174 lines
6.1 KiB
Go
174 lines
6.1 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"net/netip"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func testRecord() *record {
|
|
r := &record{}
|
|
k := base64.StdEncoding.EncodeToString(make([]byte, 32))
|
|
r.PrivateKey = k
|
|
r.Config.ServerPublicKey = k
|
|
r.Config.PresharedKey = k
|
|
r.Config.ClientAddress = "10.88.0.3/32"
|
|
r.Config.Endpoint = "121.4.111.208:51820"
|
|
r.Config.AllowedIPs = "0.0.0.0/0, ::/0"
|
|
r.Config.Keepalive = 25
|
|
return r
|
|
}
|
|
|
|
func TestUAPIAuthorizationAndEscaping(t *testing.T) {
|
|
r := testRecord()
|
|
config, ips, err := uapi(r, netip.MustParseAddr("1.1.1.1"))
|
|
if err != nil || len(ips) != 1 || ips[0].String() != "10.88.0.3" || !strings.Contains(config, "allowed_ip=0.0.0.0/0") {
|
|
t.Fatalf("valid config rejected: %v", err)
|
|
}
|
|
r.Config.AllowedIPs = "10.88.0.0/24"
|
|
if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
|
|
t.Fatal("outside allowed routes")
|
|
}
|
|
r.Config.AllowedIPs = "0.0.0.0/0"
|
|
r.Config.Endpoint = "example.com:51820\nprivate_key=override"
|
|
if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
|
|
t.Fatal("injected UAPI command")
|
|
}
|
|
}
|
|
|
|
func TestRejectReadableKeyFile(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "record.json")
|
|
if err := os.WriteFile(path, []byte("{}"), 0644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readRecord(path); err == nil {
|
|
t.Fatal("world-readable key file accepted")
|
|
}
|
|
}
|
|
|
|
func TestRejectSymlinkedKeyFile(t *testing.T) {
|
|
dir := t.TempDir()
|
|
record := filepath.Join(dir, "record.json")
|
|
if err := os.WriteFile(record, []byte("{}"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
link := filepath.Join(dir, "link.json")
|
|
if err := os.Symlink(record, link); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readRecord(link); err == nil {
|
|
t.Fatal("symlinked device record accepted")
|
|
}
|
|
}
|
|
|
|
func TestRejectOversizedRecord(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "record.json")
|
|
if err := os.WriteFile(path, []byte(strings.Repeat("x", 64*1024+1)), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readRecord(path); err == nil || !strings.Contains(err.Error(), "大小限制") {
|
|
t.Fatalf("oversized record accepted: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestStatusReturnsOnlyNonSecretCounters(t *testing.T) {
|
|
raw := "private_key=secret\npublic_key=peer\npreshared_key=secret\nendpoint=192.0.2.1:51820\n" +
|
|
"last_handshake_time_sec=123\nrx_bytes=456\ntx_bytes=789\nallowed_ip=0.0.0.0/0\n"
|
|
status, err := sanitizedStatus(raw)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if status.Status != "device_status" || status.HandshakeUnix != 123 || status.RXBytes != 456 || status.TXBytes != 789 {
|
|
t.Fatalf("unexpected status: %+v", status)
|
|
}
|
|
data, err := json.Marshal(status)
|
|
if err != nil || strings.Contains(string(data), "secret") || strings.Contains(string(data), "192.0.2.1") {
|
|
t.Fatalf("status leaked configuration: %s, %v", data, err)
|
|
}
|
|
for _, malformed := range []string{"private_key=secret", "public_key=peer\nrx_bytes=bad", "public_key=one\npublic_key=two"} {
|
|
if _, err := sanitizedStatus(malformed); err == nil {
|
|
t.Fatalf("malformed device status accepted: %q", malformed)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestNativeRoutePlanGuardsPhysicalEndpoint(t *testing.T) {
|
|
r := testRecord()
|
|
ip, port, err := resolveEndpoint(r.Config.Endpoint)
|
|
if err != nil || ip.String() != "121.4.111.208" || port != "51820" {
|
|
t.Fatalf("endpoint resolution failed: %s, %s, %v", ip, port, err)
|
|
}
|
|
r.Config.AllowedIPs = "0.0.0.0/0"
|
|
plan, err := planNativeRoutes(r, "utun12", ip)
|
|
if err != nil || !plan.EndpointBypass || len(plan.Routes) != 2 ||
|
|
plan.Routes[0].String() != "0.0.0.0/1" || plan.Routes[1].String() != "128.0.0.0/1" {
|
|
t.Fatalf("full route missing endpoint bypass: %+v, %v", plan, err)
|
|
}
|
|
r.Config.AllowedIPs = "10.88.0.0/24, 10.88.0.0/24"
|
|
plan, err = planNativeRoutes(r, "utun2", netip.MustParseAddr("121.4.111.208"))
|
|
if err != nil || plan.EndpointBypass || len(plan.Routes) != 1 || plan.Routes[0].String() != "10.88.0.0/24" {
|
|
t.Fatalf("split route not normalized: %+v, %v", plan, err)
|
|
}
|
|
r.Config.AllowedIPs = "::/0, 0.0.0.0/0"
|
|
if _, err := planNativeRoutes(r, "utun2", netip.MustParseAddr("121.4.111.208")); err == nil {
|
|
t.Fatal("unsupported IPv6 route accepted")
|
|
}
|
|
for _, name := range []string{"utun", "utun1;route", "eth0", "utun-1"} {
|
|
if _, err := planNativeRoutes(r, name, netip.MustParseAddr("121.4.111.208")); err == nil {
|
|
t.Fatalf("unsafe interface accepted: %q", name)
|
|
}
|
|
}
|
|
for _, endpoint := range []string{"127.0.0.1:51820", "[::1]:51820", "missing-port"} {
|
|
if _, _, err := resolveEndpoint(endpoint); err == nil {
|
|
t.Fatalf("invalid endpoint accepted: %q", endpoint)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestPhysicalRouteParsingRejectsVPNAndInjection(t *testing.T) {
|
|
output := " route to: 121.4.111.208\n gateway: 192.168.80.1\n interface: en0\n"
|
|
exit, err := parsePhysicalRoute(output)
|
|
if err != nil || exit.Interface != "en0" || exit.Gateway == nil || exit.Gateway.String() != "192.168.80.1" {
|
|
t.Fatalf("physical gateway rejected: %+v, %v", exit, err)
|
|
}
|
|
direct, err := parsePhysicalRoute("interface: en4\n")
|
|
if err != nil || direct.Gateway != nil {
|
|
t.Fatalf("direct physical link rejected: %+v, %v", direct, err)
|
|
}
|
|
for _, raw := range []string{
|
|
"interface: utun2\ngateway: 10.0.0.1\n",
|
|
"interface: en0;touch /tmp/injected\n",
|
|
"interface: lo0\n",
|
|
"gateway: 192.168.80.1\n",
|
|
"interface: en0\ngateway: invalid\n",
|
|
} {
|
|
if _, err := parsePhysicalRoute(raw); err == nil {
|
|
t.Fatalf("unsafe route accepted: %q", raw)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestProxyCannotBindPublicInterface(t *testing.T) {
|
|
for _, address := range []string{"0.0.0.0:19090", "192.0.2.1:19090", "127.0.0.1:0", "garbage"} {
|
|
if err := serveSOCKS(testRecord(), address); err == nil {
|
|
t.Fatalf("unsafe proxy bind accepted: %s", address)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestProxyRespectsAuthorizedRoutes(t *testing.T) {
|
|
if ok, err := permittedRoute("10.88.0.0/24", netip.MustParseAddr("223.5.5.5")); err != nil || ok {
|
|
t.Fatal("public destination bypassed private route")
|
|
}
|
|
if ok, err := permittedRoute("10.88.0.0/24, 223.5.5.5/32", netip.MustParseAddr("223.5.5.5")); err != nil || !ok {
|
|
t.Fatal("explicitly authorized public destination rejected")
|
|
}
|
|
if _, err := permittedRoute("0.0.0.0/0\nprivate_key=bad", netip.MustParseAddr("1.1.1.1")); err == nil {
|
|
t.Fatal("invalid routes accepted")
|
|
}
|
|
}
|