mirror of
https://github.com/trailofbits/algo.git
synced 2025-08-04 11:53:02 +02:00
fix: Add IPv6 support for WireGuard endpoint addresses (#14780)
* fix: Add IPv6 support for WireGuard endpoint addresses Fixes issue where IPv6 addresses in WireGuard configuration files were not properly formatted with square brackets when used with port numbers. The WireGuard client configuration template now detects IPv6 addresses using the ansible.utils.ipv6 filter and wraps them in brackets as required by the WireGuard configuration format. Example outputs: - IPv4: 192.168.1.1:51820 - IPv6: [2600:3c01::f03c:91ff:fedf:3b2a]:51820 - Hostname: vpn.example.com:51820 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: Use simple colon check for IPv6 detection in WireGuard template The original implementation tried to use `ansible.utils.ipv6` filter which is not available in the current environment. This caused the Smart Test Selection workflow to fail with "No filter named 'ansible.utils.ipv6' found." This change replaces the filter with a simple string check for colons (':') which is a reliable way to detect IPv6 addresses since they contain colons while IPv4 addresses and hostnames typically don't. The fix maintains the same functionality: - IPv6 addresses: `[2600:3c01::f03c:91ff:fedf:3b2a]:51820` - IPv4 addresses: `192.168.1.1:51820` - Hostnames: `vpn.example.com:51820` Fixes failing workflow in PR #14780. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * test: Add IPv6 endpoint formatting tests - Add comprehensive test cases for IPv4, IPv6, and hostname endpoints - Test IPv6 addresses are properly bracketed in WireGuard configs - Verify IPv4 and hostnames are not bracketed - Include edge case test for IPv6 with zone ID --------- Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
parent
6d9b1b9df3
commit
554121f0fc
1 changed files with 70 additions and 0 deletions
|
@ -190,6 +190,75 @@ def test_variable_consistency():
|
||||||
print("✓ Variable consistency check completed")
|
print("✓ Variable consistency check completed")
|
||||||
|
|
||||||
|
|
||||||
|
def test_wireguard_ipv6_endpoints():
|
||||||
|
"""Test that WireGuard client configs properly format IPv6 endpoints"""
|
||||||
|
test_cases = [
|
||||||
|
# IPv4 address - should not be bracketed
|
||||||
|
{
|
||||||
|
'IP_subject_alt_name': '192.168.1.100',
|
||||||
|
'expected_endpoint': 'Endpoint = 192.168.1.100:51820'
|
||||||
|
},
|
||||||
|
# IPv6 address - should be bracketed
|
||||||
|
{
|
||||||
|
'IP_subject_alt_name': '2600:3c01::f03c:91ff:fedf:3b2a',
|
||||||
|
'expected_endpoint': 'Endpoint = [2600:3c01::f03c:91ff:fedf:3b2a]:51820'
|
||||||
|
},
|
||||||
|
# Hostname - should not be bracketed
|
||||||
|
{
|
||||||
|
'IP_subject_alt_name': 'vpn.example.com',
|
||||||
|
'expected_endpoint': 'Endpoint = vpn.example.com:51820'
|
||||||
|
},
|
||||||
|
# IPv6 with zone ID - should be bracketed
|
||||||
|
{
|
||||||
|
'IP_subject_alt_name': 'fe80::1%eth0',
|
||||||
|
'expected_endpoint': 'Endpoint = [fe80::1%eth0]:51820'
|
||||||
|
},
|
||||||
|
]
|
||||||
|
|
||||||
|
template_path = 'roles/wireguard/templates/client.conf.j2'
|
||||||
|
if not os.path.exists(template_path):
|
||||||
|
print(f"⚠ Skipping IPv6 endpoint test - {template_path} not found")
|
||||||
|
return
|
||||||
|
|
||||||
|
base_vars = get_test_variables()
|
||||||
|
errors = []
|
||||||
|
|
||||||
|
for test_case in test_cases:
|
||||||
|
try:
|
||||||
|
# Set up test variables
|
||||||
|
test_vars = {**base_vars, **test_case}
|
||||||
|
test_vars['item'] = ('test-user', 'test-user')
|
||||||
|
|
||||||
|
# Render template
|
||||||
|
env = Environment(
|
||||||
|
loader=FileSystemLoader('roles/wireguard/templates'),
|
||||||
|
undefined=StrictUndefined
|
||||||
|
)
|
||||||
|
env.globals['lookup'] = mock_lookup
|
||||||
|
|
||||||
|
template = env.get_template('client.conf.j2')
|
||||||
|
output = template.render(**test_vars)
|
||||||
|
|
||||||
|
# Check if the expected endpoint format is in the output
|
||||||
|
if test_case['expected_endpoint'] not in output:
|
||||||
|
errors.append(f"Expected '{test_case['expected_endpoint']}' for IP '{test_case['IP_subject_alt_name']}' but not found in output")
|
||||||
|
# Print relevant part of output for debugging
|
||||||
|
for line in output.split('\n'):
|
||||||
|
if 'Endpoint' in line:
|
||||||
|
errors.append(f" Found: {line.strip()}")
|
||||||
|
|
||||||
|
except Exception as e:
|
||||||
|
errors.append(f"Error testing {test_case['IP_subject_alt_name']}: {e}")
|
||||||
|
|
||||||
|
if errors:
|
||||||
|
print("✗ WireGuard IPv6 endpoint test failed:")
|
||||||
|
for error in errors:
|
||||||
|
print(f" - {error}")
|
||||||
|
assert False, "IPv6 endpoint formatting errors"
|
||||||
|
else:
|
||||||
|
print("✓ WireGuard IPv6 endpoint test passed (4 test cases)")
|
||||||
|
|
||||||
|
|
||||||
def test_template_conditionals():
|
def test_template_conditionals():
|
||||||
"""Test templates with different conditional states"""
|
"""Test templates with different conditional states"""
|
||||||
test_cases = [
|
test_cases = [
|
||||||
|
@ -276,6 +345,7 @@ if __name__ == "__main__":
|
||||||
test_template_syntax,
|
test_template_syntax,
|
||||||
test_critical_templates,
|
test_critical_templates,
|
||||||
test_variable_consistency,
|
test_variable_consistency,
|
||||||
|
test_wireguard_ipv6_endpoints,
|
||||||
test_template_conditionals,
|
test_template_conditionals,
|
||||||
]
|
]
|
||||||
|
|
||||||
|
|
Loading…
Add table
Reference in a new issue