89 lines
2.5 KiB
JavaScript
89 lines
2.5 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { spawnSync } from "node:child_process";
|
|
import test from "node:test";
|
|
|
|
const ROOT = path.resolve(import.meta.dirname, "../..");
|
|
const ENTRYPOINT = path.join(ROOT, "entrypoint.sh");
|
|
|
|
function writeExecutable(filePath, contents) {
|
|
fs.writeFileSync(filePath, contents, { mode: 0o755 });
|
|
}
|
|
|
|
test("entrypoint bypasses configured source CIDRs before TProxy interception", () => {
|
|
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "vpn-entrypoint-"));
|
|
const commandLog = path.join(tmp, "commands.log");
|
|
|
|
writeExecutable(
|
|
path.join(tmp, "iptables"),
|
|
`#!/usr/bin/env bash
|
|
printf 'iptables %s\\n' "$*" >> "$COMMAND_LOG"
|
|
exit 0
|
|
`,
|
|
);
|
|
writeExecutable(
|
|
path.join(tmp, "ip"),
|
|
`#!/usr/bin/env bash
|
|
printf 'ip %s\\n' "$*" >> "$COMMAND_LOG"
|
|
exit 0
|
|
`,
|
|
);
|
|
writeExecutable(
|
|
path.join(tmp, "ipset"),
|
|
`#!/usr/bin/env bash
|
|
printf 'ipset %s\\n' "$*" >> "$COMMAND_LOG"
|
|
exit 0
|
|
`,
|
|
);
|
|
writeExecutable(
|
|
path.join(tmp, "node"),
|
|
`#!/usr/bin/env bash
|
|
printf 'node %s\\n' "$*" >> "$COMMAND_LOG"
|
|
exit 0
|
|
`,
|
|
);
|
|
|
|
const result = spawnSync("bash", [ENTRYPOINT], {
|
|
cwd: ROOT,
|
|
env: {
|
|
...process.env,
|
|
PATH: `${tmp}${path.delimiter}${process.env.PATH}`,
|
|
COMMAND_LOG: commandLog,
|
|
TPROXY_BYPASS_SOURCE_CIDRS: "192.168.50.25/32 192.168.50.26/32",
|
|
DIRECT_BYPASS_CACHE: "true",
|
|
BYPASS_CIDRS: "10.0.0.0/8",
|
|
},
|
|
encoding: "utf8",
|
|
});
|
|
|
|
assert.equal(result.status, 0, result.stderr || result.stdout);
|
|
|
|
const commands = fs.readFileSync(commandLog, "utf8").trim().split("\n");
|
|
const sourceBypassIndex = commands.findIndex((line) =>
|
|
line.includes(
|
|
"iptables -w -t mangle -A VPN_PROXY_TPROXY -s 192.168.50.25/32 -j RETURN",
|
|
),
|
|
);
|
|
const secondSourceBypassIndex = commands.findIndex((line) =>
|
|
line.includes(
|
|
"iptables -w -t mangle -A VPN_PROXY_TPROXY -s 192.168.50.26/32 -j RETURN",
|
|
),
|
|
);
|
|
const directCacheIndex = commands.findIndex((line) =>
|
|
line.includes("-m set --match-set vpn_direct_bypass dst -j RETURN"),
|
|
);
|
|
const tproxyIndex = commands.findIndex((line) =>
|
|
line.includes("-p tcp -j TPROXY --on-port 7895"),
|
|
);
|
|
|
|
assert.notEqual(sourceBypassIndex, -1);
|
|
assert.notEqual(secondSourceBypassIndex, -1);
|
|
assert.notEqual(directCacheIndex, -1);
|
|
assert.notEqual(tproxyIndex, -1);
|
|
assert.ok(sourceBypassIndex < directCacheIndex);
|
|
assert.ok(secondSourceBypassIndex < directCacheIndex);
|
|
assert.ok(sourceBypassIndex < tproxyIndex);
|
|
});
|