test: establish compatibility and security baselines

Author: Aethersailor

.github/workflows/build-dockerhub.yml

@@ -297,6 +297,10 @@ jobs:
           python3 scripts/verify_custom_openclash_rules_bundle.py \
             --root base/Custom_OpenClash_Rules
 
+      - name: Run Python regression baselines
+        shell: bash
+        run: python3 -m unittest discover -s tests -p 'test_*.py' -v
+
       - name: Set up Docker Buildx
         shell: bash
         run: |

.github/workflows/codeql.yml

@@ -250,8 +250,9 @@ jobs:
     - name: Build (manual)
       if: matrix.language == 'c-cpp'
       run: |
-        cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH=/usr/local
+        cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH=/usr/local -DBUILD_TESTS=ON
         cmake --build build -j$(nproc)
+        python3 scripts/run-test-suite.py --build-dir build --mode full
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4

CMakeLists.txt

@@ -89,6 +89,7 @@ ADD_EXECUTABLE(${BUILD_TARGET_NAME}
     src/handler/webget.cpp
     src/handler/proxy_policy.cpp
     src/handler/settings.cpp
+    src/handler/settings_snapshot.cpp
     src/handler/sub_request_key.cpp
     src/main.cpp
     src/parser/infoparser.cpp
@@ -227,6 +228,17 @@ IF(BUILD_TESTS)
         NAME custom_openclash_rules_bundle
         COMMAND ${Python3_EXECUTABLE}
                 ${CMAKE_SOURCE_DIR}/tests/test_custom_openclash_rules_bundle.py)
+    SET_TESTS_PROPERTIES(custom_openclash_rules_bundle PROPERTIES LABELS fast)
+
+    ADD_TEST(
+        NAME compatibility_security_baseline
+        COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_SOURCE_DIR}/tests/compatibility_security_baseline.py
+                --binary $<TARGET_FILE:${BUILD_TARGET_NAME}>)
+    SET_TESTS_PROPERTIES(compatibility_security_baseline PROPERTIES
+        LABELS full
+        TIMEOUT 120
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR})
 
     ADD_EXECUTABLE(proxy_policy_test
         tests/proxy_policy_test.cpp
@@ -237,6 +249,7 @@ IF(BUILD_TESTS)
     TARGET_INCLUDE_DIRECTORIES(proxy_policy_test PRIVATE src)
     TARGET_LINK_LIBRARIES(proxy_policy_test ${CMAKE_THREAD_LIBS_INIT})
     ADD_TEST(NAME proxy_policy COMMAND proxy_policy_test)
+    SET_TESTS_PROPERTIES(proxy_policy PROPERTIES LABELS fast)
 
     ADD_EXECUTABLE(custom_openclash_rules_test
         tests/custom_openclash_rules_test.cpp
@@ -254,13 +267,15 @@ IF(BUILD_TESTS)
         ${YAML_CPP_LIBRARY})
     ADD_TEST(NAME custom_openclash_rules COMMAND custom_openclash_rules_test)
     SET_TESTS_PROPERTIES(custom_openclash_rules PROPERTIES
+        LABELS fast
         WORKING_DIRECTORY ${CMAKE_SOURCE_DIR})
 
     ADD_EXECUTABLE(ruleset_options_test
         tests/ruleset_options_test.cpp
         src/config/ruleset.cpp)
     TARGET_INCLUDE_DIRECTORIES(ruleset_options_test PRIVATE src)
     ADD_TEST(NAME ruleset_options COMMAND ruleset_options_test)
+    SET_TESTS_PROPERTIES(ruleset_options PROPERTIES LABELS fast)
 
     ADD_EXECUTABLE(external_rules_test
         tests/external_rules_test.cpp
@@ -273,20 +288,23 @@ IF(BUILD_TESTS)
     TARGET_LINK_LIBRARIES(external_rules_test
         ${YAML_CPP_LIBRARY})
     ADD_TEST(NAME external_rules COMMAND external_rules_test)
+    SET_TESTS_PROPERTIES(external_rules PROPERTIES LABELS fast)
 
     ADD_EXECUTABLE(concurrency_primitives_test
         tests/concurrency_primitives_test.cpp)
     TARGET_INCLUDE_DIRECTORIES(concurrency_primitives_test PRIVATE src)
     TARGET_LINK_LIBRARIES(concurrency_primitives_test
         ${CMAKE_THREAD_LIBS_INIT})
     ADD_TEST(NAME concurrency_primitives COMMAND concurrency_primitives_test)
+    SET_TESTS_PROPERTIES(concurrency_primitives PROPERTIES LABELS fast)
 
     ADD_EXECUTABLE(sub_request_key_test
         tests/sub_request_key_test.cpp
         src/handler/sub_request_key.cpp
         src/utils/md5/md5.cpp)
     TARGET_INCLUDE_DIRECTORIES(sub_request_key_test PRIVATE src)
     ADD_TEST(NAME sub_request_key COMMAND sub_request_key_test)
+    SET_TESTS_PROPERTIES(sub_request_key PROPERTIES LABELS fast)
 
     ADD_EXECUTABLE(curl_handle_pool_test
         tests/curl_handle_pool_test.cpp
@@ -302,6 +320,17 @@ IF(BUILD_TESTS)
         TARGET_LINK_LIBRARIES(curl_handle_pool_test ws2_32)
     ENDIF()
     ADD_TEST(NAME curl_handle_pool COMMAND curl_handle_pool_test)
+    SET_TESTS_PROPERTIES(curl_handle_pool PROPERTIES LABELS fast)
+
+    ADD_EXECUTABLE(file_scope_test
+        tests/file_scope_test.cpp
+        src/utils/file.cpp
+        src/utils/string.cpp)
+    TARGET_INCLUDE_DIRECTORIES(file_scope_test PRIVATE src)
+    ADD_TEST(NAME file_scope COMMAND file_scope_test)
+    SET_TESTS_PROPERTIES(file_scope PROPERTIES
+        LABELS fast
+        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR})
 ENDIF()
 
 ELSE() #BUILD_STATIC_LIBRARY

scripts/ci/docker-build-args.sh

@@ -25,6 +25,7 @@ MIHOMO_CACHE_BUST="${MIHOMO_CACHE_BUST:-${DEPENDENCY_SNAPSHOT_SHA}}"
 SOURCE_DEPS_CACHE_BUST="${SOURCE_DEPS_CACHE_BUST:-${DEPENDENCY_SNAPSHOT_SHA}}"
 REFRESH_GO_DEPS="${REFRESH_GO_DEPS:-false}"
 REFRESH_HEADERS="${REFRESH_HEADERS:-false}"
+BUILD_TESTS="${BUILD_TESTS:-true}"
 
 cat <<EOF
 THREADS=${THREADS}
@@ -50,4 +51,5 @@ DEBIAN_TRIXIE_IMAGE=${DEBIAN_TRIXIE_IMAGE}
 DEBIAN_TRIXIE_SLIM_IMAGE=${DEBIAN_TRIXIE_SLIM_IMAGE}
 REFRESH_GO_DEPS=${REFRESH_GO_DEPS}
 REFRESH_HEADERS=${REFRESH_HEADERS}
+BUILD_TESTS=${BUILD_TESTS}
 EOF

scripts/run-test-suite.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Run the repository's fast or full CTest baseline."""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+from pathlib import Path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--build-dir", type=Path, required=True)
+    parser.add_argument("--mode", choices=("fast", "full"), default="fast")
+    parser.add_argument("--timeout", type=int, default=120)
+    args = parser.parse_args()
+
+    command = [
+        "ctest",
+        "--test-dir",
+        str(args.build_dir),
+        "--output-on-failure",
+        "--timeout",
+        str(args.timeout),
+    ]
+    if args.mode == "fast":
+        command.extend(["--label-regex", "^fast$"])
+    completed = subprocess.run(command, check=False)
+    if completed.returncode:
+        return completed.returncode
+    print(f"{args.mode} test suite passed")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

src/handler/settings_snapshot.cpp

@@ -0,0 +1,130 @@
+#include "handler/settings_snapshot.h"
+
+#include <string>
+
+#include <nlohmann/json.hpp>
+
+#include "handler/proxy_policy.h"
+#include "handler/settings.h"
+#include "utils/string.h"
+
+namespace {
+
+nlohmann::json sensitiveState(const std::string &value) {
+  const std::string trimmed = trimWhitespace(value, true, true);
+  return {
+      {"configured", !trimmed.empty()},
+      {"length", trimmed.size()},
+  };
+}
+
+std::string triState(const tribool &value) {
+  if (value.is_undef())
+    return "inherit";
+  return value.get() ? "true" : "false";
+}
+
+} // namespace
+
+std::string sanitizedSettingsSnapshot(const Settings &settings) {
+  nlohmann::json snapshot = {
+      {"schema", 1},
+      {"common",
+       {
+           {"base_path", settings.basePath},
+           {"default_urls", sensitiveState(settings.defaultUrls)},
+           {"insert_urls", sensitiveState(settings.insertUrls)},
+           {"default_external_config",
+            sensitiveState(settings.defaultExtConfig)},
+           {"enable_insert", settings.enableInsert.get(false)},
+           {"prepend_insert", settings.prependInsert},
+           {"append_proxy_type", settings.appendType},
+           {"reload_conf_on_request", settings.reloadConfOnRequest},
+           {"exclude_remarks_count", settings.excludeRemarks.size()},
+           {"include_remarks_count", settings.includeRemarks.size()},
+       }},
+      {"node_pref",
+       {
+           {"udp", triState(settings.UDPFlag)},
+           {"tcp_fast_open", triState(settings.TFOFlag)},
+           {"skip_cert_verify", triState(settings.skipCertVerify)},
+           {"tls13", triState(settings.TLS13Flag)},
+           {"sort", settings.enableSort},
+           {"filter_deprecated", settings.filterDeprecated},
+           {"append_userinfo", settings.appendUserinfo},
+           {"clash_new_fields", settings.clashUseNewField},
+           {"clash_proxies_style", settings.clashProxiesStyle},
+           {"singbox_add_clash_modes", settings.singBoxAddClashModes},
+       }},
+      {"rules",
+       {
+           {"enabled", settings.enableRuleGen},
+           {"overwrite_original", settings.overwriteOriginalRules},
+           {"update_on_request", settings.updateRulesetOnRequest},
+           {"ruleset_count", settings.customRulesets.size()},
+           {"proxy_group_count", settings.customProxyGroups.size()},
+       }},
+      {"server",
+       {
+           {"listen", settings.listenAddress},
+           {"port", settings.listenPort},
+           {"serve_file_root", settings.serveFileRoot},
+           {"max_pending_connections", settings.maxPendingConns},
+           {"max_concurrent_threads", settings.maxConcurThreads},
+           {"max_server_threads", settings.maxServerThreads},
+       }},
+      {"advanced",
+       {
+           {"max_allowed_rulesets", settings.maxAllowedRulesets},
+           {"max_allowed_rules", settings.maxAllowedRules},
+           {"max_allowed_download_size", settings.maxAllowedDownloadSize},
+           {"cache_subscription", settings.cacheSubscription},
+           {"cache_config", settings.cacheConfig},
+           {"cache_ruleset", settings.cacheRuleset},
+           {"serve_cache_on_fetch_fail", settings.serveCacheOnFetchFail},
+           {"skip_failed_links", settings.skipFailedLinks},
+           {"request_coalescing", settings.enableRequestCoalescing},
+           {"coalesce_retry_on_5xx", settings.coalesceRetryOn5xx},
+           {"allow_insecure_tls", settings.allowInsecureTls},
+           {"response_cache_ttl", settings.responseCacheTtl},
+       }},
+      {"security",
+       {
+           {"profile", settings.securityProfile},
+           {"allow_public_upload", settings.allowPublicUpload},
+       }},
+      {"custom_openclash_rules",
+       {
+           {"fallback_enabled", settings.customOpenClashRulesFallback},
+           {"publish_enabled", settings.customOpenClashRulesPublish},
+       }},
+      {"proxies",
+       {
+           {"config", parseProxy(settings.proxyConfig).describe()},
+           {"ruleset", parseProxy(settings.proxyRuleset).describe()},
+           {"subscription",
+            parseProxy(settings.proxySubscription).describe()},
+       }},
+      {"statistics",
+       {
+           {"enabled", settings.statisticsEnabled},
+           {"data_dir", settings.statisticsDataDir},
+           {"flush_interval", settings.statisticsFlushInterval},
+           {"geo_provider", settings.statisticsGeoProvider},
+           {"country_header_count",
+            settings.statisticsCountryHeaders.size()},
+           {"china_region_header_count",
+            settings.statisticsChinaRegionHeaders.size()},
+           {"dashboard_auth_enabled", settings.dashboardAuthEnabled},
+           {"dashboard_username_configured",
+            !settings.dashboardAuthUsername.empty()},
+           {"dashboard_password_configured",
+            !settings.dashboardAuthPassword.empty()},
+           {"dashboard_max_failures", settings.dashboardAuthMaxFailures},
+           {"dashboard_window_seconds",
+            settings.dashboardAuthWindowSeconds},
+           {"dashboard_lock_seconds", settings.dashboardAuthLockSeconds},
+       }},
+  };
+  return snapshot.dump(2) + "\n";
+}

src/handler/settings_snapshot.h

@@ -0,0 +1,10 @@
+#ifndef SETTINGS_SNAPSHOT_H_INCLUDED
+#define SETTINGS_SNAPSHOT_H_INCLUDED
+
+#include <string>
+
+struct Settings;
+
+std::string sanitizedSettingsSnapshot(const Settings &settings);
+
+#endif // SETTINGS_SNAPSHOT_H_INCLUDED

src/main.cpp

@@ -15,6 +15,7 @@
 #include "handler/interfaces.h"
 #include "handler/multithread.h"
 #include "handler/settings.h"
+#include "handler/settings_snapshot.h"
 #include "handler/statistics.h"
 #include "handler/version_page.h"
 #include "handler/webget.h"
@@ -34,6 +35,7 @@
 
 WebServer webServer;
 static volatile std::sig_atomic_t pendingShutdownSignal = 0;
+static bool settingsSnapshotMode = false;
 
 #ifndef _WIN32
 void SetConsoleTitle(const std::string &title) {
@@ -84,6 +86,8 @@ void chkArg(int argc, char *argv[]) {
       if (i < argc - 1)
         if (freopen(argv[++i], "a", stderr) == nullptr)
           std::cerr << "无法将输出重定向到日志文件。\n";
+    } else if (strcmp(argv[i], "--settings-snapshot") == 0) {
+      settingsSnapshotMode = true;
     }
   }
 }
@@ -160,6 +164,10 @@ int main(int argc, char *argv[]) {
   SetConsoleTitle("SubConverter-Extended " VERSION);
   if (!readConf())
     return 1;
+  if (settingsSnapshotMode) {
+    std::cout << sanitizedSettingsSnapshot(global);
+    return 0;
+  }
   writeLog(
       0,
       "并发运行参数：HTTP base/max threads=" +

src/utils/file.h

@@ -18,6 +18,7 @@
 
 std::string fileGet(const std::string &path, bool scope_limit = false);
 bool fileExist(const std::string &path, bool scope_limit = false);
+bool isInScope(const std::string &path);
 bool fileCopy(const std::string &source, const std::string &dest);
 int fileWrite(const std::string &path, const std::string &content, bool overwrite);