473 lines
24 KiB
Bash
Executable File
473 lines
24 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
#
|
||
# run_tests.sh — setup_caddy_xray_hysteria.sh 的 DRY_RUN 集成测试
|
||
# 在 dev 机上以固定测试值干跑主脚本，断言渲染出的配置文件内容正确。
|
||
#
|
||
set -euo pipefail
|
||
cd "$(dirname "$0")/.."
|
||
|
||
SCRIPT=./setup_caddy_xray_hysteria.sh
|
||
export PATH="$HOME/.local/bin:$PATH" # 本地安装的检查工具可能在这里
|
||
DRY_DIR="$(mktemp -d)"
|
||
trap 'rm -rf "$DRY_DIR"' EXIT
|
||
|
||
fail() { echo "[FAIL] $*" >&2; exit 1; }
|
||
pass() { echo "[ ok ] $*"; }
|
||
|
||
# 断言文件包含某字符串（grep -F）
|
||
assert_contains() { # <文件> <字符串> <说明>
|
||
grep -qF -- "$2" "$1" || fail "$3：$1 应包含 [$2]"
|
||
pass "$3"
|
||
}
|
||
assert_not_contains() {
|
||
if grep -qF -- "$2" "$1"; then fail "$3：$1 不应包含 [$2]"; fi
|
||
pass "$3"
|
||
}
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 0. 静态检查
|
||
# ---------------------------------------------------------------------------
|
||
bash -n "$SCRIPT" || fail "bash -n 未通过"
|
||
pass "bash -n 语法检查"
|
||
if command -v shellcheck >/dev/null 2>&1; then
|
||
shellcheck "$SCRIPT" || fail "shellcheck 未通过"
|
||
pass "shellcheck"
|
||
else
|
||
echo "[skip] shellcheck 未安装"
|
||
fi
|
||
|
||
# 回归测试：preflight 在非 DRY_RUN 下必须以零状态返回。
|
||
# 事故背景：preflight 最后一行曾是 `[ -n "$DRY_RUN" ] && info ...`，DRY_RUN 为空时
|
||
# 该 && 列表返回 1，函数返回 1，set -e 在主流程第一句就静默杀掉整个脚本（零输出）。
|
||
PREFLIGHT_BODY="$(sed -n '/^preflight() {/,/^}/p' "$SCRIPT")"
|
||
MOCK_BIN="$(mktemp -d)"
|
||
printf '#!/bin/sh\n[ "${1:-}" = "-u" ] && echo 0 || echo mock\n' > "$MOCK_BIN/id"
|
||
printf '#!/bin/sh\nexit 0\n' > "$MOCK_BIN/apt-get"
|
||
chmod +x "$MOCK_BIN/id" "$MOCK_BIN/apt-get"
|
||
if ! env -i PATH="$MOCK_BIN:/usr/bin:/bin" bash -c "
|
||
set -euo pipefail
|
||
info() { echo \"[INFO] \$*\"; }
|
||
warn() { :; }
|
||
die() { echo \"[ERROR] \$*\" >&2; exit 1; }
|
||
DRY_RUN=''
|
||
$PREFLIGHT_BODY
|
||
preflight
|
||
"; then
|
||
fail "preflight 在非 DRY_RUN 下返回非零（set -e 静默退出回归）"
|
||
fi
|
||
pass "preflight 非 DRY_RUN 返回零"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 固定测试值，干跑主脚本
|
||
# ---------------------------------------------------------------------------
|
||
run_dry() {
|
||
env -i PATH="$PATH" HOME="$HOME" \
|
||
DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR" \
|
||
DOMAIN=test.example.com \
|
||
EMAIL=test@example.com \
|
||
CF_API_TOKEN=cf-test-token \
|
||
${CDN_DOMAIN:+CDN_DOMAIN="$CDN_DOMAIN"} \
|
||
${XHTTP_PADDING:+XHTTP_PADDING="$XHTTP_PADDING"} \
|
||
${XPADDING_HEADER:+XPADDING_HEADER="$XPADDING_HEADER"} \
|
||
${XPADDING_KEY:+XPADDING_KEY="$XPADDING_KEY"} \
|
||
${ECH_CONFIG:+ECH_CONFIG="$ECH_CONFIG"} \
|
||
XRAY_UUID=11111111-1111-1111-1111-111111111111 \
|
||
XRAY_WS_UUID=22222222-2222-2222-2222-222222222222 \
|
||
XRAY_XHTTP_UUID=33333333-3333-3333-3333-333333333333 \
|
||
XRAY_PRIVATE_KEY=testPrivateKey \
|
||
XRAY_SHORT_ID=3f9a2b1c \
|
||
XHTTP_PATH=/xh88ab \
|
||
XHTTP_PORT=8080 \
|
||
HY2_PASSWORD=hy2-test-password \
|
||
HY2_MASQUERADE_URL=https://engineersblog.net \
|
||
ENV_FILE="$DRY_DIR/nonexistent-default.env" \
|
||
bash "$SCRIPT" ${1:-}
|
||
}
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 2 断言：setup.env
|
||
# ---------------------------------------------------------------------------
|
||
OUT="$(run_dry)"
|
||
[ -f "$DRY_DIR/setup.env" ] || fail "setup.env 未生成"
|
||
pass "setup.env 已生成"
|
||
assert_contains "$DRY_DIR/setup.env" "DOMAIN=test.example.com" "setup.env 含 DOMAIN"
|
||
assert_contains "$DRY_DIR/setup.env" "BASE_DOMAIN=example.com" "BASE_DOMAIN 自动去掉首段子域名"
|
||
assert_contains "$DRY_DIR/setup.env" "XRAY_PRIVATE_KEY=testPrivateKey" "setup.env 含私钥"
|
||
mode="$(stat -c %a "$DRY_DIR/setup.env")"
|
||
[ "$mode" = "600" ] || fail "setup.env 权限应为 600，实际 $mode"
|
||
pass "setup.env 权限 600"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 2 断言：只给必填项，其余自动生成
|
||
# ---------------------------------------------------------------------------
|
||
DRY_DIR2="$(mktemp -d)"
|
||
trap 'rm -rf "$DRY_DIR" "$DRY_DIR2"' EXIT
|
||
env -i PATH="$PATH" HOME="$HOME" \
|
||
DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR2" \
|
||
DOMAIN=auto.example.org CF_API_TOKEN=tok \
|
||
ENV_FILE="$DRY_DIR2/none.env" \
|
||
bash "$SCRIPT" >/dev/null
|
||
grep -qE '^XRAY_UUID=[0-9a-f-]{36}$' "$DRY_DIR2/setup.env" || fail "XRAY_UUID 应自动生成"
|
||
pass "XRAY_UUID 自动生成"
|
||
grep -qE '^HY2_PASSWORD=[0-9a-f]{32}$' "$DRY_DIR2/setup.env" || fail "HY2_PASSWORD 应自动生成 32 位 hex"
|
||
pass "HY2_PASSWORD 自动生成"
|
||
grep -qE '^XHTTP_PATH=/[0-9a-f]{8}$' "$DRY_DIR2/setup.env" || fail "XHTTP_PATH 应自动生成 /8hex"
|
||
pass "XHTTP_PATH 自动生成"
|
||
grep -qE '^EMAIL=admin@example\.org$' "$DRY_DIR2/setup.env" || fail "EMAIL 默认 admin@BASE_DOMAIN"
|
||
pass "EMAIL 默认值"
|
||
|
||
# 缺 DOMAIN 且无 tty 应报错退出
|
||
if env -i PATH="$PATH" HOME="$HOME" DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR2" \
|
||
ENV_FILE="$DRY_DIR2/none.env" bash "$SCRIPT" >/dev/null 2>&1; then
|
||
fail "缺 DOMAIN 应退出非零"
|
||
fi
|
||
pass "缺 DOMAIN 报错退出"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 3 断言：Caddyfile
|
||
# ---------------------------------------------------------------------------
|
||
CF="$DRY_DIR/Caddyfile"
|
||
[ -f "$CF" ] || fail "Caddyfile 未生成"
|
||
assert_contains "$CF" "email test@example.com" "Caddyfile email 替换"
|
||
assert_contains "$CF" "test.example.com {" "Caddyfile 站点域名替换"
|
||
assert_contains "$CF" "path /xh88ab /xh88ab/*" "Caddyfile 含 \@xhttppaths"
|
||
assert_contains "$CF" "not path /portainer /portainer/* /scilad /scilad/* /xh88ab /xh88ab/*" \
|
||
"\@notpaths 排除 XHTTP 路径"
|
||
assert_contains "$CF" "reverse_proxy @xhttppaths 127.0.0.1:8080" "XHTTP 反代到 8080"
|
||
assert_contains "$CF" "servers 127.0.0.1:8003" "8003 PROXY protocol 监听"
|
||
assert_contains "$CF" "reverse_proxy @websockets 127.0.0.1:54442" "WS 反代到 54442"
|
||
assert_contains "$CF" "@acme_challenge path /.well-known/acme-challenge/*" "hy2 HTTP-01 challenge 匹配器"
|
||
assert_contains "$CF" "handle @acme_challenge" "challenge 反代 handle"
|
||
assert_contains "$CF" "reverse_proxy 127.0.0.1:9180" "challenge 反代到 hy2 altPort"
|
||
assert_contains "$CF" "@no_acme_challenge not path /.well-known/acme-challenge/*" "redir 排除 challenge 路径"
|
||
assert_contains "$CF" "redir @no_acme_challenge https://{host}:443{uri} permanent" "redir 带匹配器（防通吃）"
|
||
assert_contains "$CF" "auto_https disable_redirects" "关闭自动重定向（防运行时注入的路由 308 走 challenge）"
|
||
assert_not_contains "$CF" "alpn h3" "TCP 监听器不得通告 h3（防客户端 ALPN 误协商挂死）"
|
||
assert_not_contains "$CF" "handle_path /scilad" "WS 路由不得剥离 /scilad 前缀（xray path 要匹配）"
|
||
assert_not_contains "$CF" "xxx.yyy.zzz" "无残留占位域名"
|
||
assert_not_contains "$CF" "__DOMAIN__" "无残留占位符"
|
||
assert_not_contains "$CF" "cdn.example.com" "未设 CDN_DOMAIN 时无第二站点块"
|
||
|
||
# 设 CDN_DOMAIN 时应多出第二个站点块（run_dry 渲染到 $DRY_DIR）
|
||
CDN_DOMAIN=cdn.example.com run_dry >/dev/null
|
||
assert_contains "$DRY_DIR/Caddyfile" "cdn.example.com {" "CDN 站点块存在"
|
||
assert_contains "$DRY_DIR/Caddyfile" "test.example.com {" "主站点块仍存在"
|
||
|
||
# 可选活测试：本机有 caddy 二进制时，验证 80 端口块路由行为
|
||
# （事故背景 1：bare redir 排在 handle 前通吃 challenge 请求，LE 验证被 301 走；
|
||
# 事故背景 2：Caddy 为管理证书的域名在运行时注入自动 HTTP→HTTPS 重定向路由
|
||
# ——静态 adapt 输出不可见——把 hy2 的 challenge token 308 到 443。必须带一个
|
||
# 被管理证书的站点块才能复现，且全局块必须保留 auto_https disable_redirects）
|
||
if command -v caddy >/dev/null 2>&1; then
|
||
LIVE="$(mktemp -d)"
|
||
pkill -f 'MOCK_HY2_TOKEN' 2>/dev/null || true
|
||
python3 - "$DRY_DIR/Caddyfile" "$LIVE/Caddyfile" <<'PYEOF'
|
||
import sys
|
||
content = open(sys.argv[1]).read()
|
||
|
||
def extract_top_block(text, start):
|
||
depth = 0
|
||
for i in range(start, len(text)):
|
||
if text[i] == '{': depth += 1
|
||
elif text[i] == '}':
|
||
depth -= 1
|
||
if depth == 0: return text[start:i+1]
|
||
raise ValueError('unbalanced braces')
|
||
|
||
# 全局块（含 auto_https disable_redirects；8003 重映射避免占用本机端口，
|
||
# 补 http_port 使自动重定向注入目标端口与 http:// 站点一致——若有人移除
|
||
# disable_redirects，本测试会精确复现线上的 308 而非 caddy 起不来）
|
||
gstart = content.index('{')
|
||
gblock = extract_top_block(content, gstart).replace('8003', '18003')
|
||
gblock = gblock.replace('https_port 18003', 'https_port 18003\n http_port 18088')
|
||
|
||
# http:// 站点块
|
||
hstart = content.index('http:// {')
|
||
hblock = extract_top_block(content, hstart).replace('http:// {', 'http://:18088 {', 1).replace('9180', '19180')
|
||
|
||
# 被管理证书的站点块：触发 Caddy 运行时自动重定向注入，复现线上条件
|
||
managed = 'test.example.com {\n\tbind 127.0.0.1\n\ttls internal\n\trespond "managed ok"\n}\n'
|
||
|
||
open(sys.argv[2], 'w').write(gblock + '\n' + hblock + '\n' + managed)
|
||
PYEOF
|
||
python3 -c "
|
||
from http.server import BaseHTTPRequestHandler, HTTPServer
|
||
class H(BaseHTTPRequestHandler):
|
||
def do_GET(self):
|
||
body = b'MOCK_HY2_TOKEN'
|
||
self.send_response(200); self.send_header('Content-Length', str(len(body))); self.end_headers()
|
||
self.wfile.write(body)
|
||
def log_message(self, *a): pass
|
||
HTTPServer(('127.0.0.1', 19180), H).serve_forever()
|
||
" &
|
||
MOCK_PID=$!
|
||
caddy run --config "$LIVE/Caddyfile" --adapter caddyfile > "$LIVE/caddy.log" 2>&1 &
|
||
CADDY_PID=$!
|
||
sleep 2
|
||
code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 \
|
||
-H 'Host: test.example.com' 'http://127.0.0.1:18088/.well-known/acme-challenge/TOK' || true)"
|
||
[ "$code" = "200" ] || fail "challenge 路径应反代到 hy2（得到 $code，期望 200；若 308 则是 auto_https 自动重定向回归）"
|
||
pass "活测试：challenge 路径反代到 hy2（非 301/308）"
|
||
body="$(curl -s --max-time 5 -H 'Host: test.example.com' \
|
||
'http://127.0.0.1:18088/.well-known/acme-challenge/TOK' || true)"
|
||
[ "$body" = "MOCK_HY2_TOKEN" ] || fail "challenge 响应应来自 hy2 mock（得到 $body）"
|
||
pass "活测试：challenge 响应来自 hy2"
|
||
loc="$(curl -s -D- -o /dev/null --max-time 5 -H 'Host: test.example.com' \
|
||
'http://127.0.0.1:18088/other' | grep -i '^location:' || true)"
|
||
echo "$loc" | grep -qF 'https://test.example.com:443/other' || fail "其他路径应 301 到 443（得到 $loc）"
|
||
pass "活测试：其他路径 301 到 443"
|
||
kill "$MOCK_PID" "$CADDY_PID" 2>/dev/null || true
|
||
wait "$MOCK_PID" "$CADDY_PID" 2>/dev/null || true
|
||
rm -rf "$LIVE"
|
||
else
|
||
echo "[skip] 无 caddy 二进制，跳过 80 端口块活测试（CADDY 放入 PATH 可启用）"
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 4 断言：xray config.json
|
||
# ---------------------------------------------------------------------------
|
||
CDN_DOMAIN= run_dry >/dev/null # 重新渲染不带 CDN 的干净版本
|
||
XJ="$DRY_DIR/config.json"
|
||
[ -f "$XJ" ] || fail "xray config.json 未生成"
|
||
python3 -m json.tool "$XJ" >/dev/null || fail "config.json 不是合法 JSON"
|
||
pass "config.json 是合法 JSON"
|
||
assert_contains "$XJ" '"id": "11111111-1111-1111-1111-111111111111"' "REALITY UUID"
|
||
assert_contains "$XJ" '"id": "22222222-2222-2222-2222-222222222222"' "WS UUID"
|
||
assert_contains "$XJ" '"id": "33333333-3333-3333-3333-333333333333"' "XHTTP UUID"
|
||
assert_contains "$XJ" '"privateKey": "testPrivateKey"' "REALITY 私钥"
|
||
assert_contains "$XJ" '"3f9a2b1c"' "shortId"
|
||
assert_contains "$XJ" '"test.example.com"' "serverNames"
|
||
assert_contains "$XJ" '"dest": "8003"' "REALITY 回落 dest"
|
||
assert_contains "$XJ" '"xver": 1' "xver 1（PROXY protocol）"
|
||
assert_contains "$XJ" '"network": "ws"' "WS inbound"
|
||
assert_contains "$XJ" '"path": "/scilad"' "WS path"
|
||
assert_contains "$XJ" '"network": "xhttp"' "XHTTP inbound"
|
||
assert_contains "$XJ" '"port": 8080' "XHTTP 端口"
|
||
assert_contains "$XJ" '"path": "/xh88ab"' "XHTTP path"
|
||
assert_contains "$XJ" '"mode": "auto"' "XHTTP mode auto"
|
||
assert_contains "$XJ" '"xPaddingObfsMode": true' "默认 XHTTP 带 extra/padding 块（XHTTP_PADDING 默认开）"
|
||
assert_contains "$XJ" '"bittorrent"' "bittorrent 阻断"
|
||
assert_not_contains "$XJ" "__XRAY_VLESS_DECRYPTION__" "无残留占位符"
|
||
assert_not_contains "$XJ" "__XRAY_UUID__" "无残留占位符"
|
||
assert_not_contains "$XJ" "__XHTTP_EXTRA__" "XHTTP_EXTRA 占位符已展开"
|
||
|
||
# XHTTP_PADDING=1：服务端渲染 extra 块、链接带 extra= 参数
|
||
XHTTP_PADDING=1 XPADDING_HEADER=X-aa XPADDING_KEY=_bb run_dry >/dev/null
|
||
XJP="$DRY_DIR/config.json"
|
||
assert_contains "$XJP" '"xPaddingObfsMode": true' "padding 开启：extra 块渲染"
|
||
assert_contains "$XJP" '"xPaddingHeader": "X-aa"' "padding 开启：header"
|
||
assert_contains "$XJP" '"xPaddingKey": "_bb"' "padding 开启：key"
|
||
python3 -m json.tool "$XJP" >/dev/null || fail "padding 开启后 config.json 不是合法 JSON"
|
||
pass "padding 开启后 JSON 合法"
|
||
OUTP="$(XHTTP_PADDING=1 XPADDING_HEADER=X-aa XPADDING_KEY=_bb run_dry)"
|
||
echo "$OUTP" | grep -qF '&extra=' || fail "padding 开启：链接应带 extra= 参数"
|
||
pass "padding 开启：链接带 extra 参数"
|
||
# extra 参数 URL 解码后应是合法 JSON 且含键名
|
||
extra_enc="$(printf '%s\n' "$OUTP" | grep -o 'extra=[^#]*' | head -1 | sed 's/^extra=//')"
|
||
extra_json="$(python3 -c 'import sys,urllib.parse; print(urllib.parse.unquote(sys.argv[1]))' "$extra_enc")"
|
||
echo "$extra_json" | python3 -m json.tool >/dev/null || fail "extra 参数解码后不是合法 JSON"
|
||
echo "$extra_json" | grep -qF '"xPaddingHeader":"X-aa"' || fail "extra JSON 缺 padding header"
|
||
pass "padding 开启：extra 参数为合法编码 JSON"
|
||
# setup.env 持久化 XHTTP_PADDING 与键名
|
||
assert_contains "$DRY_DIR/setup.env" "XHTTP_PADDING=1" "setup.env 持久化 XHTTP_PADDING"
|
||
assert_contains "$DRY_DIR/setup.env" "XPADDING_HEADER=X-aa" "setup.env 持久化 padding header"
|
||
|
||
# XHTTP_PADDING=0：服务端无 extra 块、链接不带 extra= 参数
|
||
XHTTP_PADDING=0 run_dry >/dev/null
|
||
assert_not_contains "$DRY_DIR/config.json" '"xPaddingObfsMode"' "padding=0：服务端无 extra 块"
|
||
OUT0="$(XHTTP_PADDING=0 run_dry)"
|
||
if printf '%s\n' "$OUT0" | grep -qF '&extra='; then fail "padding=0：链接不应带 extra= 参数"; fi
|
||
pass "padding=0：链接不带 extra 参数"
|
||
assert_contains "$DRY_DIR/setup.env" "XHTTP_PADDING=0" "setup.env 持久化 XHTTP_PADDING=0"
|
||
run_dry >/dev/null # 恢复默认渲染，供后续断言用
|
||
|
||
# 默认不开启 VLESS 加密：decryption 为 none，链接 encryption=none
|
||
n="$(grep -c '"decryption": "none"' "$XJ")"
|
||
[ "$n" = "3" ] || fail "默认三个 inbound 的 decryption 应为 none（实际 $n 处）"
|
||
pass "默认 decryption=none ×3"
|
||
echo "$OUT" | grep -qF "encryption=none&flow=xtls-rprx-vision" || fail "默认链接应 encryption=none"
|
||
pass "默认链接 encryption=none"
|
||
|
||
# 开启 XRAY_VLESS_ENC：DRY_RUN 用占位密钥串
|
||
DRY_DIR6="$(mktemp -d)"
|
||
trap 'rm -rf "$DRY_DIR" "$DRY_DIR2" "$DRY_DIR4" "$DRY_DIR5" "$DRY_DIR6"' EXIT
|
||
OUT6="$(env -i PATH="$PATH" HOME="$HOME" \
|
||
DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR6" \
|
||
DOMAIN=test.example.com XRAY_VLESS_ENC=1 \
|
||
ENV_FILE="$DRY_DIR6/none.env" \
|
||
bash "$SCRIPT")"
|
||
n="$(grep -c '"decryption": "DRYRUN_VLESS_DECRYPTION"' "$DRY_DIR6/config.json")"
|
||
[ "$n" = "3" ] || fail "开启后三个 inbound 应用 vlessenc decryption（实际 $n 处）"
|
||
pass "XRAY_VLESS_ENC=1 时 decryption 替换 ×3"
|
||
python3 -m json.tool "$DRY_DIR6/config.json" >/dev/null || fail "vlessenc 开启后 config.json 不是合法 JSON"
|
||
pass "vlessenc 开启后 JSON 合法"
|
||
echo "$OUT6" | grep -qF "encryption=DRYRUN_VLESS_ENCRYPTION&flow=xtls-rprx-vision" \
|
||
|| fail "开启后 REALITY 链接应带 vlessenc encryption"
|
||
pass "REALITY 链接带后量子 encryption"
|
||
grep -qF "XRAY_VLESS_DECRYPTION=DRYRUN_VLESS_DECRYPTION" "$DRY_DIR6/setup.env" \
|
||
|| fail "setup.env 应保存 vlessenc 密钥"
|
||
pass "vlessenc 密钥持久化到 setup.env"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 5 断言：hysteria config.yaml（默认 http 模式）
|
||
# ---------------------------------------------------------------------------
|
||
HY="$DRY_DIR/config.yaml"
|
||
[ -f "$HY" ] || fail "hysteria config.yaml 未生成"
|
||
assert_contains "$HY" "listen: :8443" "hy2 监听 8443"
|
||
assert_contains "$HY" '- "test.example.com"' "hy2 证书域名（非通配 DOMAIN）"
|
||
assert_contains "$HY" "email: test@example.com" "hy2 ACME email"
|
||
assert_contains "$HY" "type: http" "hy2 默认 HTTP-01"
|
||
assert_contains "$HY" "listenHost: 127.0.0.1" "hy2 challenge 仅监听回环"
|
||
assert_contains "$HY" "altPort: 9180" "hy2 challenge altPort"
|
||
assert_contains "$HY" "dir: /etc/hysteria/acme_certs" "hy2 证书目录"
|
||
assert_contains "$HY" "password: hy2-test-password" "hy2 密码"
|
||
assert_contains "$HY" "url: https://engineersblog.net" "hy2 伪装 url"
|
||
assert_contains "$HY" "rewriteHost: true" "hy2 rewriteHost"
|
||
assert_not_contains "$HY" "__BASE_DOMAIN__" "无残留占位符"
|
||
assert_not_contains "$HY" "cloudflare_api_token" "http 模式不含 CF token"
|
||
|
||
# dns 备选模式：渲染 dns 块
|
||
DRY_DIR4="$(mktemp -d)"
|
||
trap 'rm -rf "$DRY_DIR" "$DRY_DIR2" "$DRY_DIR4"' EXIT
|
||
env -i PATH="$PATH" HOME="$HOME" \
|
||
DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR4" \
|
||
DOMAIN=test.example.com EMAIL=test@example.com \
|
||
HY2_CERT_MODE=dns CF_API_TOKEN=cf-test-token \
|
||
ENV_FILE="$DRY_DIR4/none.env" \
|
||
bash "$SCRIPT" >/dev/null
|
||
assert_contains "$DRY_DIR4/config.yaml" "type: dns" "dns 模式 type"
|
||
assert_contains "$DRY_DIR4/config.yaml" '"*.example.com"' "dns 模式通配符域名"
|
||
assert_contains "$DRY_DIR4/config.yaml" "cloudflare_api_token: cf-test-token" "dns 模式 CF token"
|
||
assert_not_contains "$DRY_DIR4/Caddyfile" "acme-challenge" "dns 模式不加 challenge 路由"
|
||
|
||
# dns 模式缺 CF_API_TOKEN 应报错
|
||
if env -i PATH="$PATH" HOME="$HOME" \
|
||
DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR4" \
|
||
DOMAIN=test.example.com HY2_CERT_MODE=dns \
|
||
ENV_FILE="$DRY_DIR4/none2.env" \
|
||
bash "$SCRIPT" >/dev/null 2>&1; then
|
||
fail "dns 模式缺 CF_API_TOKEN 应退出非零"
|
||
fi
|
||
pass "dns 模式缺 CF_API_TOKEN 报错退出"
|
||
|
||
# SKIP_CADDY + http 模式：hy2 直占 80（standalone），不报错
|
||
DRY_DIR5="$(mktemp -d)"
|
||
trap 'rm -rf "$DRY_DIR" "$DRY_DIR2" "$DRY_DIR4" "$DRY_DIR5"' EXIT
|
||
env -i PATH="$PATH" HOME="$HOME" \
|
||
DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR5" \
|
||
DOMAIN=test.example.com EMAIL=test@example.com \
|
||
SKIP_CADDY=1 \
|
||
ENV_FILE="$DRY_DIR5/none.env" \
|
||
bash "$SCRIPT" >/dev/null || fail "SKIP_CADDY=1 + http 模式应可干跑"
|
||
pass "SKIP_CADDY=1 + http 模式正常（standalone）"
|
||
assert_contains "$DRY_DIR5/config.yaml" "altPort: 80" "standalone 直占 80"
|
||
assert_not_contains "$DRY_DIR5/config.yaml" "listenHost" "standalone 不限回环"
|
||
[ ! -f "$DRY_DIR5/Caddyfile" ] || fail "SKIP_CADDY=1 不应渲染 Caddyfile"
|
||
pass "SKIP_CADDY=1 不渲染 Caddyfile"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 6 断言：nftables
|
||
# ---------------------------------------------------------------------------
|
||
NFT="$DRY_DIR/hysteria.nft"
|
||
[ -f "$NFT" ] || fail "hysteria.nft 未生成"
|
||
assert_contains "$NFT" "table inet hysteria_nat" "nft 表名"
|
||
assert_contains "$NFT" "udp dport 20000-30000 redirect to :8443" "端口跳跃 redirect"
|
||
NFTCONF="$DRY_DIR/nftables.conf"
|
||
[ -f "$NFTCONF" ] || fail "nftables.conf（干跑渲染）未生成"
|
||
assert_contains "$NFTCONF" 'include "/etc/nftables/hysteria.nft"' "include 行"
|
||
# 再跑两次，include 行不应重复
|
||
run_dry >/dev/null; run_dry >/dev/null
|
||
n="$(grep -cF 'include "/etc/nftables/hysteria.nft"' "$NFTCONF")"
|
||
[ "$n" = "1" ] || fail "include 行重复（$n 次）"
|
||
pass "include 行幂等（重复运行不追加）"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Task 7 断言：print_summary 分享链接 + uninstall 干跑
|
||
# ---------------------------------------------------------------------------
|
||
OUT="$(CDN_DOMAIN=cdn.example.com run_dry)"
|
||
echo "$OUT" | grep -qF "vless://11111111-1111-1111-1111-111111111111@test.example.com:443?encryption=none&flow=xtls-rprx-vision&security=reality" \
|
||
|| fail "缺 REALITY 链接"
|
||
pass "REALITY 分享链接"
|
||
echo "$OUT" | grep -qF "pbk=DRYRUN_PUBLIC_KEY&sid=3f9a2b1c" || fail "REALITY 链接缺 pbk/sid"
|
||
pass "REALITY 链接 pbk/sid"
|
||
echo "$OUT" | grep -qF "vless://22222222-2222-2222-2222-222222222222@test.example.com:443" || fail "缺 WS 链接"
|
||
pass "WS 分享链接"
|
||
echo "$OUT" | grep -qF "path=%2Fscilad" || fail "WS 链接 path 未编码"
|
||
pass "WS path URL 编码"
|
||
echo "$OUT" | grep -qF "vless://33333333-3333-3333-3333-333333333333@test.example.com:443" || fail "缺 XHTTP 链接"
|
||
pass "XHTTP 分享链接"
|
||
echo "$OUT" | grep -qF "path=%2Fxh88ab&mode=auto" || fail "XHTTP 链接 path/mode 不对"
|
||
pass "XHTTP path/mode"
|
||
echo "$OUT" | grep -qF "vless://33333333-3333-3333-3333-333333333333@cdn.example.com:443" || fail "缺 CDN XHTTP 链接"
|
||
pass "CDN XHTTP 分享链接"
|
||
echo "$OUT" | grep -qF "vless://22222222-2222-2222-2222-222222222222@cdn.example.com:443" || fail "缺 CDN WS 链接"
|
||
pass "CDN WS 分享链接"
|
||
# 默认：两条 CDN 链接内嵌动态查询形式的 ech=（"域名+DoH"，URL 编码）
|
||
n_ech="$(printf '%s\n' "$OUT" | grep -cF 'ech=cdn.example.com%2Budp%3A%2F%2F9.9.9.9' || true)"
|
||
[ "$n_ech" = "2" ] || fail "两条 CDN 链接应默认带动态 ech= 参数（实际 $n_ech/2）"
|
||
pass "CDN 链接默认内嵌 ECH 动态查询串"
|
||
# ECH_CONFIG 手动指定时原样嵌入（静态 base64 快照的 +/= 需 URL 编码）
|
||
OUTE="$(CDN_DOMAIN=cdn.example.com ECH_CONFIG='AEX+DQB/==' run_dry)"
|
||
n_ech="$(printf '%s\n' "$OUTE" | grep -cF 'ech=AEX%2BDQB%2F%3D%3D' || true)"
|
||
[ "$n_ech" = "2" ] || fail "两条 CDN 链接应带编码后的 ech= 参数（实际 $n_ech/2）"
|
||
pass "ECH_CONFIG 静态快照原样嵌入（URL 编码）"
|
||
# ECH_CONFIG=off：链接不带 ech=
|
||
OUTO="$(CDN_DOMAIN=cdn.example.com ECH_CONFIG=off run_dry)"
|
||
if printf '%s\n' "$OUTO" | grep -qF '&ech='; then fail "ECH_CONFIG=off 时链接不应带 ech="; fi
|
||
pass "ECH_CONFIG=off 关闭 ech 参数"
|
||
# 全部 TLS 链接（ws/xhttp，直连+CDN 共 4 条）必须显式带 uTLS 指纹，避免 Go 原生指纹被识别
|
||
n_fp="$(printf '%s\n' "$OUT" | grep -c 'security=tls.*fp=chrome' || true)"
|
||
[ "$n_fp" = "4" ] || fail "TLS 链接应全部带 fp=chrome（实际 $n_fp/4）"
|
||
pass "TLS 链接全部带 fp=chrome"
|
||
echo "$OUT" | grep -qF "hysteria2://hy2-test-password@test.example.com:8443/?mport=20000-30000&sni=test.example.com" \
|
||
|| fail "缺 hy2 链接（http 模式 sni=DOMAIN）"
|
||
pass "hysteria2 分享链接（sni=DOMAIN）"
|
||
|
||
# 无 CDN_DOMAIN 时不应有 CDN 链接
|
||
OUT="$(CDN_DOMAIN= run_dry)"
|
||
if echo "$OUT" | grep -qF "xhttp-cdn"; then fail "未设 CDN_DOMAIN 不应有 CDN 链接"; fi
|
||
pass "无 CDN_DOMAIN 无 CDN 链接"
|
||
|
||
# uninstall 干跑不报错
|
||
env -i PATH="$PATH" HOME="$HOME" DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR" \
|
||
ACTION=uninstall NFTABLES_CONF="$DRY_DIR/nftables.conf" \
|
||
bash "$SCRIPT" >/dev/null || fail "ACTION=uninstall DRY_RUN 应正常退出"
|
||
pass "uninstall 干跑正常退出"
|
||
# uninstall 应删掉 include 行
|
||
if grep -qF 'include "/etc/nftables/hysteria.nft"' "$DRY_DIR/nftables.conf"; then
|
||
fail "uninstall 未删除 include 行"
|
||
fi
|
||
pass "uninstall 删除 include 行"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# ACTION=upgrade
|
||
# ---------------------------------------------------------------------------
|
||
# 未安装过（无 setup.env）应报错
|
||
if env -i PATH="$PATH" HOME="$HOME" DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR2" \
|
||
ACTION=upgrade ENV_FILE="$DRY_DIR2/definitely-not-there.env" \
|
||
bash "$SCRIPT" >/dev/null 2>&1; then
|
||
fail "upgrade 无 setup.env 应退出非零"
|
||
fi
|
||
pass "upgrade 无安装时报错"
|
||
|
||
# 有 setup.env 时正常干跑（沿用已保存参数，不交互）
|
||
env -i PATH="$PATH" HOME="$HOME" DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR" \
|
||
ACTION=upgrade ENV_FILE="$DRY_DIR/setup.env" \
|
||
bash "$SCRIPT" >/dev/null || fail "upgrade 干跑应正常退出"
|
||
pass "upgrade 干跑正常退出"
|
||
assert_contains "$DRY_DIR/config.json" '"id": "11111111-1111-1111-1111-111111111111"' \
|
||
"upgrade 沿用已保存 UUID（不重新生成）"
|
||
|
||
# 旧版 setup.env（无 HY2_CERT_MODE，有 CF_API_TOKEN）→ 推断 dns，保持原形态
|
||
DRY_DIR7="$(mktemp -d)"
|
||
trap 'rm -rf "$DRY_DIR" "$DRY_DIR2" "$DRY_DIR4" "$DRY_DIR5" "$DRY_DIR6" "$DRY_DIR7" "$MOCK_BIN"' EXIT
|
||
printf 'DOMAIN=legacy.example.com\nEMAIL=a@b.c\nCF_API_TOKEN=old-token\n' > "$DRY_DIR7/old.env"
|
||
env -i PATH="$PATH" HOME="$HOME" DRY_RUN=1 DRY_RUN_DIR="$DRY_DIR7" \
|
||
ACTION=upgrade ENV_FILE="$DRY_DIR7/old.env" \
|
||
bash "$SCRIPT" >/dev/null || fail "旧版 setup.env 升级应正常"
|
||
assert_contains "$DRY_DIR7/config.yaml" "type: dns" "旧版参数升级保持 dns 证书模式"
|
||
assert_contains "$DRY_DIR7/config.yaml" '"*.example.com"' "旧版升级保持通配符证书"
|
||
|
||
echo
|
||
echo "全部测试通过"
|