feat: add native TLS serving

transport/native/server_test.go

@@ -3,9 +3,17 @@ package native_test
 import (
 	"bufio"
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"io"
+	"math/big"
 	"net"
 	"net/http"
 	"strings"
@@ -848,6 +856,96 @@ func TestAppRunWithNativeRunner(t *testing.T) {
 	}
 }
 
+func TestAppRunWithNativeTLS(t *testing.T) {
+	application := omni.NewWithRouter(netrouter.New())
+	application.GET("/health", func(ctx *omni.Context) error { return ctx.OK("ok") })
+	certificate := testCertificate(t)
+	server := native.New(nil)
+	server.TLSConfig = &tls.Config{
+		Certificates: []tls.Certificate{certificate},
+		MinVersion:   tls.VersionTLS12,
+	}
+	address := freeAddress(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	done := make(chan error, 1)
+	go func() { done <- application.RunWith(ctx, server, address) }()
+
+	client := &http.Client{Transport: &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // test certificate is self-signed
+	}}
+	defer client.CloseIdleConnections()
+	var response *http.Response
+	var err error
+	deadline := time.Now().Add(2 * time.Second)
+	for response == nil && time.Now().Before(deadline) {
+		response, err = client.Get("https://" + address + "/health")
+		if err != nil {
+			time.Sleep(10 * time.Millisecond)
+		}
+	}
+	if err != nil || response == nil {
+		t.Fatalf("TLS request failed: response=%v error=%v", response, err)
+	}
+	body, readErr := io.ReadAll(response.Body)
+	response.Body.Close()
+	if readErr != nil || response.StatusCode != http.StatusOK || !strings.Contains(string(body), `"data":"ok"`) {
+		t.Fatalf("unexpected TLS response: status=%d body=%q error=%v", response.StatusCode, body, readErr)
+	}
+	cancel()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatal(err)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("TLS RunWith did not stop")
+	}
+}
+
+func testCertificate(t *testing.T) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 120))
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: serial,
+		Subject:      pkix.Name{CommonName: "localhost"},
+		NotBefore:    now.Add(-time.Minute),
+		NotAfter:     now.Add(time.Hour),
+		KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:     []string{"localhost"},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certificate, err := tls.X509KeyPair(
+		pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}),
+		pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: mustMarshalECKey(t, key)}),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return certificate
+}
+
+func mustMarshalECKey(t *testing.T, key *ecdsa.PrivateKey) []byte {
+	t.Helper()
+	der, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return der
+}
+
 func startServer(t *testing.T, handler http.Handler) (*native.Server, net.Listener, <-chan error) {
 	t.Helper()
 	listener, err := net.Listen("tcp", "127.0.0.1:0")