369 lines
No EOL
16 KiB
Bash
369 lines
No EOL
16 KiB
Bash
#!/usr/bin/env bash
|
|
# test/integration.sh — integration test sections
|
|
# Tests run against the live wgctl binary.
|
|
# Sourced by test.command.sh — do not execute directly.
|
|
|
|
WGCTL_BINARY="$(command -v wgctl)"
|
|
|
|
# ============================================
|
|
# Helpers
|
|
# ============================================
|
|
|
|
function cmd::test::_strip_ansi() {
|
|
sed 's/\x1b\[[0-9;]*m//g'
|
|
}
|
|
|
|
function cmd::test::run_cmd() {
|
|
local desc="$1" expected="${2:-}"
|
|
shift 2
|
|
|
|
local tmp exit_code
|
|
tmp=$(mktemp)
|
|
|
|
set +e
|
|
timeout 30 "$WGCTL_BINARY" "$@" > "$tmp" 2>&1
|
|
exit_code=$?
|
|
set -e
|
|
|
|
# Reset terminal color in case command output left ANSI state dirty
|
|
printf "\033[0m" >&2
|
|
|
|
if [[ $exit_code -eq 124 ]]; then
|
|
test::warn "${desc} (timed out after 30s)"
|
|
rm -f "$tmp"
|
|
return 1
|
|
fi
|
|
|
|
local clean
|
|
clean=$(cmd::test::_strip_ansi < "$tmp")
|
|
|
|
if [[ $exit_code -ne 0 ]]; then
|
|
local msg="${desc}"
|
|
[[ -n "$expected" ]] && msg="${desc} (expected '${expected}', command failed)"
|
|
test::fail "$msg"
|
|
if [[ "${WGCTL_TEST_VERBOSE:-false}" == "true" ]]; then
|
|
printf " Output: %s\n" "$(echo "$clean" | head -3 | tr '\n' ' ')"
|
|
fi
|
|
rm -f "$tmp"
|
|
return 1
|
|
fi
|
|
|
|
if [[ -n "$expected" ]] && ! echo "$clean" | grep -qF "$expected"; then
|
|
local actual
|
|
actual=$(echo "$clean" | head -3 | tr '\n' ' ' | sed 's/ */ /g' | cut -c1-100)
|
|
test::fail "${desc} (expected '${expected}', got: '${actual}')"
|
|
rm -f "$tmp"
|
|
return 1
|
|
fi
|
|
|
|
test::pass "$desc"
|
|
rm -f "$tmp"
|
|
}
|
|
|
|
function cmd::test::run_cmd_any() {
|
|
local desc="$1" expected="${2:-}"
|
|
shift 2
|
|
|
|
local tmp
|
|
tmp=$(mktemp)
|
|
|
|
set +e
|
|
timeout 30 "$WGCTL_BINARY" "$@" > "$tmp" 2>&1
|
|
set -e
|
|
|
|
printf "\033[0m" >&2
|
|
|
|
local clean
|
|
clean=$(cmd::test::_strip_ansi < "$tmp")
|
|
|
|
if [[ -n "$expected" ]] && ! echo "$clean" | grep -qF "$expected"; then
|
|
local actual
|
|
actual=$(echo "$clean" | head -3 | tr '\n' ' ' | sed 's/ */ /g' | cut -c1-100)
|
|
test::fail "${desc} (expected '${expected}', got: '${actual}')"
|
|
rm -f "$tmp"
|
|
return 1
|
|
fi
|
|
|
|
test::pass "$desc"
|
|
rm -f "$tmp"
|
|
}
|
|
|
|
function cmd::test::run_cmd_fails() {
|
|
local desc="$1"
|
|
shift
|
|
|
|
local tmp exit_code
|
|
tmp=$(mktemp)
|
|
|
|
set +e
|
|
timeout 10 "$WGCTL_BINARY" "$@" > "$tmp" 2>&1
|
|
exit_code=$?
|
|
set -e
|
|
|
|
printf "\033[0m" >&2
|
|
rm -f "$tmp"
|
|
|
|
if [[ $exit_code -eq 124 ]]; then
|
|
test::warn "${desc} (timed out)"
|
|
return 1
|
|
fi
|
|
|
|
if [[ $exit_code -eq 0 ]]; then
|
|
test::fail "${desc} (expected failure but succeeded)"
|
|
return 1
|
|
fi
|
|
|
|
test::pass "$desc"
|
|
}
|
|
|
|
# ============================================
|
|
# Sections
|
|
# ============================================
|
|
|
|
function cmd::test::run_all_integration_sections() {
|
|
cmd::test::section_list
|
|
cmd::test::section_inspect
|
|
cmd::test::section_config
|
|
cmd::test::section_rules
|
|
cmd::test::section_groups
|
|
cmd::test::section_audit
|
|
cmd::test::section_logs
|
|
cmd::test::section_fw
|
|
cmd::test::section_net
|
|
cmd::test::section_subnet
|
|
cmd::test::section_identity
|
|
cmd::test::section_activity
|
|
cmd::test::section_policy
|
|
cmd::test::section_hosts
|
|
cmd::test::section_peer_cmd
|
|
cmd::test::section_group_purge
|
|
cmd::test::section_logs_clean
|
|
}
|
|
|
|
function cmd::test::section_list() {
|
|
test::section "List"
|
|
cmd::test::run_cmd "list" "rule:" list
|
|
cmd::test::run_cmd "list --online" "" list --online
|
|
cmd::test::run_cmd "list --offline" "" list --offline
|
|
cmd::test::run_cmd "list --blocked" "" list --blocked
|
|
cmd::test::run_cmd "list --type phone" "phone" list --type phone
|
|
cmd::test::run_cmd "list --detailed" "rule:" list --detailed
|
|
cmd::test::run_cmd "list --name phone-nuno" "phone-nuno" list --name phone-nuno
|
|
cmd::test::run_cmd "list --json" '"ok":true' list --json
|
|
cmd::test::run_cmd "list --json has peers" '"peers":' list --json
|
|
cmd::test::run_cmd "list --json has meta" '"meta":' list --json
|
|
cmd::test::run_cmd "list --json peer name" '"name":' list --json
|
|
cmd::test::run_cmd "list --json peer ip" '"ip":' list --json
|
|
cmd::test::run_cmd "list --json peer status" '"status":' list --json
|
|
}
|
|
|
|
function cmd::test::section_inspect() {
|
|
test::section "Inspect"
|
|
cmd::test::run_cmd "inspect --name phone-nuno" "IP:" inspect --name phone-nuno
|
|
cmd::test::run_cmd "inspect --name nuno --type phone" "IP:" inspect --name nuno --type phone
|
|
cmd::test::run_cmd "inspect --name phone-nuno --config" "PrivateKey" inspect --name phone-nuno --config
|
|
cmd::test::run_cmd_fails "inspect nonexistent" inspect --name nonexistent-peer
|
|
cmd::test::run_cmd "inspect --json" '"ok":true' inspect --name phone-nuno --json
|
|
cmd::test::run_cmd "inspect --json rule" '"rule":' inspect --name phone-nuno --json
|
|
cmd::test::run_cmd "inspect --json identity" '"identity":' inspect --name phone-nuno --json
|
|
cmd::test::run_cmd "inspect --json groups" '"groups":' inspect --name phone-nuno --json
|
|
}
|
|
|
|
function cmd::test::section_config() {
|
|
test::section "Config & QR"
|
|
cmd::test::run_cmd "config --name phone-nuno" "PrivateKey" config --name phone-nuno
|
|
cmd::test::run_cmd "config --name nuno --type phone" "PrivateKey" config --name nuno --type phone
|
|
cmd::test::run_cmd "qr --name phone-nuno" "" qr --name phone-nuno
|
|
}
|
|
|
|
function cmd::test::section_rules() {
|
|
test::section "Rules"
|
|
cmd::test::run_cmd "rule list" "user" rule list
|
|
cmd::test::run_cmd "rule show --name guest" "Description" rule show --name guest
|
|
cmd::test::run_cmd "rule show --name user" "Description" rule show --name user
|
|
cmd::test::run_cmd "rule show --name admin" "Description" rule show --name admin
|
|
cmd::test::run_cmd "rule list --json" '"rules":' rule list --json
|
|
cmd::test::run_cmd "rule list --json" '"rules":' rule list --json
|
|
cmd::test::run_cmd "rule --json is_base" '"is_base":' rule list --json
|
|
cmd::test::run_cmd "rule --json extends" '"extends":' rule list --json
|
|
cmd::test::run_cmd "rule --json allows" '"allows":' rule list --json
|
|
cmd::test::run_cmd_fails "rule show nonexistent" rule show --name nonexistent
|
|
}
|
|
|
|
function cmd::test::section_groups() {
|
|
test::section "Groups"
|
|
cmd::test::run_cmd "group list" "Groups" group list
|
|
cmd::test::run_cmd "group show --name family" "Peers:" group show --name family
|
|
cmd::test::run_cmd "group list --json" '"groups":' group list --json
|
|
cmd::test::run_cmd "group list --json" '"groups":' group list --json
|
|
cmd::test::run_cmd "group --json peer_count" '"peer_count":' group list --json
|
|
cmd::test::run_cmd_fails "group show nonexistent" group show --name nonexistent
|
|
}
|
|
|
|
function cmd::test::section_audit() {
|
|
test::section "Audit"
|
|
cmd::test::run_cmd_any "audit" "passed" audit
|
|
cmd::test::run_cmd_any "audit --peer phone-nuno" "passed" audit --peer phone-nuno
|
|
cmd::test::run_cmd_any "audit --type phone" "passed" audit --type phone
|
|
}
|
|
|
|
function cmd::test::section_logs() {
|
|
test::section "Logs"
|
|
cmd::test::run_cmd "logs" "Activity" logs
|
|
cmd::test::run_cmd "logs --name phone-nuno" "Activity" logs --name phone-nuno
|
|
cmd::test::run_cmd "logs --fw" "Firewall Drops" logs --fw
|
|
cmd::test::run_cmd "logs --wg" "WireGuard Events" logs --wg
|
|
cmd::test::run_cmd "logs --since 2099-01-01" "No logs" logs --since "2099-01-01"
|
|
cmd::test::run_cmd "logs --wg --since 2099-01-01" "No logs" logs --wg --since "2099-01-01"
|
|
cmd::test::run_cmd "logs --fw --since 2099-01-01" "No logs" logs --fw --since "2099-01-01"
|
|
cmd::test::run_cmd "logs --wg --event attempt" "" logs --wg --event attempt
|
|
cmd::test::run_cmd "logs --detailed" "" logs --detailed
|
|
cmd::test::run_cmd "logs --resolved" "" logs --resolved
|
|
cmd::test::run_cmd "logs --ascending" "" logs --ascending
|
|
cmd::test::run_cmd "logs --descending" "" logs --descending
|
|
cmd::test::run_cmd "logs --wg --ascending" "" logs --wg --ascending
|
|
}
|
|
|
|
function cmd::test::section_fw() {
|
|
test::section "Firewall"
|
|
cmd::test::run_cmd "fw list" "FORWARD" fw list
|
|
cmd::test::run_cmd "fw list --peer phone-nuno" "" fw list --peer phone-nuno
|
|
cmd::test::run_cmd "fw list --no-nflog" "" fw list --no-nflog
|
|
cmd::test::run_cmd "fw list --no-accept" "" fw list --no-accept
|
|
cmd::test::run_cmd "fw list --no-drop" "" fw list --no-drop
|
|
cmd::test::run_cmd "fw nat" "PREROUTING" fw nat
|
|
cmd::test::run_cmd "fw count" "TOTAL" fw count
|
|
}
|
|
|
|
function cmd::test::section_net() {
|
|
test::section "Net"
|
|
"$WGCTL_BINARY" net rm --name test-svc --force > /dev/null 2>&1 || true
|
|
|
|
cmd::test::run_cmd "net add service" "added" net add --name test-svc --ip 10.0.0.99 --desc "Test service"
|
|
cmd::test::run_cmd "net add port" "Added" net add --name test-svc:web --port 9999:tcp
|
|
cmd::test::run_cmd "net list" "test-svc" net list
|
|
cmd::test::run_cmd "net list --detailed" "web" net list --detailed
|
|
cmd::test::run_cmd "net show" "9999" net show --name test-svc
|
|
cmd::test::run_cmd "net rm port" "Removed" net rm --name test-svc:web --force
|
|
cmd::test::run_cmd "net add port again" "Added" net add --name test-svc:web --port 9999:tcp
|
|
cmd::test::run_cmd "net rm all ports" "Removed" net rm --name test-svc:ports --force
|
|
cmd::test::run_cmd "net rm service" "Removed" net rm --name test-svc --force
|
|
cmd::test::run_cmd "net list --json" '"services":' net list --json
|
|
cmd::test::run_cmd "net --json has tags" '"tags":' net list --json
|
|
cmd::test::run_cmd "net --json port_count" '"port_count":' net list --json
|
|
cmd::test::run_cmd_fails "net show nonexistent" net show --name nonexistent-svc
|
|
cmd::test::run_cmd_fails "net add port no service" net add --name nonexistent:web --port 80:tcp
|
|
}
|
|
|
|
function cmd::test::section_subnet() {
|
|
test::section "Subnet"
|
|
"$WGCTL_BINARY" subnet rm --name test-subnet-2 > /dev/null 2>&1 || true
|
|
"$WGCTL_BINARY" subnet rm --name test-subnet > /dev/null 2>&1 || true
|
|
|
|
cmd::test::run_cmd "subnet list" "desktop" subnet list
|
|
cmd::test::run_cmd "subnet show desktop" "tunnel:" subnet show --name desktop
|
|
cmd::test::run_cmd "subnet show guests group" "guests" subnet show --name guests
|
|
cmd::test::run_cmd_fails "subnet show nonexistent" subnet show --name nonexistent
|
|
cmd::test::run_cmd "subnet add" "added" subnet add --name test-subnet --subnet 10.1.250.0/24 --type iot --desc "Test"
|
|
cmd::test::run_cmd "subnet list shows new" "test-subnet" subnet list
|
|
cmd::test::run_cmd_fails "subnet rename in-use (desktop)" subnet rename --name desktop --new-name workstation
|
|
cmd::test::run_cmd "subnet rename unused" "renamed" subnet rename --name test-subnet --new-name test-subnet-2
|
|
cmd::test::run_cmd "subnet rm" "removed" subnet rm --name test-subnet-2
|
|
cmd::test::run_cmd "subnet list --json" '"subnets":' subnet list --json
|
|
cmd::test::run_cmd "subnet --json has cidr" '"cidr":' subnet list --json
|
|
cmd::test::run_cmd "subnet --json is_group" '"is_group":' subnet list --json
|
|
cmd::test::run_cmd_fails "subnet rm nonexistent" subnet rm --name nonexistent-subnet
|
|
}
|
|
|
|
function cmd::test::section_identity() {
|
|
test::section "Identity"
|
|
cmd::test::run_cmd "identity list" "" identity list
|
|
cmd::test::run_cmd "identity migrate --dry-run" "Dry run" identity migrate --dry-run
|
|
cmd::test::run_cmd "identity show nuno" "nuno" identity show --name nuno
|
|
cmd::test::run_cmd "identity list --json" '"identities":' identity list --json
|
|
cmd::test::run_cmd "identity --json types array" '"types":[' identity list --json
|
|
cmd::test::run_cmd "identity --json rules array" '"rules":[' identity list --json
|
|
cmd::test::run_cmd_fails "identity show nonexistent" identity show --name nonexistent
|
|
}
|
|
|
|
function cmd::test::section_activity() {
|
|
test::section "Activity"
|
|
cmd::test::run_cmd "activity" "Activity" activity
|
|
cmd::test::run_cmd "activity --json" '"peers":' activity --json
|
|
cmd::test::run_cmd "activity --json services" '"services":' activity --json
|
|
cmd::test::run_cmd "activity --json rx" '"rx":' activity --json
|
|
}
|
|
|
|
function cmd::test::section_policy() {
|
|
test::section "Policy"
|
|
cmd::test::run_cmd "policy list --json" '"policies":' policy list --json
|
|
cmd::test::run_cmd "policy --json has tunnel_mode" '"tunnel_mode":' policy list --json
|
|
cmd::test::run_cmd "policy --json strict_rule bool" '"strict_rule":false' policy list --json
|
|
}
|
|
|
|
function cmd::test::section_hosts() {
|
|
test::section "Hosts"
|
|
|
|
# Cleanup
|
|
"$WGCTL_BINARY" hosts rm --ip 192.0.2.1 --force > /dev/null 2>&1 || true
|
|
"$WGCTL_BINARY" hosts rm --port 9999 --force > /dev/null 2>&1 || true
|
|
|
|
cmd::test::run_cmd "hosts list" "Hosts" hosts list
|
|
cmd::test::run_cmd "hosts add --ip" "Added" hosts add --ip 192.0.2.1 --name test-host --desc "Test" --tags test,unit
|
|
cmd::test::run_cmd "hosts list shows new" "test-host" hosts list
|
|
cmd::test::run_cmd "hosts show --ip" "Name" hosts show --ip 192.0.2.1
|
|
cmd::test::run_cmd "hosts add --port" "Added" hosts add --port 9999 --name test-port
|
|
cmd::test::run_cmd "hosts list shows port" "test-port" hosts list
|
|
cmd::test::run_cmd "hosts rm --ip" "Removed" hosts rm --ip 192.0.2.1 --force
|
|
cmd::test::run_cmd "hosts rm --port" "Removed" hosts rm --port 9999 --force
|
|
cmd::test::run_cmd "hosts list --json" '"hosts":' hosts list --json
|
|
cmd::test::run_cmd "hosts --json has type" '"type":' hosts list --json
|
|
cmd::test::run_cmd "hosts --json has tags" '"tags":' hosts list --json
|
|
cmd::test::run_cmd_fails "hosts show nonexistent" hosts show --ip 192.0.2.99
|
|
cmd::test::run_cmd_fails "hosts add missing --name" hosts add --ip 192.0.2.1
|
|
}
|
|
|
|
function cmd::test::section_peer_cmd() {
|
|
test::section "Peer command"
|
|
|
|
"$WGCTL_BINARY" remove --name phone-testunit --force > /dev/null 2>&1 || true
|
|
"$WGCTL_BINARY" add --name testunit --type phone > /dev/null 2>&1
|
|
|
|
# update-dns
|
|
cmd::test::run_cmd "peer update-dns --name" "Updated DNS" peer update-dns --name phone-testunit
|
|
cmd::test::run_cmd "peer update-dns applies" "10.0.0.103" config --name phone-testunit
|
|
cmd::test::run_cmd "peer update-dns --all" "peer(s)" peer update-dns --all
|
|
|
|
# update-tunnel
|
|
cmd::test::run_cmd "peer update-tunnel split" "split" peer update-tunnel --name phone-testunit --mode split
|
|
cmd::test::run_cmd "peer update-tunnel full" "Updated" peer update-tunnel --name phone-testunit --mode full
|
|
cmd::test::run_cmd_fails "peer update-tunnel bad mode" peer update-tunnel --name phone-testunit --mode invalid
|
|
cmd::test::run_cmd_fails "peer update-tunnel missing --mode" peer update-tunnel --name phone-testunit
|
|
cmd::test::run_cmd_fails "peer update-tunnel missing --name" peer update-tunnel --mode split
|
|
|
|
# Restore split tunnel
|
|
"$WGCTL_BINARY" peer update-tunnel --name phone-testunit --mode split > /dev/null 2>&1 || true
|
|
"$WGCTL_BINARY" remove --name phone-testunit --force > /dev/null 2>&1 || true
|
|
}
|
|
|
|
function cmd::test::section_group_purge() {
|
|
test::section "Group: purge-stale"
|
|
|
|
# dry-run should not modify anything
|
|
cmd::test::run_cmd "purge-stale --all --dry-run" \
|
|
"[dry-run]" \
|
|
group purge-stale --all --dry-run --force
|
|
|
|
# single group dry-run
|
|
cmd::test::run_cmd "purge-stale --name family --dry-run" \
|
|
"[dry-run]" \
|
|
group purge-stale --name family --dry-run --force
|
|
}
|
|
|
|
function cmd::test::section_logs_clean() {
|
|
test::section "Logs: clean"
|
|
|
|
cmd::test::run_cmd "logs clean --force" \
|
|
"keepalive" \
|
|
logs clean --force
|
|
} |