-
Notifications
You must be signed in to change notification settings - Fork 175
164 lines (144 loc) · 5.96 KB
/
test.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
name: Build and Test
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
build:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
- name: Set up Go
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
with:
go-version: 1.21.5
- name: Check module vendoring
run: |
go mod tidy
go mod vendor
go mod verify
test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
- name: Generate and build
run: |
make release
tar xfv release/pwru-linux-amd64.tar.gz
- name: Store executable
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
with:
name: pwru
path: pwru
test:
runs-on: ubuntu-latest-4cores-16gb
name: Test
needs: build
strategy:
fail-fast: false
matrix:
kernel: [ '5.4-20240201.165956', '5.10-20240201.165956', '5.15-20240201.165956', '6.1-20240201.165956', 'bpf-next-20240204.012837' ]
timeout-minutes: 10
steps:
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
- name: Retrieve stored pwru executable
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
with:
name: pwru
path: pwru
- name: Provision LVH VMs
uses: cilium/little-vm-helper@a4311c6d054de3008bdf9195b0fabf6ee60d8bdd # v0.0.17
with:
test-name: pwru-test
image-version: ${{ matrix.kernel }}
host-mount: ./
install-dependencies: 'true'
cmd: |
chmod +x /host/pwru/pwru
- name: Test basic IPv4
uses: ./.github/actions/pwru-test
with:
test-name: basic-ipv4
pwru-pcap-filter: 'dst host 1.0.0.1 and port 8080'
traffic-setup: |
iptables -I OUTPUT 1 -m tcp --proto tcp --dst 1.0.0.1/32 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.0.0.1:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*1.0.0.1:8080'
- name: Test basic IPv6
uses: ./.github/actions/pwru-test
with:
test-name: basic-ipv6
pwru-pcap-filter: 'dst host 2606:4700:4700::1001 and port 8080'
traffic-setup: |
ip6tables -I OUTPUT 1 -m tcp --proto tcp --dst 2606:4700:4700::1001 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://[2606:4700:4700::1001]:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*\[2606:4700:4700::1001\]:8080'
- name: Test advanced IPv4
uses: ./.github/actions/pwru-test
with:
test-name: advanced-ipv4
pwru-pcap-filter: 'tcp[tcpflags] = tcp-syn'
traffic-setup: |
iptables -I OUTPUT 1 -m tcp --proto tcp --dst 1.0.0.2/32 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.0.0.2:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*1.0.0.2:8080'
- name: Test advanced IPv6
uses: ./.github/actions/pwru-test
with:
test-name: advanced-ipv6
pwru-pcap-filter: 'ip6[53] & 0x3f = 0x2'
traffic-setup: |
ip6tables -I OUTPUT 1 -m tcp --proto tcp --dst 2606:4700:4700::1002 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://[2606:4700:4700::1002]:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*\[2606:4700:4700::1002\]:8080'
- name: Test pcap filter using stack
uses: ./.github/actions/pwru-test
with:
test-name: pcap-filter-stack
pwru-pcap-filter: '(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
traffic-setup: curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.1.1.1 || true
expected-output-pattern: '1.1.1.1:80'
- name: Test --filter-track-skb
uses: ./.github/actions/pwru-test
with:
test-name: filter-track-skb
pwru-flags: --filter-track-skb
pwru-pcap-filter: dst host 10.10.20.99
traffic-setup: |
iptables -t nat -I OUTPUT 1 -d 10.10.20.99/32 -j DNAT --to-destination 10.10.14.2
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://10.10.20.99:80 || true
expected-output-pattern: '10.10.14.2:80'
- name: Test ARP filter
uses: ./.github/actions/pwru-test
with:
test-name: filter-arp
pwru-pcap-filter: 'arp and arp[7] = 1 and arp[24]= 169 and arp[25] = 254 and arp[26] = 0 and arp[27] = 1'
traffic-setup: |
ip net a pwru
ip l a pwru-veth type veth peer name pwru-veth-peer
ip l s pwru-veth-peer up
ip l s pwru-veth netns pwru
ip net e pwru ip l s pwru-veth up
ip r a 10.0.0.1 dev pwru-veth-peer
ip net e pwru ip a a 10.0.0.1 dev pwru-veth
ip net e pwru ip r a 169.254.0.1 dev pwru-veth
ip net e pwru ip r a default via 169.254.0.1 dev pwru-veth
ping -W1 -c1 10.0.0.1 || true
expected-output-pattern: 'arp_rcv'
- name: Test --filter-ifname
uses: ./.github/actions/pwru-test
with:
test-name: filter-ifname
pwru-flags: --filter-ifname lo
pwru-pcap-filter: icmp
traffic-setup: |
ping -W1 -c1 127.0.0.1 || true
expected-output-pattern: 'icmp'
- name: Fetch artifacts
if: ${{ !success() }}
uses: cilium/little-vm-helper@a4311c6d054de3008bdf9195b0fabf6ee60d8bdd # v0.0.17
with:
provision: 'false'
cmd: |
for i in /tmp/pwru-*.status /tmp/pwru-*.ready /tmp/pwru-*.log; do
echo "--- \$i ---"
cat \$i || true
done