ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-wan-controller/oci_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/oracle/oci-go-sdk/v65/common"
+	"github.com/oracle/oci-go-sdk/v65/core"
+)
+
+type recordingNSGClient struct {
+	request core.UpdateNetworkSecurityGroupSecurityRulesRequest
+	calls   int
+	rules   []core.SecurityRule
+}
+
+func (c *recordingNSGClient) UpdateNetworkSecurityGroupSecurityRules(_ context.Context, request core.UpdateNetworkSecurityGroupSecurityRulesRequest) (core.UpdateNetworkSecurityGroupSecurityRulesResponse, error) {
+	c.request = request
+	c.calls++
+	return core.UpdateNetworkSecurityGroupSecurityRulesResponse{
+		UpdatedNetworkSecurityGroupSecurityRules: core.UpdatedNetworkSecurityGroupSecurityRules{SecurityRules: c.rules},
+	}, nil
+}
+
+func returnedRule(id, source string, port int) core.SecurityRule {
+	return core.SecurityRule{
+		Direction:   core.SecurityRuleDirectionIngress,
+		Id:          common.String(id),
+		Protocol:    common.String("17"),
+		Source:      common.String(source),
+		SourceType:  core.SecurityRuleSourceTypeCidrBlock,
+		IsStateless: common.Bool(false),
+		UdpOptions:  &core.UdpOptions{DestinationPortRange: &core.PortRange{Min: common.Int(port), Max: common.Int(port)}},
+	}
+}
+
+func TestOCIReconcilerUpdatesOnlyConfiguredWireGuardRule(t *testing.T) {
+	client := &recordingNSGClient{rules: []core.SecurityRule{returnedRule("rule", "203.0.113.7/32", 51820)}}
+	probed := false
+	reconciler := &ociReconciler{
+		client: client, networkSecurityGroup: "nsg", securityRule: "rule", wireguardDestinationPort: 51820,
+		wireguardURL: "http://relay.test:19100/metrics", recoveryTimeout: time.Minute,
+		probeWireGuard: func(_ context.Context, address string, timeout time.Duration) error {
+			probed = address == "http://relay.test:19100/metrics" && timeout == time.Minute
+			return nil
+		},
+	}
+	if err := reconciler.Reconcile(context.Background(), net.ParseIP("203.0.113.7")); err != nil {
+		t.Fatal(err)
+	}
+	rules := client.request.SecurityRules
+	if len(rules) != 1 {
+		t.Fatalf("rule count = %d", len(rules))
+	}
+	rule := rules[0]
+	if *rule.Id != "rule" || *rule.Source != "203.0.113.7/32" || *rule.Protocol != "17" {
+		t.Fatalf("unexpected rule: %#v", rule)
+	}
+	if rule.UdpOptions == nil || *rule.UdpOptions.DestinationPortRange.Min != 51820 || *rule.UdpOptions.DestinationPortRange.Max != 51820 {
+		t.Fatalf("unexpected UDP options: %#v", rule.UdpOptions)
+	}
+	if !probed {
+		t.Fatal("WireGuard connectivity was not probed")
+	}
+}
+
+func TestOCIReconcilerRejectsUnexpectedUpdatedRule(t *testing.T) {
+	client := &recordingNSGClient{rules: []core.SecurityRule{returnedRule("other", "203.0.113.7/32", 51820)}}
+	reconciler := &ociReconciler{
+		client: client, networkSecurityGroup: "nsg", securityRule: "rule", wireguardDestinationPort: 51820,
+		probeWireGuard: func(context.Context, string, time.Duration) error { return nil },
+	}
+	if err := reconciler.Reconcile(context.Background(), net.ParseIP("203.0.113.7")); err == nil {
+		t.Fatal("expected returned rule rejection")
+	}
+}
+
+func TestOCIReconcilerRejectsPrivateSource(t *testing.T) {
+	reconciler := &ociReconciler{client: &recordingNSGClient{}, networkSecurityGroup: "nsg", securityRule: "rule", wireguardDestinationPort: 51820}
+	if err := reconciler.Reconcile(context.Background(), net.ParseIP("10.180.186.43")); err == nil {
+		t.Fatal("expected private source rejection")
+	}
+}