mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-12 07:51:00 +01:00
Krzysztof kuhy Rudnicki
9f2e208257
The nine network-curfew functions -- the per-UID iptables allow-list that cuts every app outside $NIGHT_WHITELIST off the network overnight -- move into curfew_net.sh. NET_BUILT stays in the enforcer: both files write it, so it is a genuine shared global rather than a seam violation. Placed as a FLAT sibling, not under lib/. deploy.sh pushes phone scripts into one directory, so a lib/ path would simply not exist on the device; dns_iptables.sh and tether_iptables.sh sit beside their enforcers for the same reason. Added to BOTH deploy lists, and deliberately not to the chmod list -- sourced files need no exec bit there, matching the other two. 41 assertions, 60/60 lines, 17 mutations all killed. The one that matters most flips the 10000-19999 REJECT to ACCEPT, which would silently disable the entire cut-off while leaving a chain that looks populated. The suite also asserts rule ORDER, not just presence: every ACCEPT must precede that REJECT, or the whitelist blocks the very apps it exists to permit. night_uids and fill_net_chain are reported as non-verbatim by verify_shell_split.sh, correctly: both ended in `done < file`, a line kcov instruments and bash never reports, which alone held the file at 96.77%. Both are now piped. Neither loop reads stdin internally, so the subshell is immaterial -- unlike pull_apks in backup_capture.sh, where the same change would reintroduce a known bug. Behaviour was checked rather than assumed: night_uids emits the same uids, and fill_net_chain emits an identical 11-rule sequence, diffed against the pre-split bodies. UNVERIFIED ON DEVICE -- joins tether_enforcer.sh and dns_enforcer.sh. Over-cap count 21 -> 20. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
24 lines
921 B
Bash
Executable File
24 lines
921 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Unit tests for curfew_net.sh — the per-UID network allow-list of the night
|
|
# curfew — against the stubs in curfew_net_harness.sh. No device needed.
|
|
#
|
|
# What matters here is not that rules are added but that they are added in an
|
|
# order that means something: every ACCEPT must precede the 10000-19999
|
|
# REJECT, or the whitelist lets nothing through.
|
|
#
|
|
# This is the only entry point; the cases live in two sourced files purely to
|
|
# stay under the 250-line cap.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
# shellcheck source=curfew_net_harness.sh
|
|
. "${SCRIPT_DIR}/curfew_net_harness.sh"
|
|
# shellcheck source=curfew_net_cases_chain.sh
|
|
. "${SCRIPT_DIR}/curfew_net_cases_chain.sh"
|
|
# shellcheck source=curfew_net_cases_lifecycle.sh
|
|
. "${SCRIPT_DIR}/curfew_net_cases_lifecycle.sh"
|
|
|
|
printf '\nResults: %d passed, %d failed\n' "${PASS}" "${FAIL}"
|
|
[[ "${FAIL}" -eq 0 ]]
|