mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 21:27:02 +01:00
Krzysztof kuhy Rudnicki
1ea94e142c
Gateway mode routes LAN devices through the PC: forced DNS, DoH/DoT dropped. The work laptop still bypassed it through Cloudflare WARP, so the WARP ingress is dropped too. warp_window.sh opens it for the LAN only Mon/Fri 09:00-15:30 (nft set with a timeout to 15:30), asked for over a forced-command key by warp_home.sh, which keeps WARP off at home otherwise because WARP fails closed. Also: dnsmasq upstreams, AAAA filtering, DoH canary, and extracted_repo_dir resolving ~/src first (the nightly blocklist refresh had failed since 2026-09-11). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019C8pdLR4MePsLocE1pWz7F
204 lines
8.6 KiB
Bash
Executable File
204 lines
8.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Tests for wg_firewall.sh -- the rendered ruleset and the docker restart.
|
|
#
|
|
# Every apply used to start with 'flush ruleset' and end with a docker
|
|
# restart, so opening one port bounced every container on the host. The
|
|
# subject now replaces only its own table and restarts docker only when
|
|
# docker's own rules are really gone; both are asserted on generated content
|
|
# and on the commands actually called.
|
|
#
|
|
# Rendering writes only where it is told and every command is stubbed, so
|
|
# this suite needs no jail, but it runs inside one with its siblings.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=./features_harness.sh
|
|
. "$SCRIPT_DIR/features_harness.sh"
|
|
|
|
_t_setup_env
|
|
trap _t_teardown EXIT
|
|
|
|
# The globals setup_wireguard_ssh.sh defines above its source line.
|
|
WG_IFACE="wg0"
|
|
WG_PORT="51820"
|
|
LAN_SUBNET="192.168.1.0/24"
|
|
NFT_CONF="$TEST_TMPDIR/nftables.conf"
|
|
ALLOW_WEB="true"
|
|
ALLOW_DNS="false"
|
|
ALLOW_HOMEASSISTANT="true"
|
|
ALLOW_DOT="true"
|
|
detect_lan_subnet() { :; }
|
|
log_ok() { log "$1"; }
|
|
log_warn() { log "$1"; }
|
|
log_error() { log "$1"; }
|
|
die() {
|
|
log "$1"
|
|
exit 1
|
|
}
|
|
is_service_active() { [[ ${DOCKER_ACTIVE:-yes} == yes ]]; }
|
|
|
|
# shellcheck source=../wg_gateway.sh
|
|
. "$FEATURES_LIB_DIR/wg_gateway.sh"
|
|
# shellcheck source=../wg_firewall.sh
|
|
. "$FEATURES_LIB_DIR/wg_firewall.sh"
|
|
|
|
printf '\n-- only our own table is replaced --\n'
|
|
RULES="$TEST_TMPDIR/rules.nft"
|
|
render_nftables_ruleset "$RULES"
|
|
if grep -q '^flush ruleset' "$RULES"; then
|
|
_t_fail "no 'flush ruleset' (it deletes Docker's and Tailscale's tables)"
|
|
else
|
|
_t_pass "no 'flush ruleset' (it deletes Docker's and Tailscale's tables)"
|
|
fi
|
|
_t_eq "table inet filter|delete table inet filter" \
|
|
"$(grep -E '^(delete )?table inet filter$' "$RULES" | paste -sd'|')" \
|
|
"declare-then-delete precedes the definition, so a first boot loads"
|
|
|
|
printf '\n-- flags render their rules --\n'
|
|
_t_file_has "$RULES" 'iifname "wg0" tcp dport 853 accept' "ALLOW_DOT opens 853 on wg0"
|
|
_t_file_has "$RULES" 'iifname "wg0" tcp dport 8123 accept' "ALLOW_HOMEASSISTANT keeps 8123"
|
|
_t_file_has "$RULES" 'tcp dport { 80, 443 } accept' "ALLOW_WEB keeps 80/443"
|
|
ALLOW_DOT="false"
|
|
render_nftables_ruleset "$RULES"
|
|
if grep -q 'dport 853' "$RULES"; then
|
|
_t_fail "ALLOW_DOT=false renders no 853 rule"
|
|
else
|
|
_t_pass "ALLOW_DOT=false renders no 853 rule"
|
|
fi
|
|
printf '\n-- the workout poke is LAN-only --\n'
|
|
if grep -q 'dport 8774' "$RULES"; then
|
|
_t_fail "ALLOW_WORKOUT_POKE unset renders no 8774 rule"
|
|
else
|
|
_t_pass "ALLOW_WORKOUT_POKE unset renders no 8774 rule"
|
|
fi
|
|
ALLOW_WORKOUT_POKE="true"
|
|
render_nftables_ruleset "$RULES"
|
|
_t_file_has "$RULES" 'ip saddr 192.168.1.0/24 tcp dport 8774 accept' \
|
|
"ALLOW_WORKOUT_POKE opens 8774 to the LAN subnet"
|
|
_t_eq "1" "$(grep -c 'dport 8774' "$RULES")" \
|
|
"exactly one 8774 rule: no wg0 rule, the poke never rides WireGuard"
|
|
ALLOW_WORKOUT_POKE="false"
|
|
render_nftables_ruleset "$RULES"
|
|
if grep -q 'dport 8774' "$RULES"; then
|
|
_t_fail "ALLOW_WORKOUT_POKE=false renders no 8774 rule"
|
|
else
|
|
_t_pass "ALLOW_WORKOUT_POKE=false renders no 8774 rule"
|
|
fi
|
|
if command -v nft >/dev/null 2>&1; then
|
|
ALLOW_DOT="true"
|
|
ALLOW_WORKOUT_POKE="true"
|
|
render_nftables_ruleset "$RULES"
|
|
if nft -c -f "$RULES" >/dev/null 2>&1; then
|
|
_t_pass "nft -c accepts the rendered ruleset"
|
|
else
|
|
# nft -c needs CAP_NET_ADMIN; outside the jail it cannot check at all.
|
|
printf ' (skipped: nft -c not permitted here)\n'
|
|
fi
|
|
fi
|
|
|
|
printf '\n-- docker is restarted only when its rules are gone --\n'
|
|
_t_stub systemctl
|
|
printf '#!/usr/bin/env bash\nprintf "iptables %%s\\n" "$*" >>"%s/calls.log"\nexit 0\n' \
|
|
"$TEST_TMPDIR" >"$TEST_TMPDIR/bin/iptables"
|
|
chmod +x "$TEST_TMPDIR/bin/iptables"
|
|
out="$(restore_docker_rules 2>&1)"
|
|
_t_has "$out" 'intact; containers untouched' "intact docker rules are left alone"
|
|
if grep -q 'systemctl restart docker' "$TEST_TMPDIR/calls.log"; then
|
|
_t_fail "no docker restart while its rules are intact"
|
|
else
|
|
_t_pass "no docker restart while its rules are intact"
|
|
fi
|
|
|
|
printf '#!/usr/bin/env bash\nexit 1\n' >"$TEST_TMPDIR/bin/iptables"
|
|
out="$(restore_docker_rules 2>&1)"
|
|
_t_has "$out" 'restarted' "missing docker rules trigger a rebuild"
|
|
_t_called 'systemctl restart docker' "the rebuild is a docker restart"
|
|
|
|
: >"$TEST_TMPDIR/calls.log"
|
|
DOCKER_ACTIVE=no restore_docker_rules
|
|
if grep -q 'iptables\|systemctl' "$TEST_TMPDIR/calls.log"; then
|
|
_t_fail "an inactive docker is not touched"
|
|
else
|
|
_t_pass "an inactive docker is not touched"
|
|
fi
|
|
|
|
printf '\n-- allow-workout-poke persists the flag, then applies it --\n'
|
|
# save_config belongs to setup_wireguard_ssh.sh and the apply needs root, so
|
|
# both are recorded instead; the ruleset itself is the real render.
|
|
save_config() {
|
|
printf 'save_config ALLOW_WORKOUT_POKE=%s\n' "$ALLOW_WORKOUT_POKE" >>"$TEST_TMPDIR/calls.log"
|
|
}
|
|
verify_nftables_then_apply() { printf 'apply\n' >>"$TEST_TMPDIR/calls.log"; }
|
|
: >"$TEST_TMPDIR/calls.log"
|
|
rm -f "$NFT_CONF" "${NFT_CONF}.new"
|
|
ALLOW_WORKOUT_POKE="false"
|
|
out="$(allow_workout_poke 2>&1)"
|
|
mapfile -t calls <"$TEST_TMPDIR/calls.log"
|
|
_t_eq "save_config ALLOW_WORKOUT_POKE=true|apply" "$(IFS='|' && printf '%s' "${calls[*]}")" \
|
|
"the flag is saved as true before the ruleset is applied"
|
|
_t_file_has "${NFT_CONF}.new" 'ip saddr 192.168.1.0/24 tcp dport 8774 accept' \
|
|
"the applied ruleset carries the LAN-only 8774 rule"
|
|
_t_has "$out" 'not wg0' "the confirmation says the port stays off WireGuard"
|
|
|
|
printf '\n-- LAN gateway mode --\n'
|
|
LAN_IFACE="enp6s0"
|
|
LAN_IP="192.168.1.43"
|
|
ALLOW_LAN_GATEWAY="false"
|
|
render_nftables_ruleset "$RULES"
|
|
_t_eq "table ip lan_gateway|delete table ip lan_gateway" \
|
|
"$(grep -E '^(delete )?table ip lan_gateway$' "$RULES" | paste -sd'|')" \
|
|
"gateway off still deletes a stale nat table on apply"
|
|
if grep -qE 'masquerade|dnat|oifname "enp6s0"' "$RULES"; then
|
|
_t_fail "gateway off renders no forwarding or nat"
|
|
else
|
|
_t_pass "gateway off renders no forwarding or nat"
|
|
fi
|
|
ALLOW_LAN_GATEWAY="true"
|
|
render_nftables_ruleset "$RULES"
|
|
_t_file_has "$RULES" 'iifname "enp6s0" oifname "enp6s0" ip saddr 192.168.1.0/24 accept' \
|
|
"LAN traffic is forwarded back out of the same NIC"
|
|
_t_file_has "$RULES" 'iifname "enp6s0" ip saddr 192.168.1.0/24 ip daddr @doh_v4 drop' \
|
|
"traffic to DoH resolvers is dropped"
|
|
_t_file_has "$RULES" 'iifname "enp6s0" ip saddr 192.168.1.0/24 tcp dport 853 drop' "DoT tcp/853 dropped"
|
|
_t_file_has "$RULES" 'iifname "enp6s0" ip saddr 192.168.1.0/24 udp dport 853 drop' "DoQ udp/853 dropped"
|
|
_t_file_has "$RULES" 'ip saddr != 192.168.1.43 ip daddr != 192.168.1.43 udp dport 53 dnat to 192.168.1.43' \
|
|
"plain DNS to any server is redirected to the blocker"
|
|
_t_file_has "$RULES" 'oifname "enp6s0" ip saddr 192.168.1.0/24 ip saddr != 192.168.1.43 ip daddr != 192.168.1.0/24 masquerade' \
|
|
"forwarded traffic is masqueraded, the PC's own is not"
|
|
doh_line=$(grep -n '@doh_v4 drop' "$RULES" | cut -d: -f1)
|
|
accept_line=$(grep -n 'oifname "enp6s0" ip saddr 192.168.1.0/24 accept' "$RULES" | cut -d: -f1)
|
|
if [[ -n $doh_line && -n $accept_line ]] && ((doh_line < accept_line)); then
|
|
_t_pass "the DoH drop precedes the forward accept"
|
|
else
|
|
_t_fail "the DoH drop precedes the forward accept"
|
|
fi
|
|
_t_file_has "$RULES" 'iifname "enp6s0" ip saddr 192.168.1.0/24 ip saddr != @warp_open ip daddr @warp_v4 drop' \
|
|
"traffic to the WARP tunnel ingress is dropped unless the window is open"
|
|
_t_file_has "$RULES" 'iifname "enp6s0" ip saddr 192.168.1.0/24 ip saddr != @warp_open ip daddr @warp_udp_v4 meta l4proto udp drop' \
|
|
"UDP to the shared consumer-WARP ranges is dropped unless the window is open"
|
|
_t_file_has "$RULES" 'set warp_open' "the WARP window set is declared"
|
|
_t_file_has "$RULES" 'flags interval,timeout' "the window set expires its elements by itself"
|
|
_t_file_has "$RULES" '162.159.193.0/24' "the WireGuard ingress is in the WARP set"
|
|
_t_file_has "$RULES" '162.159.197.0/24' "the MASQUE ingress (incl. its TCP 443 fallback) is in the WARP set"
|
|
_t_file_has "$RULES" '188.114.96.0/22' "consumer WARP endpoints are in the UDP-only set"
|
|
if grep -qE 'udp dport (500|1701|4500) drop' "$RULES"; then
|
|
_t_fail "IPsec ports stay open for the rest of the LAN"
|
|
else
|
|
_t_pass "IPsec ports stay open for the rest of the LAN"
|
|
fi
|
|
warp_line=$(grep -n '@warp_v4 drop' "$RULES" | cut -d: -f1)
|
|
if [[ -n $warp_line && -n $accept_line ]] && ((warp_line < accept_line)); then
|
|
_t_pass "the WARP drop precedes the forward accept"
|
|
else
|
|
_t_fail "the WARP drop precedes the forward accept"
|
|
fi
|
|
_t_file_has "$RULES" 'iifname "docker0" accept' "docker forwarding is untouched by gateway mode"
|
|
if command -v nft >/dev/null 2>&1 && nft -c -f "$RULES" >/dev/null 2>&1; then
|
|
_t_pass "nft -c accepts the gateway ruleset"
|
|
else
|
|
printf ' (skipped: nft -c not permitted here)\n'
|
|
fi
|
|
ALLOW_LAN_GATEWAY="false"
|
|
|
|
_t_report "test_wg_firewall.sh"
|