mirror of
https://github.com/XTLS/Xray-core.git
synced 2026-11-03 08:57:00 +00:00
patternihaandClaude Opus 5.5
c684201cd8
"ipv4:" or "ipv6:" in front of any value limits it to that IP version, e.g. "ipv4:udp/53", "ipv6:all", "ipv4:dns" or "ipv6:misconfigtun". "tcpv4", "udpv6", "icmpv4" and the like are gone. Values that only differ in the IP version become one: "ipv4:udp/53" with "ipv6:udp/53" is "udp/53". "all" overrides "allexceptlan" per IP version, and "all" over one IP version needs dns, as port 53 over one does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
104 lines
4.8 KiB
Go
104 lines
4.8 KiB
Go
package tun
|
|
|
|
import (
|
|
"slices"
|
|
"testing"
|
|
)
|
|
|
|
func TestExpandWfpBlockLeak(t *testing.T) {
|
|
for _, c := range []struct {
|
|
values []string
|
|
leaks []string
|
|
systemDNS bool
|
|
}{
|
|
{nil, nil, false},
|
|
{[]string{"dns"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}, true},
|
|
{[]string{"DNS", "MisconfigTUN"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853", "misconfigtun"}, true},
|
|
{[]string{"tcp/853", "dns", "TCP/0853"}, []string{"tcp/853", "udp/53", "tcp/53", "windnsclient", "udp/853"}, true},
|
|
{[]string{"tcp/853", "udp/853", "misconfigtun"}, []string{"tcp/853", "udp/853", "misconfigtun"}, false},
|
|
{[]string{"udp/65535", "tcp/1"}, []string{"udp/65535", "tcp/1"}, false},
|
|
{[]string{"tcp/53"}, []string{"tcp/53"}, true},
|
|
{[]string{"windnsclient"}, []string{"windnsclient"}, true},
|
|
{[]string{"ALL"}, []string{"all"}, true},
|
|
{[]string{"tcp", "TCP", "UDP"}, []string{"tcp", "udp"}, true},
|
|
{[]string{"tcp/1-65535", "udp/1-65535"}, []string{"tcp", "udp"}, true},
|
|
{[]string{"udp/10-20", "udp/53-53", "tcp/50-60"}, []string{"udp/10-20", "udp/53", "tcp/50-60"}, true},
|
|
{[]string{"tcp/54-60", "udp/1-52"}, []string{"tcp/54-60", "udp/1-52"}, false},
|
|
{[]string{"ICMP", "icmp"}, []string{"icmp"}, false},
|
|
{[]string{"AllExceptLAN"}, []string{"allexceptlan", "udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}, true},
|
|
{[]string{"dns", "allexceptlan", "all"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853", "allexceptlan", "all"}, true},
|
|
// For one IP version only.
|
|
{[]string{"IPv4:TCP/853", "ipv6:udp/10-20", "IPV4:icmp"}, []string{"ipv4:tcp/853", "ipv6:udp/10-20", "ipv4:icmp"}, false},
|
|
{[]string{"ipv4:udp/53"}, []string{"ipv4:udp/53"}, true},
|
|
{[]string{"ipv6:tcp/53-53"}, []string{"ipv6:tcp/53"}, true},
|
|
{[]string{"ipv4:dns"}, []string{"ipv4:udp/53", "ipv4:tcp/53", "ipv4:windnsclient", "ipv4:tcp/853", "ipv4:udp/853"}, true},
|
|
{[]string{"ipv6:all"}, []string{"ipv6:all"}, true},
|
|
{[]string{"ipv4:windnsclient"}, []string{"ipv4:windnsclient"}, true},
|
|
{[]string{"ipv6:misconfigtun"}, []string{"ipv6:misconfigtun"}, false},
|
|
{[]string{"ipv4:allexceptlan", "ipv6:all"}, []string{"ipv4:allexceptlan", "ipv4:udp/53", "ipv4:tcp/53", "ipv4:windnsclient", "ipv4:tcp/853", "ipv4:udp/853", "ipv6:all"}, true},
|
|
// Values that only differ in the IP versions become one.
|
|
{[]string{"ipv4:udp/53", "tcp", "ipv6:udp/53"}, []string{"udp/53", "tcp"}, true},
|
|
{[]string{"ipv6:tcp/1-65535", "ipv4:tcp"}, []string{"tcp"}, true},
|
|
{[]string{"ipv4:icmp", "icmp"}, []string{"icmp"}, false},
|
|
{[]string{"ipv4:tcp/853", "ipv6:tcp/853-853", "ipv6:tcp/854"}, []string{"tcp/853", "ipv6:tcp/854"}, false},
|
|
{[]string{"dns", "ipv4:dns"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}, true},
|
|
{[]string{"ipv4:dns", "ipv6:udp/53"}, []string{"udp/53", "ipv4:tcp/53", "ipv4:windnsclient", "ipv4:tcp/853", "ipv4:udp/853"}, true},
|
|
{[]string{"ipv4:misconfigtun", "ipv6:misconfigtun", "ipv6:all", "ipv4:all"}, []string{"misconfigtun", "all"}, true},
|
|
} {
|
|
leaks, err := ExpandWfpBlockLeak(c.values)
|
|
if err != nil {
|
|
t.Errorf("%v: %v", c.values, err)
|
|
continue
|
|
}
|
|
if !slices.Equal(leaks, c.leaks) {
|
|
t.Errorf("%v: got %v, want %v", c.values, leaks, c.leaks)
|
|
}
|
|
if got := BlocksSystemDNS(leaks); got != c.systemDNS {
|
|
t.Errorf("%v: BlocksSystemDNS() = %v", c.values, got)
|
|
}
|
|
}
|
|
for _, value := range []string{
|
|
"", "ip", "tcp/", "udp/65536", "tcp/-1", "tcp/+53", "tcp/53/1", "udp/abc", "icmp/0", "icmp/8", "tcp:53", " dns",
|
|
"tcp/0-10", "tcp/20-10", "tcp/5-", "tcp/-5", "tcp/1-2-3", "tcp/1-65536", "udp/ 53", "all/0", "dns/53", "windnsclient/53",
|
|
"tcp/0", "udp/0", "tcp/00", "udp/0-0", "udp/65535-1",
|
|
"ipv4", "ipv6", "ipv4:", ":udp", "ipv5:udp", "ip:all", "v4:udp", "ipv4/udp", "ipv4 :udp", "ipv4: udp", "ipv4:ipv6:udp",
|
|
"ipv4:ipv4", "ipv4:tcp/0", "ipv6:icmp/8", "ipv4:dns/53", "ipv6:udp/20-10", "ipv4+ipv6:udp",
|
|
"tcpv4", "udpv6", "icmpv4", "tcpv4/853", "tcp4", "udp6", "dnsv4", "allv6",
|
|
} {
|
|
if _, err := ExpandWfpBlockLeak([]string{value}); err == nil {
|
|
t.Errorf("%q was accepted", value)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLeakCovers(t *testing.T) {
|
|
for _, c := range []struct {
|
|
value string
|
|
protocol string
|
|
port uint16
|
|
covers bool
|
|
}{
|
|
{"tcp", "tcp", 1, true},
|
|
{"tcp", "udp", 53, false},
|
|
{"udp/53", "udp", 53, true},
|
|
{"udp/53", "udp", 54, false},
|
|
{"tcp/10-20", "tcp", 10, true},
|
|
{"tcp/10-20", "tcp", 20, true},
|
|
{"tcp/10-20", "tcp", 21, false},
|
|
{"tcp/10-20", "tcp", 9, false},
|
|
{"ipv4:udp/53", "udp", 53, true},
|
|
{"ipv6:tcp", "tcp", 443, true},
|
|
{"ipv4:icmp", "udp", 53, false},
|
|
{"all", "udp", 53, false},
|
|
} {
|
|
l, ok := parseLeak(c.value)
|
|
if !ok {
|
|
t.Errorf("%q was not parsed", c.value)
|
|
continue
|
|
}
|
|
if got := l.covers(c.protocol, c.port); got != c.covers {
|
|
t.Errorf("%q covers %s/%d = %v", c.value, c.protocol, c.port, got)
|
|
}
|
|
}
|
|
}
|