mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-14 01:19:09 +02:00
Maycon Santos
66a28fd666
Reaching an internal service meant installing the agent, which needs root for a TUN device. nblink runs the embedded client in netstack mode and forwards local HTTP listeners to upstreams inside the tunnel, so it works on managed machines and in rootless containers. Upstream names resolve in-process. Forwards bind loopback unless --allow-public-bind is given. The listener refuses rebound and cross-site browser requests and bounds stalled request bodies. It ships as release archives and a distroless image that runs under an arbitrary UID. An embedded client given no StatePath now keeps its state in memory rather than falling back to the installed agent's state file, which every embedded client in a proxy process also shared. The state manager gets an explicit in-memory store for it.
81 lines
2.8 KiB
Go
81 lines
2.8 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/netbirdio/netbird/version"
|
|
)
|
|
|
|
// TestMain clears the ambient NB_ environment before any test runs.
|
|
//
|
|
// Every flag reads an NB_-prefixed variable, so a developer who has nblink
|
|
// configured in their own shell would otherwise hand these commands a
|
|
// configuration the test never asked for: an inherited NB_FORWARD alone makes
|
|
// the missing-forward case resolve successfully and the test fail. Clearing
|
|
// here rather than in execute keeps t.Setenv working for the tests that do
|
|
// want a variable set.
|
|
func TestMain(m *testing.M) {
|
|
for _, entry := range os.Environ() {
|
|
name, _, _ := strings.Cut(entry, "=")
|
|
if strings.HasPrefix(name, "NB_") {
|
|
if err := os.Unsetenv(name); err != nil {
|
|
fmt.Fprintf(os.Stderr, "unset %s: %v\n", name, err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
}
|
|
os.Exit(m.Run())
|
|
}
|
|
|
|
func execute(t *testing.T, args ...string) (string, error) {
|
|
t.Helper()
|
|
cmd := rootCmd()
|
|
var out strings.Builder
|
|
cmd.SetOut(&out)
|
|
cmd.SetErr(&out)
|
|
cmd.SetArgs(args)
|
|
err := cmd.Execute()
|
|
return out.String(), err
|
|
}
|
|
|
|
// A forward spec that lost its --forward is the usual stray argument, and it
|
|
// must not start a forwarder with whatever else was configured.
|
|
func TestRejectsPositionalArguments(t *testing.T) {
|
|
_, err := execute(t, "--check", "--forward", "http://8080=https://grafana.internal", "http://9090=https://prometheus.internal")
|
|
require.Error(t, err, "a positional argument must be refused")
|
|
assert.Contains(t, err.Error(), "unknown command", "the error must point at the stray argument")
|
|
}
|
|
|
|
func TestRejectsInvalidEnvironmentValue(t *testing.T) {
|
|
t.Setenv("NB_ALLOW_PUBLIC_BIND", "maybe")
|
|
_, err := execute(t, "--check", "--forward", "http://8080=https://grafana.internal")
|
|
require.Error(t, err, "an unparseable environment value must stop the start")
|
|
assert.Contains(t, err.Error(), "NB_ALLOW_PUBLIC_BIND", "the error must name the variable")
|
|
}
|
|
|
|
func TestEnvironmentConfiguresAFullCheck(t *testing.T) {
|
|
t.Setenv("NB_FORWARD", "http://8080=https://grafana.internal,http://0.0.0.0:9090=https://prometheus.internal")
|
|
t.Setenv("NB_ALLOW_PUBLIC_BIND", "true")
|
|
t.Setenv("NB_CHECK", "true")
|
|
_, err := execute(t)
|
|
assert.NoError(t, err, "a complete environment configuration must pass the check without flags")
|
|
}
|
|
|
|
func TestRequiresAForward(t *testing.T) {
|
|
_, err := execute(t, "--check")
|
|
require.Error(t, err, "a run with no forward must be refused")
|
|
assert.Contains(t, err.Error(), "NB_FORWARD", "the error must name the environment variable too")
|
|
}
|
|
|
|
func TestPrintsVersion(t *testing.T) {
|
|
out, err := execute(t, "--version")
|
|
require.NoError(t, err)
|
|
assert.Contains(t, out, version.NetbirdVersion(), "--version must print the build version")
|
|
}
|