135 lines
4.2 KiB
TypeScript
135 lines
4.2 KiB
TypeScript
import { describe, expect, test } from "bun:test";
|
|
import buildHostIptablesScripts from "./build-host-iptables-scripts";
|
|
|
|
const base = {
|
|
host_id: 0,
|
|
interface_name: "wgui0",
|
|
target_interface: "eth0",
|
|
};
|
|
|
|
describe("buildHostIptablesScripts", () => {
|
|
test("deny by default with no clients", () => {
|
|
const res = buildHostIptablesScripts({
|
|
...base,
|
|
clients: [],
|
|
});
|
|
|
|
expect(res.success).toBe(true);
|
|
expect(res.post_up).toContain("iptables -N WGUI0FWD");
|
|
expect(res.post_up).toContain("iptables -A WGUI0FWD -j DROP");
|
|
expect(res.post_up).toContain("iptables -A WGUI0IN -j DROP");
|
|
expect(res.post_up).not.toContain("WGUI0FWD -s");
|
|
expect(res.post_down).toContain("iptables -X WGUI0FWD");
|
|
expect(res.post_down).toContain("iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE");
|
|
});
|
|
|
|
test("all access accepts the client on forward and input", () => {
|
|
const res = buildHostIptablesScripts({
|
|
...base,
|
|
clients: [
|
|
{
|
|
id: 1,
|
|
wg_ip_address: "10.0.0.2",
|
|
rules: [{ rule_type: "all" }],
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(res.success).toBe(true);
|
|
expect(res.post_up).toContain(
|
|
"iptables -A WGUI0FWD -s 10.0.0.2/32 -j ACCEPT",
|
|
);
|
|
expect(res.post_up).toContain(
|
|
"iptables -A WGUI0IN -s 10.0.0.2/32 -j ACCEPT",
|
|
);
|
|
});
|
|
|
|
test("destination IP and ports", () => {
|
|
const res = buildHostIptablesScripts({
|
|
...base,
|
|
clients: [
|
|
{
|
|
id: 2,
|
|
wg_ip_address: "10.0.0.3",
|
|
rules: [
|
|
{
|
|
rule_type: "destination",
|
|
destination: "192.168.1.10",
|
|
ports: "80,443",
|
|
protocol: "tcp",
|
|
},
|
|
],
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(res.success).toBe(true);
|
|
expect(res.post_up).toContain(
|
|
"iptables -A WGUI0FWD -s 10.0.0.3/32 -d 192.168.1.10/32 -p tcp -m multiport --dports 80,443 -j ACCEPT",
|
|
);
|
|
expect(res.post_up).toContain(
|
|
"iptables -A WGUI0IN -s 10.0.0.3/32 -d 192.168.1.10/32 -p tcp -m multiport --dports 80,443 -j ACCEPT",
|
|
);
|
|
});
|
|
|
|
test("protocol any with ports emits tcp and udp", () => {
|
|
const res = buildHostIptablesScripts({
|
|
...base,
|
|
clients: [
|
|
{
|
|
id: 3,
|
|
wg_ip_address: "10.0.0.4",
|
|
rules: [
|
|
{
|
|
rule_type: "destination",
|
|
ports: "53",
|
|
protocol: "any",
|
|
},
|
|
],
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(res.success).toBe(true);
|
|
expect(res.post_up).toContain(
|
|
"iptables -A WGUI0FWD -s 10.0.0.4/32 -p tcp --dport 53 -j ACCEPT",
|
|
);
|
|
expect(res.post_up).toContain(
|
|
"iptables -A WGUI0FWD -s 10.0.0.4/32 -p udp --dport 53 -j ACCEPT",
|
|
);
|
|
});
|
|
|
|
test("rejects invalid destination", () => {
|
|
const res = buildHostIptablesScripts({
|
|
...base,
|
|
clients: [
|
|
{
|
|
id: 4,
|
|
wg_ip_address: "10.0.0.5",
|
|
rules: [
|
|
{
|
|
rule_type: "destination",
|
|
destination: "not-an-ip",
|
|
},
|
|
],
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(res.success).toBe(false);
|
|
});
|
|
|
|
test("cleans up legacy allow-all rules", () => {
|
|
const res = buildHostIptablesScripts({
|
|
...base,
|
|
});
|
|
|
|
expect(res.post_up).toContain(
|
|
"iptables -D FORWARD -i wgui0 -j ACCEPT 2>/dev/null || true",
|
|
);
|
|
expect(res.post_down).toContain(
|
|
"iptables -D FORWARD -i wgui0 -j ACCEPT 2>/dev/null || true",
|
|
);
|
|
});
|
|
});
|