From ef549dc2b8405a1e8378d9c81f2ae3871495121f Mon Sep 17 00:00:00 2001
From: samosvalishe <samosvalishe@users.noreply.github.com>
Date: Thu, 21 May 2026 01:11:08 +0300
Subject: [PATCH] =?UTF-8?q?fix(dtlsdial):=20=D1=83=D0=BD=D0=B8=D1=84=D0=B8?=
 =?UTF-8?q?=D1=86=D0=B8=D1=80=D0=BE=D0=B2=D0=B0=D1=82=D1=8C=20=D0=B3=D0=B5?=
 =?UTF-8?q?=D0=BD=D0=B5=D1=80=D0=B0=D1=86=D0=B8=D1=8E=20self-signed=20?=
 =?UTF-8?q?=D1=81=D0=B5=D1=80=D1=82=D0=B8=D1=84=D0=B8=D0=BA=D0=B0=D1=82?=
 =?UTF-8?q?=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Добавляет dtlsdial.GenerateSelfSignedCert() как единственное место создания
self-signed сертификата. cmd/server теперь использует его вместо прямого импорта
selfsign; Dialer.Dial уже использовал ленивый путь certOnce, который внутри
зовёт ту же функцию.
---
 cmd/server/main.go                      | 4 ++--
 internal/transport/dtlsdial/dtlsdial.go | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/cmd/server/main.go b/cmd/server/main.go
index abb9181..2fd0caf 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -16,9 +16,9 @@ import (
 	"github.com/samosvalishe/btp/internal/proxy/bondserver"
 	"github.com/samosvalishe/btp/internal/proxy/tcpfwdserver"
 	"github.com/samosvalishe/btp/internal/proxy/udpserver"
+	"github.com/samosvalishe/btp/internal/transport/dtlsdial"
 	"github.com/samosvalishe/btp/internal/wire/srtpmimicry"
 	"github.com/pion/dtls/v3"
-	"github.com/pion/dtls/v3/pkg/crypto/selfsign"
 )
 
 func main() {
@@ -66,7 +66,7 @@ func main() {
 		logger.Warnf("running without -wrap: any client reaching %s can relay to %s (no shared-key auth)", cfg.Proxy.Listen, cfg.Proxy.Connect)
 	}
 
-	certificate, genErr := selfsign.GenerateSelfSigned()
+	certificate, genErr := dtlsdial.GenerateSelfSignedCert()
 	if genErr != nil {
 		logger.Errorf("self-signed cert: %v", genErr)
 		os.Exit(1)
diff --git a/internal/transport/dtlsdial/dtlsdial.go b/internal/transport/dtlsdial/dtlsdial.go
index 7bd7485..d00c9d3 100644
--- a/internal/transport/dtlsdial/dtlsdial.go
+++ b/internal/transport/dtlsdial/dtlsdial.go
@@ -14,6 +14,13 @@ import (
 	"github.com/pion/dtls/v3/pkg/crypto/selfsign"
 )
 
+// GenerateSelfSignedCert returns a new self-signed TLS certificate for use
+// as the DTLS identity. It is a thin wrapper around selfsign.GenerateSelfSigned
+// and exists so both cmd/server and Dialer share one call-site.
+func GenerateSelfSignedCert() (tls.Certificate, error) {
+	return selfsign.GenerateSelfSigned()
+}
+
 // Dialer configures the DTLS client handshake.
 type Dialer struct {
 	// HandshakeTimeout caps the handshake context. Zero means no timeout.