fips_setup/scripts/test-connectivity.sh

#!/bin/bash
# ==============================================================================
# test-connectivity.sh
#
# Unified connectivity tests for sys-fips.
#
# Modes:
#   --local   tests expected to run in sys-fips
#   --appvm   tests expected to run in an AppVM routed via sys-fips
#   --full    run everything reasonably applicable (default)
# ==============================================================================
set -euo pipefail

MODE="${1:---full}"
PASSED=0
FAILED=0
SKIPPED=0

GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[0;33m'
NC='\033[0m'

pass() { echo -e "${GREEN}PASS${NC}: $1"; PASSED=$((PASSED + 1)); }
fail() { echo -e "${RED}FAIL${NC}: $1"; FAILED=$((FAILED + 1)); }
skip() { echo -e "${YELLOW}SKIP${NC}: $1"; SKIPPED=$((SKIPPED + 1)); }

is_sys_fips=false
if ip link show fips0 >/dev/null 2>&1 || [ -f /etc/systemd/system/fips.service ]; then
    is_sys_fips=true
fi

echo "=== FIPS Connectivity Test ($MODE) ==="
echo ""

run_local_tests() {
    if command -v fips >/dev/null 2>&1; then
        pass "fips binary installed"
    else
        fail "fips binary missing"
    fi

    if systemctl is-active --quiet fips 2>/dev/null; then
        pass "fips service active"
    else
        fail "fips service not active"
    fi

    if ip link show fips0 >/dev/null 2>&1; then
        pass "fips0 exists"
        IPV6=$(ip -6 addr show fips0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
        if [ -n "${IPV6:-}" ]; then
            pass "fips0 has IPv6 (${IPV6})"
        else
            fail "fips0 has no global IPv6"
        fi
    else
        fail "fips0 missing"
    fi

    if ip -6 route show | grep -q 'fd00::/8'; then
        pass "fd00::/8 route present"
    else
        fail "fd00::/8 route missing"
    fi

    if pgrep -x dnsmasq >/dev/null 2>&1; then
        pass "dnsmasq running"
    else
        fail "dnsmasq not running"
    fi

    if command -v nft >/dev/null 2>&1; then
        if nft list chain ip qubes dnat-dns >/dev/null 2>&1; then
            pass "nft chain exists: ip qubes dnat-dns"
            if nft list chain ip qubes dnat-dns | grep -F 'iifname "vif*" udp dport 53 dnat to 10.139.1.1:53' >/dev/null 2>&1; then
                pass "nft DNS DNAT rule present (UDP 53)"
            else
                fail "nft DNS DNAT rule missing (UDP 53)"
            fi
            if nft list chain ip qubes dnat-dns | grep -F 'iifname "vif*" tcp dport 53 dnat to 10.139.1.1:53' >/dev/null 2>&1; then
                pass "nft DNS DNAT rule present (TCP 53)"
            else
                fail "nft DNS DNAT rule missing (TCP 53)"
            fi
        else
            skip "nft chain missing: ip qubes dnat-dns"
        fi

        if nft list chain ip6 qubes-firewall forward >/dev/null 2>&1; then
            pass "nft chain exists: ip6 qubes-firewall forward"
            if nft list chain ip6 qubes-firewall forward | grep -F 'iifname "vif*" ip6 daddr fd00::/8 accept' >/dev/null 2>&1; then
                pass "nft forward rule present (vif* -> fd00::/8)"
            else
                fail "nft forward rule missing (vif* -> fd00::/8)"
            fi
            if nft list chain ip6 qubes-firewall forward | grep -F 'iifname "fips0" ip6 saddr fd00::/8 accept' >/dev/null 2>&1; then
                pass "nft forward rule present (fips0 -> fd00::/8)"
            else
                fail "nft forward rule missing (fips0 -> fd00::/8)"
            fi
        else
            skip "nft chain missing: ip6 qubes-firewall forward"
        fi
    else
        skip "nft not installed"
    fi

    if dig @127.0.0.1 test.fips AAAA +time=2 >/dev/null 2>&1; then
        pass ".fips DNS query path reachable"
    else
        fail ".fips DNS query path failed"
    fi
}

run_appvm_tests() {
    GW=$(ip route show default 2>/dev/null | awk '{print $3}' | head -1)
    if [ -n "$GW" ]; then
        pass "default gateway present ($GW)"
    else
        fail "default gateway missing"
    fi

    if [ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null || echo 1)" = "0" ]; then
        pass "IPv6 enabled"
    else
        fail "IPv6 disabled"
    fi

    if command -v dig >/dev/null 2>&1; then
        STATUS=$(dig test.fips AAAA +time=3 2>&1 | grep 'status:' || true)
        if echo "$STATUS" | grep -qE 'NXDOMAIN|SERVFAIL|NOERROR'; then
            pass ".fips DNS forwarding path reachable"
        else
            fail ".fips DNS forwarding path unreachable"
        fi
    else
        skip "dig not installed"
    fi
}

case "$MODE" in
    --local)
        run_local_tests
        ;;
    --appvm)
        run_appvm_tests
        ;;
    --full)
        if [ "$is_sys_fips" = true ]; then
            run_local_tests
        else
            skip "local sys-fips checks skipped (not in sys-fips)"
        fi
        run_appvm_tests
        ;;
    *)
        echo "Usage: $0 [--local|--appvm|--full]"
        exit 1
        ;;
esac

echo ""
echo "Results: pass=$PASSED fail=$FAILED skip=$SKIPPED"

if [ "$FAILED" -gt 0 ]; then
    exit 1
fi