magic-agent 1.0.2 → 1.0.46

package/internal/client/proxy_test.go

@@ -0,0 +1,212 @@
+package client
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+// socks5Request 手写一遍 SOCKS5 握手，验证服务端行为（不引第三方库）。
+func socks5Request(t *testing.T, proxyAddr, user, pass, targetHost string, targetPort int) (net.Conn, error) {
+	t.Helper()
+	c, err := net.DialTimeout("tcp", proxyAddr, 3*time.Second)
+	if err != nil {
+		return nil, err
+	}
+	// 协商：只给「用户名口令」一种方法。
+	if _, err := c.Write([]byte{0x05, 0x01, 0x02}); err != nil {
+		return nil, err
+	}
+	sel := make([]byte, 2)
+	if _, err := io.ReadFull(c, sel); err != nil {
+		return nil, err
+	}
+	if sel[0] != 0x05 || sel[1] != 0x02 {
+		c.Close()
+		return nil, fmt.Errorf("协商失败：%v", sel)
+	}
+	// 认证
+	req := []byte{0x01, byte(len(user))}
+	req = append(req, user...)
+	req = append(req, byte(len(pass)))
+	req = append(req, pass...)
+	if _, err := c.Write(req); err != nil {
+		return nil, err
+	}
+	ar := make([]byte, 2)
+	if _, err := io.ReadFull(c, ar); err != nil {
+		return nil, err
+	}
+	if ar[1] != 0x00 {
+		c.Close()
+		return nil, fmt.Errorf("认证失败：%v", ar)
+	}
+	// CONNECT（域名形式）
+	r := []byte{0x05, 0x01, 0x00, 0x03, byte(len(targetHost))}
+	r = append(r, targetHost...)
+	p := make([]byte, 2)
+	binary.BigEndian.PutUint16(p, uint16(targetPort))
+	r = append(r, p...)
+	if _, err := c.Write(r); err != nil {
+		return nil, err
+	}
+	rep := make([]byte, 10)
+	if _, err := io.ReadFull(c, rep); err != nil {
+		return nil, err
+	}
+	if rep[1] != 0x00 {
+		c.Close()
+		return nil, fmt.Errorf("CONNECT 被拒：rep=%d", rep[1])
+	}
+	return c, nil
+}
+
+func TestSOCKS5ProxyConnect(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, "hello-from-upstream")
+	}))
+	defer upstream.Close()
+	uu, _ := url.Parse(upstream.URL)
+
+	s := &Service{log: testLogger(), opts: Options{Token: "sekret"}}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	go func() { _ = s.ServeProxy(ln) }()
+
+	host, portStr, _ := net.SplitHostPort(uu.Host)
+	var port int
+	_, _ = fmt.Sscanf(portStr, "%d", &port)
+
+	conn, err := socks5Request(t, ln.Addr().String(), "magic", "sekret", host, port)
+	if err != nil {
+		t.Fatalf("SOCKS5 握手失败：%v", err)
+	}
+	defer conn.Close()
+
+	_, _ = io.WriteString(conn, "GET / HTTP/1.1\r\nHost: "+uu.Host+"\r\nConnection: close\r\n\r\n")
+	body, err := io.ReadAll(conn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(body), "hello-from-upstream") {
+		t.Errorf("未取到上游内容，实际：%s", body)
+	}
+}
+
+func TestSOCKS5ProxyRejectsBadPassword(t *testing.T) {
+	s := &Service{log: testLogger(), opts: Options{Token: "sekret"}}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	go func() { _ = s.ServeProxy(ln) }()
+
+	if _, err := socks5Request(t, ln.Addr().String(), "magic", "wrong", "example.com", 80); err == nil {
+		t.Error("错误口令应当被拒")
+	}
+}
+
+func testLogger() *log.Logger { return log.New(io.Discard, "", 0) }
+
+// TestSOCKS5UDPAssociate 验证 UDP ASSOCIATE：VPN 里 DNS/QUIC 全靠它。
+func TestSOCKS5UDPAssociate(t *testing.T) {
+	echo, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer echo.Close()
+	go func() {
+		b := make([]byte, 2048)
+		for {
+			n, from, err := echo.ReadFromUDP(b)
+			if err != nil {
+				return
+			}
+			_, _ = echo.WriteToUDP(append([]byte("echo:"), b[:n]...), from)
+		}
+	}()
+
+	s := &Service{log: testLogger(), opts: Options{Token: "sekret"}}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	go func() { _ = s.ServeProxy(ln) }()
+
+	c, err := net.DialTimeout("tcp", ln.Addr().String(), 3*time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer c.Close()
+
+	_, _ = c.Write([]byte{0x05, 0x01, 0x02})
+	sel := make([]byte, 2)
+	if _, err := io.ReadFull(c, sel); err != nil || sel[1] != 0x02 {
+		t.Fatalf("协商失败：%v %v", sel, err)
+	}
+	auth := []byte{0x01, 5}
+	auth = append(auth, "magic"...)
+	auth = append(auth, 6)
+	auth = append(auth, "sekret"...)
+	_, _ = c.Write(auth)
+	ar := make([]byte, 2)
+	if _, err := io.ReadFull(c, ar); err != nil || ar[1] != 0 {
+		t.Fatalf("认证失败：%v %v", ar, err)
+	}
+
+	// UDP ASSOCIATE（DST 用 0.0.0.0:0）
+	_, _ = c.Write([]byte{0x05, 0x03, 0x00, 0x01, 0, 0, 0, 0, 0, 0})
+	rep := make([]byte, 10)
+	if _, err := io.ReadFull(c, rep); err != nil {
+		t.Fatal(err)
+	}
+	if rep[1] != 0x00 {
+		t.Fatalf("UDP ASSOCIATE 被拒：rep=%d", rep[1])
+	}
+	relay := &net.UDPAddr{IP: net.IP(rep[4:8]), Port: int(binary.BigEndian.Uint16(rep[8:10]))}
+	if relay.IP.IsUnspecified() {
+		relay.IP = net.IPv4(127, 0, 0, 1)
+	}
+
+	uc, err := net.DialUDP("udp", nil, relay)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer uc.Close()
+
+	target := echo.LocalAddr().(*net.UDPAddr)
+	pkt := []byte{0x00, 0x00, 0x00, 0x01}
+	pkt = append(pkt, target.IP.To4()...)
+	pkt = append(pkt, byte(target.Port>>8), byte(target.Port))
+	pkt = append(pkt, []byte("ping")...)
+	if _, err := uc.Write(pkt); err != nil {
+		t.Fatal(err)
+	}
+
+	_ = uc.SetReadDeadline(time.Now().Add(5 * time.Second))
+	rb := make([]byte, 2048)
+	n, err := uc.Read(rb)
+	if err != nil {
+		t.Fatalf("读回包失败：%v", err)
+	}
+	_, payload, ok := parseSocksUDP(rb[:n])
+	if !ok {
+		t.Fatalf("回包格式不对：%x", rb[:n])
+	}
+	if string(payload) != "echo:ping" {
+		t.Errorf("回包内容不对：%q", payload)
+	}
+}