test: improve test coverage for IPv6 routing and packets

NNdroid · NNdroid · commit f013ce9b6b73 · 2026-07-21T17:59:04.000+08:00
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -129,6 +129,7 @@ jobs:
           ./librespeed-cli --local-json config_librespeed.json --server 2 --json --share --telemetry-level disabled | python3 -m json.tool
 
           ping 10.66.0.2 -w 20 -c 10
+          ping6 fd00:66:0::2 -w 20 -c 10 || true
           # TODO: remove this temporal hack for linux
           ping awl-tester.awl -w 20 -c 10 || true
 
diff --git a/application_test.go b/application_test.go
@@ -794,6 +794,52 @@ func TestUpdatePeerSettingsIPAddr(t *testing.T) {
 		})
 		ts.NoError(err)
 	})
+
+	t.Run("IPv6TunnelPackets", func(t *testing.T) {
+		const packetSize = 1500
+		const packetsCount = 10
+
+		peer2Config, err := peer1.api.KnownPeerConfig(peer2.PeerID())
+		ts.NoError(err)
+		
+		peer2IPv4 := net.ParseIP(peer2Config.IPAddr).To4()
+		ts.NotNil(peer2IPv4)
+		
+		awlSubnet4, err := netip.ParsePrefix(peer1.app.Conf.VPNConfig.IPNet)
+		ts.NoError(err)
+		awlSubnet6, err := netip.ParsePrefix(peer1.app.Conf.VPNConfig.IPNetV6)
+		ts.NoError(err)
+		
+		// Map IPv4 to IPv6 using the same logic as peerIPv6FromIPv4
+		peer2IPv6 := make(net.IP, net.IPv6len)
+		copy(peer2IPv6, awlSubnet6.Addr().AsSlice())
+		v4Mask := net.CIDRMask(awlSubnet4.Bits(), 32)
+		for i := 0; i < net.IPv4len; i++ {
+			peer2IPv6[12+i] |= peer2IPv4[i] &^ v4Mask[i]
+		}
+
+		// Configure tunnel for packet testing
+		peer1.tun.SetInboundCapture(packetSize, nil)
+		peer2.tun.SetInboundCapture(packetSize, nil)
+		peer1.tun.ClearInboundCount()
+		peer2.tun.ClearInboundCount()
+
+		// Wait for IP map to be ready
+		time.Sleep(100 * time.Millisecond)
+
+		// Send IPv6 packets from peer1 to peer2
+		packet := testPacketWithDestV6(packetSize, peer2IPv6.String())
+		for i := 0; i < packetsCount; i++ {
+			peer1.tun.Outbound <- [][]byte{packet}
+		}
+
+		// Wait for packet processing
+		time.Sleep(500 * time.Millisecond)
+
+		// Verify packet reception
+		received := peer2.tun.InboundCount()
+		ts.EqualValues(packetsCount, received)
+	})
 }
 
 func TestDisableVPNInterface(t *testing.T) {
diff --git a/service/tunnel_test.go b/service/tunnel_test.go
@@ -0,0 +1,96 @@
+package service
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPeerIPv6FromIPv4(t *testing.T) {
+	tests := []struct {
+		name       string
+		peerIPv4   string
+		awlSubnet4 string
+		awlSubnet6 string
+		expected   string
+	}{
+		{
+			name:       "valid conversion /16 and /112",
+			peerIPv4:   "10.66.0.5",
+			awlSubnet4: "10.66.0.0/16",
+			awlSubnet6: "fd00:66::/112",
+			expected:   "fd00:66::5",
+		},
+		{
+			name:       "valid conversion /16 and /48",
+			peerIPv4:   "10.66.0.5",
+			awlSubnet4: "10.66.0.0/16",
+			awlSubnet6: "fd00:66:0::/48",
+			expected:   "fd00:66:0::5",
+		},
+		{
+			name:       "valid conversion with larger IPv4 offset",
+			peerIPv4:   "10.66.255.5",
+			awlSubnet4: "10.66.0.0/16",
+			awlSubnet6: "fd00:66:0::/48",
+			expected:   "fd00:66:0::ff05",
+		},
+		{
+			name:       "out of bounds IPv4",
+			peerIPv4:   "10.67.0.5",
+			awlSubnet4: "10.66.0.0/16",
+			awlSubnet6: "fd00:66:0::/48",
+			expected:   "", // expected nil
+		},
+		{
+			name:       "capacity mismatch v4 host bits > v6 host bits",
+			peerIPv4:   "10.66.0.5",
+			awlSubnet4: "10.66.0.0/16", // 16 host bits
+			awlSubnet6: "fd00:66::/120", // 8 host bits
+			expected:   "", // expected nil
+		},
+		{
+			name:       "invalid mask lengths (v4)",
+			peerIPv4:   "10.66.0.5",
+			awlSubnet4: "10.66.0.0/16",
+			awlSubnet6: "fd00:66::/112",
+			expected:   "",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			peerIP := net.ParseIP(tc.peerIPv4)
+			var sub4, sub6 *net.IPNet
+
+			if tc.awlSubnet4 != "" {
+				_, sub4, _ = net.ParseCIDR(tc.awlSubnet4)
+				if tc.name == "invalid mask lengths (v4)" {
+					sub4.Mask = net.CIDRMask(16, 128)
+				}
+			}
+			if tc.awlSubnet6 != "" {
+				_, sub6, _ = net.ParseCIDR(tc.awlSubnet6)
+			}
+
+			result := peerIPv6FromIPv4(peerIP, sub4, sub6)
+
+			if tc.expected == "" {
+				assert.Nil(t, result)
+			} else {
+				assert.NotNil(t, result)
+				assert.Equal(t, net.ParseIP(tc.expected).To16(), result)
+			}
+		})
+	}
+
+	t.Run("nil inputs", func(t *testing.T) {
+		assert.Nil(t, peerIPv6FromIPv4(nil, nil, nil))
+
+		_, sub4, _ := net.ParseCIDR("10.66.0.0/16")
+		_, sub6, _ := net.ParseCIDR("fd00:66:0::/48")
+		assert.Nil(t, peerIPv6FromIPv4(net.ParseIP("10.66.0.5"), nil, sub6))
+		assert.Nil(t, peerIPv6FromIPv4(net.ParseIP("10.66.0.5"), sub4, nil))
+	})
+}
diff --git a/test_suite_test.go b/test_suite_test.go
@@ -593,6 +593,50 @@ func testPacketWithDest(length int, destIP string) []byte {
 	return testPacketWithSrcDest(length, "10.66.0.1", destIP)
 }
 
+func testPacketWithSrcDestV6(length int, srcIP, destIP string) []byte {
+	data, err := hex.DecodeString("6000000000141140fd000000000000000000000000000001fd00000000000000000000000000000204d2162e0014000068656c6c6f20776f726c6421")
+	if err != nil {
+		panic(err)
+	}
+
+	packet := data
+	if length > len(data) {
+		packet = make([]byte, length)
+		copy(packet, data)
+		_, err = rand.Read(packet[len(data):])
+		if err != nil {
+			panic(err)
+		}
+	}
+
+	vpnPacket := vpn.Packet{}
+	_, err = vpnPacket.ReadFrom(bytes.NewReader(packet))
+	if err != nil {
+		panic(err)
+	}
+	vpnPacket.Parse()
+
+	srcIPParsed := net.ParseIP(srcIP).To16()
+	if srcIPParsed == nil {
+		panic(fmt.Sprintf("invalid source IPv6: %s", srcIP))
+	}
+	copy(vpnPacket.Src, srcIPParsed)
+
+	destIPParsed := net.ParseIP(destIP).To16()
+	if destIPParsed == nil {
+		panic(fmt.Sprintf("invalid destination IPv6: %s", destIP))
+	}
+	copy(vpnPacket.Dst, destIPParsed)
+
+	vpnPacket.RecalculateChecksum()
+
+	return vpnPacket.Packet
+}
+
+func testPacketWithDestV6(length int, destIP string) []byte {
+	return testPacketWithSrcDestV6(length, "fd00:66:0::1", destIP)
+}
+
 // parsePacketIPs extracts src and dst IPs from a raw IPv4 packet.
 func parsePacketIPs(rawPacket []byte) (src, dst net.IP) {
 	pkt := vpn.Packet{}
diff --git a/vpn/netstate/vpn_hostnet_windows_integration_test.go b/vpn/netstate/vpn_hostnet_windows_integration_test.go
@@ -281,7 +281,7 @@ func TestGatewayHostNetNATLifecycle(t *testing.T) {
 	require.False(t, awlNATInstalled(t), "pre-existing awl-gateway NetNat; clean the host before running")
 
 	mgr := NewManager()
-	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, nicGUID))
+	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, "", nicGUID))
 	require.True(t, mgr.ServerNATActive())
 
 	require.True(t, awlNATInstalled(t), "NetNat must exist while NAT is up")
@@ -317,7 +317,7 @@ func TestGatewayHostNetNATPreservesExistingForwarding(t *testing.T) {
 	}
 
 	mgr := NewManager()
-	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, nicGUID))
+	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, "", nicGUID))
 	require.True(t, forwardingEnabled(t, nicLUID))
 
 	require.NoError(t, mgr.DisableServerNAT())
@@ -338,7 +338,7 @@ func TestGatewayHostNetNATStaleRecovery(t *testing.T) {
 	require.True(t, awlNATInstalled(t))
 
 	mgr := NewManager()
-	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, nicGUID),
+	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, "", nicGUID),
 		"EnableServerNAT must recover from a stale awl-gateway NetNat")
 	require.True(t, awlNATInstalled(t))
 
@@ -370,7 +370,7 @@ func TestGatewayHostNetNATRollback(t *testing.T) {
 	})
 
 	mgr := NewManager()
-	err = mgr.EnableServerNAT(testAwlSubnet, nicGUID)
+	err = mgr.EnableServerNAT(testAwlSubnet, "", nicGUID)
 	if err == nil {
 		// If even overlapping-prefix instances are tolerated, there is no
 		// failure to roll back from. Clean up and skip rather than fail.
@@ -603,7 +603,7 @@ func TestGatewayHostNetClientFenceAllowsClientServerCoexist(t *testing.T) {
 	_, nicGUID := pickServerTestNIC(t)
 
 	require.NoError(t, mgr.EnableClientRoutes(tunGUID))
-	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, nicGUID))
+	require.NoError(t, mgr.EnableServerNAT(testAwlSubnet, "", nicGUID))
 	t.Cleanup(func() { _ = mgr.DisableServerNAT() })
 
 	require.Equal(t, 8, clientFenceRuleCount(t), "client fence rules present with both roles on")
diff --git a/vpn/packet_test.go b/vpn/packet_test.go
@@ -21,6 +21,20 @@ func TestPacket_RecalculateChecksum(t *testing.T) {
 	a.Equal(rawData, packet.Packet)
 }
 
+func TestPacket_RecalculateChecksum_IPv6(t *testing.T) {
+	a := require.New(t)
+	packet, rawData := testUDPPacketIPv6()
+	// testUDPPacketIPv6 has 0000 for checksum, calling RecalculateChecksum will update it
+	packet.RecalculateChecksum()
+	// Just verify it doesn't crash and actually modifies the checksum if it was 0000
+	a.NotEqual(rawData, packet.Packet)
+	
+	// Test idempotency
+	firstRecalculate := append([]byte(nil), packet.Packet...)
+	packet.RecalculateChecksum()
+	a.Equal(firstRecalculate, packet.Packet)
+}
+
 // TODO: bench with bigger packet
 func BenchmarkPacket_RecalculateChecksum(b *testing.B) {
 	packet, _ := testUDPPacket()
@@ -76,6 +90,31 @@ func TestPacket_Parse_RejectsMalformedIPv4(t *testing.T) {
 	}
 }
 
+func TestPacket_Parse_RejectsMalformedIPv6(t *testing.T) {
+	newRawIPv6 := func(size int, nextHeader byte) []byte {
+		raw := make([]byte, size)
+		raw[0] = 0x60 // version 6
+		if len(raw) > 6 {
+			raw[6] = nextHeader
+		}
+		return raw
+	}
+
+	cases := []struct {
+		name string
+		raw  []byte
+	}{
+		{"length less than ipv6 header", newRawIPv6(20, 17)}, // ipv6 header is 40
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			p := new(Packet)
+			_, _ = p.ReadFrom(bytes.NewReader(tc.raw))
+			require.False(t, p.Parse(), "malformed IPv6 packet must be rejected by Parse")
+		})
+	}
+}
+
 // defense in depth: RecalculateChecksum must be panic-safe on malformed or
 // truncated packets, including when called without a prior successful Parse.
 func TestPacket_RecalculateChecksum_MalformedNoPanic(t *testing.T) {
@@ -186,6 +225,19 @@ func testUDPPacket() (*Packet, []byte) {
 	return packet, data
 }
 
+func testUDPPacketIPv6() (*Packet, []byte) {
+	data, err := hex.DecodeString("6000000000141140fd000000000000000000000000000001fd00000000000000000000000000000204d2162e0014000068656c6c6f20776f726c6421")
+	if err != nil {
+		panic(err)
+	}
+
+	packet := new(Packet)
+	_, _ = packet.ReadFrom(bytes.NewReader(data))
+	packet.Parse()
+
+	return packet, data
+}
+
 func TestGetIPv4BroadcastAddress(t *testing.T) {
 	tests := []struct {
 		name  string
