ci: test IPv6 for CIDR resources (#10168)

Docker for Mac finally supports IPv6 in general availability. It's time
to add IPv6 to our suite of integration tests.

The thinking behind this PR is try and not slow down CI much, if at all,
by testing IPv6 side-by-side with the existing IPv4 tests.

More comprehensive testing is being developed in #10131 that will test
things like IPv4-in-6 relaying, client / gateway IP stack mismatches,
and so forth.

scripts/tests/direct-curl-api-down.sh

@@ -3,7 +3,9 @@
 source "./scripts/tests/lib.sh"
 
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"
 
 docker compose stop api # Stop portal
 
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"

scripts/tests/direct-curl-api-restart.sh

@@ -5,7 +5,9 @@ source "./scripts/tests/lib.sh"
 docker compose restart api # Restart portal
 
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"
 
 docker compose restart api # Restart again
 
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"

scripts/tests/direct-curl-ecn.sh

@@ -5,3 +5,4 @@ source "./scripts/tests/lib.sh"
 client sysctl -w net.ipv4.tcp_ecn=1
 
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"

scripts/tests/lib.sh

@@ -20,10 +20,11 @@ function relay2() {
 
 function install_iptables_drop_rules() {
     # Install `iptables` to have it available in the compatibility tests
-    docker compose exec -it client /bin/sh -c 'apk add iptables'
+    client apk add iptables
 
     # Execute within the client container because doing so from the host is not reliable in CI.
-    docker compose exec -it client /bin/sh -c 'iptables -A OUTPUT -d 172.28.0.105 -j DROP'
+    client iptables -A OUTPUT -d 172.28.0.105 -j DROP
+    client ip6tables -A OUTPUT -d 172:28:0::105 -j DROP
 }
 
 function client_curl_resource() {

scripts/tests/relay-graceful-shutdown.sh

@@ -5,6 +5,7 @@ source "./scripts/tests/lib.sh"
 # Arrange: Setup a relayed connection
 install_iptables_drop_rules
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"
 
 # Act: Send SIGTERM
 docker compose kill relay-1 --signal SIGTERM
@@ -13,6 +14,7 @@ sleep 2 # Closing websocket isn't instant.
 
 # Assert: Dataplane still works
 client_curl_resource "172.20.0.100/get"
+client_curl_resource "[172:20:0::100]/get"
 
 # Assert: Websocket connection is cut
 OPEN_SOCKETS=$(relay1 netstat -tn | grep "ESTABLISHED" | grep 8081 || true) # Portal listens on port 8081

scripts/tests/systemd/dns-systemd-resolved.sh

@@ -10,6 +10,7 @@ SERVICE_NAME=firezone-client-headless
 debug_exit() {
     echo "Bailing out. Waiting a couple seconds for things to settle..."
     sleep 5
+    docker compose ps -a
     resolvectl dns tun-firezone || true
     systemctl status "$SERVICE_NAME" || true
     exit 1

scripts/tests/systemd/env

@@ -1 +1 @@
-FIREZONE_API_URL=ws://localhost:8081
+FIREZONE_API_URL=ws://127.0.0.1:8081

scripts/tests/systemd/firezone-client-headless.service

@@ -34,7 +34,7 @@ SystemCallArchitectures=native
 SystemCallFilter=@aio @basic-io @file-system @io-event @network-io @signal @system-service
 UMask=077
 
-Environment="FIREZONE_API_URL=ws://localhost:8081"
+Environment="FIREZONE_API_URL=ws://127.0.0.1:8081"
 # TODO: Remove after #6163 gets into a release
 Environment="FIREZONE_DNS_CONTROL=systemd-resolved"
 Environment="RUST_LOG=info"