Files
Easytier/easytier-web/frontend-lib/tests/remote-management-config.spec.ts
KKRainbow 62e4fd15e9 feat(vpn): multi-client WireGuard portal with attached peers (#2502)
* feat(peer): support protocol-agnostic attached peers

Add locally attached peers backed by independent, peer-level portable
managers and authenticated in-process ring connections. Carry trusted
connection provenance through packet admission so attached relay
privileges cannot be forged through packet headers.

Let every peer manager own ACL loading, sanitized policy updates, route
refresh, and runtime cleanup. In Secure Mode, grant attached identities
ephemeral credentials instead of sharing administrator and group secrets.

* feat(vpn): add reusable attached-peer portal runtime

Add a protocol-neutral portal runtime that converts authenticated client
sessions into attached EasyTier peers. Own per-client generations,
status, packet forwarding, address translation, and peer cleanup without
knowing the transport protocol.

Add transactional IPv4 source and destination rewriting with correct
IPv4, TCP, UDP, ICMP, and quoted-packet checksum updates. Keep the old
production portal path temporarily active until the WireGuard adapter is
migrated in the next change.

* feat(wireguard): attach named clients through peer portal

Replace the monolithic WireGuard portal with a native adapter that owns
key derivation, UDP demultiplexing, reauthentication, roaming, and
bounded per-client packet queues. Hand authenticated sessions to the
generic portal runtime for peer lifecycle and IPv4 translation.

Move portal configuration into the core instance model, require a
dedicated server key, and preserve existing listener, CLI, and runtime
configuration behavior. Reject runtime address conflicts before
publishing shared configuration.

* feat(vpn): expose per-client portal status

Project configured clients and their runtime state through the portal
RPC, including generated client configuration, listener, peer identity,
endpoint, tunnel address, ACL groups, and errors. Keep private client
configuration out of the broad instance-info response and expose the
explicit RPC through the CLI and Tauri bridge.

* feat(vpn): add portal configuration to web clients

Expose WireGuard portal listener, key, client, ACL group, and runtime
status fields in the shared frontend library, Web dashboard, and Tauri
client. Preserve UUID and uint64 values across protobuf JSON
boundaries, keep dynamic client editor rows stable, and document the
portal workflow.

* test(vpn): cover multi-client and roaming WireGuard portals

Add two three-node integration tests for the WireGuard VPN portal.

The multi-client test connects two kernel WireGuard clients from
separate network namespaces, verifies per-client connectivity to mesh
nodes, and exercises cross-client traffic that runs the IPv4 source
and destination translation in both directions. A TCP echo exchange
through the portal additionally covers the TCP pseudo-header checksum
rewrite path that ICMP-only ping tests miss, and portal status
snapshots must report both clients online with distinct peer ids and
correctly learned tunnel addresses.

The roaming test swaps the client namespace address (delete the old
address, then add the new one) so the kernel WireGuard source cache is
invalidated and the client keeps sending under the same session from
the new source, exactly like a real network change. The portal must
update the client endpoint on the same peer id via the data path
(same generation, no re-handshake, no detach/reconnect) while
connectivity to mesh nodes is preserved.

Supporting changes: run_wireguard_client now takes an interface name,
and the shared namespace topology gains net_f (10.1.2.5) on the portal
bridge for the second client.
2026-08-21 10:59:05 +08:00

229 lines
5.7 KiB
TypeScript

import { flushPromises, mount } from '@vue/test-utils'
import { describe, expect, it, vi } from 'vitest'
import { nextTick } from 'vue'
import RemoteManagement from '../src/components/RemoteManagement.vue'
import {
DEFAULT_NETWORK_CONFIG,
type NetworkConfig,
} from '../src/types/network'
const BOOLEAN_CONFIG_FIELDS = [
'dhcp',
'advanced_settings',
'latency_first',
'use_smoltcp',
'disable_ipv6',
'enable_kcp_proxy',
'disable_kcp_input',
'disable_p2p',
'bind_device',
'no_tun',
'enable_exit_node',
'relay_all_peer_rpc',
'multi_thread',
'enable_relay_network_whitelist',
'enable_manual_routes',
'proxy_forward_by_system',
'disable_encryption',
'enable_socks5',
'disable_udp_hole_punching',
'enable_magic_dns',
'enable_private_mode',
'enable_quic_proxy',
'disable_quic_input',
'disable_sym_hole_punching',
'p2p_only',
'lazy_p2p',
'need_p2p',
'disable_upnp',
'ipv6_public_addr_provider',
'ipv6_public_addr_auto',
'disable_relay_data',
'enable_udp_broadcast_relay',
'disable_tcp_hole_punching',
] as const satisfies readonly (keyof NetworkConfig)[]
vi.mock('vue-i18n', () => ({
useI18n: () => ({
t: (key: string) => key,
}),
}))
vi.mock('primevue', async () => {
const { defineComponent, h } = await import('vue')
const PassThrough = defineComponent({
name: 'PassThrough',
props: {
label: String,
value: String,
},
setup(props, { slots }) {
return () => h('div', {
'data-label': props.label,
'data-value': props.value,
'data-stub': 'pass-through',
}, slots.default?.())
},
})
const ButtonStub = defineComponent({
name: 'Button',
props: {
label: String,
icon: String,
disabled: Boolean,
},
emits: ['click'],
setup(props, { slots, emit }) {
return () => h('button', {
type: 'button',
disabled: props.disabled,
'data-label': props.label ?? props.icon,
onClick: (event: MouseEvent) => emit('click', event),
}, slots.default?.() ?? props.label ?? props.icon)
},
})
const SelectStub = defineComponent({
name: 'Select',
props: {
modelValue: Object,
options: Array,
},
emits: ['update:modelValue'],
setup(props, { slots }) {
return () => h('div', { 'data-stub': 'select' }, [
slots.value?.({ value: props.modelValue, placeholder: '' }),
])
},
})
const MenuStub = defineComponent({
name: 'Menu',
setup(_, { expose }) {
expose({ toggle: vi.fn() })
return () => h('div', { 'data-stub': 'menu' })
},
})
return {
Button: ButtonStub,
ConfirmPopup: PassThrough,
Divider: PassThrough,
IftaLabel: PassThrough,
Menu: MenuStub,
Message: PassThrough,
Select: SelectStub,
Tag: PassThrough,
useConfirm: () => ({ require: vi.fn() }),
useToast: () => ({ add: vi.fn() }),
}
})
const INSTANCE_ID = '00000000-0000-0000-0000-000000000001'
const INSTANCE_UUID = {
part1: 0,
part2: 0,
part3: 0,
part4: 1,
}
function makeFlagConfig(): NetworkConfig {
const config = {
...DEFAULT_NETWORK_CONFIG(),
instance_id: INSTANCE_ID,
network_name: 'mesh-save',
}
BOOLEAN_CONFIG_FIELDS.forEach((field, index) => {
config[field] = index % 2 === 0
})
return config
}
function cloneConfig(config: NetworkConfig): NetworkConfig {
return JSON.parse(JSON.stringify(config)) as NetworkConfig
}
function snapshotBooleanConfigFields(config: NetworkConfig): Record<string, unknown> {
return Object.fromEntries(
BOOLEAN_CONFIG_FIELDS.map((field) => [field, config[field]]),
)
}
async function settleRemoteManagement() {
for (let i = 0; i < 3; i++) {
await new Promise((resolve) => setTimeout(resolve, 0))
await flushPromises()
await nextTick()
}
}
describe('RemoteManagement config save', () => {
it('saves the current network config without dropping boolean fields', async () => {
const config = makeFlagConfig()
const expectedFlags = snapshotBooleanConfigFields(config)
const api = {
delete_network: vi.fn(),
generate_config: vi.fn(),
get_network_config: vi.fn(async () => cloneConfig(config)),
get_network_info: vi.fn(),
get_vpn_portal_info: vi.fn(),
get_network_metas: vi.fn(async (instanceIds: string[]) => ({
metas: Object.fromEntries(instanceIds.map((id) => [id, {
config_permission: 0xffffffff,
inst_id: INSTANCE_UUID,
instance_name: 'mesh-save',
network_name: 'mesh-save',
source: 2,
}])),
})),
list_network_instance_ids: vi.fn(async () => ({
disabled_inst_ids: [INSTANCE_UUID],
running_inst_ids: [],
})),
parse_config: vi.fn(),
run_network: vi.fn(),
save_config: vi.fn(async () => undefined),
update_network_instance_state: vi.fn(),
validate_config: vi.fn(),
}
const wrapper = mount(RemoteManagement, {
props: {
api,
instanceId: INSTANCE_ID,
},
global: {
stubs: {
Config: true,
ConfigEditDialog: true,
Status: true,
},
},
})
try {
await settleRemoteManagement()
const saveButton = wrapper.find('button[data-label="web.device_management.save_config"]')
expect(saveButton.exists()).toBe(true)
expect(saveButton.attributes('disabled')).toBeUndefined()
await saveButton.trigger('click')
await flushPromises()
expect(api.save_config).toHaveBeenCalledOnce()
const savedConfig = api.save_config.mock.calls[0][0] as NetworkConfig
for (const field of BOOLEAN_CONFIG_FIELDS) {
expect(savedConfig[field], `${field} should be saved`).toBe(expectedFlags[field])
}
} finally {
wrapper.unmount()
}
})
})