143 lines
6.6 KiB
Swift
143 lines
6.6 KiB
Swift
import Foundation
|
|
import Testing
|
|
|
|
@testable import RunnerCore
|
|
|
|
/// Tests for ``LocalNetworkPolicy`` — the arithmetic behind the Local Network
|
|
/// subnet allowlist.
|
|
///
|
|
/// The bug these exist for: an allowlist entry that covers *today's* guest
|
|
/// subnet but not tomorrow's. vmnet picks its NAT subnet at runtime and steps
|
|
/// to the next free /24 when one is taken, so `192.168.64.0/24` works right up
|
|
/// until the day a second VM host appears on the machine — and then every guest
|
|
/// connection fails with "No route to host" with the allowlist still looking
|
|
/// perfectly configured.
|
|
@Suite("LocalNetworkPolicy")
|
|
struct LocalNetworkPolicyTests {
|
|
|
|
// MARK: - Coverage
|
|
|
|
@Test("an entry must cover the whole vmnet span, not just its first /24")
|
|
func coverageIsAllOrNothing() {
|
|
// The exact span, and anything wider.
|
|
#expect(LocalNetworkPolicy.coversVMNetRange("192.168.64.0/18"))
|
|
#expect(LocalNetworkPolicy.coversVMNetRange("192.168.0.0/16"))
|
|
#expect(LocalNetworkPolicy.coversVMNetRange("192.168.0.0/8"))
|
|
#expect(LocalNetworkPolicy.coversVMNetRange("0.0.0.0/0"))
|
|
|
|
// The trap: contains 192.168.64.x, but not 192.168.65.x.
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange("192.168.64.0/24"))
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange("192.168.64.0/19"))
|
|
|
|
// Adjacent but disjoint.
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange("192.168.128.0/18"))
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange("10.0.0.0/8"))
|
|
}
|
|
|
|
@Test("the RFC 1918 default covers the guest range")
|
|
func defaultSubnetsCoverGuests() {
|
|
#expect(LocalNetworkPolicy.defaultSubnets.contains(where: LocalNetworkPolicy.coversVMNetRange))
|
|
}
|
|
|
|
@Test("a prefix is required for coverage; a bare address is a /32")
|
|
func bareAddressIsASingleHost() {
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange("192.168.64.1"))
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange("192.168.64.1/32"))
|
|
}
|
|
|
|
@Test("host bits below the prefix do not change the block")
|
|
func hostBitsAreMaskedOff() {
|
|
// 192.168.70.5/18 and 192.168.64.0/18 are the same block.
|
|
#expect(LocalNetworkPolicy.coversVMNetRange("192.168.70.5/18"))
|
|
}
|
|
|
|
// MARK: - Rejecting what macOS would silently ignore
|
|
|
|
@Test("malformed, IPv6 and hostname entries are rejected, not crashed on")
|
|
func garbageIsRejected() {
|
|
for entry in [
|
|
"", "/", "/24", "192.168.64.0/", "192.168.64.0/33", "192.168.64.0/-1",
|
|
"192.168.64", "192.168.64.0.1", "192.168.256.0/18", "192.168.64.x/18",
|
|
"fd00::/8", "::/0", "localhost", "example.com/24", "192.168.64.0/18/24",
|
|
] {
|
|
#expect(!LocalNetworkPolicy.isValidSubnet(entry), "\(entry) should be rejected")
|
|
#expect(!LocalNetworkPolicy.coversVMNetRange(entry), "\(entry) should not cover")
|
|
}
|
|
}
|
|
|
|
@Test("well-formed entries validate")
|
|
func goodEntriesValidate() {
|
|
for entry in ["0.0.0.0/0", "10.0.0.0/8", "192.168.64.0/24", "192.168.64.1", "255.255.255.255/32"] {
|
|
#expect(LocalNetworkPolicy.isValidSubnet(entry), "\(entry) should validate")
|
|
}
|
|
}
|
|
|
|
@Test("ipv4Value packs octets most-significant first")
|
|
func addressPacking() {
|
|
#expect(LocalNetworkPolicy.ipv4Value("0.0.0.0") == 0)
|
|
#expect(LocalNetworkPolicy.ipv4Value("192.168.64.0") == 0xC0A8_4000)
|
|
#expect(LocalNetworkPolicy.ipv4Value("192.168.127.255") == 0xC0A8_7FFF)
|
|
#expect(LocalNetworkPolicy.ipv4Value("255.255.255.255") == 0xFFFF_FFFF)
|
|
#expect(LocalNetworkPolicy.ipv4Value("192.168.64") == nil)
|
|
#expect(LocalNetworkPolicy.ipv4Value("192.168.64.256") == nil)
|
|
}
|
|
|
|
// MARK: - What gets written
|
|
|
|
@Test("both interface keys are written, each with the subnets as separate arguments")
|
|
func writeArgumentsCoverBothKeys() {
|
|
let subnets = ["10.0.0.0/8", "192.168.0.0/16"]
|
|
let commands = LocalNetworkPolicy.writeArguments(subnets: subnets)
|
|
|
|
#expect(commands.count == 2)
|
|
#expect(commands[0] == ["write", LocalNetworkPolicy.domain, LocalNetworkPolicy.ethernetKey,
|
|
"-array", "10.0.0.0/8", "192.168.0.0/16"])
|
|
#expect(commands[1] == ["write", LocalNetworkPolicy.domain, LocalNetworkPolicy.wifiKey,
|
|
"-array", "10.0.0.0/8", "192.168.0.0/16"])
|
|
|
|
// Each subnet is its own argv element. Joined into one string, macOS
|
|
// would read the whole thing as a single unparseable entry and grant
|
|
// nothing — while `defaults read` still showed something plausible.
|
|
for command in commands {
|
|
#expect(!command.contains { $0.contains(" ") })
|
|
}
|
|
}
|
|
|
|
@Test("the shell rendering quotes anything a shell would reinterpret")
|
|
func shellRenderingIsSafe() {
|
|
let lines = LocalNetworkPolicy.writeCommandLines(subnets: ["10.0.0.0/8", "a b; rm -rf /"])
|
|
#expect(lines.count == 2)
|
|
for line in lines {
|
|
#expect(line.hasPrefix("sudo defaults write \(LocalNetworkPolicy.domain) "))
|
|
// Plain CIDR stays readable; the hostile entry gets quoted.
|
|
#expect(line.contains(" 10.0.0.0/8 "))
|
|
#expect(line.contains("'a b; rm -rf /'"))
|
|
}
|
|
}
|
|
|
|
// MARK: - Reading the host back
|
|
|
|
@Test("status reads the live host without throwing and stays self-consistent")
|
|
func statusIsSelfConsistent() {
|
|
// Cannot assert the host's actual configuration — this suite runs on
|
|
// developer machines and in CI guests alike. What must hold either way
|
|
// is that the derived flags agree with the entries.
|
|
let status = LocalNetworkPolicy.status()
|
|
#expect(status.isConfigured == !status.allowlist.isEmpty)
|
|
#expect(status.coversGuestRange == status.allowlist.contains(where: LocalNetworkPolicy.coversVMNetRange))
|
|
if status.allowlist.isEmpty { #expect(status.sourcePaths.isEmpty) }
|
|
#expect(Set(status.allowlist).count == status.allowlist.count, "entries should be deduplicated")
|
|
}
|
|
|
|
@Test("all three candidate preference paths are checked")
|
|
func candidatePathsCoverBothSudoOutcomes() {
|
|
let candidates = LocalNetworkPolicy.preferenceCandidates()
|
|
// `sudo defaults write` lands in root's preferences or the invoking
|
|
// user's depending on whether sudo preserved HOME, so both must be
|
|
// checked — plus the system-wide location.
|
|
#expect(candidates.contains("/var/root/Library/Preferences/\(LocalNetworkPolicy.domain).plist"))
|
|
#expect(candidates.contains("/Library/Preferences/\(LocalNetworkPolicy.domain).plist"))
|
|
#expect(candidates.contains(NSHomeDirectory() + "/Library/Preferences/\(LocalNetworkPolicy.domain).plist"))
|
|
}
|
|
}
|