roof
adce219a46
Unit Tests / test (push) Successful in 7m29s
wg-quick creates an nftables 'preraw' table per interface that drops decrypted ICMP replies arriving on any other interface. If a test run crashes before bring_down(), the table persists and silently kills pings on subsequent runs (handshake succeeds, replies are decrypted, but the stale table drops them before the ping process sees them). Extend cleanup_stale_e2e_interfaces() to also delete any orphaned wg-quick-pic-e2e-* nftables tables found on the host. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
70 lines
2.8 KiB
Python
70 lines
2.8 KiB
Python
import os
|
|
import subprocess
|
|
import secrets
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
|
|
class WGInterface:
|
|
def __init__(self, config_path: str, iface_name: str):
|
|
self.config_path = config_path
|
|
self.iface_name = iface_name
|
|
self.up = False
|
|
|
|
def bring_up(self, timeout=30):
|
|
subprocess.run(['sudo', 'wg-quick', 'up', self.config_path],
|
|
check=True, timeout=timeout, capture_output=True, text=True)
|
|
self.up = True
|
|
|
|
def bring_down(self):
|
|
if self.up:
|
|
subprocess.run(['sudo', 'wg-quick', 'down', self.config_path],
|
|
check=False, timeout=15, capture_output=True)
|
|
self.up = False
|
|
|
|
def is_connected(self, server_ip='10.0.0.1', timeout=5) -> bool:
|
|
result = subprocess.run(
|
|
['ping', '-c', '1', '-W', str(timeout), server_ip],
|
|
capture_output=True, timeout=timeout + 2
|
|
)
|
|
return result.returncode == 0
|
|
|
|
|
|
def build_wg_config(private_key: str, peer_ip: str, server_pubkey: str,
|
|
server_endpoint: str, server_port: int = 51820,
|
|
allowed_ips: str = '10.0.0.0/24',
|
|
dns: str = None) -> str:
|
|
# Omit DNS line by default — wg-quick would try to call resolvconf/systemd-resolved
|
|
# to set system DNS, which is not installed in all test environments.
|
|
# DNS tests reach 10.0.0.1 directly via `dig @10.0.0.1` once the tunnel is up.
|
|
dns_line = f"DNS = {dns}\n" if dns else ""
|
|
return (
|
|
f"[Interface]\n"
|
|
f"PrivateKey = {private_key}\n"
|
|
f"Address = {peer_ip}/32\n"
|
|
f"{dns_line}\n"
|
|
f"[Peer]\n"
|
|
f"PublicKey = {server_pubkey}\n"
|
|
f"Endpoint = {server_endpoint}:{server_port}\n"
|
|
f"AllowedIPs = {allowed_ips}\n"
|
|
f"PersistentKeepalive = 25\n"
|
|
)
|
|
|
|
|
|
def cleanup_stale_e2e_interfaces():
|
|
"""Remove any leftover pic-e2e-* interfaces and nftables tables from previous failed runs."""
|
|
result = subprocess.run(['ip', 'link', 'show'], capture_output=True, text=True)
|
|
for line in result.stdout.splitlines():
|
|
if 'pic-e2e-' in line:
|
|
iface = line.split(':')[1].strip().split('@')[0]
|
|
subprocess.run(['sudo', 'ip', 'link', 'delete', iface], capture_output=True)
|
|
|
|
# wg-quick creates an nftables table per interface; if the interface was never brought
|
|
# down cleanly the table persists and drops decrypted ICMP replies on future runs.
|
|
nft_result = subprocess.run(['nft', 'list', 'tables'], capture_output=True, text=True)
|
|
for line in nft_result.stdout.splitlines():
|
|
if 'wg-quick-pic-e2e-' in line:
|
|
table_name = line.strip().split()[-1]
|
|
subprocess.run(['sudo', 'nft', 'delete', 'table', 'ip', table_name],
|
|
capture_output=True)
|