1 files changed, 22 insertions, 0 deletions
diff --git a/tests/import-wireguard-configs/test_import_wireguard_configs.py b/tests/import-wireguard-configs/test_import_wireguard_configs.py
index 0307041..45afa54 100644
--- a/tests/import-wireguard-configs/test_import_wireguard_configs.py
+++ b/tests/import-wireguard-configs/test_import_wireguard_configs.py
@@ -162,6 +162,28 @@ class ImportWireguardConfigs(unittest.TestCase):
         imports = [ln for ln in self.log_lines() if ln.startswith("connection import")]
         self.assertEqual(len(imports), 1)
 
+    def test_tunnel_is_brought_down_before_the_modify(self):
+        # nmcli import auto-activates a full-tunnel (0.0.0.0/0) profile. The
+        # down must run before the rename/modify so a failed modify under set -e
+        # can never leave a live unasked-for VPN up.
+        self.write_conf("USNY")
+        r = self.run_script()
+        self.assertEqual(r.returncode, 0, r.stderr)
+        verbs = [ln.split()[1] for ln in self.log_lines()
+                 if ln.startswith("connection ")]
+        self.assertEqual(verbs, ["import", "down", "modify"], verbs)
+
+    def test_modify_failure_still_left_the_tunnel_down(self):
+        # Even when the modify fails and aborts the run, the down already ran,
+        # so no live tunnel survives.
+        self.write_conf("USNY")
+        r = self.run_script(env_extra={"FAKE_NMCLI_MODIFY_RC": "4"})
+        self.assertNotEqual(r.returncode, 0)
+        verbs = [ln.split()[1] for ln in self.log_lines()
+                 if ln.startswith("connection ")]
+        self.assertIn("down", verbs, "the tunnel must be downed before the modify aborts")
+        self.assertLess(verbs.index("down"), verbs.index("modify"))
+
 
 if __name__ == "__main__":
     unittest.main()