James Coleman
5095d90fa4
- New Capabilities: PortPair, Negation, RejectAction, FamilyWithoutAddress, DenyActionFromConfig, advertised per backend. - coversDirection isolates DirForward even when output is unowned; add splitNATDualRow so a concrete-family removal re-adds the opposite family's NAT translation. - Resolve ip6tables/ufw ICMPv6 type aliases; ParseNATKind rejects the "invalid" sentinel as input while JSON round-trips it. - Sync counts additions on mid-batch failure and uses RuleBatcher. - NewManager runs a probe loop joining each backend's reason for diagnosability; services.go drops "generated" from enabled, handles it on enable, clears start-limit-hit on restart, and matches rc.local by token. - nftables: per-source connection limits (meter set), quoted-token parsing preserving log-prefix spacing, digit-led prefix sanitizing. - apf/csf: deny-action-from-config with cached STOP settings, port lists and inexpressible shapes routed through the pre-hook, confKeyApplies guard against a missing config line. - atomic config writes fsync before rename and resolve symlinks; readConfValue is last-assignment-wins; runCommand preserves the exit code through the wrapped error. - Move coreos/go-systemd to the maintained v22 module directly.
91 lines
4 KiB
Makefile
91 lines
4 KiB
Makefile
# go-firewall test targets.
|
|
#
|
|
# make lint golangci-lint across every target GOOS
|
|
# make test-general unit / parser tests — fast, no root, no VM
|
|
# make test-integration Linux backends end-to-end in a throwaway QEMU VM
|
|
# make test-integration-freebsd pf backend end-to-end in a throwaway FreeBSD VM
|
|
# make test-integration-windows Windows Firewall backend in a throwaway Windows VM
|
|
# make test general + Linux integration
|
|
# make test-all general + every OS's integration (slow; big downloads)
|
|
# make build the go-firewall CLI (separate module in ./cmd/go-firewall)
|
|
# make install install the go-firewall CLI into $GOBIN
|
|
#
|
|
# test-general runs the plain `go test` suite (rule parsing/marshalling, capability
|
|
# and helper logic) — it never touches a live firewall.
|
|
#
|
|
# The test-integration* targets boot disposable QEMU VMs and run the capability-
|
|
# driven suite against the real backends there, so nothing touches the host:
|
|
# * Linux — nft/firewalld/ufw/iptables/apf/csf natively in an Ubuntu VM.
|
|
# Limit backends with BACKENDS, e.g. `make test-integration BACKENDS=nft`.
|
|
# * FreeBSD — pf in a FreeBSD VM (pf runs natively; also covers macOS's pf backend).
|
|
# * Windows — the Windows Firewall backend in a Windows VM (heaviest; large image).
|
|
# They need qemu-system-x86_64, KVM (/dev/kvm), genisoimage (and python3 for FreeBSD).
|
|
#
|
|
# macOS is not automatable in a VM (Apple hardware); run its pf backend manually on a
|
|
# Mac: `sudo go test -tags integration -run TestIntegration`.
|
|
#
|
|
# VM artifacts (cloud images, overlay disks, seeds) are cached under ./.cache
|
|
# (git-ignored). `make clean` removes that cache and the compiled test binaries.
|
|
|
|
BACKENDS ?=
|
|
CLI_DIR := ./cmd/go-firewall
|
|
BUILD_DIR := ./build
|
|
CLI_BIN := $(BUILD_DIR)/go-firewall
|
|
|
|
# Sources the CLI is built from: its own package plus the library it imports.
|
|
CLI_SRC := $(shell find $(CLI_DIR) . -maxdepth 1 -name '*.go' -not -name '*_test.go') \
|
|
$(CLI_DIR)/go.mod $(CLI_DIR)/go.sum go.mod go.sum
|
|
|
|
.PHONY: all lint test test-general test-integration test-integration-linux test-integration-freebsd test-integration-windows cli install clean
|
|
|
|
# Bare `make` builds the CLI.
|
|
.DEFAULT_GOAL := all
|
|
all: cli
|
|
|
|
test: test-general test-integration
|
|
|
|
# Lint every target GOOS. Each backend is behind a build tag, so a single run
|
|
# only sees one platform's code. The linux run is authoritative (it compiles all
|
|
# backends and shared helpers, so `unused` is meaningful); the cross-compiled
|
|
# runs disable `unused` because a linux-only helper unavoidably reads as dead
|
|
# code under another GOOS. Requires golangci-lint v2 (see .golangci.yml).
|
|
lint:
|
|
golangci-lint run ./...
|
|
GOOS=darwin golangci-lint run --disable=unused ./...
|
|
GOOS=freebsd golangci-lint run --disable=unused ./...
|
|
GOOS=windows golangci-lint run --disable=unused ./...
|
|
cd $(CLI_DIR) && golangci-lint run ./...
|
|
|
|
test-general:
|
|
go test ./...
|
|
|
|
test-integration: test-integration-linux test-integration-freebsd test-integration-windows
|
|
|
|
test-integration-linux:
|
|
./test/integration/host-linux-vm.sh $(BACKENDS)
|
|
|
|
test-integration-freebsd:
|
|
./test/integration/host-freebsd-vm.sh
|
|
|
|
test-integration-windows:
|
|
./test/integration/host-windows-vm.sh
|
|
|
|
# Build the go-firewall CLI into $(BUILD_DIR) (./build by default, git-ignored).
|
|
# The CLI lives in a separate Go module (so the kong dependency is not imposed
|
|
# on library users) and is built from $(CLI_DIR). `cli` is a convenience alias
|
|
# for the real binary target below, which only relinks when a source changes.
|
|
# Override the version with: make cli VERSION=v1.2.3
|
|
cli: $(CLI_BIN)
|
|
|
|
$(CLI_BIN): $(CLI_SRC) | $(BUILD_DIR)
|
|
go build -C $(CLI_DIR) -ldflags "-X main.version=$(VERSION)" -o $(abspath $(CLI_BIN)) .
|
|
|
|
$(BUILD_DIR):
|
|
mkdir -p $(BUILD_DIR)
|
|
|
|
# Install the go-firewall CLI into $GOBIN (or $GOPATH/bin). Requires Go 1.26+.
|
|
install:
|
|
go install -C $(CLI_DIR) -ldflags "-X main.version=$(VERSION)"
|
|
|
|
clean:
|
|
rm -rf .cache $(BUILD_DIR) test/integration/firewall.test test/integration/firewall.test.*
|