Skip to content

Commit 833f5dd

Browse files
r-caamanor-caamano
authored
Merge pull request #104 from netfoundry/v0.9.21-release-candidate
V0.9.21 release candidate
2 parents 624fbf1 + 3039958 commit 833f5dd

7 files changed

Lines changed: 77 additions & 38 deletions

File tree

‎.github/workflows/pr.yml‎

Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ env:
1414
NF_NETWORK_NAME: 'dariuszdev02'
1515
TF_VAR_test_iterate_count: ${{ fromJSON(vars.TEST_ITERATE_COUNT) }}
1616
TF_VAR_github_pt: ${{ secrets.PAT }}
17+
TF_VAR_ziti_type: ${{ vars.ZITI_TYPE }}
18+
TF_VAR_repo_name: ${{ vars.REPO_NAME }}
1719
NF_API_CLIENT_ID: "${{ secrets.NF_API_CLIENT_ID }}"
1820
NF_API_CLIENT_SECRET: "${{ secrets.NF_API_CLIENT_SECRET }}"
1921

@@ -301,18 +303,26 @@ jobs:
301303
cd ${{ github.workspace }}/AWS/tf-provider/
302304
zfw0_ver=`/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo /opt/openziti/bin/zfw -V'`
303305
zfw1_ver=`/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo /opt/openziti/bin/zfw -V'`
304-
if [ "$zfw0_ver" != "$zfw1_ver" ]; then
306+
echo "*** zfw0: $zfw0_ver ***"
307+
echo "*** zfw1: $zfw1_ver ***"
308+
if [ "${{ vars.DEBUG }}" == "true" ] || [ "$zfw0_ver" != "$zfw1_ver" ]; then
309+
sleep 60
310+
echo -e "\033[31mDebug mode ${{ vars.DEBUG }}, printing debug info for zfw0\033[m"
305311
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo cat /var/log/cloud-init-output.log'
312+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo ls -l /opt/netfoundry/'
313+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo cat /opt/netfoundry/dl_artifacts_zfw.sh'
314+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo ls -l /var/lib/cloud/instance/scripts/'
315+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo cat /var/lib/cloud/instance/scripts/runcmd'
316+
echo -e "\033[31mDebug mode ${{ vars.DEBUG }}, printing debug info for zfw1\033[m"
306317
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo cat /var/log/cloud-init-output.log'
307-
sleep 60
308-
zfw0_ver=`/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[0]) -tq 'sudo /opt/openziti/bin/zfw -V'`
309-
zfw1_ver=`/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo /opt/openziti/bin/zfw -V'`
318+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo ls -l /opt/netfoundry/'
319+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo cat /opt/netfoundry/dl_artifacts_zfw.sh'
320+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo ls -l /var/lib/cloud/instance/scripts/'
321+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .backend_public_ips.value[1]) -tq 'sudo cat /var/lib/cloud/instance/scripts/runcmd'
310322
fi
311-
echo "*** zfw0: $zfw0_ver ***"
312-
echo "*** zfw1: $zfw1_ver ***"
313323
while :
314324
do
315-
sleep 900
325+
sleep ${{ fromJSON(vars.LOOP_SLEEP_TIMER) }}
316326
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .client_public_ips.value[0]) -tq '/usr/bin/tail -n 1 /var/log/http_test.json' > ${{ github.workspace }}/AWS/tf-provider/result
317327
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .client_public_ips.value[1]) -tq '/usr/bin/tail -n 1 /var/log/http_test.json' >> ${{ github.workspace }}/AWS/tf-provider/result
318328
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .client_public_ips.value[0]) -tq '/usr/bin/tail -n 30 /var/log/http.log' > ${{ github.workspace }}/AWS/tf-provider/test.log
@@ -337,7 +347,29 @@ jobs:
337347
cat ./test.log
338348
exit 1
339349
else
350+
echo -e "\033[33mResult File\033[m"
340351
cat ./result
352+
if [ "${{ vars.DEBUG }}" == "true" ]; then
353+
echo -e "\033[33mLog File\033[m"
354+
cat ./test.log
355+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .client_public_ips.value[0]) -tq '/usr/bin/pgrep -f http' > ${{ github.workspace }}/AWS/tf-provider/pgrep.log
356+
/usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ./zfw_rsa ziggy@$(terraform output -json | jq -r .client_public_ips.value[1]) -tq '/usr/bin/pgrep -f http' >> ${{ github.workspace }}/AWS/tf-provider/pgrep.log
357+
count=`cat ./pgrep.log | wc -l`
358+
echo "Count: $count"
359+
if [ $count -eq 0 ]; then
360+
echo -e "\033[31mFAILED, http app is not running\033[m"
361+
cat ./pgrep.log
362+
elif [ $count -eq 1 ]; then
363+
echo -e "\033[33mPARTIALLYPASSED, http app is running on one client\033[m"
364+
cat ./pgrep.log
365+
elif [ $count -eq 2 ]; then
366+
echo -e "\033[32mPASSED, http app is running on both clients\033[m"
367+
cat ./pgrep.log
368+
else
369+
echo -e "\033[31mFAILED, unexpected number of http apps running: $count\033[m"
370+
cat ./pgrep.log
371+
fi
372+
fi
341373
continue
342374
fi
343375
done

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file. The format
55
---
66
###
77

8+
# [0.9.21] - 2025-7-18
9+
10+
- Refactored port_extension_key.pad to port_extension_key.type to differentiate ipv4 from ipv6
11+
range/interface maps so that they are not ambiguous in the case of all zeros prefix/len with
12+
matching ifindex/lowport values.
13+
- Fixed issue in zfw_tunnel_wrapper.c that could cause a rule cleanup issue on exit.
14+
- Refactored pr.yml due to changes in the regression test pattern.
15+
16+
###
17+
818
# [0.9.20] - 2025-7-18
919

1020
- Refactored cli sanitization to only block '-' at start of argument and removed

‎src/zfw.c‎

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ char *direction_string;
278278
char *masq_interface;
279279
char check_alt[IF_NAMESIZE];
280280

281-
const char *argp_program_version = "0.9.20";
281+
const char *argp_program_version = "0.9.21";
282282
struct ring_buffer *ring_buffer;
283283

284284
__u32 if_list[MAX_IF_LIST_ENTRIES];
@@ -381,23 +381,20 @@ struct interface6
381381
uint32_t addresses[MAX_ADDRESSES][4];
382382
};
383383

384-
struct port_extension_key
385-
{
386-
union
387-
{
384+
struct port_extension_key {
385+
union {
388386
__u32 ip;
389387
__u32 ip6[4];
390-
} __in46_u_dst;
391-
union
392-
{
388+
}__in46_u_dst;
389+
union {
393390
__u32 ip;
394391
__u32 ip6[4];
395-
} __in46_u_src;
392+
}__in46_u_src;
396393
__u16 low_port;
397394
__u8 dprefix_len;
398395
__u8 sprefix_len;
399396
__u8 protocol;
400-
__u8 pad;
397+
__u8 type;
401398
};
402399

403400
struct if_list_extension_mapping
@@ -1096,7 +1093,7 @@ void print_rule6(struct tproxy6_key *key, struct tproxy_tuple *tuple, int *rule_
10961093
port_ext_key.dprefix_len = key->dprefix_len;
10971094
port_ext_key.sprefix_len = key->sprefix_len;
10981095
port_ext_key.protocol = key->protocol;
1099-
port_ext_key.pad = 0;
1096+
port_ext_key.type = 6;
11001097
char saddr6[INET6_ADDRSTRLEN];
11011098
char daddr6[INET6_ADDRSTRLEN];
11021099
struct in6_addr saddr_6 = {0};
@@ -1374,7 +1371,7 @@ void print_rule(struct tproxy_key *key, struct tproxy_tuple *tuple, int *rule_co
13741371
port_ext_key.dprefix_len = key->dprefix_len;
13751372
port_ext_key.sprefix_len = key->sprefix_len;
13761373
port_ext_key.protocol = key->protocol;
1377-
port_ext_key.pad = 0;
1374+
port_ext_key.type = 4;
13781375
port_range_map->key = (uint64_t)&port_ext_key;
13791376

13801377
struct range_mapping range_value;
@@ -4245,7 +4242,7 @@ void map_insert6()
42454242
port_ext_key.dprefix_len = dplen;
42464243
port_ext_key.sprefix_len = splen;
42474244
port_ext_key.protocol = protocol;
4248-
port_ext_key.pad = 0;
4245+
port_ext_key.type = 6;
42494246
if (protocol == IPPROTO_UDP)
42504247
{
42514248
printf("Adding UDP mapping\n");
@@ -4411,7 +4408,7 @@ void map_insert()
44114408
port_ext_key.dprefix_len = dplen;
44124409
port_ext_key.sprefix_len = splen;
44134410
port_ext_key.protocol = protocol;
4414-
port_ext_key.pad = 0;
4411+
port_ext_key.type = 4;
44154412
if (protocol == IPPROTO_UDP)
44164413
{
44174414
printf("Adding UDP mapping\n");
@@ -4595,7 +4592,7 @@ void range_delete_key(struct port_extension_key key)
45954592
{
45964593
char *saddr;
45974594
char *daddr;
4598-
if (cd)
4595+
if (key.type == 4)
45994596
{
46004597
saddr = nitoa(ntohl(key.__in46_u_src.ip));
46014598
daddr = nitoa(ntohl(key.__in46_u_dst.ip));
@@ -4782,7 +4779,7 @@ void map_delete6()
47824779
port_ext_key.dprefix_len = dplen;
47834780
port_ext_key.sprefix_len = splen;
47844781
port_ext_key.protocol = protocol;
4785-
port_ext_key.pad = 0;
4782+
port_ext_key.type = 6;
47864783
int fd = syscall(__NR_bpf, BPF_OBJ_GET, &map, sizeof(map));
47874784
if (fd == -1)
47884785
{
@@ -4955,7 +4952,7 @@ void map_delete()
49554952
port_ext_key.dprefix_len = dplen;
49564953
port_ext_key.sprefix_len = splen;
49574954
port_ext_key.protocol = protocol;
4958-
port_ext_key.pad = 0;
4955+
port_ext_key.type = 4;
49594956
int fd = syscall(__NR_bpf, BPF_OBJ_GET, &map, sizeof(map));
49604957
if (fd == -1)
49614958
{

‎src/zfw_monitor.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ char check_alt[IF_NAMESIZE];
9393
char doc[] = "zfw_monitor -- ebpf firewall monitor tool";
9494
const char *rb_map_path = "/sys/fs/bpf/tc/globals/rb_map";
9595
const char *tproxy_map_path = "/sys/fs/bpf/tc/globals/zt_tproxy_map";
96-
const char *argp_program_version = "0.9.20";
96+
const char *argp_program_version = "0.9.21";
9797
union bpf_attr rb_map;
9898
int rb_fd = -1;
9999

‎src/zfw_tc_ingress.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ struct port_extension_key {
116116
__u8 dprefix_len;
117117
__u8 sprefix_len;
118118
__u8 protocol;
119-
__u8 pad;
119+
__u8 type;
120120
};
121121

122122
struct wildcard_port_key {
@@ -3603,7 +3603,7 @@ int bpf_sk_splice5(struct __sk_buff *skb){
36033603
ext_key.dprefix_len = key.dprefix_len;
36043604
ext_key.sprefix_len = key.sprefix_len;
36053605
ext_key.protocol = key.protocol;
3606-
ext_key.pad = 0;
3606+
ext_key.type = 4;
36073607
struct range_mapping *range = get_range_ports(ext_key);
36083608
//check if there is a udp or tcp destination port match
36093609
if (range && ((bpf_ntohs(tuple->ipv4.dport) >= bpf_ntohs(port_key))
@@ -3804,7 +3804,7 @@ int bpf_sk_splice5(struct __sk_buff *skb){
38043804
ext_key.dprefix_len = key->dprefix_len;
38053805
ext_key.sprefix_len = key->sprefix_len;
38063806
ext_key.protocol = key->protocol;
3807-
ext_key.pad = 0;
3807+
ext_key.type = 6;
38083808
for (int index = 0; index < max_entries; index++){
38093809
__u16 port_key = tproxy->index_table[index];
38103810
ext_key.low_port = port_key;

‎src/zfw_tc_outbound_track.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ struct port_extension_key {
293293
__u8 dprefix_len;
294294
__u8 sprefix_len;
295295
__u8 protocol;
296-
__u8 pad;
296+
__u8 type;
297297
};
298298

299299
struct tproxy_extension_mapping {
@@ -2221,7 +2221,7 @@ int bpf_sk_splice5(struct __sk_buff *skb){
22212221
ext_key.dprefix_len = key.dprefix_len;
22222222
ext_key.sprefix_len = key.sprefix_len;
22232223
ext_key.protocol = key.protocol;
2224-
ext_key.pad = 0;
2224+
ext_key.type = 4;
22252225
struct range_mapping *range = get_range_ports(ext_key);
22262226
//check if there is a udp or tcp destination port match
22272227
if (range && ((bpf_ntohs(tuple->ipv4.dport) >= bpf_ntohs(port_key))
@@ -2320,7 +2320,7 @@ int bpf_sk_splice5(struct __sk_buff *skb){
23202320
ext_key.dprefix_len = key->dprefix_len;
23212321
ext_key.sprefix_len = key->sprefix_len;
23222322
ext_key.protocol = key->protocol;
2323-
ext_key.pad = 0;
2323+
ext_key.type = 6;
23242324
for (int index = 0; index < max_entries; index++){
23252325
__u16 port_key = tproxy->index_table[index];
23262326
ext_key.low_port = port_key;

‎src/zfw_tunnel_wrapper.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ struct port_extension_key {
8282
__u8 dprefix_len;
8383
__u8 sprefix_len;
8484
__u8 protocol;
85-
__u8 pad;
85+
__u8 type;
8686
};
8787

8888
const char *transp_map_path = "/sys/fs/bpf/tc/globals/zet_transp_map";
@@ -327,8 +327,8 @@ void process_service_updates(char * service_id)
327327
port_ext_key.low_port = orule.index_table[x];
328328
port_ext_key.dprefix_len = current_key.dprefix_len;
329329
port_ext_key.sprefix_len = current_key.sprefix_len;
330-
port_ext_key.protocol = current_key.protocol,
331-
port_ext_key.pad = 0;
330+
port_ext_key.protocol = current_key.protocol;
331+
port_ext_key.type = 4;
332332
range_map.key = (uint64_t)&port_ext_key;
333333
struct range_mapping range_ports = {0};
334334
range_map.value = (uint64_t)&range_ports;
@@ -398,8 +398,8 @@ bool rule_exists(uint32_t dst_ip, uint8_t dplen, uint32_t src_ip, uint8_t splen,
398398
port_ext_key.low_port = orule.index_table[x];
399399
port_ext_key.dprefix_len = current_key.dprefix_len;
400400
port_ext_key.sprefix_len = current_key.sprefix_len;
401-
port_ext_key.protocol = current_key.protocol,
402-
port_ext_key.pad = 0;
401+
port_ext_key.protocol = current_key.protocol;
402+
port_ext_key.type = 4;
403403
range_map.key = (uint64_t)&port_ext_key;
404404
struct range_mapping range_ports = {0};
405405
range_map.value = (uint64_t)&range_ports;
@@ -468,8 +468,8 @@ void process_rules()
468468
port_ext_key.low_port = orule.index_table[x];
469469
port_ext_key.dprefix_len = current_key.dprefix_len;
470470
port_ext_key.sprefix_len = current_key.sprefix_len;
471-
port_ext_key.protocol = current_key.protocol,
472-
port_ext_key.pad = 0;
471+
port_ext_key.protocol = current_key.protocol;
472+
port_ext_key.type = 4;
473473
range_map.key = (uint64_t)&port_ext_key;
474474
struct range_mapping range_ports = {0};
475475
range_map.value = (uint64_t)&range_ports;

0 commit comments

Comments
 (0)