89 lines
2.6 KiB
Bash
89 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
|
|
script="ochenstarik-server-monitor-manager.sh"
|
|
temp_dir="$(mktemp -d)"
|
|
trap 'rm -rf -- "$temp_dir"' EXIT
|
|
|
|
helper="$temp_dir/ochenstarik-smm-hub"
|
|
awk '
|
|
capture && /^EOF$/ { exit }
|
|
/cat > .*HUB_HELPER.*<</ { capture=1; next }
|
|
capture { print }
|
|
' "$script" > "$helper"
|
|
chmod 700 "$helper"
|
|
|
|
state="$temp_dir/state"
|
|
mock_bin="$temp_dir/bin"
|
|
nft_capture="$temp_dir/nft.conf"
|
|
mkdir -p "$state/nodes" "$state/tokens" "$mock_bin"
|
|
sed -i "s|^readonly STATE_DIR=.*|readonly STATE_DIR=\"$state\"|" "$helper"
|
|
sed -i "s|^readonly WG_CONFIG=.*|readonly WG_CONFIG=\"$temp_dir/smm0.conf\"|" "$helper"
|
|
sed -i 's/^require_root() .*/require_root() { :; }/' "$helper"
|
|
sed -i 's/ -o root -g root//g' "$helper"
|
|
|
|
cat > "$mock_bin/nft" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
previous=''
|
|
for argument in "$@"; do
|
|
if [[ "$previous" == -f ]]; then
|
|
cp -- "$argument" "$NFT_CAPTURE"
|
|
fi
|
|
previous="$argument"
|
|
done
|
|
exit 0
|
|
EOF
|
|
chmod 700 "$mock_bin/nft"
|
|
|
|
cat > "$state/hub.conf" <<'EOF'
|
|
HUB_ENDPOINT=hub.example.test
|
|
WG_PORT=51820
|
|
HUB_ADDRESS=10.77.0.1
|
|
MESH_CIDR=10.77.0.0/24
|
|
EOF
|
|
printf 'test-hub-private-key\n' > "$state/hub.key"
|
|
cat > "$state/nodes/ai-agent.node" <<'EOF'
|
|
NAME=ai-agent
|
|
ADDRESS=10.77.0.2
|
|
PUBLIC_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
|
|
EOF
|
|
cat > "$state/nodes/home.node" <<'EOF'
|
|
NAME=home
|
|
ADDRESS=10.77.0.3
|
|
PUBLIC_KEY=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=
|
|
EOF
|
|
printf 'legacy-policy home\n' > "$state/links"
|
|
|
|
PATH="$mock_bin:$PATH" NFT_CAPTURE="$nft_capture" \
|
|
"$helper" link-connect ai-agent home tcp 2222 120
|
|
|
|
read -r source target cidr protocol port expires < "$state/links"
|
|
[[ "$source" == ai-agent ]]
|
|
[[ "$target" == home ]]
|
|
[[ "$cidr" == 10.77.0.3/32 ]]
|
|
[[ "$protocol" == tcp ]]
|
|
[[ "$port" == 2222 ]]
|
|
(( expires > $(date +%s) ))
|
|
grep -Fq 'ip saddr 10.77.0.2 ip daddr 10.77.0.3/32 tcp dport 2222 accept' "$nft_capture"
|
|
|
|
if PATH="$mock_bin:$PATH" NFT_CAPTURE="$nft_capture" \
|
|
"$helper" link-connect ai-agent home tcp 70000 120 >/dev/null 2>&1; then
|
|
echo 'Invalid port was accepted.' >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf 'ai-agent home 10.77.0.3/32 udp 53 1\n' >> "$state/links"
|
|
PATH="$mock_bin:$PATH" NFT_CAPTURE="$nft_capture" "$helper" firewall-restore
|
|
[[ "$(wc -l < "$state/links")" -eq 1 ]]
|
|
|
|
PATH="$mock_bin:$PATH" NFT_CAPTURE="$nft_capture" \
|
|
"$helper" link-disconnect ai-agent home tcp 2222
|
|
[[ ! -s "$state/links" ]]
|
|
if grep -Fq 'dport 2222 accept' "$nft_capture"; then
|
|
echo 'Disconnected policy remained in nftables.' >&2
|
|
exit 1
|
|
fi
|
|
|
|
grep -Fq 'OnUnitActiveSec=1min' "$script"
|
|
printf 'Server Monitor Manager Link policy checks passed.\n'
|