-
Notifications
You must be signed in to change notification settings - Fork 177
164 lines (144 loc) · 5.95 KB
/
test.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
name: Build and Test
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- name: Set up Go
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32
with:
go-version: 1.23.1
- name: Check module vendoring
run: |
go mod tidy
go mod vendor
go mod verify
test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
- name: Generate and build
run: |
make release
tar xfv release/pwru-linux-amd64.tar.gz
- name: Store executable
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
with:
name: pwru
path: pwru
test:
runs-on: ubuntu-latest
name: Test
needs: build
strategy:
fail-fast: false
matrix:
kernel: [ '5.4-20240201.165956', '5.10-20240201.165956', '5.15-20240201.165956', '6.1-20240201.165956', 'bpf-next-20240204.012837' ]
timeout-minutes: 10
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- name: Retrieve stored pwru executable
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
with:
name: pwru
path: pwru
- name: Provision LVH VMs
uses: cilium/little-vm-helper@97c89f004bd0ab4caeacfe92ebc956e13e362e6b # v0.0.19
with:
test-name: pwru-test
image-version: ${{ matrix.kernel }}
host-mount: ./
install-dependencies: 'true'
cmd: |
chmod +x /host/pwru/pwru
- name: Test basic IPv4
uses: ./.github/actions/pwru-test
with:
test-name: basic-ipv4
pwru-pcap-filter: 'dst host 1.0.0.1 and port 8080'
traffic-setup: |
iptables -I OUTPUT 1 -m tcp --proto tcp --dst 1.0.0.1/32 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.0.0.1:8080 || true
expected-output-pattern: '1.0.0.1:8080.*(kfree_skb_reason|kfree_skb\b)'
- name: Test basic IPv6
uses: ./.github/actions/pwru-test
with:
test-name: basic-ipv6
pwru-pcap-filter: 'dst host 2606:4700:4700::1001 and port 8080'
traffic-setup: |
ip6tables -I OUTPUT 1 -m tcp --proto tcp --dst 2606:4700:4700::1001 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://[2606:4700:4700::1001]:8080 || true
expected-output-pattern: '\[2606:4700:4700::1001\]:8080.*(kfree_skb_reason|kfree_skb\b)'
- name: Test advanced IPv4
uses: ./.github/actions/pwru-test
with:
test-name: advanced-ipv4
pwru-pcap-filter: 'tcp[tcpflags] = tcp-syn'
traffic-setup: |
iptables -I OUTPUT 1 -m tcp --proto tcp --dst 1.0.0.2/32 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.0.0.2:8080 || true
expected-output-pattern: '1.0.0.2:8080.*(kfree_skb_reason|kfree_skb\b)'
- name: Test advanced IPv6
uses: ./.github/actions/pwru-test
with:
test-name: advanced-ipv6
pwru-pcap-filter: 'ip6[53] & 0x3f = 0x2'
traffic-setup: |
ip6tables -I OUTPUT 1 -m tcp --proto tcp --dst 2606:4700:4700::1002 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://[2606:4700:4700::1002]:8080 || true
expected-output-pattern: '\[2606:4700:4700::1002\]:8080.*(kfree_skb_reason|kfree_skb\b)'
- name: Test pcap filter using stack
uses: ./.github/actions/pwru-test
with:
test-name: pcap-filter-stack
pwru-pcap-filter: '(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
traffic-setup: curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.1.1.1 || true
expected-output-pattern: '1.1.1.1:80'
- name: Test --filter-track-skb
uses: ./.github/actions/pwru-test
with:
test-name: filter-track-skb
pwru-flags: --filter-track-skb
pwru-pcap-filter: dst host 10.10.20.99
traffic-setup: |
iptables -t nat -I OUTPUT 1 -d 10.10.20.99/32 -j DNAT --to-destination 10.10.14.2
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://10.10.20.99:80 || true
expected-output-pattern: '10.10.14.2:80'
- name: Test ARP filter
uses: ./.github/actions/pwru-test
with:
test-name: filter-arp
pwru-pcap-filter: 'arp and arp[7] = 1 and arp[24]= 169 and arp[25] = 254 and arp[26] = 0 and arp[27] = 1'
traffic-setup: |
ip net a pwru
ip l a pwru-veth type veth peer name pwru-veth-peer
ip l s pwru-veth-peer up
ip l s pwru-veth netns pwru
ip net e pwru ip l s pwru-veth up
ip r a 10.0.0.1 dev pwru-veth-peer
ip net e pwru ip a a 10.0.0.1 dev pwru-veth
ip net e pwru ip r a 169.254.0.1 dev pwru-veth
ip net e pwru ip r a default via 169.254.0.1 dev pwru-veth
ping -W1 -c1 10.0.0.1 || true
expected-output-pattern: 'arp_rcv'
- name: Test --filter-ifname
uses: ./.github/actions/pwru-test
with:
test-name: filter-ifname
pwru-flags: --filter-ifname lo
pwru-pcap-filter: icmp
traffic-setup: |
ping -W1 -c1 127.0.0.1 || true
expected-output-pattern: 'icmp'
- name: Fetch artifacts
if: ${{ !success() }}
uses: cilium/little-vm-helper@97c89f004bd0ab4caeacfe92ebc956e13e362e6b # v0.0.19
with:
provision: 'false'
cmd: |
for i in /tmp/pwru-*.status /tmp/pwru-*.ready /tmp/pwru-*.log; do
echo "--- \$i ---"
cat \$i || true
done