mirror of
https://github.com/cfal/shoes.git
synced 2026-11-06 16:14:11 +00:00
cfal
7460f5d046
Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
58 lines
1.8 KiB
YAML
58 lines
1.8 KiB
YAML
name: Kernel TUN
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
CARGO_BUILD_JOBS: 1
|
|
RUST_BACKTRACE: 1
|
|
|
|
jobs:
|
|
kernel-tun:
|
|
name: Linux kernel TUN
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Check kernel test prerequisites
|
|
run: |
|
|
sudo -n true
|
|
sudo apt-get update
|
|
sudo apt-get install -y nftables
|
|
test -c /dev/net/tun
|
|
command -v ip
|
|
ip -j -6 address show dev lo | jq --exit-status 'any(.[].addr_info[]; .local == "::1")'
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Cache Rust build
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
target
|
|
key: ${{ runner.os }}-tun-kernel-cargo-${{ hashFiles('**/Cargo.lock') }}
|
|
|
|
- name: Run kernel TUN tests
|
|
run: >-
|
|
.github/require-tests.sh cargo test -p shoes --locked --features privileged-tests
|
|
--test privileged tun_kernel:: --verbose -- --test-threads=1
|
|
|
|
- name: Run managed capture and recovery tests
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/resolved"
|
|
(cd "$RUNNER_TEMP/resolved" && apt-get download systemd-resolved)
|
|
dpkg-deb --extract "$RUNNER_TEMP"/resolved/*.deb "$RUNNER_TEMP/resolved/root"
|
|
SHOES_RESOLVED_ROOT="$RUNNER_TEMP/resolved/root/usr" .github/require-tests.sh cargo test -p shoes --locked --lib \
|
|
desktop::linux::tests::managed_kernel_capture_and_cleanup \
|
|
-- --ignored --nocapture --test-threads=1
|
|
.github/require-tests.sh cargo test -p shoes --locked --test process_contract \
|
|
config_tooling::check_dry_run_does_not_dispatch_cleanup -- --ignored --nocapture
|