--- /dev/null
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2017-2020 WireGuard LLC. All Rights Reserved.
+ */
+
+package device_test
+
+import (
+ "bytes"
+ "fmt"
+ "io/ioutil"
+ "log"
+ "os"
+ "os/exec"
+ "runtime"
+ "sort"
+ "strings"
+ "testing"
+ "time"
+
+ "golang.zx2c4.com/wireguard/device"
+ "golang.zx2c4.com/wireguard/ipc"
+ "golang.zx2c4.com/wireguard/tun"
+)
+
+// Test the following topology:
+//
+// ┌─────────────────────┐ ┌──────────────────────────────────┐ ┌─────────────────────┐
+// │ $netns1 namespace │ │ $netns0 namespace │ │ $netns2 namespace │
+// │ │ │ │ │ │
+// │┌────────┐ │ │ ┌────────┐ │ │ ┌────────┐│
+// ││ $wg1 │───────────┼───┼────────────│ lo │────────────┼───┼───────────│ $wg2 ││
+// │├────────┴──────────┐│ │ ┌───────┴────────┴────────┐ │ │┌──────────┴────────┤│
+// ││192.168.241.1/24 ││ │ │(ns1) (ns2) │ │ ││192.168.241.2/24 ││
+// ││fd00::1/24 ││ │ │127.0.0.1:1 127.0.0.1:2│ │ ││fd00::2/24 ││
+// │└───────────────────┘│ │ │[::]:1 [::]:2 │ │ │└───────────────────┘│
+// └─────────────────────┘ │ └─────────────────────────┘ │ └─────────────────────┘
+// └──────────────────────────────────┘
+//
+// Note: $netns0 is the endpoint for the wg1 interfaces in $netns1 and $netns2.
+// See https://www.wireguard.com/netns/ for further details.
+func TestNS(t *testing.T) {
+ checkRootOnLinux(t)
+
+ mustsh := func(t *testing.T, cmd string, arg, stdin string) string {
+ t.Helper()
+ sh := exec.Command(cmd, arg)
+ if stdin != "" {
+ sh.Stdin = strings.NewReader(stdin)
+ }
+ out, err := sh.CombinedOutput()
+ if err != nil {
+ t.Fatalf("%s %s: %v", cmd, arg, err)
+ }
+ return strings.TrimSpace(string(out))
+ }
+
+ netns := func(num int) string {
+ return fmt.Sprintf("wg-test-%d-%d", os.Getpid(), num)
+ }
+ wg := func(num int) string {
+ return fmt.Sprintf("wg%d%d", 1, num)
+ }
+ key1 := mustsh(t, "wg", "genkey", "")
+ key2 := mustsh(t, "wg", "genkey", "")
+ script := scriptScope{
+ vars: map[string]string{
+ "netns0": netns(0),
+ "netns1": netns(1),
+ "netns2": netns(2),
+ "wg1": wg(1),
+ "wg2": wg(2),
+ "key1": key1,
+ "key2": key2,
+ "pub1": mustsh(t, "wg", "pubkey", key1),
+ "pub2": mustsh(t, "wg", "pubkey", key2),
+ "psk": mustsh(t, "wg", "genpsk", ""),
+ },
+ }
+
+ // TODO: orig_message_cost
+
+ script.run(t, "setup namespace", `
+ip netns del $netns0 2>/dev/null || true
+ip netns del $netns1 2>/dev/null || true
+ip netns del $netns2 2>/dev/null || true
+ip netns add $netns0
+ip netns add $netns1
+ip netns add $netns2
+ip0 link set up dev lo
+`)
+
+ wg1cmd := startWG(t, netns(0), "$wg1", wg(1))
+ defer wg1cmd.Process.Kill()
+ script.run(t, "setup $wg1", `ip0 link set $wg1 netns $netns1`)
+
+ wg2cmd := startWG(t, netns(0), "$wg2", wg(2))
+ defer wg2cmd.Process.Kill()
+ script.run(t, "setup $wg2", `ip0 link set $wg2 netns $netns2`)
+
+ script.run(t, "configure", `
+ip1 addr add 192.168.241.1/24 dev $wg1
+ip1 addr add fd00::1/24 dev $wg1
+
+ip2 addr add 192.168.241.2/24 dev $wg2
+ip2 addr add fd00::2/24 dev $wg2
+
+n0 wg set $wg1 \
+ private-key <(echo "$key1") \
+ listen-port 10000 \
+ peer "$pub2" \
+ preshared-key <(echo "$psk") \
+ allowed-ips 192.168.241.2/32,fd00::2/128
+n0 wg set $wg2 \
+ private-key <(echo "$key2") \
+ listen-port 20000 \
+ peer "$pub1" \
+ preshared-key <(echo "$psk") \
+ allowed-ips 192.168.241.1/32,fd00::1/128
+
+ip1 link set up dev $wg1
+ip2 link set up dev $wg2
+
+sleep 1
+
+# Test using IPv4 as outer transport
+#n0 wg set $wg1 peer "$pub2" endpoint 127.0.0.1:20000
+n0 wg set $wg2 peer "$pub1" endpoint 127.0.0.1:10000
+
+n0 wg showconf $wg1
+n0 wg showconf $wg2
+`)
+
+ time.Sleep(1 * time.Second)
+
+ // TODO: counter test
+
+ script.run(t, "ping test", `
+# Ping over IPv4
+n2 ping -c 10 -f -W 1 192.168.241.1
+n1 ping -c 10 -f -W 1 192.168.241.2
+
+# Ping over IPv6
+n2 ping6 -c 10 -f -W 1 fd00::1
+n1 ping6 -c 10 -f -W 1 fd00::2
+`)
+
+}
+
+// TODO
+// TestSticky tests sticky sockets work.
+//
+// We start with this topology:
+//
+// ┌────────────────────────────────────────┐ ┌────────────────────────────────────────┐
+// │ $netns1 namespace │ │ $netns2 namespace │
+// │ │ │ │
+// │ ┌──────┐ ┌─────┐ │ │ ┌─────┐ ┌──────┐ │
+// │ │ $wg1 |────────────│veth1│───────────┼────┼──│veth2│────────────│ $wg2 │ │
+// │ ├──────┴─────────┐ ├─────┴──────────┐│ │ ├─────┴──────────┐ ├──────┴─────────┐ │
+// │ │192.168.241.1/24│ │10.0.0.1/24 ││ │ │10.0.0.2/24 │ │192.168.241.2/24│ │
+// │ │fd00::1/24 │ │fd00:aa::1/96 ││ │ │fd00:aa::2/96 │ │fd00::2/24 │ │
+// │ └────────────────┘ └────────────────┘│ │ └────────────────┘ └────────────────┘ │
+// └────────────────────────────────────────┘ └────────────────────────────────────────┘
+// TODO
+
+// startWG starts wireguard-go by forking the test process and executing
+// TestChild with a magic env variable. We do this instead of starting
+// wireguard directly in the process because we want to run under a
+// linux namespace.
+//
+// We cannot use setns(2) for this, because the syscall is per-thread.
+// The initial tun binding works, but then device.NewDevice creates
+// goroutines which run on other OS threads where setns(2) wasn't applied.
+func startWG(t *testing.T, netns, dispname, name string) *exec.Cmd {
+ t.Helper()
+ cmd := exec.Command("ip", "netns", "exec", netns, os.Args[0], "-test.run=TestChild$")
+ cmd.Env = append([]string{
+ "TEST_WG_CHILD=" + name,
+ }, os.Environ()...)
+ cmd.Stdout = logWriter{logf: func(format string, args ...interface{}) {
+ t.Logf(dispname+": "+format, args...)
+ }}
+ cmd.Stderr = cmd.Stdout
+ if err := cmd.Start(); err != nil {
+ t.Fatal(err)
+ }
+ time.Sleep(1 * time.Second) // eww TODO
+ return cmd
+}
+
+// TestChild is a fake test. See startWG for details.
+func TestChild(t *testing.T) {
+ name := os.Getenv("TEST_WG_CHILD")
+ if name == "" {
+ t.Skip("TestChild is a fake test used to start the tun $TEST_WG_CHILD, skipping")
+ }
+ log.Printf("starting wireguard-go on tun %s", name)
+
+ tun, err := tun.CreateTUN(name, device.DefaultMTU)
+ if err != nil {
+ t.Fatal(err)
+ }
+ d := device.NewDevice(tun, device.NewLogger(device.LogLevelInfo, "")) // TODO: LogLevelDebug option
+
+ fileUAPI, err := ipc.UAPIOpen(name)
+ if err != nil {
+ t.Fatal(err)
+ }
+ uapi, err := ipc.UAPIListen(name, fileUAPI)
+ if err != nil {
+ t.Fatal(err)
+ }
+ for {
+ conn, err := uapi.Accept()
+ if err != nil {
+ break
+ }
+ go d.IpcHandle(conn)
+ }
+ // TODO: listen for a user signal to know shutdown is clean
+ os.Exit(0)
+}
+
+type scriptScope struct {
+ vars map[string]string
+}
+
+func (s scriptScope) run(t *testing.T, name, script string) {
+ const header = `#!/bin/sh
+set -e
+
+export WG_HIDE_KEYS=never
+
+n0() { ip netns exec $netns0 "$@"; }
+n1() { ip netns exec $netns1 "$@"; }
+n2() { ip netns exec $netns2 "$@"; }
+ip0() { ip -n $netns0 "$@"; }
+ip1() { ip -n $netns1 "$@"; }
+ip2() { ip -n $netns2 "$@"; }
+
+`
+
+ buf := new(bytes.Buffer)
+ buf.WriteString(header)
+ var varNames []string
+ for name := range s.vars {
+ varNames = append(varNames, name)
+ }
+ sort.Strings(varNames)
+ for _, name := range varNames {
+ fmt.Fprintf(buf, "%s=%q\n", name, s.vars[name])
+ }
+ buf.WriteString("set -x\n")
+ buf.WriteString(script)
+
+ sh := exec.Command("/bin/bash")
+ sh.Stdin = buf
+ sh.Stdout = logWriter{logf: t.Logf}
+ sh.Stderr = logWriter{logf: t.Logf}
+ if err := sh.Run(); err != nil {
+ t.Fatalf("%s failed: %v", name, err)
+ }
+}
+
+func checkRootOnLinux(t *testing.T) {
+ t.Helper()
+ if runtime.GOOS != "linux" {
+ t.Skip("SKIPPING test, requires GOOS=linux")
+ }
+ if os.Getuid() != 0 {
+ t.Skip("SKIPPING test, requires root")
+ }
+}
+
+func logger(name string, logf func(format string, args ...interface{})) *device.Logger {
+ w := logWriter{logf: logf}
+ return &device.Logger{
+ Debug: log.New(ioutil.Discard, "DEBUG("+name+"): ", 0),
+ Info: log.New(w, "INFO("+name+"): ", 0),
+ Error: log.New(w, "ERROR("+name+"): ", 0),
+ }
+}
+
+type logWriter struct {
+ logf func(format string, args ...interface{})
+}
+
+func (lw logWriter) Write(b []byte) (int, error) {
+ lw.logf("%s", b)
+ return len(b), nil
+}
projects / thirdparty / wireguard-go.git / commitdiff
