mirror of
https://git.zx2c4.com/wireguard-go
synced 2024-11-15 01:05:15 +01:00
[WIP] device: run testns.sh from a Go test harness
objectives: - to make it easy to run these tests during go development (TODO: running sudo go test is weird, is there some alternative? does docker provide a namespace hole for normal users if it's installed?) - to make it easy to run some part of the script, e.g. just run the sticky sockets test without waiting on the prior iperf tests not clear yet if the shell-inside-go is worth it Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
This commit is contained in:
David Crawshaw
parent
da9d300cf8
commit
c9159a5b86
292
device/ns_test.go
Normal file
292
device/ns_test.go
Normal file
@ -0,0 +1,292 @@
|
|||||||
|
/* SPDX-License-Identifier: MIT
|
||||||
|
*
|
||||||
|
* Copyright (C) 2017-2020 WireGuard LLC. All Rights Reserved.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package device_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"fmt"
|
||||||
|
"io/ioutil"
|
||||||
|
"log"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
"runtime"
|
||||||
|
"sort"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"golang.zx2c4.com/wireguard/device"
|
||||||
|
"golang.zx2c4.com/wireguard/ipc"
|
||||||
|
"golang.zx2c4.com/wireguard/tun"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Test the following topology:
|
||||||
|
//
|
||||||
|
// ┌─────────────────────┐ ┌──────────────────────────────────┐ ┌─────────────────────┐
|
||||||
|
// │ $netns1 namespace │ │ $netns0 namespace │ │ $netns2 namespace │
|
||||||
|
// │ │ │ │ │ │
|
||||||
|
// │┌────────┐ │ │ ┌────────┐ │ │ ┌────────┐│
|
||||||
|
// ││ $wg1 │───────────┼───┼────────────│ lo │────────────┼───┼───────────│ $wg2 ││
|
||||||
|
// │├────────┴──────────┐│ │ ┌───────┴────────┴────────┐ │ │┌──────────┴────────┤│
|
||||||
|
// ││192.168.241.1/24 ││ │ │(ns1) (ns2) │ │ ││192.168.241.2/24 ││
|
||||||
|
// ││fd00::1/24 ││ │ │127.0.0.1:1 127.0.0.1:2│ │ ││fd00::2/24 ││
|
||||||
|
// │└───────────────────┘│ │ │[::]:1 [::]:2 │ │ │└───────────────────┘│
|
||||||
|
// └─────────────────────┘ │ └─────────────────────────┘ │ └─────────────────────┘
|
||||||
|
// └──────────────────────────────────┘
|
||||||
|
//
|
||||||
|
// Note: $netns0 is the endpoint for the wg1 interfaces in $netns1 and $netns2.
|
||||||
|
// See https://www.wireguard.com/netns/ for further details.
|
||||||
|
func TestNS(t *testing.T) {
|
||||||
|
checkRootOnLinux(t)
|
||||||
|
|
||||||
|
mustsh := func(t *testing.T, cmd string, arg, stdin string) string {
|
||||||
|
t.Helper()
|
||||||
|
sh := exec.Command(cmd, arg)
|
||||||
|
if stdin != "" {
|
||||||
|
sh.Stdin = strings.NewReader(stdin)
|
||||||
|
}
|
||||||
|
out, err := sh.CombinedOutput()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("%s %s: %v", cmd, arg, err)
|
||||||
|
}
|
||||||
|
return strings.TrimSpace(string(out))
|
||||||
|
}
|
||||||
|
|
||||||
|
netns := func(num int) string {
|
||||||
|
return fmt.Sprintf("wg-test-%d-%d", os.Getpid(), num)
|
||||||
|
}
|
||||||
|
wg := func(num int) string {
|
||||||
|
return fmt.Sprintf("wg%d%d", 1, num)
|
||||||
|
}
|
||||||
|
key1 := mustsh(t, "wg", "genkey", "")
|
||||||
|
key2 := mustsh(t, "wg", "genkey", "")
|
||||||
|
script := scriptScope{
|
||||||
|
vars: map[string]string{
|
||||||
|
"netns0": netns(0),
|
||||||
|
"netns1": netns(1),
|
||||||
|
"netns2": netns(2),
|
||||||
|
"wg1": wg(1),
|
||||||
|
"wg2": wg(2),
|
||||||
|
"key1": key1,
|
||||||
|
"key2": key2,
|
||||||
|
"pub1": mustsh(t, "wg", "pubkey", key1),
|
||||||
|
"pub2": mustsh(t, "wg", "pubkey", key2),
|
||||||
|
"psk": mustsh(t, "wg", "genpsk", ""),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO: orig_message_cost
|
||||||
|
|
||||||
|
script.run(t, "setup namespace", `
|
||||||
|
ip netns del $netns0 2>/dev/null || true
|
||||||
|
ip netns del $netns1 2>/dev/null || true
|
||||||
|
ip netns del $netns2 2>/dev/null || true
|
||||||
|
ip netns add $netns0
|
||||||
|
ip netns add $netns1
|
||||||
|
ip netns add $netns2
|
||||||
|
ip0 link set up dev lo
|
||||||
|
`)
|
||||||
|
|
||||||
|
wg1cmd := startWG(t, netns(0), "$wg1", wg(1))
|
||||||
|
defer wg1cmd.Process.Kill()
|
||||||
|
script.run(t, "setup $wg1", `ip0 link set $wg1 netns $netns1`)
|
||||||
|
|
||||||
|
wg2cmd := startWG(t, netns(0), "$wg2", wg(2))
|
||||||
|
defer wg2cmd.Process.Kill()
|
||||||
|
script.run(t, "setup $wg2", `ip0 link set $wg2 netns $netns2`)
|
||||||
|
|
||||||
|
script.run(t, "configure", `
|
||||||
|
ip1 addr add 192.168.241.1/24 dev $wg1
|
||||||
|
ip1 addr add fd00::1/24 dev $wg1
|
||||||
|
|
||||||
|
ip2 addr add 192.168.241.2/24 dev $wg2
|
||||||
|
ip2 addr add fd00::2/24 dev $wg2
|
||||||
|
|
||||||
|
n0 wg set $wg1 \
|
||||||
|
private-key <(echo "$key1") \
|
||||||
|
listen-port 10000 \
|
||||||
|
peer "$pub2" \
|
||||||
|
preshared-key <(echo "$psk") \
|
||||||
|
allowed-ips 192.168.241.2/32,fd00::2/128
|
||||||
|
n0 wg set $wg2 \
|
||||||
|
private-key <(echo "$key2") \
|
||||||
|
listen-port 20000 \
|
||||||
|
peer "$pub1" \
|
||||||
|
preshared-key <(echo "$psk") \
|
||||||
|
allowed-ips 192.168.241.1/32,fd00::1/128
|
||||||
|
|
||||||
|
ip1 link set up dev $wg1
|
||||||
|
ip2 link set up dev $wg2
|
||||||
|
|
||||||
|
sleep 1
|
||||||
|
|
||||||
|
# Test using IPv4 as outer transport
|
||||||
|
#n0 wg set $wg1 peer "$pub2" endpoint 127.0.0.1:20000
|
||||||
|
n0 wg set $wg2 peer "$pub1" endpoint 127.0.0.1:10000
|
||||||
|
|
||||||
|
n0 wg showconf $wg1
|
||||||
|
n0 wg showconf $wg2
|
||||||
|
`)
|
||||||
|
|
||||||
|
time.Sleep(1 * time.Second)
|
||||||
|
|
||||||
|
// TODO: counter test
|
||||||
|
|
||||||
|
script.run(t, "ping test", `
|
||||||
|
# Ping over IPv4
|
||||||
|
n2 ping -c 10 -f -W 1 192.168.241.1
|
||||||
|
n1 ping -c 10 -f -W 1 192.168.241.2
|
||||||
|
|
||||||
|
# Ping over IPv6
|
||||||
|
n2 ping6 -c 10 -f -W 1 fd00::1
|
||||||
|
n1 ping6 -c 10 -f -W 1 fd00::2
|
||||||
|
`)
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO
|
||||||
|
// TestSticky tests sticky sockets work.
|
||||||
|
//
|
||||||
|
// We start with this topology:
|
||||||
|
//
|
||||||
|
// ┌────────────────────────────────────────┐ ┌────────────────────────────────────────┐
|
||||||
|
// │ $netns1 namespace │ │ $netns2 namespace │
|
||||||
|
// │ │ │ │
|
||||||
|
// │ ┌──────┐ ┌─────┐ │ │ ┌─────┐ ┌──────┐ │
|
||||||
|
// │ │ $wg1 |────────────│veth1│───────────┼────┼──│veth2│────────────│ $wg2 │ │
|
||||||
|
// │ ├──────┴─────────┐ ├─────┴──────────┐│ │ ├─────┴──────────┐ ├──────┴─────────┐ │
|
||||||
|
// │ │192.168.241.1/24│ │10.0.0.1/24 ││ │ │10.0.0.2/24 │ │192.168.241.2/24│ │
|
||||||
|
// │ │fd00::1/24 │ │fd00:aa::1/96 ││ │ │fd00:aa::2/96 │ │fd00::2/24 │ │
|
||||||
|
// │ └────────────────┘ └────────────────┘│ │ └────────────────┘ └────────────────┘ │
|
||||||
|
// └────────────────────────────────────────┘ └────────────────────────────────────────┘
|
||||||
|
// TODO
|
||||||
|
|
||||||
|
// startWG starts wireguard-go by forking the test process and executing
|
||||||
|
// TestChild with a magic env variable. We do this instead of starting
|
||||||
|
// wireguard directly in the process because we want to run under a
|
||||||
|
// linux namespace.
|
||||||
|
//
|
||||||
|
// We cannot use setns(2) for this, because the syscall is per-thread.
|
||||||
|
// The initial tun binding works, but then device.NewDevice creates
|
||||||
|
// goroutines which run on other OS threads where setns(2) wasn't applied.
|
||||||
|
func startWG(t *testing.T, netns, dispname, name string) *exec.Cmd {
|
||||||
|
t.Helper()
|
||||||
|
cmd := exec.Command("ip", "netns", "exec", netns, os.Args[0], "-test.run=TestChild$")
|
||||||
|
cmd.Env = append([]string{
|
||||||
|
"TEST_WG_CHILD=" + name,
|
||||||
|
}, os.Environ()...)
|
||||||
|
cmd.Stdout = logWriter{logf: func(format string, args ...interface{}) {
|
||||||
|
t.Logf(dispname+": "+format, args...)
|
||||||
|
}}
|
||||||
|
cmd.Stderr = cmd.Stdout
|
||||||
|
if err := cmd.Start(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
time.Sleep(1 * time.Second) // eww TODO
|
||||||
|
return cmd
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestChild is a fake test. See startWG for details.
|
||||||
|
func TestChild(t *testing.T) {
|
||||||
|
name := os.Getenv("TEST_WG_CHILD")
|
||||||
|
if name == "" {
|
||||||
|
t.Skip("TestChild is a fake test used to start the tun $TEST_WG_CHILD, skipping")
|
||||||
|
}
|
||||||
|
log.Printf("starting wireguard-go on tun %s", name)
|
||||||
|
|
||||||
|
tun, err := tun.CreateTUN(name, device.DefaultMTU)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
d := device.NewDevice(tun, device.NewLogger(device.LogLevelInfo, "")) // TODO: LogLevelDebug option
|
||||||
|
|
||||||
|
fileUAPI, err := ipc.UAPIOpen(name)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
uapi, err := ipc.UAPIListen(name, fileUAPI)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
for {
|
||||||
|
conn, err := uapi.Accept()
|
||||||
|
if err != nil {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
go d.IpcHandle(conn)
|
||||||
|
}
|
||||||
|
// TODO: listen for a user signal to know shutdown is clean
|
||||||
|
os.Exit(0)
|
||||||
|
}
|
||||||
|
|
||||||
|
type scriptScope struct {
|
||||||
|
vars map[string]string
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s scriptScope) run(t *testing.T, name, script string) {
|
||||||
|
const header = `#!/bin/sh
|
||||||
|
set -e
|
||||||
|
|
||||||
|
export WG_HIDE_KEYS=never
|
||||||
|
|
||||||
|
n0() { ip netns exec $netns0 "$@"; }
|
||||||
|
n1() { ip netns exec $netns1 "$@"; }
|
||||||
|
n2() { ip netns exec $netns2 "$@"; }
|
||||||
|
ip0() { ip -n $netns0 "$@"; }
|
||||||
|
ip1() { ip -n $netns1 "$@"; }
|
||||||
|
ip2() { ip -n $netns2 "$@"; }
|
||||||
|
|
||||||
|
`
|
||||||
|
|
||||||
|
buf := new(bytes.Buffer)
|
||||||
|
buf.WriteString(header)
|
||||||
|
var varNames []string
|
||||||
|
for name := range s.vars {
|
||||||
|
varNames = append(varNames, name)
|
||||||
|
}
|
||||||
|
sort.Strings(varNames)
|
||||||
|
for _, name := range varNames {
|
||||||
|
fmt.Fprintf(buf, "%s=%q\n", name, s.vars[name])
|
||||||
|
}
|
||||||
|
buf.WriteString("set -x\n")
|
||||||
|
buf.WriteString(script)
|
||||||
|
|
||||||
|
sh := exec.Command("/bin/bash")
|
||||||
|
sh.Stdin = buf
|
||||||
|
sh.Stdout = logWriter{logf: t.Logf}
|
||||||
|
sh.Stderr = logWriter{logf: t.Logf}
|
||||||
|
if err := sh.Run(); err != nil {
|
||||||
|
t.Fatalf("%s failed: %v", name, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func checkRootOnLinux(t *testing.T) {
|
||||||
|
t.Helper()
|
||||||
|
if runtime.GOOS != "linux" {
|
||||||
|
t.Skip("SKIPPING test, requires GOOS=linux")
|
||||||
|
}
|
||||||
|
if os.Getuid() != 0 {
|
||||||
|
t.Skip("SKIPPING test, requires root")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func logger(name string, logf func(format string, args ...interface{})) *device.Logger {
|
||||||
|
w := logWriter{logf: logf}
|
||||||
|
return &device.Logger{
|
||||||
|
Debug: log.New(ioutil.Discard, "DEBUG("+name+"): ", 0),
|
||||||
|
Info: log.New(w, "INFO("+name+"): ", 0),
|
||||||
|
Error: log.New(w, "ERROR("+name+"): ", 0),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
type logWriter struct {
|
||||||
|
logf func(format string, args ...interface{})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (lw logWriter) Write(b []byte) (int, error) {
|
||||||
|
lw.logf("%s", b)
|
||||||
|
return len(b), nil
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user