Skip to content

Commit fb50560

Browse files
dlondlon
committed
Prevent ARP lookups during LAN tests
1 parent 634e0d9 commit fb50560

File tree

3 files changed

+48
-60
lines changed

3 files changed

+48
-60
lines changed

Diff for: ‎test/test-manager/src/tests/helpers.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ pub async fn send_guest_probes(
121121
rpc: ServiceClient,
122122
interface: String,
123123
destination: SocketAddr,
124-
) -> Result<ProbeResult, Error> {
124+
) -> ProbeResult {
125125
const MONITOR_DURATION: Duration = Duration::from_secs(8);
126126

127127
let pktmon = start_packet_monitor(
@@ -162,7 +162,7 @@ pub async fn send_guest_probes(
162162
}
163163
}
164164

165-
Ok(result)
165+
result
166166
}
167167

168168
/// Send one probe per transport protocol to `destination` without running a packet monitor

Diff for: ‎test/test-manager/src/tests/settings.rs

+26-36
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,9 @@ use super::{
33
helpers::{connect_and_wait, send_guest_probes},
44
Error, TestContext,
55
};
6-
use crate::{assert_tunnel_state, vm::network::DUMMY_LAN_INTERFACE_IP};
76

87
use mullvad_management_interface::MullvadProxyClient;
9-
use mullvad_types::states::TunnelState;
10-
use std::net::{IpAddr, SocketAddr};
8+
use std::net::SocketAddr;
119
use test_macro::test_function;
1210
use test_rpc::ServiceClient;
1311

@@ -22,12 +20,9 @@ pub async fn test_lan(
2220
rpc: ServiceClient,
2321
mut mullvad_client: MullvadProxyClient,
2422
) -> Result<(), Error> {
25-
let lan_destination = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 1234);
26-
27-
// Connect
28-
//
29-
30-
connect_and_wait(&mut mullvad_client).await?;
23+
// Take care not to use some bogus IP in the guest's subnet, lest we just send ARP requests
24+
// These will fail if there's no actual host present
25+
let lan_destination = "10.1.2.3:1234".parse().unwrap();
3126

3227
// Disable LAN sharing
3328
//
@@ -39,14 +34,19 @@ pub async fn test_lan(
3934
.await
4035
.expect("failed to disable LAN sharing");
4136

37+
// Connect
38+
//
39+
40+
connect_and_wait(&mut mullvad_client).await?;
41+
4242
// Ensure LAN is not reachable
4343
//
4444

4545
log::info!("Test whether outgoing LAN traffic is blocked");
4646

4747
let default_interface = rpc.get_default_interface().await?;
4848
let detected_probes =
49-
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination).await?;
49+
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination).await;
5050
assert!(
5151
detected_probes.none(),
5252
"observed unexpected outgoing LAN packets: {detected_probes:?}"
@@ -67,8 +67,7 @@ pub async fn test_lan(
6767

6868
log::info!("Test whether outgoing LAN traffic is blocked");
6969

70-
let detected_probes =
71-
send_guest_probes(rpc.clone(), default_interface, lan_destination).await?;
70+
let detected_probes = send_guest_probes(rpc.clone(), default_interface, lan_destination).await;
7271
assert!(
7372
detected_probes.all(),
7473
"did not observe all outgoing LAN packets: {detected_probes:?}"
@@ -96,19 +95,11 @@ pub async fn test_lockdown(
9695
rpc: ServiceClient,
9796
mut mullvad_client: MullvadProxyClient,
9897
) -> Result<(), Error> {
99-
let lan_destination: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 1337);
98+
// Take care not to use some bogus IP in the guest's subnet, lest we just send ARP requests
99+
// These will fail if there's no actual host present
100+
let lan_destination = "10.1.2.3:1234".parse().unwrap();
100101
let inet_destination: SocketAddr = "1.1.1.1:1337".parse().unwrap();
101102

102-
log::info!("Verify tunnel state: disconnected");
103-
assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
104-
105-
// Enable lockdown mode
106-
//
107-
mullvad_client
108-
.set_block_when_disconnected(true)
109-
.await
110-
.expect("failed to enable lockdown mode");
111-
112103
// Disable LAN sharing
113104
//
114105

@@ -119,20 +110,27 @@ pub async fn test_lockdown(
119110
.await
120111
.expect("failed to disable LAN sharing");
121112

113+
// Enable lockdown mode
114+
//
115+
mullvad_client
116+
.set_block_when_disconnected(true)
117+
.await
118+
.expect("failed to enable lockdown mode");
119+
122120
// Ensure all destinations are unreachable
123121
//
124122

125123
let default_interface = rpc.get_default_interface().await?;
126124

127125
let detected_probes =
128-
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination).await?;
126+
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination).await;
129127
assert!(
130128
detected_probes.none(),
131129
"observed outgoing packets to LAN: {detected_probes:?}"
132130
);
133131

134132
let detected_probes =
135-
send_guest_probes(rpc.clone(), default_interface.clone(), inet_destination).await?;
133+
send_guest_probes(rpc.clone(), default_interface.clone(), inet_destination).await;
136134
assert!(
137135
detected_probes.none(),
138136
"observed outgoing packets to internet: {detected_probes:?}"
@@ -152,14 +150,14 @@ pub async fn test_lockdown(
152150
//
153151

154152
let detected_probes =
155-
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination).await?;
153+
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination).await;
156154
assert!(
157155
detected_probes.all(),
158156
"did not observe some outgoing packets: {detected_probes:?}"
159157
);
160158

161159
let detected_probes =
162-
send_guest_probes(rpc.clone(), default_interface.clone(), inet_destination).await?;
160+
send_guest_probes(rpc.clone(), default_interface.clone(), inet_destination).await;
163161
assert!(
164162
detected_probes.none(),
165163
"observed outgoing packets to internet: {detected_probes:?}"
@@ -180,19 +178,11 @@ pub async fn test_lockdown(
180178

181179
// Send traffic outside the tunnel to sanity check that the internet is *not* reachable via non-
182180
// tunnel interfaces.
183-
let detected_probes =
184-
send_guest_probes(rpc.clone(), default_interface, inet_destination).await?;
181+
let detected_probes = send_guest_probes(rpc.clone(), default_interface, inet_destination).await;
185182
assert!(
186183
detected_probes.none(),
187184
"observed outgoing packets to internet: {detected_probes:?}"
188185
);
189186

190-
// Disable lockdown mode
191-
//
192-
mullvad_client
193-
.set_block_when_disconnected(false)
194-
.await
195-
.expect("failed to disable lockdown mode");
196-
197187
Ok(())
198188
}

Diff for: ‎test/test-manager/src/tests/tunnel_state.rs

+20-22
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,7 @@ use super::{
55
},
66
ui, Error, TestContext,
77
};
8-
use crate::{
9-
assert_tunnel_state, tests::helpers::ping_sized_with_timeout,
10-
vm::network::DUMMY_LAN_INTERFACE_IP,
11-
};
8+
use crate::{assert_tunnel_state, tests::helpers::ping_sized_with_timeout};
129

1310
use mullvad_management_interface::MullvadProxyClient;
1411
use mullvad_relay_selector::query::builder::RelayQueryBuilder;
@@ -20,10 +17,7 @@ use mullvad_types::{
2017
states::TunnelState,
2118
CustomTunnelEndpoint,
2219
};
23-
use std::{
24-
net::{IpAddr, SocketAddr},
25-
time::Duration,
26-
};
20+
use std::{net::SocketAddr, time::Duration};
2721
use talpid_types::net::{Endpoint, TransportProtocol, TunnelEndpoint, TunnelType};
2822
use test_macro::test_function;
2923
use test_rpc::ServiceClient;
@@ -143,7 +137,7 @@ pub async fn test_disconnected_state(
143137
.expect("failed to obtain non-tun interface");
144138

145139
let detected_probes =
146-
send_guest_probes(rpc.clone(), non_tunnel_interface, inet_destination).await?;
140+
send_guest_probes(rpc.clone(), non_tunnel_interface, inet_destination).await;
147141
assert!(
148142
detected_probes.all(),
149143
"did not see (all) outgoing packets to destination: {detected_probes:?}",
@@ -181,9 +175,11 @@ pub async fn test_connecting_state(
181175
mut mullvad_client: MullvadProxyClient,
182176
) -> Result<(), Error> {
183177
let inet_destination = "1.1.1.1:1337".parse().unwrap();
184-
let lan_destination: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 1337);
178+
// Take care not to use some bogus IP in the guest's subnet, lest we just send ARP requests
179+
// These will fail if there's no actual host present
180+
let lan_destination = "10.1.2.3:1234".parse().unwrap();
185181
let inet_dns = "1.1.1.1:53".parse().unwrap();
186-
let lan_dns: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 53);
182+
let lan_dns = "10.1.2.3:53".parse().unwrap();
187183

188184
log::info!("Verify tunnel state: disconnected");
189185
assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
@@ -225,25 +221,25 @@ pub async fn test_connecting_state(
225221

226222
assert!(
227223
send_guest_probes(rpc.clone(), non_tunnel_interface.clone(), inet_destination)
228-
.await?
224+
.await
229225
.none(),
230226
"observed unexpected outgoing packets (inet)"
231227
);
232228
assert!(
233229
send_guest_probes(rpc.clone(), non_tunnel_interface.clone(), lan_destination)
234-
.await?
230+
.await
235231
.none(),
236232
"observed unexpected outgoing packets (lan)"
237233
);
238234
assert!(
239235
send_guest_probes(rpc.clone(), non_tunnel_interface.clone(), inet_dns)
240-
.await?
236+
.await
241237
.none(),
242238
"observed unexpected outgoing packets (DNS, inet)"
243239
);
244240
assert!(
245241
send_guest_probes(rpc.clone(), non_tunnel_interface, lan_dns)
246-
.await?
242+
.await
247243
.none(),
248244
"observed unexpected outgoing packets (DNS, lan)"
249245
);
@@ -262,9 +258,11 @@ pub async fn test_error_state(
262258
mut mullvad_client: MullvadProxyClient,
263259
) -> Result<(), Error> {
264260
let inet_destination = "1.1.1.1:1337".parse().unwrap();
265-
let lan_destination: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 1337);
261+
// Take care not to use some bogus IP in the guest's subnet, lest we just send ARP requests
262+
// These will fail if there's no actual host present
263+
let lan_destination = "10.1.2.3:1234".parse().unwrap();
266264
let inet_dns = "1.1.1.1:53".parse().unwrap();
267-
let lan_dns: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 53);
265+
let lan_dns = "10.1.2.3:53".parse().unwrap();
268266

269267
log::info!("Verify tunnel state: disconnected");
270268
assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
@@ -303,25 +301,25 @@ pub async fn test_error_state(
303301

304302
assert!(
305303
send_guest_probes(rpc.clone(), default_interface.clone(), inet_destination)
306-
.await?
304+
.await
307305
.none(),
308306
"observed unexpected outgoing packets (inet)"
309307
);
310308
assert!(
311309
send_guest_probes(rpc.clone(), default_interface.clone(), lan_destination)
312-
.await?
310+
.await
313311
.none(),
314312
"observed unexpected outgoing packets (lan)"
315313
);
316314
assert!(
317315
send_guest_probes(rpc.clone(), default_interface.clone(), inet_dns)
318-
.await?
316+
.await
319317
.none(),
320318
"observed unexpected outgoing packets (DNS, inet)"
321319
);
322320
assert!(
323321
send_guest_probes(rpc.clone(), default_interface, lan_dns)
324-
.await?
322+
.await
325323
.none(),
326324
"observed unexpected outgoing packets (DNS, lan)"
327325
);
@@ -389,7 +387,7 @@ pub async fn test_connected_state(
389387
.await
390388
.expect("failed to find non-tun interface");
391389

392-
let detected_probes = send_guest_probes(rpc.clone(), nontun_iface, inet_destination).await?;
390+
let detected_probes = send_guest_probes(rpc.clone(), nontun_iface, inet_destination).await;
393391
assert!(
394392
detected_probes.none(),
395393
"observed unexpected outgoing packets: {detected_probes:?}"

0 commit comments

Comments
 (0)