Rayhaan JaufeerallyandClaude Fable 5.1
1fc44798b7
New crate bgp-fib. It follows the routing table's best routes and keeps
the kernel's routing table the same, and learns the machine's interfaces
and addresses from the kernel, which is what says whether a next hop can
be reached.
- netlink: the rtnetlink messages used (routes, addresses, links, errors),
as bytes and back. No I/O; property tested and fuzzed.
- interfaces: what is directly reachable, and from which interface.
- plan: what to ask the kernel for, given the best routes and what the
kernel has. No I/O; tested against a model kernel.
- kernel (Linux only): the sockets and the task. Requests go in batches;
routes of ours found at startup are kept if still right and removed if
not; a change of interfaces has every route worked out again; a clean
stop removes our routes.
Only routes marked proto bgp with the configured table and metric are
ever touched. A best route is installed if its next hop is a neighbor;
next hops further away are not resolved through other routes yet, and
such prefixes are counted and shown instead.
Configured with `kernel { table metric }`; off by default. The daemon
needs CAP_NET_ADMIN and stops if the kernel refuses it. On shutdown it
closes sessions and then removes its routes.
/api/kernel and the status page show installed, unresolved and refused
counts, the last error and the interfaces; five bgp_kernel_* metrics.
Testing: scripts/kernel-tests.sh runs, in network namespaces of their
own and with only the capabilities the daemon needs, the installer
against `ip route`, the daemon with a peer, and two daemons that route
for each other with pings across over IPv4 and IPv6.
scripts/linux-vm.sh runs that, or anything else, in a Lima VM from
macOS. CI runs the kernel tests and fuzzes the netlink decoder.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
# Runs on every push and pull request. Gitea Actions reads this file too
|
|
# (it falls back to .github/workflows), so one definition serves both.
|
|
name: ci
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
# Warnings fail the build here, and only here: locally they stay warnings
|
|
# so that work in progress compiles.
|
|
RUSTFLAGS: -D warnings
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- name: Format
|
|
run: cargo fmt --all -- --check
|
|
- name: Lint
|
|
run: cargo clippy --workspace --all-targets -- -D warnings
|
|
- name: Test
|
|
run: cargo test --workspace
|
|
# The tests that change a kernel's routes, in a network namespace of
|
|
# their own; and two daemons that route for each other.
|
|
- name: Kernel tests
|
|
run: scripts/kernel-tests.sh
|
|
|
|
# A short run of each fuzz target: enough to notice a parser change that
|
|
# breaks on input the seeds are close to. Long runs are done by hand; see
|
|
# fuzz/README.md.
|
|
fuzz:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@nightly
|
|
- name: Install cargo-fuzz
|
|
run: cargo install cargo-fuzz --locked
|
|
- name: Fuzz
|
|
working-directory: fuzz
|
|
# cargo-fuzz sets its own flags; the workspace's -D warnings would
|
|
# replace them.
|
|
env:
|
|
RUSTFLAGS: ""
|
|
run: |
|
|
for target in message message_body prefix_text config rtr netlink; do
|
|
mkdir -p "corpus/$target"
|
|
cargo fuzz run "$target" "corpus/$target" "seeds/$target" -- -max_total_time=60
|
|
done
|