mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
0ccd4bbf24
In CI, eBPF in driver mode actually functions just fine with no changes to our existing tests, given we apply a few workarounds and bugfixes: - The interface learning mechanism had two flaws: (1) it only learned per-CPU, which meant the risk for a missing entry grew as the core count of the relay host grew, and (2) it did not filter for unicast IPs, so it picked up broadcast and link-local addresses, causing cross-relay paths to fail occasionally - The `relay-relay` candidate where the two relays are the same relay causes packet drops / loops in the Docker bridge setup, and possibly in GCP too. I'm not sure this is a valid path that solves a real connectivity issue in the wild. I can understand relay-relay paths where two relays are different hosts, and the client and gateway both talk over their TURN channel to each other (i.e. WireGuard is blocked in each of their networks), but I can't think of an advantage for a relay-relay candidate where the traffic simply hairpins (or is dropped) off the nearest switch. This has been now detected with a new `PacketLoop` error that triggers whenever source_ip == dest_ip. - The relays in CI need a common next-hop to talk to for the MAC address swapping to work. A simple router service is added which functions as a basic L3 router (no NAT) that allows the MAC swapping to work. - The `veth` driver has some peculiar requirements to allow it to function with XDP_TX. If you send a packet out of one interface of a veth pair with XDP_TX, you need to either make sure both interfaces have GRO enabled, or you need to attach a dummy XDP program that simply does XDP_PASS to the other interface so that the sk_buff is allocated before going up the stack to the Docker bridge. The GRO method was unreliable and didn't work in our case, causing massive packet delays and unpredictable bursts that prevented ICE from working, so we use the XDP_PASS method instead. A simple docker image is built and lives at https://github.com/firezone/xdp-pass to handle this. Related: #10138 Related: #10260
Firezone shell scripts
This directory contains various shell scripts used for development, testing, and deployment of the Firezone product.
Developer Setup
We lint shell scripts in CI. To get your PR to pass, you'll want to ensure your local development environment is set up to lint shell scripts:
- Install
shfmt:brew install shfmton macOS- Install shfmt from https://github.com/mvdan/sh/releases for other platforms
- Install
shellcheck:brew install shellcheckon macOSsudo apt-get install shellcheckon Ubuntu
Then just lint and format your shell scripts before you commit:
shfmt -i 4 **/*.sh
shellcheck --severity=warning **/*.sh
You can achieve this more easily by using pre-commit. See
CONTRIBUTING.
Editor setup
- Vim (here's an example using ALE)
- VSCode
Scripting tips
- Use
#!/usr/bin/env bashalong withset -euox pipefailin general for dev and test scripts. - In Docker images and other minimal envs, stick to
#!/bin/shand simplyset -eu.