DebTik/internal/vpn/wireguard_integration_test.go

package vpn

import (
	"github.com/vishvananda/netlink"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

func TestWireGuardEditAndClearingInNamespace(t *testing.T) {
	if os.Getenv("DEBTIK_WG_INTEGRATION") != "1" {
		t.Skip("isolated mount/network namespaces required")
	}
	for _, target := range []string{"/etc/proxmox-router/vpn", "/etc/wireguard"} {
		if err := exec.Command("mount", "--bind", t.TempDir(), target).Run(); err != nil {
			t.Fatal(err)
		}
	}
	bin := t.TempDir()
	if err := os.WriteFile(filepath.Join(bin, "systemctl"), []byte("#!/bin/sh\nexit 0\n"), 0755); err != nil {
		t.Fatal(err)
	}
	t.Setenv("PATH", bin+":"+os.Getenv("PATH"))
	m := &WireGuardManager{}
	req := SaveWireGuardInterfaceRequest{WireGuardInterface: WireGuardInterface{Name: "wg-audit0", Address: "10.99.241.1/30", MTU: 1420}}
	if err := m.SaveInterface(req); err != nil {
		t.Fatal(err)
	}
	before, err := netlink.LinkByName("wg-audit0")
	if err != nil {
		t.Fatal(err)
	}
	key := m.interfaces[0].PrivateKey
	req.Comment = "comment only"
	if err := m.SaveInterface(req); err != nil {
		t.Fatal(err)
	}
	after, err := netlink.LinkByName("wg-audit0")
	if err != nil {
		t.Fatal(err)
	}
	if before.Attrs().Index != after.Attrs().Index || key != m.interfaces[0].PrivateKey {
		t.Fatal("comment edit restarted interface or changed key")
	}
	psk, pub, err := m.GenerateKeyPair()
	if err != nil {
		t.Fatal(err)
	}
	peer := SaveWireGuardPeerRequest{WireGuardPeer: WireGuardPeer{Interface: "wg-audit0", PublicKey: pub, PresharedKey: psk, AllowedIPs: []string{"192.0.2.0/24"}, EndpointAddress: "192.0.2.1", EndpointPort: 51820, PersistentKeepalive: 25}}
	if err := m.SavePeer(peer); err != nil {
		t.Fatal(err)
	}
	peer.PresharedKey = ""
	peer.AllowedIPs = nil
	peer.EndpointAddress = ""
	peer.EndpointPort = 0
	peer.PersistentKeepalive = 0
	if err := m.SavePeer(peer); err != nil {
		t.Fatal(err)
	}
	for _, field := range []string{"persistent-keepalive", "endpoints", "allowed-ips", "preshared-keys"} {
		out, err := exec.Command("wg", "show", "wg-audit0", field).CombinedOutput()
		if err != nil {
			t.Fatal(field, err)
		}
		text := string(out)
		if field == "persistent-keepalive" {
			if !strings.Contains(text, "off") {
				t.Fatal("keepalive not cleared")
			}
		} else if !strings.Contains(text, "(none)") {
			t.Fatal(field, "not cleared")
		}
	}
}