Privatae
812 lines
29 KiB
Go
812 lines
29 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"path"
|
|
"path/filepath"
|
|
"sort"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// fwStandin plays this machine's firewall commands: netsh, ufw, firewall-cmd,
|
|
// socketfilterfw, nft and iptables, each with the state it would keep. Every
|
|
// command run is recorded, so a test can say what was never run.
|
|
type fwStandin struct {
|
|
mu sync.Mutex
|
|
ran []string
|
|
fail map[string]bool // a verb that fails ("add")
|
|
|
|
// Windows: rule name -> its add arguments.
|
|
win map[string]string
|
|
// ufw: on or off, and its rules as `ufw status` lists them.
|
|
ufwOn bool
|
|
ufwRules []string
|
|
// firewalld: running, ports now and permanently.
|
|
fwdOn bool
|
|
fwdNow, fwdPerm map[string]bool
|
|
macOn, macAllIn bool
|
|
macApps map[string]bool
|
|
nftRuleset, ipts string
|
|
}
|
|
|
|
func newFWStandin() *fwStandin {
|
|
return &fwStandin{fail: map[string]bool{}, win: map[string]string{}, fwdNow: map[string]bool{},
|
|
fwdPerm: map[string]bool{}, macApps: map[string]bool{}}
|
|
}
|
|
|
|
var errExit1 = errors.New("exit status 1")
|
|
|
|
func (f *fwStandin) exec(name string, args ...string) (string, error) {
|
|
f.mu.Lock()
|
|
defer f.mu.Unlock()
|
|
line := path.Base(strings.ReplaceAll(name, `\`, "/")) + " " + strings.Join(args, " ")
|
|
f.ran = append(f.ran, line)
|
|
a := strings.Join(args, " ")
|
|
switch path.Base(strings.ReplaceAll(name, `\`, "/")) {
|
|
case "netsh.exe":
|
|
if !strings.HasPrefix(a, "advfirewall firewall ") || len(args) < 5 {
|
|
return "", fmt.Errorf("netsh: %s", a)
|
|
}
|
|
rule := strings.TrimPrefix(args[4], "name=")
|
|
switch args[2] {
|
|
case "show":
|
|
if _, ok := f.win[rule]; ok {
|
|
return "Rule Name: " + rule + "\n", nil
|
|
}
|
|
return "No rules match the specified criteria.\n", errExit1
|
|
case "add":
|
|
if f.fail["add"] {
|
|
return "The requested operation requires elevation (Run as administrator).", errExit1
|
|
}
|
|
f.win[rule] = strings.Join(args[5:], " ")
|
|
return "Ok.\n", nil
|
|
case "delete":
|
|
if _, ok := f.win[rule]; !ok {
|
|
return "No rules match the specified criteria.\n", errExit1
|
|
}
|
|
delete(f.win, rule)
|
|
return "\nDeleted 1 rule(s).\nOk.\n", nil
|
|
}
|
|
case "ufw":
|
|
switch {
|
|
case a == "status":
|
|
if !f.ufwOn {
|
|
return "Status: inactive\n", nil
|
|
}
|
|
return "Status: active\n\nTo Action From\n-- ------ ----\n" +
|
|
strings.Join(f.ufwRules, "\n") + "\n", nil
|
|
case strings.HasPrefix(a, "allow "):
|
|
port := args[1]
|
|
c := ""
|
|
if len(args) == 4 && args[2] == "comment" {
|
|
c = " # " + args[3]
|
|
}
|
|
f.ufwRules = append(f.ufwRules, port+" ALLOW Anywhere"+c,
|
|
port+" (v6) ALLOW Anywhere (v6)"+c)
|
|
return "Rule added\nRule added (v6)\n", nil
|
|
case strings.HasPrefix(a, "delete allow "):
|
|
port := args[2]
|
|
var keep []string
|
|
for _, r := range f.ufwRules {
|
|
if strings.Fields(r)[0] != port {
|
|
keep = append(keep, r)
|
|
}
|
|
}
|
|
if len(keep) == len(f.ufwRules) {
|
|
return "Could not delete non-existent rule\n", errExit1
|
|
}
|
|
f.ufwRules = keep
|
|
return "Rule deleted\nRule deleted (v6)\n", nil
|
|
}
|
|
case "firewall-cmd":
|
|
perm := len(args) > 0 && args[0] == "--permanent"
|
|
set := f.fwdNow
|
|
if perm {
|
|
set, args = f.fwdPerm, args[1:]
|
|
}
|
|
if len(args) == 0 {
|
|
break
|
|
}
|
|
switch {
|
|
case args[0] == "--state":
|
|
if f.fwdOn {
|
|
return "running\n", nil
|
|
}
|
|
return "not running\n", errors.New("exit status 252")
|
|
case strings.HasPrefix(args[0], "--query-port="):
|
|
if set[strings.TrimPrefix(args[0], "--query-port=")] {
|
|
return "yes\n", nil
|
|
}
|
|
return "no\n", errExit1
|
|
case strings.HasPrefix(args[0], "--add-port="):
|
|
if perm && f.fail["permanent"] {
|
|
return "Error: COMMAND_FAILED\n", errExit1
|
|
}
|
|
set[strings.TrimPrefix(args[0], "--add-port=")] = true
|
|
return "success\n", nil
|
|
case strings.HasPrefix(args[0], "--remove-port="):
|
|
p := strings.TrimPrefix(args[0], "--remove-port=")
|
|
if !set[p] {
|
|
return "Warning: NOT_ENABLED: " + p + "\nsuccess\n", nil
|
|
}
|
|
delete(set, p)
|
|
return "success\n", nil
|
|
}
|
|
case "socketfilterfw":
|
|
switch args[0] {
|
|
case "--getglobalstate":
|
|
if f.macOn {
|
|
return "Firewall is enabled. (State = 1)\n", nil
|
|
}
|
|
return "Firewall is disabled. (State = 0)\n", nil
|
|
case "--getblockall":
|
|
if f.macAllIn {
|
|
return "Firewall is set to block all non-essential incoming connections\nBlock all ENABLED!\n", nil
|
|
}
|
|
return "Block all DISABLED!\n", nil
|
|
case "--listapps":
|
|
// As macOS before 15 prints it (developer.apple.com/forums/thread/757909).
|
|
var b strings.Builder
|
|
fmt.Fprintf(&b, "ALF: total number of apps = %d \n\n", len(f.macApps))
|
|
var ps []string
|
|
for p := range f.macApps {
|
|
ps = append(ps, p)
|
|
}
|
|
sort.Strings(ps)
|
|
for i, p := range ps {
|
|
st := "Block"
|
|
if f.macApps[p] {
|
|
st = "Allow"
|
|
}
|
|
fmt.Fprintf(&b, "%d : %s ( %s incoming connections )\n", i+1, p, st)
|
|
}
|
|
return b.String(), nil
|
|
case "--add":
|
|
f.macApps[args[1]] = false
|
|
return "The file " + args[1] + " added to firewall\n", nil
|
|
case "--unblockapp":
|
|
if f.fail["unblock"] {
|
|
return "Error\n", errExit1
|
|
}
|
|
f.macApps[args[1]] = true
|
|
return "Incoming connection to the application is permitted\n", nil
|
|
case "--remove":
|
|
delete(f.macApps, args[1])
|
|
return "The file " + args[1] + " removed from firewall\n", nil
|
|
}
|
|
case "nft":
|
|
return f.nftRuleset, nil
|
|
case "iptables":
|
|
return f.ipts, nil
|
|
}
|
|
return "", fmt.Errorf("the stand-in does not know %s", line)
|
|
}
|
|
|
|
func (f *fwStandin) commands() []string {
|
|
f.mu.Lock()
|
|
defer f.mu.Unlock()
|
|
return append([]string(nil), f.ran...)
|
|
}
|
|
|
|
// fwWorld stands the firewall in for goos, with the door wanted while *want.
|
|
func fwWorld(t *testing.T, goos string, root bool) (*fwStandin, *bool) {
|
|
t.Helper()
|
|
uiTestConfigDir(t)
|
|
f := newFWStandin()
|
|
want := true
|
|
prevExec, prevFor, prevBy, prevHave, prevRoot, prevProg, prevWant, prevRead :=
|
|
doorFWExec, doorFirewallFor, doorFirewallByID, doorFWHave, doorFWRoot, doorFWProgram, doorPortWanted, doorFWReadFile
|
|
t.Cleanup(func() {
|
|
doorFWExec, doorFirewallFor, doorFirewallByID, doorFWHave, doorFWRoot, doorFWProgram, doorPortWanted, doorFWReadFile =
|
|
prevExec, prevFor, prevBy, prevHave, prevRoot, prevProg, prevWant, prevRead
|
|
})
|
|
doorFWExec = f.exec
|
|
doorFirewallFor = func(port string) (doorFirewall, string) { return detectDoorFirewall(goos, port) }
|
|
doorFirewallByID = func(id string) doorFirewall { return doorFirewallOf(goos, id) }
|
|
doorFWHave = func(paths ...string) string { return paths[0] }
|
|
doorFWRoot = func() bool { return root }
|
|
doorFWProgram = func() (string, error) { return `C:\Program Files\Privatae\privatae-bastion.exe`, nil }
|
|
doorPortWanted = func(string) bool { return want }
|
|
doorFWReadFile = func(string) ([]byte, error) { return nil, errors.New("no such file") }
|
|
return f, &want
|
|
}
|
|
|
|
func fwAudit(t *testing.T) string {
|
|
t.Helper()
|
|
d, _ := configDir()
|
|
b, _ := os.ReadFile(filepath.Join(d, "pairing_audit.jsonl"))
|
|
return string(b)
|
|
}
|
|
|
|
func countOp(t *testing.T, op string) int {
|
|
return strings.Count(fwAudit(t), `"op":"`+op+`"`)
|
|
}
|
|
|
|
// Windows: the rule is the bastion's own by name, inbound, TCP on the door's
|
|
// port only, every profile, for this program only, made by netsh from
|
|
// System32. It is made once, kept while the door is in use, and removed when
|
|
// the last pairing and window are gone, each step in the audit and in status.
|
|
func TestTheWindowsRuleIsTheBastionsOwnAndGoesWithTheDoor(t *testing.T) {
|
|
f, want := fwWorld(t, "windows", false)
|
|
said := doorFirewallEnsure(":8812")
|
|
rule := doorFWRuleName("8812")
|
|
got, ok := f.win[rule]
|
|
if !ok {
|
|
t.Fatalf("no rule %q: %v", rule, f.commands())
|
|
}
|
|
for _, part := range []string{"dir=in", "action=allow", "protocol=TCP", "localport=8812",
|
|
`program=C:\Program Files\Privatae\privatae-bastion.exe`, "profile=any", "enable=yes"} {
|
|
if !strings.Contains(got, part) {
|
|
t.Fatalf("the rule lacks %s: %s", part, got)
|
|
}
|
|
}
|
|
for _, c := range f.commands() {
|
|
if !strings.HasPrefix(c, "netsh.exe advfirewall firewall ") {
|
|
t.Fatalf("ran %q", c)
|
|
}
|
|
}
|
|
if !strings.HasPrefix(netshPath(), `C:\Windows\System32`) {
|
|
t.Fatalf("netsh is not run by its absolute path: %s", netshPath())
|
|
}
|
|
if !strings.Contains(said, "added its own rule in Windows Firewall") {
|
|
t.Fatalf("said %q", said)
|
|
}
|
|
// Again (the daemon's door after the window's): kept, not doubled.
|
|
doorFirewallEnsure(":8812")
|
|
if n := strings.Count(strings.Join(f.commands(), "\n"), " add rule "); n != 1 {
|
|
t.Fatalf("%d adds", n)
|
|
}
|
|
s := readDoorFirewallStatus()
|
|
if s == nil || len(s.Rules) != 1 || !strings.Contains(s.Rules[0], "Windows Firewall allows TCP 8812") {
|
|
t.Fatalf("status: %+v", s)
|
|
}
|
|
// Still in use: the rule stays.
|
|
doorFirewallRelease(":8812")
|
|
if _, ok := f.win[rule]; !ok {
|
|
t.Fatal("removed while the door is still in use")
|
|
}
|
|
// The last pairing and window gone: removed.
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if _, ok := f.win[rule]; ok {
|
|
t.Fatal("the rule outlived the door")
|
|
}
|
|
if s := readDoorFirewallStatus(); s != nil {
|
|
t.Fatalf("status after: %+v", s)
|
|
}
|
|
if countOp(t, "door_firewall_opened") != 1 || countOp(t, "door_firewall_closed") != 1 {
|
|
t.Fatalf("the audit:\n%s", fwAudit(t))
|
|
}
|
|
// MUTATION: release removes nothing. RESULT: red, "the rule outlived the door".
|
|
// MUTATION: the add drops program=. RESULT: red, "the rule lacks program=".
|
|
// MUTATION: ensure adds without asking has(). RESULT: red, "2 adds".
|
|
}
|
|
|
|
// Windows: the bastion moved (another path): its rule is replaced by one for
|
|
// the new path; and an add refused (no administrator) is said once, with the
|
|
// command that does it by hand, in status and doctor.
|
|
func TestTheWindowsRuleFollowsTheProgramAndAFailureIsSaidOnce(t *testing.T) {
|
|
f, _ := fwWorld(t, "windows", false)
|
|
doorFirewallEnsure(":8812")
|
|
doorFWProgram = func() (string, error) { return `D:\Privatae\privatae-bastion.exe`, nil }
|
|
doorFirewallEnsure(":8812")
|
|
if got := f.win[doorFWRuleName("8812")]; !strings.Contains(got, `program=D:\Privatae\privatae-bastion.exe`) {
|
|
t.Fatalf("the rule names %s", got)
|
|
}
|
|
if st := loadDoorFW(); len(st.Rules) != 1 || st.Rules[0].Program != `D:\Privatae\privatae-bastion.exe` {
|
|
t.Fatalf("the record: %+v", st.Rules)
|
|
}
|
|
|
|
g, _ := fwWorld(t, "windows", false)
|
|
g.fail["add"] = true
|
|
doorFirewallEnsure(":8812")
|
|
doorFirewallEnsure(":8812")
|
|
if n := countOp(t, "door_firewall_failed"); n != 1 {
|
|
t.Fatalf("the failure audited %d times", n)
|
|
}
|
|
s := readDoorFirewallStatus()
|
|
if s == nil || len(s.Needs) != 1 || !strings.Contains(s.Needs[0], "New-NetFirewallRule") {
|
|
t.Fatalf("status: %+v", s)
|
|
}
|
|
cs := doorFirewallChecks(s)
|
|
if len(cs) != 1 || cs[0].OK || !strings.Contains(cs[0].Problem, "TCP 8812") {
|
|
t.Fatalf("doctor: %+v", cs)
|
|
}
|
|
// MUTATION: the program is not compared. RESULT: red, the rule names the old path.
|
|
// MUTATION: the note is audited on every ensure. RESULT: red, audited 2 times.
|
|
}
|
|
|
|
// Linux ufw: a rule only while ufw is on, with the bastion's comment; ufw is
|
|
// never turned on, off or reset; a rule of the machine's own for the port is
|
|
// neither doubled nor removed.
|
|
func TestTheUfwRuleIsAddedOnlyWhenUfwIsOnAndNeverTheMachinesOwn(t *testing.T) {
|
|
f, want := fwWorld(t, "linux", true)
|
|
// Off: nothing at all.
|
|
if said := doorFirewallEnsure(":8812"); said != "" || len(loadDoorFW().Rules) != 0 {
|
|
t.Fatalf("ufw off: %q %v", said, f.commands())
|
|
}
|
|
f.ufwOn = true
|
|
doorFirewallEnsure(":8812")
|
|
st := strings.Join(f.ufwRules, "\n")
|
|
if !strings.Contains(st, "8812/tcp") || !strings.Contains(st, "# "+doorFWComment) {
|
|
t.Fatalf("ufw rules: %s", st)
|
|
}
|
|
if s := readDoorFirewallStatus(); s == nil || len(s.Rules) != 1 || !strings.Contains(s.Rules[0], "ufw allows TCP 8812") {
|
|
t.Fatalf("status: %+v", s)
|
|
}
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if len(f.ufwRules) != 0 {
|
|
t.Fatalf("left: %v", f.ufwRules)
|
|
}
|
|
for _, c := range f.commands() {
|
|
for _, never := range []string{"ufw enable", "ufw disable", "ufw reset", "ufw default", "ufw reload"} {
|
|
if strings.HasPrefix(c, never) {
|
|
t.Fatalf("ran %q", c)
|
|
}
|
|
}
|
|
}
|
|
|
|
// The machine's own rule for the port.
|
|
g, want2 := fwWorld(t, "linux", true)
|
|
g.ufwOn = true
|
|
g.ufwRules = []string{"8812/tcp ALLOW Anywhere", "8812/tcp (v6) ALLOW Anywhere (v6)"}
|
|
said := doorFirewallEnsure(":8812")
|
|
if !strings.Contains(said, "already allowed") || len(g.ufwRules) != 2 {
|
|
t.Fatalf("said %q, rules %v", said, g.ufwRules)
|
|
}
|
|
*want2 = false
|
|
doorFirewallRelease(":8812")
|
|
if len(g.ufwRules) != 2 {
|
|
t.Fatalf("the machine's own rule was removed: %v", g.commands())
|
|
}
|
|
// MUTATION: ufwRuleFor counts any ALLOW as ours. RESULT: red, the machine's own rule was removed.
|
|
// MUTATION: detection ignores "Status: inactive". RESULT: red, ufw off.
|
|
}
|
|
|
|
// Linux firewalld: the port added now and permanently, and removed the same
|
|
// way; a port already open in it is the machine's own.
|
|
func TestTheFirewalldPortIsAddedAndRemovedNowAndPermanently(t *testing.T) {
|
|
f, want := fwWorld(t, "linux", true)
|
|
f.fwdOn = true
|
|
doorFirewallEnsure(":8812")
|
|
if !f.fwdNow["8812/tcp"] || !f.fwdPerm["8812/tcp"] {
|
|
t.Fatalf("firewalld: %v %v", f.fwdNow, f.fwdPerm)
|
|
}
|
|
doorFirewallEnsure(":8812")
|
|
if n := strings.Count(strings.Join(f.commands(), "\n"), "--add-port"); n != 2 {
|
|
t.Fatalf("%d adds: %v", n, f.commands())
|
|
}
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if f.fwdNow["8812/tcp"] || f.fwdPerm["8812/tcp"] {
|
|
t.Fatalf("left: %v %v", f.fwdNow, f.fwdPerm)
|
|
}
|
|
|
|
g, want2 := fwWorld(t, "linux", true)
|
|
g.fwdOn = true
|
|
g.fwdNow["8812/tcp"], g.fwdPerm["8812/tcp"] = true, true
|
|
doorFirewallEnsure(":8812")
|
|
*want2 = false
|
|
doorFirewallRelease(":8812")
|
|
if !g.fwdNow["8812/tcp"] || !g.fwdPerm["8812/tcp"] {
|
|
t.Fatal("the machine's own open port was closed")
|
|
}
|
|
// MUTATION: remove only the runtime port. RESULT: red, left permanently.
|
|
// MUTATION: has() reports a port it did not add as ours. RESULT: red, the machine's own port closed.
|
|
}
|
|
|
|
// Linux: a firewall the bastion does not manage (nftables, iptables), or ufw
|
|
// it may not change, is said once, with what to allow, in status and doctor,
|
|
// and nothing in it is changed.
|
|
func TestAFirewallTheBastionDoesNotManageIsSaidOnceAndLeftAlone(t *testing.T) {
|
|
f, want := fwWorld(t, "linux", true)
|
|
f.nftRuleset = "table inet filter {\n\tchain input {\n\t\ttype filter hook input priority filter; policy drop;\n\t}\n}\n"
|
|
said := doorFirewallEnsure(":8812")
|
|
doorFirewallEnsure(":8812")
|
|
if !strings.Contains(said, "nftables") || !strings.Contains(said, "tcp dport 8812 accept") {
|
|
t.Fatalf("said %q", said)
|
|
}
|
|
if n := countOp(t, "door_firewall_unmanaged"); n != 1 {
|
|
t.Fatalf("said %d times", n)
|
|
}
|
|
for _, c := range f.commands() {
|
|
if strings.HasPrefix(c, "nft ") && c != "nft list ruleset" {
|
|
t.Fatalf("ran %q", c)
|
|
}
|
|
}
|
|
s := readDoorFirewallStatus()
|
|
if s == nil || len(s.Needs) != 1 || !strings.Contains(s.Needs[0], "nftables") {
|
|
t.Fatalf("status: %+v", s)
|
|
}
|
|
if cs := doorFirewallChecks(s); len(cs) != 1 || cs[0].OK {
|
|
t.Fatalf("doctor: %+v", cs)
|
|
}
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if s := readDoorFirewallStatus(); s != nil {
|
|
t.Fatalf("still said with no door: %+v", s)
|
|
}
|
|
|
|
// iptables, and an account that may not change ufw.
|
|
g, _ := fwWorld(t, "linux", true)
|
|
g.ipts = "-P INPUT DROP\n"
|
|
if said := doorFirewallEnsure(":8812"); !strings.Contains(said, "iptables -I INPUT -p tcp --dport 8812 -j ACCEPT") {
|
|
t.Fatalf("iptables: %q", said)
|
|
}
|
|
h, _ := fwWorld(t, "linux", false)
|
|
doorFWReadFile = func(string) ([]byte, error) { return []byte("ENABLED=yes\n"), nil }
|
|
if said := doorFirewallEnsure(":8812"); !strings.Contains(said, "sudo ufw allow 8812/tcp") {
|
|
t.Fatalf("not root: %q", said)
|
|
}
|
|
for _, c := range h.commands() {
|
|
if strings.HasPrefix(c, "ufw ") {
|
|
t.Fatalf("an account that may not change ufw ran %q", c)
|
|
}
|
|
}
|
|
// MUTATION: nftFiltersInput always false. RESULT: red, said "".
|
|
// MUTATION: the note is not cleared at release. RESULT: red, still said with no door.
|
|
}
|
|
|
|
// macOS: with the application firewall on, this program is allowed; with it
|
|
// off nothing is done; "block all incoming" is only said.
|
|
func TestTheMacFirewallAllowsTheProgramOnlyWhenItIsOn(t *testing.T) {
|
|
f, want := fwWorld(t, "darwin", true)
|
|
doorFirewallEnsure(":8812")
|
|
if len(f.macApps) != 0 {
|
|
t.Fatal("added with the firewall off")
|
|
}
|
|
f.macOn = true
|
|
doorFirewallEnsure(":8812")
|
|
prog, _ := doorFWProgram()
|
|
if allowed, ok := f.macApps[prog]; !ok || !allowed {
|
|
t.Fatalf("apps: %v", f.macApps)
|
|
}
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if len(f.macApps) != 0 {
|
|
t.Fatalf("left: %v", f.macApps)
|
|
}
|
|
g, _ := fwWorld(t, "darwin", true)
|
|
g.macOn, g.macAllIn = true, true
|
|
if said := doorFirewallEnsure(":8812"); !strings.Contains(said, "blocks all incoming") || len(g.macApps) != 0 {
|
|
t.Fatalf("block all: %q %v", said, g.macApps)
|
|
}
|
|
// MUTATION: --unblockapp not run. RESULT: red, apps not allowed.
|
|
}
|
|
|
|
// uninstall removes every rule the bastion added, whatever uses the door.
|
|
func TestUninstallRemovesTheDoorsOwnRules(t *testing.T) {
|
|
f, _ := fwWorld(t, "windows", false)
|
|
doorFirewallEnsure(":8812")
|
|
doorFirewallEnsure(":9443")
|
|
said, err := doorFirewallRemoveAll()
|
|
if err != nil || len(said) != 2 || len(f.win) != 0 {
|
|
t.Fatalf("uninstall: %v %v, left %v", said, err, f.win)
|
|
}
|
|
if len(loadDoorFW().Rules) != 0 {
|
|
t.Fatal("the record outlived the rules")
|
|
}
|
|
// MUTATION: RemoveAll skips the removal. RESULT: red, rules left.
|
|
}
|
|
|
|
// A rule left behind (a `pair --open` killed before its release, a pairing
|
|
// that went while nothing ran) is removed by the daemon's sweep once nothing
|
|
// uses its port, and kept while something does.
|
|
func TestTheDaemonsSweepRemovesARuleNothingUses(t *testing.T) {
|
|
f, want := fwWorld(t, "windows", false)
|
|
doorFirewallEnsure(":8812")
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
done := make(chan struct{})
|
|
go func() { doorFirewallSweep(ctx); close(done) }()
|
|
cancel()
|
|
<-done
|
|
if _, ok := f.win[doorFWRuleName("8812")]; !ok {
|
|
t.Fatal("the sweep removed a rule in use")
|
|
}
|
|
*want = false
|
|
doorFirewallReleaseUnused()
|
|
if _, ok := f.win[doorFWRuleName("8812")]; ok {
|
|
t.Fatal("the sweep left a rule nothing uses")
|
|
}
|
|
// MUTATION: doorFirewallReleaseUnused skips recorded rules. RESULT: red, the sweep left a rule.
|
|
}
|
|
|
|
// ufw deletes by rule, whatever its comment: a rule the bastion recorded and
|
|
// the person later replaced with their own, or a record that names a port the
|
|
// bastion never opened, is the machine's, and is never removed.
|
|
func TestUfwNeverRemovesARuleThatIsNotItsOwnWhateverTheRecordSays(t *testing.T) {
|
|
f, want := fwWorld(t, "linux", true)
|
|
f.ufwOn = true
|
|
doorFirewallEnsure(":8812")
|
|
// The person deletes the bastion's rule and puts their own in its place.
|
|
f.ufwRules = []string{"8812/tcp ALLOW Anywhere", "8812/tcp (v6) ALLOW Anywhere (v6)"}
|
|
doorFirewallEnsure(":8812")
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if len(f.ufwRules) != 2 {
|
|
t.Fatalf("the person's own rule was removed: %v", f.commands())
|
|
}
|
|
|
|
// A record naming a port the bastion never opened (written by hand, or
|
|
// left from another time): the sweep leaves the machine's rule there.
|
|
g, want2 := fwWorld(t, "linux", true)
|
|
g.ufwOn = true
|
|
g.ufwRules = []string{"22/tcp ALLOW Anywhere"}
|
|
if err := saveDoorFW(doorFWState{Rules: []doorFWRule{{Firewall: "ufw", Port: "22", Added: "2026-01-01T00:00:00Z"}}}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
*want2 = false
|
|
doorFirewallReleaseUnused()
|
|
for _, c := range g.commands() {
|
|
if strings.HasPrefix(c, "ufw delete") {
|
|
t.Fatalf("ran %q on a rule that is not the bastion's", c)
|
|
}
|
|
}
|
|
if len(g.ufwRules) != 1 || len(loadDoorFW().Rules) != 0 {
|
|
t.Fatalf("rules %v, record %+v", g.ufwRules, loadDoorFW().Rules)
|
|
}
|
|
// MUTATION: ufw remove deletes without reading the comment. RESULT: red, the person's own rule was removed.
|
|
}
|
|
|
|
// Only a rule that lets a Host in from anywhere counts as the machine's own
|
|
// allow: an outbound rule, or one for one source or interface, does not, so
|
|
// the bastion adds its own rather than saying the port is already allowed.
|
|
func TestUfwAnOutboundOrOneSourceRuleIsNotTheWayIn(t *testing.T) {
|
|
for _, r := range []string{
|
|
"8812/tcp ALLOW OUT Anywhere",
|
|
"8812/tcp ALLOW 10.0.0.0/8",
|
|
"8812/tcp on eth1 ALLOW Anywhere",
|
|
"8812/tcp DENY Anywhere",
|
|
} {
|
|
f, _ := fwWorld(t, "linux", true)
|
|
f.ufwOn = true
|
|
f.ufwRules = []string{r}
|
|
said := doorFirewallEnsure(":8812")
|
|
if !strings.Contains(said, "added its own rule in ufw") {
|
|
t.Fatalf("with %q: said %q", r, said)
|
|
}
|
|
}
|
|
for _, r := range []string{
|
|
"8812/tcp ALLOW Anywhere",
|
|
"8812/tcp ALLOW IN Anywhere",
|
|
"8812 (v6) ALLOW Anywhere (v6)",
|
|
} {
|
|
if _, other := ufwRuleFor(r, "8812"); !other {
|
|
t.Fatalf("%q lets a Host in from anywhere", r)
|
|
}
|
|
}
|
|
// MUTATION: any line with ALLOW counts. RESULT: red, said "already allowed".
|
|
}
|
|
|
|
// firewalld: a permanent add that fails takes the runtime port back out, so
|
|
// no open port is left that no record says is the bastion's.
|
|
func TestFirewalldAFailedPermanentAddLeavesNoPortOpen(t *testing.T) {
|
|
f, _ := fwWorld(t, "linux", true)
|
|
f.fwdOn = true
|
|
f.fail["permanent"] = true
|
|
said := doorFirewallEnsure(":8812")
|
|
if !strings.Contains(said, "could not add") {
|
|
t.Fatalf("said %q", said)
|
|
}
|
|
if f.fwdNow["8812/tcp"] {
|
|
t.Fatalf("the runtime port was left open with no record: %v", f.commands())
|
|
}
|
|
// Next time it is tried again, not taken for the machine's own.
|
|
f.fail["permanent"] = false
|
|
if said := doorFirewallEnsure(":8812"); !strings.Contains(said, "added its own rule") {
|
|
t.Fatalf("said %q", said)
|
|
}
|
|
// MUTATION: no undo of the runtime add. RESULT: red, the runtime port was left open.
|
|
}
|
|
|
|
// macOS: an --unblockapp that fails takes the --add back out, so no entry is
|
|
// left that would read as the machine's own and never go.
|
|
func TestTheMacAFailedUnblockLeavesNoEntry(t *testing.T) {
|
|
f, _ := fwWorld(t, "darwin", true)
|
|
f.macOn = true
|
|
f.fail["unblock"] = true
|
|
if said := doorFirewallEnsure(":8812"); !strings.Contains(said, "could not add") {
|
|
t.Fatalf("said %q", said)
|
|
}
|
|
if len(f.macApps) != 0 {
|
|
t.Fatalf("left an entry with no record: %v", f.macApps)
|
|
}
|
|
// MUTATION: no --remove after a failed --unblockapp. RESULT: red, left an entry.
|
|
}
|
|
|
|
// realDoorPortWanted is the door-in-use check fwWorld stands in.
|
|
var realDoorPortWanted = doorPortWanted
|
|
|
|
// sweepOnce runs the daemon's sweep's first pass.
|
|
func sweepOnce() {
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
cancel()
|
|
doorFirewallSweep(ctx)
|
|
}
|
|
|
|
// A door claims the window (its file is moved aside) before the pairing is
|
|
// saved: between the two, neither is there to read. The window is still in
|
|
// use then, so a sweep in that gap keeps the rule, and puts it back if it had
|
|
// gone; once the window has its result and no pairing uses the port, the
|
|
// rule goes.
|
|
func TestAWindowClaimedForAPairingStillBeingSavedKeepsTheRule(t *testing.T) {
|
|
f, _ := fwWorld(t, "windows", false)
|
|
doorPortWanted = realDoorPortWanted
|
|
code, err := newWindowCode()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
now := time.Now().UTC()
|
|
w := &pairWindow{ID: "w-claimed", Code: code, Door: ":8812", Opened: now.Format(time.RFC3339),
|
|
Expires: now.Add(windowLifetime).Format(time.RFC3339)}
|
|
if err := saveWindowFile(w); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
doorFirewallEnsure(":8812")
|
|
rule := doorFWRuleName("8812")
|
|
if _, ok := f.win[rule]; !ok {
|
|
t.Fatalf("no rule for the open window: %v", f.commands())
|
|
}
|
|
if !claimWindow(w.ID) {
|
|
t.Fatal("the window could not be claimed")
|
|
}
|
|
sweepOnce()
|
|
if _, ok := f.win[rule]; !ok {
|
|
t.Fatal("the sweep removed the rule while a pairing on the window was being saved")
|
|
}
|
|
// The rule gone in that gap (by hand, or a release that ran then): back.
|
|
delete(f.win, rule)
|
|
sweepOnce()
|
|
if _, ok := f.win[rule]; !ok {
|
|
t.Fatal("the sweep did not put back the rule of a window still in use")
|
|
}
|
|
endWindow(w.ID, windowResult{Error: "the Host refused"})
|
|
sweepOnce()
|
|
if _, ok := f.win[rule]; ok {
|
|
t.Fatal("the rule outlived the window")
|
|
}
|
|
// MUTATION: doorPortsInUse ignores a claimed window. RESULT: red, the sweep removed the rule while a pairing ... was being saved.
|
|
// MUTATION: claimedWindowUnderWay counts a window with its result. RESULT: red, the rule outlived the window.
|
|
}
|
|
|
|
// A rule that goes while its door is in use (removed by hand, the firewall
|
|
// reset) is put back by the daemon's sweep; a port a rule of the machine's
|
|
// own allows is still never given a second one; nothing in use, nothing added.
|
|
func TestTheSweepPutsBackARuleThatWentWhileTheDoorIsInUse(t *testing.T) {
|
|
f, want := fwWorld(t, "windows", false)
|
|
doorFirewallEnsure(":8812")
|
|
rule := doorFWRuleName("8812")
|
|
delete(f.win, rule) // removed by hand
|
|
sweepOnce()
|
|
if got, ok := f.win[rule]; !ok || !strings.Contains(got, "localport=8812") {
|
|
t.Fatalf("not put back: %v", f.commands())
|
|
}
|
|
if n := countOp(t, "door_firewall_opened"); n != 2 {
|
|
t.Fatalf("opened %d times:\n%s", n, fwAudit(t))
|
|
}
|
|
*want = false
|
|
sweepOnce()
|
|
if _, ok := f.win[rule]; ok {
|
|
t.Fatal("a rule nothing uses was kept")
|
|
}
|
|
sweepOnce()
|
|
if _, ok := f.win[rule]; ok {
|
|
t.Fatal("the sweep added a rule nothing uses")
|
|
}
|
|
|
|
// ufw: the bastion's rule deleted while the door is in use, back with its comment.
|
|
g, _ := fwWorld(t, "linux", true)
|
|
g.ufwOn = true
|
|
doorFirewallEnsure(":8812")
|
|
g.ufwRules = nil
|
|
sweepOnce()
|
|
if st := strings.Join(g.ufwRules, "\n"); !strings.Contains(st, "8812/tcp") || !strings.Contains(st, "# "+doorFWComment) {
|
|
t.Fatalf("ufw not put back: %v", g.commands())
|
|
}
|
|
|
|
// ufw: the machine's own rule allows the port: never a second one.
|
|
h, _ := fwWorld(t, "linux", true)
|
|
h.ufwOn = true
|
|
h.ufwRules = []string{"8812/tcp ALLOW Anywhere"}
|
|
doorFirewallEnsure(":8812")
|
|
sweepOnce()
|
|
sweepOnce()
|
|
for _, c := range h.commands() {
|
|
if strings.HasPrefix(c, "ufw allow") {
|
|
t.Fatalf("ran %q with the machine's own rule there", c)
|
|
}
|
|
}
|
|
// MUTATION: the sweep only releases. RESULT: red, not put back (and in
|
|
// TestAWindowClaimedForAPairingStillBeingSavedKeepsTheRule).
|
|
}
|
|
|
|
// macOS: an entry is for one program path; the bastion that moved removes the
|
|
// entry by the path it recorded, both when its door is released and when it
|
|
// makes the entry for its new path.
|
|
func TestTheMacEntryIsRemovedByThePathItWasAddedFor(t *testing.T) {
|
|
const a, b = "/usr/local/bin/privatae-bastion", "/opt/example/privatae-bastion"
|
|
f, want := fwWorld(t, "darwin", true)
|
|
f.macOn = true
|
|
doorFWProgram = func() (string, error) { return a, nil }
|
|
doorFirewallEnsure(":8812")
|
|
if !f.macApps[a] {
|
|
t.Fatalf("apps: %v", f.macApps)
|
|
}
|
|
doorFWProgram = func() (string, error) { return b, nil }
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if len(f.macApps) != 0 {
|
|
t.Fatalf("the moved bastion left its old path allowed: %v", f.macApps)
|
|
}
|
|
|
|
// Moved while the door is in use: the old path's entry goes, the new one's is made.
|
|
g, _ := fwWorld(t, "darwin", true)
|
|
g.macOn = true
|
|
doorFWProgram = func() (string, error) { return a, nil }
|
|
doorFirewallEnsure(":8812")
|
|
doorFWProgram = func() (string, error) { return b, nil }
|
|
doorFirewallEnsure(":8812")
|
|
if _, ok := g.macApps[a]; ok || !g.macApps[b] {
|
|
t.Fatalf("apps: %v", g.macApps)
|
|
}
|
|
if st := loadDoorFW(); len(st.Rules) != 1 || st.Rules[0].Program != b {
|
|
t.Fatalf("the record: %+v", st.Rules)
|
|
}
|
|
// MUTATION: remove uses this program's path, not the record's. RESULT: red, the moved bastion left its old path allowed.
|
|
// MUTATION: the moved case removes this program's path. RESULT: red, apps: both paths.
|
|
}
|
|
|
|
// macOS: --listapps is read entry by entry, by the exact path, and only an
|
|
// "allow incoming" entry counts: a blocked entry is the person's setting and
|
|
// is said, not changed; a longer path (…/privatae-bastion.old) is not this
|
|
// program's.
|
|
func TestTheMacReadsEachEntryAndCountsOnlyAnAllow(t *testing.T) {
|
|
const prog = "/usr/local/bin/privatae-bastion"
|
|
f, _ := fwWorld(t, "darwin", true)
|
|
f.macOn = true
|
|
doorFWProgram = func() (string, error) { return prog, nil }
|
|
f.macApps[prog] = false // the person blocked it
|
|
said := doorFirewallEnsure(":8812")
|
|
if !strings.Contains(said, "block incoming connections for this program") {
|
|
t.Fatalf("said %q", said)
|
|
}
|
|
for _, c := range f.commands() {
|
|
if strings.Contains(c, "--unblockapp") || strings.Contains(c, "--add") || strings.Contains(c, "--remove") {
|
|
t.Fatalf("changed the person's setting: %q", c)
|
|
}
|
|
}
|
|
if s := readDoorFirewallStatus(); s == nil || len(s.Needs) != 1 {
|
|
t.Fatalf("status: %+v", s)
|
|
}
|
|
|
|
g, _ := fwWorld(t, "darwin", true)
|
|
g.macOn = true
|
|
doorFWProgram = func() (string, error) { return prog, nil }
|
|
g.macApps[prog+".old"] = true
|
|
if said := doorFirewallEnsure(":8812"); !strings.Contains(said, "added its own rule") || !g.macApps[prog] {
|
|
t.Fatalf("a longer path counted as this program: said %q, apps %v", said, g.macApps)
|
|
}
|
|
|
|
// Its own entry, later set to block by the person: left as it is at release.
|
|
h, want := fwWorld(t, "darwin", true)
|
|
h.macOn = true
|
|
doorFWProgram = func() (string, error) { return prog, nil }
|
|
doorFirewallEnsure(":8812")
|
|
h.macApps[prog] = false
|
|
*want = false
|
|
doorFirewallRelease(":8812")
|
|
if allowed, ok := h.macApps[prog]; !ok || allowed {
|
|
t.Fatalf("the person's block was removed: %v", h.macApps)
|
|
}
|
|
// MUTATION: has() counts a listed program whatever its state. RESULT: red, said "already allowed".
|
|
// MUTATION: the path is matched as a prefix. RESULT: red, a longer path counted as this program.
|
|
// MUTATION: remove runs --remove on a blocked entry. RESULT: red, the person's block was removed.
|
|
}
|