Skip to content

Support L2 filters such as ARP #347

Support L2 filters such as ARP

Support L2 filters such as ARP #347

Workflow file for this run

name: Build and Test
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
build:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
- name: Set up Go
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
with:
go-version: 1.20.5
- name: Check module vendoring
run: |
go mod tidy
go mod vendor
go mod verify
test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
- name: Generate and build
run: |
make release
tar xfv release/pwru-linux-amd64.tar.gz
- name: Store executable
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
with:
name: pwru
path: pwru
test:
runs-on: ubuntu-latest-4cores-16gb
name: Test
needs: build
strategy:
fail-fast: false
matrix:
kernel: [ '5.4-v0.3', '5.15-v0.3', '6.3-main', 'bpf-next-main' ]
timeout-minutes: 10
steps:
- uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
- name: Retrieve stored pwru executable
uses: actions/download-artifact@v3
with:
name: pwru
path: pwru
- name: Provision LVH VMs
uses: cilium/little-vm-helper@908ab1ff8a596a03cd5221a1f8602dc44c3f906d # v0.0.12
with:
test-name: pwru-test
image-version: ${{ matrix.kernel }}
host-mount: ./
dns-resolver: '1.1.1.1'
install-dependencies: 'true'
cmd: |
chmod +x /host/pwru/pwru
- name: Test basic IPv4
uses: ./.github/actions/pwru-test
with:
test-name: basic-ipv4
pwru-pcap-filter: 'dst host 1.0.0.1 and port 8080'
traffic-setup: |
iptables -I OUTPUT 1 -m tcp --proto tcp --dst 1.0.0.1/32 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.0.0.1:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*1.0.0.1:8080'
- name: Test basic IPv6
uses: ./.github/actions/pwru-test
with:
test-name: basic-ipv6
pwru-pcap-filter: 'dst host 2606:4700:4700::1001 and port 8080'
traffic-setup: |
ip6tables -I OUTPUT 1 -m tcp --proto tcp --dst 2606:4700:4700::1001 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://[2606:4700:4700::1001]:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*\[2606:4700:4700::1001\]:8080'
- name: Test advanced IPv4
uses: ./.github/actions/pwru-test
with:
test-name: advanced-ipv4
pwru-pcap-filter: 'tcp[tcpflags] = tcp-syn'
traffic-setup: |
iptables -I OUTPUT 1 -m tcp --proto tcp --dst 1.0.0.2/32 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.0.0.2:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*1.0.0.2:8080'
- name: Test advanced IPv6
uses: ./.github/actions/pwru-test
with:
test-name: advanced-ipv6
pwru-pcap-filter: 'ip6[53] & 0x3f = 0x2'
traffic-setup: |
ip6tables -I OUTPUT 1 -m tcp --proto tcp --dst 2606:4700:4700::1002 --dport 8080 -j DROP
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://[2606:4700:4700::1002]:8080 || true
expected-output-pattern: '(kfree_skb_reason|kfree_skb\b).*\[2606:4700:4700::1002\]:8080'
- name: Test pcap filter using stack
uses: ./.github/actions/pwru-test
with:
test-name: pcap-filter-stack
pwru-pcap-filter: '(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
traffic-setup: curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://1.1.1.1 || true
expected-output-pattern: '1.1.1.1:80'
- name: Test --filter-track-skb
# DNAT
uses: ./.github/actions/pwru-test
with:
test-name: filter-track-skb
pwru-flags: --filter-track-skb
pwru-pcap-filter: dst host 10.10.20.99
traffic-setup: |
iptables -t nat -I OUTPUT 1 -d 10.10.20.99/32 -j DNAT --to-destination 10.10.14.2
curl -vvv -sS --fail --connect-timeout "1" -o /dev/null http://10.10.20.99:80 || true
expected-output-pattern: '10.10.14.2:80'
- name: Fetch artifacts
if: ${{ !success() }}
uses: cilium/little-vm-helper@908ab1ff8a596a03cd5221a1f8602dc44c3f906d
with:
provision: 'false'
cmd: |
cat /tmp/pwru-*.status || true
cat /tmp/pwru-*.ready || true
cat /tmp/pwru-*.log || true