1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
//go:build linux
package wireguard
import (
"os"
"path/filepath"
"strings"
"testing"
"git.theodohertyfamily.com/wg-wrap/internal/namespace"
"git.theodohertyfamily.com/wg-wrap/internal/paths"
"golang.org/x/sys/unix"
)
// mockMountOps records mount calls for verification.
type mockMountOps struct {
mounts []mountCall
unmounts []string
}
type mountCall struct {
source string
target string
flags uintptr
}
func (m *mockMountOps) Mount(source, target, fstype string, flags uintptr, data string) error {
m.mounts = append(m.mounts, mountCall{source, target, flags})
return nil
}
func (m *mockMountOps) Unmount(target string, flags int) error {
m.unmounts = append(m.unmounts, target)
return nil
}
// mockFS mimics a filesystem using a temporary directory.
type mockFS struct {
root string
}
func (m *mockFS) fullPath(path string) string {
if filepath.IsAbs(path) {
path = strings.TrimPrefix(path, "/")
}
return filepath.Join(m.root, path)
}
func (m *mockFS) Stat(name string) (os.FileInfo, error) {
return os.Stat(m.fullPath(name))
}
func (m *mockFS) MkdirAll(path string, perm os.FileMode) error {
return os.MkdirAll(m.fullPath(path), perm)
}
func (m *mockFS) CreateTemp(dir, pattern string) (*os.File, error) {
return os.CreateTemp(m.fullPath(dir), pattern)
}
func (m *mockFS) MkdirTemp(dir, pattern string) (string, error) {
dirPath := m.fullPath(dir)
res, err := os.MkdirTemp(dirPath, pattern)
if err != nil {
return "", err
}
// Return path relative to root for consistency if needed, but OS calls return absolute.
// The TunnelManager expects a path it can pass to Remove() later.
// If we return absolute, mockFS.Remove must handle it.
return res, nil
}
func (m *mockFS) ReadFile(name string) ([]byte, error) {
return os.ReadFile(m.fullPath(name))
}
func (m *mockFS) Open(name string) (*os.File, error) {
return os.Open(m.fullPath(name))
}
func (m *mockFS) Remove(name string) error {
// If the path is absolute and starts with our root, we can remove it directly.
// Otherwise, we use fullPath to ensure it's within root.
if filepath.IsAbs(name) && strings.HasPrefix(name, m.root) {
return os.Remove(name)
}
return os.Remove(m.fullPath(name))
}
// setupParallelEnv creates a clean, isolated test environment for a single test.
func setupParallelEnv(t *testing.T) (*paths.PathManager, *mockMountOps, *mockFS, *TunnelManager) {
t.Helper()
tmpDir := t.TempDir()
hostRoot := t.TempDir()
pm := paths.NewPathManager("", tmpDir)
mockMounts := &mockMountOps{}
mockFS := &mockFS{root: hostRoot}
tm := &TunnelManager{
MountOps: mockMounts,
FS: mockFS,
}
return pm, mockMounts, mockFS, tm
}
func TestBlockHostServices_Logic(t *testing.T) {
t.Parallel()
pm, mockMounts, mockFS, tm := setupParallelEnv(t)
profile := "test-profile"
blockPaths := namespace.GetBlockPaths()
for _, p := range blockPaths {
fullPath := mockFS.fullPath(p)
_ = os.MkdirAll(filepath.Dir(fullPath), 0755)
_ = os.WriteFile(fullPath, []byte("data"), 0644)
}
err := tm.BlockHostServices(pm, profile)
if err != nil {
t.Fatalf("BlockHostServices failed: %v", err)
}
for _, p := range blockPaths {
found := false
for _, m := range mockMounts.mounts {
if m.target == p {
found = true
break
}
}
if !found {
t.Errorf("path %s was not blocked", p)
}
}
}
func TestConfigureResolvConf_Logic(t *testing.T) {
t.Parallel()
_, mockMounts, mockFS, tm := setupParallelEnv(t)
// Use a directory relative to mockFS.root
profileDir := "profile-dir"
_ = mockFS.MkdirAll(profileDir, 0755)
dnsServer := "1.1.1.1"
path, err := tm.ConfigureResolvConf(dnsServer, profileDir)
if err != nil {
t.Fatalf("ConfigureResolvConf failed: %v", err)
}
// path is returned from os.CreateTemp, which is absolute.
if _, err := os.Stat(path); os.IsNotExist(err) {
t.Errorf("resolv.conf file was not created at %s", path)
}
if len(mockMounts.mounts) < 2 {
t.Fatalf("expected 2 mounts, got %d", len(mockMounts.mounts))
}
if mockMounts.mounts[0].target != "/etc/resolv.conf" || mockMounts.mounts[0].flags != unix.MS_BIND {
t.Errorf("expected BIND mount to /etc/resolv.conf, got %+v", mockMounts.mounts[0])
}
if mockMounts.mounts[1].target != "/etc/resolv.conf" || mockMounts.mounts[1].flags != unix.MS_PRIVATE {
t.Errorf("expected PRIVATE mount to /etc/resolv.conf, got %+v", mockMounts.mounts[1])
}
}
func TestUnmountResolvConf_Logic(t *testing.T) {
t.Parallel()
_, mockMounts, mockFS, tm := setupParallelEnv(t)
// Create a file within the mock FS root
profileDir := "profile-dir"
_ = mockFS.MkdirAll(profileDir, 0755)
tmpFile := "resolv.conf.tmp"
fullPath := mockFS.fullPath(filepath.Join(profileDir, tmpFile))
err := os.WriteFile(fullPath, []byte("test"), 0644)
if err != nil {
t.Fatalf("failed to write temp resolv.conf: %v", err)
}
err = tm.UnmountResolvConf(fullPath)
if err != nil {
t.Errorf("UnmountResolvConf failed: %v", err)
}
if len(mockMounts.unmounts) == 0 || mockMounts.unmounts[0] != "/etc/resolv.conf" {
t.Errorf("expected unmount of /etc/resolv.conf, got %+v", mockMounts.unmounts)
}
if _, err := os.Stat(fullPath); !os.IsNotExist(err) {
t.Error("temporary resolv.conf file was not removed")
}
}
|
