testenv

type AddressFamily int

type Agreement int

type Auth int

type AuthPacketInfo struct {
	TotalBytes     int    `json:"total_bytes"`
	Options        string `json:"options"`
	Username       string `json:"username"`
	PasswordLen    int    `json:"password_len"`
	CredentialKind string `json:"credential_kind"`
	PeerInfo       string `json:"peer_info"`
}

type CASource int

type Cell int

type CertCheck int

type Cipher string

type Classification struct {
	// Connected reports whether the client logged
	// "Initialization Sequence Completed".
	Connected bool
	// Class is the diag class the failure falls into.
	Class diag.Class
	// Stage is the furthest connection stage the log proves was reached.
	Stage diag.Stage
	// Rule names the classification rule that fired, for example
	// "auth-rejected". It is stable and safe to aggregate on.
	Rule string
	// Evidence is the log line the rule keyed on, with the leading
	// timestamp stripped. Empty when no rule matched.
	Evidence string
	// Detail explains the verdict in one sentence, including what else could
	// produce the same evidence.
	Detail string
	// Ambiguous marks a verdict that more than one root cause produces. It is
	// not a confidence score: the log genuinely does not separate the
	// possibilities named in Detail, and a human reading it could not either.
	Ambiguous bool
}

type ClientOutcome struct {
	// Connected reports whether our client reached a working tunnel.
	Connected bool
	// Class is the diag class our attempt ended with, meaningless when
	// Connected is true.
	Class diag.Class
	// Stage is the furthest stage our attempt reached.
	Stage diag.Stage
}

type ClientProfileOptions struct {
	// Remote is the host to dial, e.g. "127.0.0.1" or "::1".
	Remote string
	// Port is the published host-side port.
	Port int
	// CACertPEM is the run's CA certificate.
	CACertPEM string
	// ClientCertPEM is the run's client certificate.
	ClientCertPEM string
	// ClientKeyPEM is the run's client private key.
	ClientKeyPEM string
	// StaticKey is the OpenVPN static key file contents, required when the
	// entry's Wrap is not WrapPlain.
	StaticKey string
	// CredentialsFile, when non-empty, is the in-container path the generated
	// auth-user-pass directive points at. Ignored unless the entry's Auth is
	// AuthUserPass. Leave it empty for the bare directive, which is what this
	// client's credential seam consumes; set it for a stock OpenVPN client,
	// which has no terminal to be prompted on inside a container and must read
	// the pair from a file.
	CredentialsFile string

	// CAFile is the path the generated `ca` directive names. Ignored unless
	// the entry's CASource is CAFile, and required when it is.
	//
	// It is per-run because one entry produces two profiles: a bare base name
	// for a profile written into a directory on this host, where OpenVPN and
	// this client both resolve it beside the profile, and an absolute
	// in-container path for the reference client, whose working directory is /
	// and not /etc/openvpn.
	CAFile string

	// DeadRemotePort is the port of the deliberately unreachable first
	// remote. Ignored unless the entry's Remotes is RemoteDeadFirst, and
	// required when it is. Nothing must be listening on it: the point of the
	// entry is that the first remote does not answer, and a port that happens
	// to be in use turns the failover test into an accident.
	DeadRemotePort int
}

type Compression int

type Config struct {
	// CRV1Mode, when true, starts the server in AUTH_FAILED,CRV1 mode.
	CRV1Mode bool

	// RedirectGateway, when true, instructs the mock server to include
	// "redirect-gateway def1" in its PUSH_REPLY, simulating AWS Client VPN
	// full-tunnel mode. Use this to test issue #7 bypass-route behaviour.
	RedirectGateway bool

	// Binary is the path to the mock-server binary. The MOCK_SERVER_BIN
	// environment variable is used as a fallback when it is empty.
	Binary string

	// CertDir is the directory containing ca.crt, server.crt, server.key.
	// Default: resolved from the binary's location.
	CertDir string

	// TCPPort is the host-side TCP port. 0 means pick a free port.
	TCPPort int

	// KeepaliveMS overrides how often the server pushes a data-channel
	// keepalive once the tunnel is up, in milliseconds. 0 leaves the mock
	// server's own default, which is already far faster than a real server's
	// pushed ping. Lower it for a test that needs traffic in flight.
	KeepaliveMS int

	// NoKeepalive switches the server's data-channel keepalives off, for a
	// test that wants a silent peer. It takes precedence over KeepaliveMS.
	NoKeepalive bool

	// UDPPort is the host-side UDP port. 0 means pick a free port. A listener
	// is always started, because the mock server starts one unconditionally
	// and a fixed default port would collide between concurrent tests; reach
	// it through Server.UDPAddr.
	UDPPort int
}

type Digest string

type MatrixEntry struct {
	// Name is a stable identifier, usable both as a Go subtest name and as a
	// lookup key for Entry. It never changes for a given combination.
	Name string

	// Version selects which pinned server image runs the entry.
	Version ServerVersion
	// Cipher is the data-channel cipher.
	Cipher Cipher
	// Digest is the HMAC digest.
	Digest Digest
	// Wrap is the control-channel wrapping mode.
	Wrap Wrap
	// Proto is the transport protocol.
	Proto Proto
	// Compression is the compression framing mode.
	Compression Compression
	// Reneg is the renegotiation policy.
	Reneg Reneg
	// Family is the transport address family.
	Family AddressFamily
	// Auth is how the client authenticates: certificate only, or certificate
	// plus a username and password.
	Auth Auth
	// CertCheck is the additional server-certificate check the client
	// profile asks for.
	CertCheck CertCheck
	// CASource is whether the client profile inlines its CA or names a file.
	CASource CASource
	// Remotes is how many remote lines the client profile carries, and
	// whether the first one answers.
	Remotes RemoteSet

	// DataV1 marks an entry whose purpose is to exercise the P_DATA_V1 data
	// channel (no peer-id prefix).
	//
	// There is no server configuration for it: 2.4, 2.5 and 2.6 all decide the
	// format from the client's IV_PROTO, so the flag is an instruction to the
	// client under test and the rig side is the ordinary server. The
	// instruction is "advertise no IV_PROTO extensions" rather than "omit the
	// DATA_V2 bit", because 2.4 and 2.5 push a peer-id whenever
	// sscanf("IV_PROTO=%d") >= 2 (push.c:prepare_push_reply) where 2.6 tests
	// the bit (multi.c:multi_client_connect_late_setup via extract_iv_proto).
	// vpn.WithholdDataV2 is that value, and a test that does not apply it for
	// an entry with this flag set measures nothing.
	DataV1 bool

	// Unimplemented, when non-empty, explains why the rig cannot bring this
	// entry up. Enumerating tests must skip such entries with this message
	// rather than fail. StartMatrix returns ErrUnimplemented for them.
	Unimplemented string

	// ClientUnsupported, when non-empty, explains why *this repository's*
	// client cannot drive the entry. The rig can: the server starts, the
	// generated profile is correct, and the reference client connects to it.
	//
	// It is not Unimplemented, and the two must never be conflated.
	// StartMatrix refuses an Unimplemented entry, so marking one that way to
	// spare our client would also deny the reference client the chance to
	// prove it. A test driving our client should skip on a non-empty value and
	// say so; one driving the rig or the reference client must ignore it.
	ClientUnsupported string

	// ReferenceRejects, when non-empty, names the ClassifyReferenceLog rule
	// the reference client is expected to report against this entry instead
	// of connecting.
	//
	// Unimplemented and ClientUnsupported both say something could not be
	// tried; this says the entry was tried and the design was to be refused.
	// An entry whose point is a check that fails is only sound if the refusal
	// is the intended one, so the rule is asserted rather than the weaker "did
	// not connect", which a server that never started would also satisfy.
	ReferenceRejects string
}

type MatrixPKI struct {
	// CACertPEM is the throwaway CA certificate.
	CACertPEM string
	// ServerCertPEM is the server certificate, signed by the CA.
	ServerCertPEM string
	// ServerKeyPEM is the server private key.
	ServerKeyPEM string
	// ClientCertPEM is a client certificate, signed by the CA.
	ClientCertPEM string
	// ClientKeyPEM is the client private key.
	ClientKeyPEM string
	// StaticKey is an OpenVPN static key V1 file, used for tls-auth and
	// tls-crypt. Empty when the entry needs no static key.
	StaticKey string
}

type MatrixServer struct {
	// Entry is the matrix entry this server was started from.
	Entry MatrixEntry
	// Image is the exact image tag that was run.
	Image string
	// ContainerID is the Docker container ID.
	ContainerID string
	// Port is the host-side published port, the same for both address
	// families when both are published.
	Port int
	// Addr is the dialable IPv4 host address ("127.0.0.1:port"), empty for
	// an IPv6-only entry.
	Addr string
	// Addr6 is the dialable IPv6 host address ("[::1]:port"), empty for an
	// IPv4-only entry.
	Addr6 string
	// DeadPort is a host port nothing is listening on, published by nothing
	// and reserved for this run. It is the first remote of a RemoteDeadFirst
	// entry's host-side profile, and zero for every other entry.
	DeadPort int
	// PKI is the ephemeral certificate material this server was given.
	PKI MatrixPKI
	// contains filtered or unexported fields
}

type MockPKI struct {
	// Dir holds ca.crt, server.crt and server.key. Pass it as Config.CertDir.
	Dir string
	// CAPEM is the CA certificate, for the client profile's CA field.
	CAPEM []byte
}

type MockServerEvent struct {
	TS     int64  `json:"ts"`
	Event  string `json:"event"`
	Detail string `json:"detail"`
}

type OracleOptions struct {
	// Version selects which pinned OpenVPN build runs the config. It names a
	// matrix image, so the exact upstream release is reproducible. Empty
	// means DefaultOracleVersion.
	Version ServerVersion

	// Timeout bounds the whole run. Zero means DefaultOracleTimeout. On
	// expiry the run is reported with TimedOut set rather than as an error.
	Timeout time.Duration

	// HandshakeWindow becomes openvpn's --hand-window. Zero means
	// DefaultOracleHandshakeWindow. Shortening it only makes a stalled
	// handshake fail sooner; it does not change the class.
	HandshakeWindow time.Duration

	// Network is the Docker network to attach the client container to. Empty
	// means the default bridge; use MatrixServer.OracleOptions to reach a
	// matrix server that sits on a throwaway network.
	Network string

	// Files are extra files placed beside the config inside the container,
	// keyed by base name. The config references them as /etc/openvpn/<name>;
	// a name containing a path separator, and "client.conf", are rejected.
	Files map[string]string

	// Directives are appended after the oracle preamble, so they win over both
	// the config and the preamble. Use sparingly: each one is a way the thing
	// being judged differs from the thing that was handed in.
	Directives []string
}

type OracleResult struct {
	// Classification is the verdict derived from the client's log.
	Classification

	// Image is the exact image tag that ran, for example
	// "go-openvpn-test/openvpn-server:2.6.22".
	Image string
	// Banner is the openvpn version banner from the run, for example
	// "OpenVPN 2.6.22 x86_64-pc-linux-gnu [SSL (OpenSSL)] ... built on ...".
	// This is the authoritative record of which binary produced the verdict.
	Banner string
	// Release is the exact upstream release parsed out of Banner, for
	// example "2.6.22".
	Release string
	// HostBanner is the host's own `openvpn --version` first line, or empty
	// when the host has no openvpn. The oracle never runs it: it is recorded
	// for contrast, the usual explanation for "we connect, openvpn does not".
	HostBanner string

	// Preamble is the directive list the oracle appended to the config.
	Preamble []string
	// Elapsed is how long the client ran.
	Elapsed time.Duration
	// TimedOut reports that the oracle's own Timeout expired with the client
	// still running. The classification is then whatever the partial log
	// supports.
	TimedOut bool
	// Log is the client container's complete log.
	Log string
}

type Proto int

type ReferenceClientResult struct {
	// Connected reports whether the reference client completed its
	// initialization sequence, i.e. handshake, auth and push all succeeded.
	Connected bool
	// Log is the reference client's container log.
	Log string
	// Classification is the same verdict the reference oracle would reach
	// from this log, so an entry that is meant to be refused can be checked
	// against the reason it was refused rather than merely against the fact.
	// "Did not connect" is also what a server that failed to start produces.
	Classification Classification
}

type RemoteSet int

type Reneg int

type Server struct {
	TCPAddr string // "127.0.0.1:<port>"
	UDPAddr string // "127.0.0.1:<port>"
	// contains filtered or unexported fields
}

type ServerVersion string

type Verdict struct {
	// Cell is which square of the four-cell table this config landed in.
	Cell Cell
	// Agreement is how far the two outcomes agree. It is keyed on the class
	// alone; see the type's documentation for why the stage is excluded.
	Agreement Agreement
	// Ours is our client's outcome.
	Ours ClientOutcome
	// Reference is the stock openvpn run it was compared against.
	Reference OracleResult
}

type Wrap int