TestEngineOutOfScopeFlowsPassThrough verifies the engine does not track flows to unrelated remote IPs.
(t *testing.T)
| 197 | // TestEngineOutOfScopeFlowsPassThrough verifies the engine does not track |
| 198 | // flows to unrelated remote IPs. |
| 199 | func TestEngineOutOfScopeFlowsPassThrough(t *testing.T) { |
| 200 | be := newFakeBackend() |
| 201 | eng, err := New(Config{ |
| 202 | Strategy: bypass.NameWrongSeq, |
| 203 | SNIPool: []string{"x.io"}, |
| 204 | Scope: platform.Scope{ |
| 205 | LocalIP: netip.MustParseAddr("10.0.0.1"), |
| 206 | RemoteIP: netip.MustParseAddr("1.1.1.1"), |
| 207 | RemotePort: 443, |
| 208 | }, |
| 209 | }, be) |
| 210 | if err != nil { |
| 211 | t.Fatal(err) |
| 212 | } |
| 213 | |
| 214 | ctx, cancel := context.WithCancel(context.Background()) |
| 215 | defer cancel() |
| 216 | go eng.Run(ctx) |
| 217 | |
| 218 | var vc verdictCounter |
| 219 | be.ch <- platform.Packet{Dir: platform.DirOutbound, Raw: makePkt(pktOpts{ |
| 220 | src: [4]byte{10, 0, 0, 1}, dst: [4]byte{9, 9, 9, 9}, |
| 221 | srcPort: 40000, dport: 443, seq: 1, flags: flagSYN, |
| 222 | }), Verdict: vc.fn()} |
| 223 | // Give the engine time to process. |
| 224 | time.Sleep(20 * time.Millisecond) |
| 225 | |
| 226 | if vc.calls() != 1 { |
| 227 | t.Errorf("verdict calls: %d", vc.calls()) |
| 228 | } |
| 229 | if len(be.captured()) != 0 { |
| 230 | t.Errorf("unexpected injection for out-of-scope flow") |
| 231 | } |
| 232 | } |
| 233 | |
| 234 | func containsBytes(hay, needle []byte) bool { |
| 235 | for i := 0; i+len(needle) <= len(hay); i++ { |