80 lines
2.8 KiB
Bash
80 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
case_name="${1:?test case is required}"
|
|
|
|
pass() {
|
|
printf '[PASS] %s\n' "$1"
|
|
}
|
|
|
|
no() {
|
|
printf '[NO] %s\n' "$1"
|
|
shift || true
|
|
if [ "$#" -gt 0 ]; then
|
|
printf 'reason: %s\n' "$*"
|
|
fi
|
|
exit 1
|
|
}
|
|
|
|
curl_check() {
|
|
local label="$1"
|
|
local url="$2"
|
|
shift 2
|
|
|
|
if curl --noproxy '*' "$@" -fsSIL --connect-timeout 10 --max-time 20 "${url}" >/tmp/curl.out 2>/tmp/curl.err; then
|
|
pass "${label}"
|
|
return 0
|
|
fi
|
|
|
|
printf '[NO] %s\n' "${label}"
|
|
printf 'reason: '
|
|
sed -n '1p' /tmp/curl.err || true
|
|
return 1
|
|
}
|
|
|
|
case "${case_name}" in
|
|
ipv6-default-off)
|
|
# PASS means an IPv6-only curl cannot complete when IPv6 is disabled by default.
|
|
if curl --noproxy '*' -6 -fsSIL --connect-timeout 5 --max-time 10 http://google.com >/tmp/curl.out 2>/tmp/curl.err; then
|
|
no "IPv6 request is blocked by default" "IPv6 request unexpectedly succeeded"
|
|
fi
|
|
pass "IPv6 request is blocked by default"
|
|
;;
|
|
ipv6-enabled)
|
|
# PASS means the container policy did not disable IPv6 via sysctl.
|
|
if [ -r /proc/sys/net/ipv6/conf/all/disable_ipv6 ]; then
|
|
value="$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6)"
|
|
[ "${value}" = "0" ] || no "IPv6 is allowed by container policy" "disable_ipv6=${value}"
|
|
fi
|
|
pass "IPv6 is allowed by container policy"
|
|
;;
|
|
proxy-on)
|
|
sleep 3
|
|
# PASS means the transparent proxy NAT chain exists and redirects TCP to Xray.
|
|
if ! iptables -t nat -S XRAY_OUTPUT >/tmp/iptables.out 2>/tmp/iptables.err; then
|
|
no "transparent proxy iptables chain exists" "$(sed -n '1p' /tmp/iptables.err)"
|
|
fi
|
|
if ! grep -q -- "--to-ports ${XRAY_REDIRECT_PORT:-12345}" /tmp/iptables.out; then
|
|
no "transparent proxy redirect rule exists" "XRAY_OUTPUT has no REDIRECT to ${XRAY_REDIRECT_PORT:-12345}"
|
|
fi
|
|
pass "transparent proxy redirect rule exists"
|
|
# PASS means curl reaches Google while transparent proxy rules are active.
|
|
curl_check "HTTP request through transparent proxy" "http://google.com" || exit 1
|
|
;;
|
|
proxy-off)
|
|
# PASS means no Xray process exists when XRAY_ENABLED=0.
|
|
if pgrep -x xray >/dev/null 2>&1; then
|
|
no "xray is not running" "xray process exists"
|
|
fi
|
|
pass "xray is not running"
|
|
# PASS means direct curl cannot reach Google when Xray is disabled.
|
|
if curl --noproxy '*' -fsSIL --connect-timeout 3 --max-time 3 http://google.com >/tmp/curl.out 2>/tmp/curl.err; then
|
|
no "HTTP request without xray is blocked" "direct request unexpectedly succeeded"
|
|
fi
|
|
pass "HTTP request without xray is blocked"
|
|
;;
|
|
*)
|
|
no "known test case" "unknown test case: ${case_name}"
|
|
;;
|
|
esac
|