Add bundled WireGuard diagnostics and application proxy

client/tunnel-go/main_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"encoding/base64"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func testRecord() *record {
+	r := &record{}
+	k := base64.StdEncoding.EncodeToString(make([]byte, 32))
+	r.PrivateKey = k
+	r.Config.ServerPublicKey = k
+	r.Config.PresharedKey = k
+	r.Config.ClientAddress = "10.88.0.3/32"
+	r.Config.Endpoint = "121.4.111.208:51820"
+	r.Config.AllowedIPs = "0.0.0.0/0, ::/0"
+	r.Config.Keepalive = 25
+	return r
+}
+
+func TestUAPIAuthorizationAndEscaping(t *testing.T) {
+	r := testRecord()
+	config, ips, err := uapi(r, netip.MustParseAddr("1.1.1.1"))
+	if err != nil || len(ips) != 1 || ips[0].String() != "10.88.0.3" || !strings.Contains(config, "allowed_ip=0.0.0.0/0") {
+		t.Fatalf("valid config rejected: %v", err)
+	}
+	r.Config.AllowedIPs = "10.88.0.0/24"
+	if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
+		t.Fatal("outside allowed routes")
+	}
+	r.Config.AllowedIPs = "0.0.0.0/0"
+	r.Config.Endpoint = "example.com:51820\nprivate_key=override"
+	if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
+		t.Fatal("injected UAPI command")
+	}
+}
+
+func TestRejectReadableKeyFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "record.json")
+	if err := os.WriteFile(path, []byte("{}"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readRecord(path); err == nil {
+		t.Fatal("world-readable key file accepted")
+	}
+}
+
+func TestRejectSymlinkedKeyFile(t *testing.T) {
+	dir := t.TempDir()
+	record := filepath.Join(dir, "record.json")
+	if err := os.WriteFile(record, []byte("{}"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(dir, "link.json")
+	if err := os.Symlink(record, link); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readRecord(link); err == nil {
+		t.Fatal("symlinked device record accepted")
+	}
+}
+
+func TestProxyCannotBindPublicInterface(t *testing.T) {
+	for _, address := range []string{"0.0.0.0:19090", "192.0.2.1:19090", "127.0.0.1:0", "garbage"} {
+		if err := serveSOCKS(testRecord(), address); err == nil {
+			t.Fatalf("unsafe proxy bind accepted: %s", address)
+		}
+	}
+}
+
+func TestProxyRespectsAuthorizedRoutes(t *testing.T) {
+	if ok, err := permittedRoute("10.88.0.0/24", netip.MustParseAddr("223.5.5.5")); err != nil || ok {
+		t.Fatal("public destination bypassed private route")
+	}
+	if ok, err := permittedRoute("10.88.0.0/24, 223.5.5.5/32", netip.MustParseAddr("223.5.5.5")); err != nil || !ok {
+		t.Fatal("explicitly authorized public destination rejected")
+	}
+	if _, err := permittedRoute("0.0.0.0/0\nprivate_key=bad", netip.MustParseAddr("1.1.1.1")); err == nil {
+		t.Fatal("invalid routes accepted")
+	}
+}