test: add e2e-tests for boundary CLI

Author: evgeniy-scherbina

e2e_tests/boundary_integration_test.go

@@ -0,0 +1,129 @@
+package e2e_tests
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// getNamespaceName gets the single network namespace name
+// Fails if there are 0 or multiple namespaces
+func getNamespaceName(t *testing.T) string {
+	cmd := exec.Command("ip", "netns", "list")
+	output, err := cmd.Output()
+	require.NoError(t, err, "Failed to list network namespaces")
+
+	lines := strings.Split(string(output), "\n")
+	var namespaces []string
+
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line != "" {
+			// Extract namespace name (first field)
+			parts := strings.Fields(line)
+			if len(parts) > 0 {
+				namespaces = append(namespaces, parts[0])
+			}
+		}
+	}
+
+	require.Len(t, namespaces, 1, "Expected exactly one network namespace, found %d: %v", len(namespaces), namespaces)
+	return namespaces[0]
+}
+
+func TestBoundaryIntegration(t *testing.T) {
+	// Build the boundary binary
+	buildCmd := exec.Command("go", "build", "-o", "/tmp/boundary-test", "./cmd/...")
+	buildCmd.Dir = "/home/coder/boundary"
+	err := buildCmd.Run()
+	require.NoError(t, err, "Failed to build boundary binary")
+
+	// Create context for boundary process
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	// Start boundary process with sudo
+	boundaryCmd := exec.CommandContext(ctx, "/tmp/boundary-test",
+		"--allow", "dev.coder.com",
+		"--allow", "jsonplaceholder.typicode.com",
+		"--log-level", "debug",
+		"--", "bash", "-c", "sleep 10 && echo 'Test completed'")
+
+	// Suppress output to prevent terminal corruption
+	boundaryCmd.Stdout = os.Stdout // Let it go to /dev/null
+	boundaryCmd.Stderr = os.Stderr
+
+	// Start the process
+	err = boundaryCmd.Start()
+	require.NoError(t, err, "Failed to start boundary process")
+
+	// Give boundary time to start
+	time.Sleep(2 * time.Second)
+
+	// Get the namespace name that boundary created
+	namespaceName := getNamespaceName(t)
+
+	// Test HTTP request through boundary (from inside the jail)
+	t.Run("HTTPRequestThroughBoundary", func(t *testing.T) {
+		// Run curl directly in the namespace using ip netns exec
+		curlCmd := exec.Command("sudo", "ip", "netns", "exec", namespaceName,
+			"curl", "-s", "http://jsonplaceholder.typicode.com/todos/1")
+
+		// Capture output
+		output, err := curlCmd.Output()
+		require.NoError(t, err, "curl command failed")
+
+		// Verify response contains expected content
+		expectedResponse := `{
+  "userId": 1,
+  "id": 1,
+  "title": "delectus aut autem",
+  "completed": false
+}`
+		require.Equal(t, expectedResponse, string(output))
+	})
+
+	// Test HTTPS request through boundary (from inside the jail)
+	t.Run("HTTPSRequestThroughBoundary", func(t *testing.T) {
+		// Run curl directly in the namespace using ip netns exec
+		// TODO(yevhenii): remove env
+		curlCmd := exec.Command("sudo", "ip", "netns", "exec", namespaceName,
+			"env", "SSL_CERT_FILE=/home/coder/.config/coder_boundary/ca-cert.pem", "curl", "-s", "https://dev.coder.com/api/v2")
+
+		// Capture output
+		output, err := curlCmd.Output()
+		require.NoError(t, err, "curl command failed")
+
+		// Verify response contains expected content
+		expectedResponse := `{"message":"👋"}
+`
+		require.Equal(t, expectedResponse, string(output))
+	})
+
+	// Test blocked domain (from inside the jail)
+	t.Run("BlockedDomainTest", func(t *testing.T) {
+		// Run curl directly in the namespace using ip netns exec
+		curlCmd := exec.Command("sudo", "ip", "netns", "exec", namespaceName,
+			"curl", "-s", "http://example.com")
+
+		// This should fail
+		output, err := curlCmd.Output()
+		require.NoError(t, err, "curl command failed")
+		require.Contains(t, string(output), "Request Blocked by Boundary")
+	})
+
+	// Clean up
+	cancel()                 // This will terminate the boundary process
+	err = boundaryCmd.Wait() // Wait for process to finish
+	if err != nil {
+		t.Logf("Boundary process finished with error: %v", err)
+	}
+
+	// Clean up binary
+	os.Remove("/tmp/boundary-test")
+}

jail/linux.go

@@ -75,10 +75,10 @@ func (l *LinuxJail) Start() error {
 func (l *LinuxJail) Command(command []string) *exec.Cmd {
 	l.logger.Debug("Creating command with namespace", "namespace", l.namespace)
 
-	cmdArgs := []string{"ip", "netns", "exec", l.namespace}
+	cmdArgs := []string{"netns", "exec", l.namespace}
 	cmdArgs = append(cmdArgs, command...)
 
-	cmd := exec.Command("sudo", cmdArgs...)
+	cmd := exec.Command("ip", cmdArgs...)
 	cmd.Env = l.commandEnv
 
 	return cmd