sasa/wireguard-scripts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: production wg dump compatibility defect

Browse Source
This commit is contained in:
sasa
2026-10-15 22:45:48 +03:00
parent a4f530d7a5
commit b0cfad98fd
4 changed files with 35 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLANS.md
+1 -1
View File
@@ -259,7 +259,7 @@ These decisions are fixed for the MVP unless the user explicitly changes them:
Allowed status values: `NOT STARTED`, `IN PROGRESS`, `BLOCKED`, `DONE`.
| Milestone | Status | Outcome |
| --------- | ----------- | ---------------------------------------------------- |
| --------- | ------ | ---------------------------------------------------- |
| M0 | DONE | Test harness and safe project skeleton |
| M1 | DONE | Runtime foundation, CLI shell, and config loading |
| M2 | DONE | WireGuard parser, client model, `status`, and `list` |
tests/fixtures/m2/runtime.dump
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= 51820 0
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB= (none) vpn.example.invalid:51820 192.0.2.2/32 1700000100 100 200 25
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB= (none) vpn.example.invalid:51820 192.0.2.2/32 1700000100 100 200 off
tests/run.sh
+13 -2
View File
@@ -1441,12 +1441,23 @@ run_m2_tests() {
assert_equal $'wg show wg0 dump\n' "$runtime_log" 'точный argv wg'
assert_equal '' "$(printf '%s' "$runtime_log" | grep -E 'systemctl|ip|gum' || true)" 'runtime без лишних команд'
begin_test 'runtime unavailable tokens normalize safely'
parse_runtime_dump $'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\tAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\t51820\t0\nBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=\t(none)\t(none)\t(none)\t0\t0\t0\t0'
parse_runtime_dump $'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\tAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\t51820\toff\nBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=\t(none)\t(none)\t(none)\t0\t0\t0\toff'
assert_equal - "${RUNTIME_ENDPOINT[BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=]}" 'endpoint none'
assert_equal - "${RUNTIME_ALLOWED[BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=]}" 'allowed none'
parse_runtime_dump $'(none)\t(none)\t51820\t0'
parse_runtime_dump $'(none)\t(none)\t51820\toff'
assert_equal 51820 "$RUNTIME_LISTEN_PORT" 'interface none tokens'
set +e
output=$(parse_runtime_dump $'(none)\t(none)\t51820\toff\nBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=\t(none)\t(none)\t(none)\t0\t0\t0\tdisabled' 2>&1)
status=$?
set -e
assert_equal "$EXIT_VALIDATION" "$status" 'runtime keepalive accepts off but rejects unknown tokens'
assert_contains 'Некорректные числа' "$output" 'runtime keepalive diagnostic'
set +e
output=$(parse_runtime_dump $'(none)\t(none)\t51820\toff\nBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=\t(none)\t(none)\t(none)\t0\t0\t0\t65536' 2>&1)
status=$?
set -e
assert_equal "$EXIT_VALIDATION" "$status" 'runtime keepalive rejects values above WireGuard range'
set +e
output=$(parse_runtime_dump $'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\tAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\t51820\t0\nBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=\t(none)\tvpn.example.invalid\t192.0.2.2/32\t0\t0\t0\t0' 2>&1)
status=$?
set -e
wg-manager.sh
+7 -1
View File
@@ -504,6 +504,12 @@ parse_metadata() {
for file in "$METADATA_DIR"/*; do [[ -e "$file" ]] || continue; parse_metadata_file "$file" || return $?; done
}
validate_dump_keepalive() {
local value=$1
[[ $value == off ]] && return 0
is_uint "$value" && (( 10#$value <= 65535 ))
}
parse_runtime_dump() {
local line fields_count line_number=0 key endpoint allowed handshake rx tx keepalive
local output=$1
@@ -525,7 +531,7 @@ parse_runtime_dump() {
[[ $endpoint == '-' || -z $endpoint ]] || validate_peer_endpoint_value "$endpoint" || { die "$EXIT_VALIDATION" 'Некорректный Endpoint в wg dump'; return $?; }
[[ -z ${RUNTIME_HANDSHAKE[$key]+x} ]] || { die "$EXIT_VALIDATION" 'Дублирующийся PublicKey в wg dump'; return $?; }
if [[ $allowed != '-' ]]; then normalize_allowed_ips "$allowed" >/dev/null || { die "$EXIT_VALIDATION" 'Некорректные AllowedIPs в wg dump'; return $?; }; fi
is_uint "$handshake" && is_uint "$rx" && is_uint "$tx" && is_uint "$keepalive" || { die "$EXIT_VALIDATION" 'Некорректные числа в wg dump'; return $?; }
is_uint "$handshake" && is_uint "$rx" && is_uint "$tx" && validate_dump_keepalive "$keepalive" || { die "$EXIT_VALIDATION" 'Некорректные числа в wg dump'; return $?; }
RUNTIME_ENDPOINT["$key"]=${endpoint:--}; if [[ $allowed == '-' ]]; then RUNTIME_ALLOWED["$key"]='-'; else RUNTIME_ALLOWED["$key"]=$(normalize_allowed_ips "$allowed"); fi; RUNTIME_HANDSHAKE["$key"]=$handshake; RUNTIME_RX["$key"]=$rx; RUNTIME_TX["$key"]=$tx
done <<<"$output"
}