Llt 4701 test interface selection logic on apple

nat-lab/bin/mac-gw-decoy

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+# Decoy gateway for macOS interface selection testing.
+# Has no internet access — traffic routed here from the macOS VM cannot
+# reach VPN or DERP servers, causing connectivity failure if libtelio
+# selects this interface instead of the primary one.
+
+touch /ready
+
+sleep infinity

nat-lab/docker-compose.yml

@@ -203,6 +203,8 @@ services:
         soft: -1
         hard: -1
     depends_on:
+      mac-gw-decoy:
+        condition: service_healthy
       mac-gw-01:
         condition: service_healthy
       mac-gw-02:
@@ -235,6 +237,8 @@ services:
       CLIENT_GATEWAY_PRIMARY: 192.168.154.254
       CLIENT_GATEWAY_SECONDARY: 192.168.155.254
     networks:
+      mac-net-decoy:
+        ipv4_address: 192.168.156.54
       mac-net-01:
         ipv4_address: 192.168.154.54
       mac-net-02:
@@ -855,6 +859,23 @@ services:
         ipv4_address: 192.168.153.254
         priority: 900
 
+  mac-gw-decoy:
+    hostname: mac-gw-decoy
+    image: nat-lab:base
+    entrypoint: /opt/bin/mac-gw-decoy
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: "ls /ready"
+    networks:
+      mac-net-decoy:
+        ipv4_address: 192.168.156.254
+        priority: 900
+
   mac-gw-01:
     hostname: mac-gw-01
     <<: *common-gw
@@ -1306,6 +1327,13 @@ networks:
       config:
         - subnet: 192.168.153.0/24
 
+  mac-net-decoy:
+    driver: bridge
+    ipam:
+      driver: default
+      config:
+        - subnet: 192.168.156.0/24
+
   mac-net-01:
     driver: bridge
     ipam:

nat-lab/tests/config.py

@@ -74,7 +74,7 @@ def get_root_path(path: str) -> str:
         "primary": "192.168.152.54",
         "secondary": "192.168.153.54",
     },
-    ConnectionTag.VM_MAC: {"primary": "192.168.154.54", "secondary": "192.168.155.54"},
+    ConnectionTag.VM_MAC: {"primary": "192.168.154.54", "secondary": "192.168.155.54", "decoy": "192.168.156.54"},
     ConnectionTag.DOCKER_CONE_GW_1: {"primary": "192.168.101.254", "secondary": ""},
     ConnectionTag.DOCKER_CONE_GW_2: {"primary": "192.168.102.254", "secondary": ""},
     ConnectionTag.DOCKER_CONE_GW_3: {"primary": "192.168.113.254", "secondary": ""},

nat-lab/tests/test_network_switch.py

@@ -11,6 +11,7 @@
 from tests.utils import stun
 from tests.utils.asyncio_util import run_async_contexts
 from tests.utils.bindings import (
+    default_features,
     features_with_endpoint_providers,
     EndpointProvider,
     PathType,
@@ -312,6 +313,61 @@ async def test_mesh_network_switch_direct(
         ])
 
 
+
+@pytest.mark.asyncio
+@pytest.mark.mac
+async def test_mac_interface_selection_with_multiple_active_interfaces() -> None:
+    async with AsyncExitStack() as exit_stack:
+        features = default_features()
+        # Enables the NativeProtector socket watcher, which performs interface
+        # selection and socket binding (disabled by default in tests).
+        features.is_test_env = False
+
+        alpha_setup_params = SetupParameters(
+            connection_tag=ConnectionTag.VM_MAC,
+            adapter_type_override=TelioAdapterType.NEP_TUN,
+            is_meshnet=False,
+            features=features,
+        )
+
+        env = await exit_stack.enter_async_context(
+            setup_environment(
+                exit_stack,
+                [alpha_setup_params],
+                vpn=[ConnectionTag.DOCKER_VPN_1],
+            )
+        )
+        client_alpha, *_ = env.clients
+        alpha_conn_mngr, *_ = env.connections
+        alpha_connection = alpha_conn_mngr.connection
+
+        # The VM has three NICs. The first (en0) is a decoy interface on
+        # mac-net-decoy whose gateway has no internet access. It appears first
+        # in the macOS SCDynamicStore service order. A buggy implementation of
+        # get_primary_interface_names() that ignores nw_path_monitor order would
+        # select en0 and bind sockets to it, causing VPN connectivity to fail.
+        wg_server = config.WG_SERVER
+        await client_alpha.connect_to_vpn(
+            str(wg_server["ipv4"]),
+            int(wg_server["port"]),
+            str(wg_server["public_key"]),
+        )
+
+        await ping(alpha_connection, config.PHOTO_ALBUM_IP)
+
+        ip = await stun.get(alpha_connection, config.STUN_SERVER)
+        assert ip == wg_server["ipv4"], (
+            f"Expected VPN server IP {wg_server['ipv4']} but got {ip}."
+        )
+
+        logs = await client_alpha.get_log()
+        assert "Binding relay socket" in logs, (
+            "Socket binding never happened — tunnel_interface was never set in the "
+            "socket watcher. Wrong interface selection cannot cause test failure. "
+            "See: 'Will not rebind relay sockets for None' in logs."
+        )
+
+
 class TestInterfaceWindows:
     @pytest.mark.asyncio
     async def test_get_network_interfaces(self):

nat-lab/tests/utils/connection/connection.py

@@ -62,6 +62,7 @@ class ConnectionTag(Enum):
     DOCKER_WINDOWS_GW_4 = auto()
     DOCKER_WINDOWS_VM_1 = auto()
     DOCKER_WINDOWS_VM_2 = auto()
+    DOCKER_MAC_GW_DECOY = auto()
     DOCKER_MAC_GW_1 = auto()
     DOCKER_MAC_GW_2 = auto()
     DOCKER_CORE_API_1 = auto()

nat-lab/tests/utils/connection/docker_connection.py

@@ -60,6 +60,7 @@
     ConnectionTag.DOCKER_WINDOWS_GW_4: "windows-gw-04",
     ConnectionTag.DOCKER_WINDOWS_VM_1: "windows-client-01",
     ConnectionTag.DOCKER_WINDOWS_VM_2: "windows-client-02",
+    ConnectionTag.DOCKER_MAC_GW_DECOY: "mac-gw-decoy",
     ConnectionTag.DOCKER_MAC_GW_1: "mac-gw-01",
     ConnectionTag.DOCKER_MAC_GW_2: "mac-gw-02",
     ConnectionTag.DOCKER_CORE_API_1: "core-api",