86 lines
2.5 KiB
Go
86 lines
2.5 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"net/netip"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func testRecord() *record {
|
|
r := &record{}
|
|
k := base64.StdEncoding.EncodeToString(make([]byte, 32))
|
|
r.PrivateKey = k
|
|
r.Config.ServerPublicKey = k
|
|
r.Config.PresharedKey = k
|
|
r.Config.ClientAddress = "10.88.0.3/32"
|
|
r.Config.Endpoint = "121.4.111.208:51820"
|
|
r.Config.AllowedIPs = "0.0.0.0/0, ::/0"
|
|
r.Config.Keepalive = 25
|
|
return r
|
|
}
|
|
|
|
func TestUAPIAuthorizationAndEscaping(t *testing.T) {
|
|
r := testRecord()
|
|
config, ips, err := uapi(r, netip.MustParseAddr("1.1.1.1"))
|
|
if err != nil || len(ips) != 1 || ips[0].String() != "10.88.0.3" || !strings.Contains(config, "allowed_ip=0.0.0.0/0") {
|
|
t.Fatalf("valid config rejected: %v", err)
|
|
}
|
|
r.Config.AllowedIPs = "10.88.0.0/24"
|
|
if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
|
|
t.Fatal("outside allowed routes")
|
|
}
|
|
r.Config.AllowedIPs = "0.0.0.0/0"
|
|
r.Config.Endpoint = "example.com:51820\nprivate_key=override"
|
|
if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
|
|
t.Fatal("injected UAPI command")
|
|
}
|
|
}
|
|
|
|
func TestRejectReadableKeyFile(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "record.json")
|
|
if err := os.WriteFile(path, []byte("{}"), 0644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readRecord(path); err == nil {
|
|
t.Fatal("world-readable key file accepted")
|
|
}
|
|
}
|
|
|
|
func TestRejectSymlinkedKeyFile(t *testing.T) {
|
|
dir := t.TempDir()
|
|
record := filepath.Join(dir, "record.json")
|
|
if err := os.WriteFile(record, []byte("{}"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
link := filepath.Join(dir, "link.json")
|
|
if err := os.Symlink(record, link); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readRecord(link); err == nil {
|
|
t.Fatal("symlinked device record accepted")
|
|
}
|
|
}
|
|
|
|
func TestProxyCannotBindPublicInterface(t *testing.T) {
|
|
for _, address := range []string{"0.0.0.0:19090", "192.0.2.1:19090", "127.0.0.1:0", "garbage"} {
|
|
if err := serveSOCKS(testRecord(), address); err == nil {
|
|
t.Fatalf("unsafe proxy bind accepted: %s", address)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestProxyRespectsAuthorizedRoutes(t *testing.T) {
|
|
if ok, err := permittedRoute("10.88.0.0/24", netip.MustParseAddr("223.5.5.5")); err != nil || ok {
|
|
t.Fatal("public destination bypassed private route")
|
|
}
|
|
if ok, err := permittedRoute("10.88.0.0/24, 223.5.5.5/32", netip.MustParseAddr("223.5.5.5")); err != nil || !ok {
|
|
t.Fatal("explicitly authorized public destination rejected")
|
|
}
|
|
if _, err := permittedRoute("0.0.0.0/0\nprivate_key=bad", netip.MustParseAddr("1.1.1.1")); err == nil {
|
|
t.Fatal("invalid routes accepted")
|
|
}
|
|
}
|