Core packages: config validation, network renderers, root helper, auth, SQLite store, capture engine

Capture engine streams dumpcap pcapng into verbatim, hashed segments with
per-segment tshark summaries; display filters, PDML dissection with verified
byte ranges, export and import. Tests run in a Debian trixie container.

internal/netgen/netgen_test.go

@@ -0,0 +1,90 @@
+package netgen
+
+import (
+	"strings"
+	"testing"
+
+	"pilens.dev/pilens/internal/config"
+)
+
+func testNet() config.Network {
+	n := config.DefaultNetwork()
+	n.Management.Interfaces = []string{"eth0"}
+	n.Management.AllowedSubnets = []string{"10.1.0.0/24"}
+	n.Uplink = "eth0"
+	n.AP.Interface = "wlan0"
+	n.AP.Passphrase = `pass\word 123`
+	n.LAN.Reservations = []config.Reservation{{MAC: "AA:BB:CC:00:11:22", IP: "192.168.50.20", Hostname: "phone"}}
+	n.LAN.DNSOverrides = []config.DNSOverride{{Name: "Api.Test.Local", IP: "192.168.50.1"}}
+	return n
+}
+
+func TestValidate(t *testing.T) {
+	n := testNet()
+	if err := n.Validate(true); err != nil {
+		t.Fatal(err)
+	}
+	bad := []func(*config.Network){
+		func(n *config.Network) { n.AP.Interface = "eth0" },
+		func(n *config.Network) { n.AP.SSID = "a;b" },
+		func(n *config.Network) { n.AP.SSID = "bad\nname" },
+		func(n *config.Network) { n.AP.Passphrase = "short" },
+		func(n *config.Network) { n.AP.Channel = 36 },
+		func(n *config.Network) { n.LAN.DHCPStart = "192.168.50.1" },
+		func(n *config.Network) { n.LAN.DHCPEnd = "192.168.51.10" },
+		func(n *config.Network) { n.Management.AllowedSubnets = []string{"192.168.50.0/25"} },
+		func(n *config.Network) { n.LAN.DNSOverrides[0].Name = "x\nserver=1.2.3.4" },
+		func(n *config.Network) { n.Uplink = "eth0; rm -rf" },
+		func(n *config.Network) { n.Forwarding.Mode = "open" },
+		func(n *config.Network) { n.LAN.Address = "192.168.50.0/24" },
+	}
+	for i, f := range bad {
+		c := testNet()
+		f(&c)
+		if c.Validate(true) == nil {
+			t.Errorf("case %d: expected validation error", i)
+		}
+	}
+}
+
+func TestKeyfile(t *testing.T) {
+	k := NMKeyfile(testNet())
+	for _, want := range []string{"mode=ap", "interface-name=wlan0", `psk=pass\\word 123`, "key-mgmt=wpa-psk", "method=disabled", "address1=192.168.50.1/24", "ssid=PiLens-Lab"} {
+		if !strings.Contains(k, want) {
+			t.Errorf("keyfile missing %q", want)
+		}
+	}
+}
+
+func TestDnsmasq(t *testing.T) {
+	d := DnsmasqConf(testNet())
+	for _, want := range []string{"interface=wlan0", "dhcp-range=192.168.50.100,192.168.50.199,255.255.255.0,720m", "dhcp-host=aa:bb:cc:00:11:22,192.168.50.20,phone", "host-record=api.test.local,192.168.50.1", "option:router,192.168.50.1"} {
+		if !strings.Contains(d, want) {
+			t.Errorf("dnsmasq missing %q\n%s", want, d)
+		}
+	}
+}
+
+func TestNftables(t *testing.T) {
+	s := Nftables(testNet())
+	for _, want := range []string{
+		"delete table inet pilens",
+		`iifname "wlan0" jump ap_forward`,
+		"meta nfproto ipv6 counter drop",
+		`ip saddr 192.168.50.0/24 oifname "eth0" masquerade`,
+		"10.1.0.0/24",
+		`tcp dport 8443 counter drop`,
+	} {
+		if !strings.Contains(s, want) {
+			t.Errorf("ruleset missing %q", want)
+		}
+	}
+	if strings.Contains(s, "flush ruleset") {
+		t.Error("must never flush the whole ruleset")
+	}
+	n := testNet()
+	n.Forwarding.Mode = "deny"
+	if !strings.Contains(Nftables(n), `"forwarding disabled"`) {
+		t.Error("deny mode must drop forwarded traffic")
+	}
+}