DebTik/internal/firewall/owned_test.go

package firewall

import (
	"os"
	"os/exec"
	"strings"
	"testing"
	"time"
)

func TestOwnedPayloadPreservesForeignRulesAndPolicies(t *testing.T) {
	live := "*filter\n:INPUT DROP [0:0]\n-A INPUT -m comment --comment foreign -j ACCEPT\n-A INPUT -m comment --comment \"id:filter-old\" -j DROP\nCOMMIT\n"
	payload := BuildIPTablesRestore([]FilterRule{{ID: "filter-new", Chain: "input", Action: "accept"}}, nil, nil)
	result := ownedPayload(payload, live)
	if strings.Contains(result, ":INPUT ACCEPT") || strings.Contains(result, "-F INPUT") || strings.Contains(result, "-D INPUT -m comment --comment foreign") {
		t.Fatal("changed a foreign rule or host policy")
	}
	if !strings.Contains(result, "-D INPUT -m comment --comment \"id:filter-old\"") || !strings.Contains(result, "-F DT_filter_INPUT") {
		t.Fatal(result)
	}
	second := ownedPayload(payload, live+"\n*filter\n-A INPUT -m comment --comment debtik:hook -j DT_filter_INPUT\n")
	if strings.Contains(strings.Split(second, "*filter\n")[1], "-I INPUT 1") {
		t.Fatal("duplicated hook")
	}
}
func TestOwnedFirewallInNamespace(t *testing.T) {
	if os.Getenv("DEBTIK_FIREWALL_INTEGRATION") != "1" {
		t.Skip("requires an isolated network namespace")
	}
	run := func(args ...string) string {
		t.Helper()
		out, err := exec.Command("iptables", args...).CombinedOutput()
		if err != nil {
			t.Fatalf("%v: %s: %v", args, out, err)
		}
		return string(out)
	}
	run("-P", "INPUT", "DROP")
	run("-A", "INPUT", "-m", "comment", "--comment", "foreign", "-j", "ACCEPT")
	rules := []FilterRule{{ID: "filter-test", Chain: "input", Action: "drop", SrcAddress: "192.0.2.0/24"}}
	if err := ApplyDualStack(rules, nil, nil); err != nil {
		t.Fatal(err)
	}
	if err := ApplyDualStack(rules, nil, nil); err != nil {
		t.Fatal(err)
	}
	state := run("-S")
	if !strings.Contains(state, "-P INPUT DROP") || !strings.Contains(state, "--comment foreign") || strings.Count(state, "-j DT_filter_INPUT") != 1 {
		t.Fatal(state)
	}
	rules[0].Action = "accept"
	if err := ApplyDualStack(rules, nil, nil); err != nil {
		t.Fatal(err)
	}
	if strings.Contains(run("-S", "DT_filter_INPUT"), "-j DROP") {
		t.Fatal("old rule retained")
	}
	rules = append(rules, FilterRule{ID: "filter-v6", IPVersion: 6, Chain: "input", Action: "drop", SrcAddress: "2001:db8::/32"})
	if err := ApplyDualStack(rules, nil, nil); err != nil {
		t.Fatal(err)
	}
	out, err := exec.Command("ip6tables", "-S", "DT_filter_INPUT").CombinedOutput()
	if err != nil || !strings.Contains(string(out), "2001:db8::/32") {
		t.Fatal(string(out), err)
	}
}

func TestMoveNATRulesWithinChainInNamespace(t *testing.T) {
	if os.Getenv("DEBTIK_FIREWALL_PERSIST_TEST") != "1" {
		t.Skip("isolated mount and network namespaces required")
	}
	dir := t.TempDir()
	if out, err := exec.Command("mount", "--bind", dir, "/etc/debtik/firewall").CombinedOutput(); err != nil {
		t.Fatalf("bind: %s: %v", out, err)
	}
	m := &FirewallManager{natRules: []NATRule{
		{ID: "nat-first", Chain: "srcnat", Action: "accept"},
		{ID: "nat-other", Chain: "output", Action: "accept"},
		{ID: "nat-last", Chain: "postrouting", Action: "accept"},
	}}
	m.remember()
	if err := m.Apply(); err != nil {
		t.Fatal(err)
	}
	if err := m.MoveNATRule("nat-first", "down"); err != nil {
		t.Fatal(err)
	}
	out, err := exec.Command("iptables", "-t", "nat", "-S", "DT_nat_POSTROUTING").CombinedOutput()
	if err != nil {
		t.Fatalf("iptables: %s: %v", out, err)
	}
	last, first := strings.Index(string(out), "id:nat-last"), strings.Index(string(out), "id:nat-first")
	if last < 0 || first < 0 || last >= first {
		t.Fatalf("wrong chain order: %s", out)
	}
}

// Run only under both an isolated mount namespace and network namespace.
func TestFirewallFailedSaveRollsBack(t *testing.T) {
	if os.Getenv("DEBTIK_FIREWALL_PERSIST_TEST") != "1" {
		t.Skip("requires isolated mount and network namespaces")
	}
	dir := t.TempDir()
	if err := exec.Command("mount", "--bind", dir, "/etc/debtik/firewall").Run(); err != nil {
		t.Fatal(err)
	}
	m := NewFirewallManager()
	good := FilterRule{ID: "filter-transaction", Chain: "input", Action: "accept", Protocol: "tcp", DstPort: "22"}
	if err := m.SaveFilterRule(good); err != nil {
		t.Fatal(err)
	}
	before := string(m.snapshot())
	disk, _ := os.ReadFile(FilterStorePath)
	bad := good
	bad.Protocol = "not-a-real-protocol"
	if err := m.SaveFilterRule(bad); err == nil {
		t.Fatal("invalid firewall save accepted")
	}
	afterDisk, _ := os.ReadFile(FilterStorePath)
	if string(m.snapshot()) != before || string(disk) != string(afterDisk) {
		t.Fatal("failed apply changed saved state")
	}
	if err := SyncAddressLists([]AddressListEntry{{Name: "test", Address: "192.0.2.0/24"}, {Name: "test", Address: "2001:db8::/32"}}, "test"); err != nil {
		t.Fatal(err)
	}
	out, err := exec.Command("ipset", "list", staticIPSetName("test")+"_v6").CombinedOutput()
	if err != nil || !strings.Contains(string(out), "2001:db8::/32") {
		t.Fatal(string(out), err)
	}
	if err := SyncAddressLists([]AddressListEntry{{Name: "test", Address: "invalid-address"}}, "test"); err == nil {
		t.Fatal("invalid list address accepted")
	}
	out, err = exec.Command("ipset", "list", staticIPSetName("test")).CombinedOutput()
	if err != nil || !strings.Contains(string(out), "192.0.2.0/24") {
		t.Fatal("failed list update destroyed old set", string(out), err)
	}
}

func TestProductionFirewallMigration(t *testing.T) {
	fixture := os.Getenv("DEBTIK_FIREWALL_PRODUCTION_FIXTURE")
	if fixture == "" {
		t.Skip("production snapshot in private namespaces only")
	}
	dir := t.TempDir()
	if _, err := os.Stat(fixture + "/metadata.json"); err == nil {
		if err = exec.Command("mount", "--bind", fixture+"/metadata.json", "/etc/debtik/metadata.json").Run(); err != nil {
			t.Fatal(err)
		}
	}
	if out, err := exec.Command("cp", "-a", fixture+"/config/.", dir).CombinedOutput(); err != nil {
		t.Fatal(string(out), err)
	}
	if err := exec.Command("mount", "--bind", dir, "/etc/debtik/firewall").Run(); err != nil {
		t.Fatal(err)
	}
	restore := func(binary, path string) {
		t.Helper()
		data, err := os.ReadFile(path)
		if err != nil {
			t.Fatal(err)
		}
		if len(data) == 0 {
			return
		}
		cmd := exec.Command(binary)
		if binary == "ipset" {
			cmd = exec.Command("ipset", "restore")
		}
		cmd.Stdin = strings.NewReader(string(data))
		if out, err := cmd.CombinedOutput(); err != nil {
			t.Fatal(binary, string(out), err)
		}
	}
	restore("ipset", fixture+"/ipset.commands")
	restore("iptables-restore", fixture+"/iptables.save")
	restore("ip6tables-restore", fixture+"/ip6tables.save")
	m := NewFirewallManager()
	select {
	case <-m.GeoIP().restoreDone:
	case <-time.After(30 * time.Second):
		t.Fatal("GeoIP restore did not finish")
	}
	if last := m.GeoIP().GetStatus()["last_error"]; last != "" {
		t.Fatal("production GeoIP restore failed", last)
	}

	if err := m.Reapply(); err != nil {
		t.Fatal("production migration failed", err)
	}
	if err := m.Reapply(); err != nil {
		t.Fatal("second apply failed", err)
	}
}