1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
package e2e
import (
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"testing"
"git.theodohertyfamily.com/wg-wrap/internal/cli"
)
// TestEditorArgumentSplitting verifies that the editor is correctly split into command and arguments.
func TestEditorArgumentSplitting(t *testing.T) {
// Create a dummy profile file so the check passes
tmpDir := t.TempDir()
profileName := "editor-test"
profilePath := tmpDir + "/" + profileName + ".conf"
err := os.WriteFile(profilePath, []byte("[Interface]\nPrivateKey = 00000000000000000000000000000000"), 0644)
if err != nil {
t.Fatal(err)
}
app := cli.NewApp([]string{"wg-wrap", "profile", "configure", profileName})
app.ConfigDir = tmpDir
// Set EDITOR to something that includes an argument.
// We use a non-existent command that clearly contains a space.
if err := os.Setenv("EDITOR", "nonexistent-editor -v"); err != nil {
t.Fatalf("failed to set EDITOR: %v", err)
}
defer func() {
_ = os.Unsetenv("EDITOR")
}()
err = app.Route()
if err == nil {
t.Fatal("Expected error when calling nonexistent editor, but got nil")
}
// If it fails because it can't find "nonexistent-editor -v" (the whole string), it's the bug.
// If it fails because it can't find "nonexistent-editor" (split), it's correct.
if strings.Contains(err.Error(), "nonexistent-editor -v") {
t.Errorf("BUG: Editor was not split into arguments. Error contains the full string: %v", err)
} else {
t.Logf("Success: Editor was likely split correctly. Error: %v", err)
}
}
// TestDNSLeak proves that the child process leaks to the host DNS if the
// isolation fails or if /etc/resolv.conf is not correctly bound.
func TestDNSLeak(t *testing.T) {
if testing.Short() {
t.Skip("Skipping DNS leak test in short mode")
}
binaryPath := EnsureBinary(t)
// 1. Setup a profile with a fake, unreachable DNS server.
tmpConfigDir := t.TempDir()
tmpRuntimeDir := t.TempDir()
profileName := "dns-leak-test"
profilesDir := filepath.Join(tmpConfigDir, "wg-wrap", "profiles")
if err := os.MkdirAll(profilesDir, 0755); err != nil {
t.Fatal(err)
}
profilePath := filepath.Join(profilesDir, profileName+".conf")
// Use a fake DNS server (10.0.0.53) and a valid-looking config.
conf := `[Interface]
Address = 10.0.0.2/24
PrivateKey = 0000000000000000000000000000000000000000000000000000000000000000
DNS = 10.0.0.53
[Peer]
PublicKey = 0000000000000000000000000000000000000000000000000000000000000000
AllowedIPs = 0.0.0.0/0
Endpoint = 1.1.1.1:51820
`
err := os.WriteFile(profilePath, []byte(conf), 0644)
if err != nil {
t.Fatal(err)
}
// 2. Run a command that performs a DNS lookup using exec.Command on the wg-wrap binary.
// We use 'timeout 3 getent hosts google.com' to ensure it fails quickly instead of waiting on timeouts.
cmd := exec.Command(binaryPath, "--profile", profileName, "--", "timeout", "3", "getent", "hosts", "google.com")
cmd.Env = append(os.Environ(),
fmt.Sprintf("XDG_CONFIG_HOME=%s", tmpConfigDir),
fmt.Sprintf("XDG_RUNTIME_DIR=%s", tmpRuntimeDir),
)
// If the DNS isolation works, it should fail to resolve because 10.0.0.53 is fake.
// If it leaks, it will resolve using the host's DNS.
out, err := cmd.CombinedOutput()
// If err is nil, it means getent returned 0, which means it RESOLVED the host -> LEAK!
if err == nil {
t.Errorf("BUG: DNS Leak detected! The command resolved the hostname using the host's DNS instead of failing via the fake VPN DNS. Output: %s", string(out))
} else {
t.Logf("Success: Command failed as expected (DNS isolated). Error: %v, Output: %s", err, string(out))
}
}
|
