *testing.T) {
	// Test custom ALPN, versions, key shares, PSK modes
	profile := &Profile{
		Name:                "custom_full",
		EnableGREASE:        false,
		CipherSuites:        []uint16{0x1301, 0x1302},
		Curves:              []uint16{29, 23},
		PointFormats:        []uint16{0},
		SignatureAlgorithms: []uint16{0x0403, 0x0804},
		ALPNProtocols:       []string{"h2", "http/1.1"},
		SupportedVersions:   []uint16{0x0304},
		KeyShareGroups:      []uint16{29, 23},
		PSKModes:            []uint16{1},
	}

	spec := buildClientHelloSpecFromProfile(profile)

	// Verify cipher suites
	if len(spec.CipherSuites) != 2 || spec.CipherSuites[0] != 0x1301 {
		t.Errorf("cipher suites: got %v", spec.CipherSuites)
	}

	// Check extensions for expected values
	var foundALPN, foundVersions, foundKeyShare, foundPSK, foundSigAlgs bool
	for _, ext := range spec.Extensions {
		switch e := ext.(type) {
		case *utls.ALPNExtension:
			foundALPN = true
			if len(e.AlpnProtocols) != 2 || e.AlpnProtocols[0] != "h2" {
				t.Errorf("ALPN: got %v, want [h2, http/1.1]", e.AlpnProtocols)
			}
		case *utls.SupportedVersionsExtension:
			foundVersions = true
			if len(e.Versions) != 1 || e.Versions[0] != 0x0304 {
				t.Errorf("versions: got %v, want [0x0304]", e.Versions)
			}
		case *utls.KeyShareExtension:
			foundKeyShare = true
			if len(e.KeyShares) != 2 {
				t.Errorf("key shares: got %d entries, want 2", len(e.KeyShares))
			}
		case *utls.PSKKeyExchangeModesExtension:
			foundPSK = true
			if len(e.Modes) != 1 || e.Modes[0] != 1 {
				t.Errorf("PSK modes: got %v, want [1]", e.Modes)
			}
		case *utls.SignatureAlgorithmsExtension:
			foundSigAlgs = true
			if len(e.SupportedSignatureAlgorithms) != 2 {
				t.Errorf("sig algs: got %d, want 2", len(e.SupportedSignatureAlgorithms))
			}
		}
	}

	for name, found := range map[string]bool{
		"ALPN": foundALPN, "Versions": foundVersions, "KeyShare": foundKeyShare,
		"PSK": foundPSK, "SigAlgs": foundSigAlgs,
	} {
		if !found {
			t.Errorf("extension %s not found in spec", name)
		}
	}

	// Test nil profile uses all defaults
	specDefault := buildClientHelloSpecFromProfile(nil)
	for _, ext := range specDefault.Extensions {
		switch e := ext.(type) {
		case *utls.ALPNExtension:
			if len(e.AlpnProtocols) != 1 || e.AlpnProtocols[0] != "http/1.1" {
				t.Errorf("default ALPN: got %v, want [http/1.1]", e.AlpnProtocols)
			}
		case *utls.SupportedVersionsExtension:
			if len(e.Versions) != 2 {
				t.Errorf("default versions: got %v, want 2 entries", e.Versions)
			}
		case *utls.KeyShareExtension:
			if len(e.KeyShares) != 1 {
				t.Errorf("default key shares: got %d, want 1", len(e.KeyShares))
			}
		}
	}

	t.Log("TestBuildClientHelloSpecNewFields passed")
}