lab/bastion/tests/integration/helpers/pxe-network.ts

// Libvirt network for PXE boot testing.
// Unlike the regular test network, this one has NO DHCP —
// the bastion provides full DHCP + PXE on this network.

import { execSync, spawnSync } from "node:child_process";
import { writeFileSync, unlinkSync } from "node:fs";
import { log } from "./libvirt.js";

export const PXE_NETWORK_NAME = "lab-pxe-test";
export const PXE_BRIDGE = "virbr-pxe";
export const PXE_SUBNET = "192.168.251";
export const PXE_GATEWAY = `${PXE_SUBNET}.1`;

const IS_ROOT = process.getuid?.() === 0;

function run(cmd: string): string {
  const full = IS_ROOT ? cmd : `sudo ${cmd}`;
  return execSync(full, { encoding: "utf-8", stdio: "pipe" });
}

function virsh(...args: string[]): { status: number; stdout: string } {
  const cmd = IS_ROOT ? "virsh" : "sudo";
  const finalArgs = IS_ROOT ? args : ["virsh", ...args];
  const result = spawnSync(cmd, finalArgs, { encoding: "utf-8", stdio: "pipe" });
  return { status: result.status ?? 1, stdout: result.stdout ?? "" };
}

// No <dhcp> section — bastion dnsmasq provides full DHCP + PXE
const NETWORK_XML = `<network>
  <name>${PXE_NETWORK_NAME}</name>
  <forward mode='nat'/>
  <bridge name='${PXE_BRIDGE}' stp='on' delay='0'/>
  <ip address='${PXE_GATEWAY}' netmask='255.255.255.0'>
  </ip>
</network>`;

/** Ensure the PXE test network exists and is active (no DHCP). */
export function ensurePxeNetwork(): void {
  const result = virsh("net-info", PXE_NETWORK_NAME);

  if (result.status === 0 && result.stdout.includes("Active:         yes")) {
    log(`Network ${PXE_NETWORK_NAME} already active`);
  } else {
    // Destroy existing if present but inactive
    if (result.status === 0) {
      virsh("net-destroy", PXE_NETWORK_NAME);
      virsh("net-undefine", PXE_NETWORK_NAME);
    }

    const xmlPath = "/tmp/lab-pxe-test-network.xml";
    writeFileSync(xmlPath, NETWORK_XML);

    log(`Creating PXE libvirt network: ${PXE_NETWORK_NAME} (${PXE_SUBNET}.0/24, no DHCP)`);
    run(`virsh net-define "${xmlPath}"`);
    run(`virsh net-start "${PXE_NETWORK_NAME}"`);

    try { unlinkSync(xmlPath); } catch { /* ignore */ }

    // `virsh net-start` returns before the bridge is usable. The bastion's
    // dnsmasq starts about a second later and binds to this device by name; if
    // the interface is not up and addressed yet it fails with "error binding
    // DHCP socket to device virbr-pxe", and because that failure is
    // asynchronous the harness carries on with NO DHCP AT ALL -- every VM then
    // sits in discovery until it times out, six minutes later, looking like a
    // PXE problem rather than a startup-order one.
    //
    // Cheap to wait, expensive not to.
    waitForBridge();

    log(`Network ${PXE_NETWORK_NAME} created and active`);
  }

  // Libvirt adds nftables reject rules for NAT networks that block host→VM SSH.
  // Delete them now and after every VM reboot (libvirt recreates them).
  deleteNftablesRejectRules();
}

/**
 * Block until the bridge exists AND carries the gateway address.
 *
 * Checking only that the device exists is not enough: it appears before the
 * address is assigned, and dnsmasq needs the address to bind.
 */
export function waitForBridge(timeoutMs = 30_000): void {
  const start = Date.now();
  let last = "";
  while (Date.now() - start < timeoutMs) {
    const r = spawnSync("ip", ["-br", "addr", "show", PXE_BRIDGE], { encoding: "utf-8", stdio: "pipe" });
    last = (r.stdout ?? "").trim();
    if (r.status === 0 && last.includes(`${PXE_GATEWAY}/`)) {
      log(`Bridge ${PXE_BRIDGE} ready with ${PXE_GATEWAY} after ${Date.now() - start}ms`);
      return;
    }
    // Busy-wait briefly; this normally resolves in well under a second.
    const until = Date.now() + 250;
    while (Date.now() < until) { /* spin */ }
  }
  throw new Error(
    `Bridge ${PXE_BRIDGE} did not come up with ${PXE_GATEWAY} within ${timeoutMs}ms ` +
    `(last: ${last || "device absent"}). dnsmasq cannot bind, so PXE would silently not work.`,
  );
}

/** Delete libvirt's nftables reject rules for our bridge so host→VM traffic works.
 *  Must be called after every VM start/restart — libvirt recreates them. */
export function deleteNftablesRejectRules(): void {
  // libvirt uses "ip libvirt_network" table (not "inet libvirt")
  const tables = ["ip libvirt_network", "ip6 libvirt_network", "inet libvirt"];
  for (const table of tables) {
    try {
      for (const chain of ["guest_input", "guest_output"]) {
        const output = run(`nft -a list chain ${table} ${chain} 2>/dev/null || true`);
        for (const line of output.split("\n")) {
          if (line.includes(PXE_BRIDGE) && line.includes("reject")) {
            const handleMatch = line.match(/# handle (\d+)/);
            if (handleMatch) {
              run(`nft delete rule ${table} ${chain} handle ${handleMatch[1]}`);
            }
          }
        }
      }
    } catch { /* table may not exist */ }
  }
}

/** Destroy the PXE test network. */
export function destroyPxeNetwork(): void {
  log(`Destroying PXE network: ${PXE_NETWORK_NAME}`);
  // nftables rules are cleaned up when the network is destroyed (libvirt removes them)
  virsh("net-destroy", PXE_NETWORK_NAME);
  virsh("net-undefine", PXE_NETWORK_NAME);
}