Skip to content

Commit 53dfc57

Browse files
jackivanovjackivanov
authored
Github Actions (trailofbits#1681)
1 parent eb40ade commit 53dfc57

File tree

8 files changed

+177
-143
lines changed

8 files changed

+177
-143
lines changed

‎.github/workflows/main.yml

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
name: Main
2+
3+
on: [push, pull_request]
4+
5+
jobs:
6+
lint:
7+
runs-on: ubuntu-18.04
8+
steps:
9+
- uses: actions/checkout@v1
10+
- uses: actions/setup-python@v1
11+
with:
12+
python-version: '3.7'
13+
14+
- name: Install dependencies
15+
run: |
16+
sudo apt update -y
17+
python -m pip install --upgrade pip
18+
pip install -r requirements.txt
19+
sudo snap install shellcheck
20+
pip install ansible-lint
21+
22+
- name: Checks and linters
23+
run: |
24+
/snap/bin/shellcheck algo install.sh
25+
ansible-playbook main.yml --syntax-check
26+
ansible-lint -v *.yml roles/{local,cloud-*}/*/*.yml
27+
28+
scripted-deploy:
29+
runs-on: ubuntu-16.04
30+
strategy:
31+
matrix:
32+
UBUNTU_VERSION: ["18.04", "19.04", "19.10"]
33+
steps:
34+
- uses: actions/checkout@v1
35+
- uses: actions/setup-python@v1
36+
with:
37+
python-version: '3.7'
38+
39+
- name: Install dependencies
40+
run: |
41+
sudo apt update -y
42+
sudo add-apt-repository -yu ppa:wireguard/wireguard
43+
sudo apt install -y \
44+
python3-pip \
45+
lxd \
46+
expect-dev \
47+
debootstrap \
48+
tree \
49+
bridge-utils \
50+
dnsutils \
51+
build-essential \
52+
libssl-dev \
53+
libffi-dev \
54+
python3-dev \
55+
linux-headers-$(uname -r) \
56+
wireguard \
57+
libxml2-utils \
58+
crudini \
59+
fping \
60+
strongswan \
61+
libstrongswan-standard-plugins \
62+
resolvconf
63+
64+
python3 -m pip install --upgrade pip
65+
python3 -m pip install -r requirements.txt
66+
67+
- name: Provision
68+
env:
69+
DEPLOY: cloud-init
70+
UBUNTU_VERSION: ${{ matrix.UBUNTU_VERSION }}
71+
run: |
72+
ssh-keygen -f ~/.ssh/id_rsa -t rsa -N ''
73+
# sed -i "s/^reduce_mtu:\s0$/reduce_mtu: 80/" config.cfg
74+
sudo -E ./tests/pre-deploy.sh
75+
76+
- name: Deployment
77+
run: |
78+
until sudo lxc exec algo -- test -f /var/log/cloud-init-output.log; do echo 'Log file not found, Sleep for 3 seconds'; sleep 3; done
79+
( sudo lxc exec algo -- tail -f /var/log/cloud-init-output.log & )
80+
until sudo lxc exec algo -- test -f /var/lib/cloud/data/result.json; do
81+
echo 'Cloud init is not finished. Sleep for 30 seconds';
82+
sleep 30;
83+
done
84+
sudo lxc exec algo -- test -f /opt/algo/configs/localhost/.config.yml
85+
sudo lxc exec algo -- tar zcf /root/algo-configs.tar -C /opt/algo/configs/ .
86+
sudo lxc file pull algo/root/algo-configs.tar ./
87+
sudo tar -C ./configs -zxf algo-configs.tar
88+
89+
- name: Tests
90+
run: |
91+
set -x
92+
sudo -E bash -x ./tests/wireguard-client.sh
93+
sudo env "PATH=$PATH" ./tests/ipsec-client.sh
94+
sudo ./tests/ssh-tunnel.sh
95+
96+
local-deploy:
97+
runs-on: ubuntu-16.04
98+
strategy:
99+
matrix:
100+
UBUNTU_VERSION: ["18.04", "19.04", "19.10"]
101+
steps:
102+
- uses: actions/checkout@v1
103+
- uses: actions/setup-python@v1
104+
with:
105+
python-version: '3.7'
106+
107+
- name: Install dependencies
108+
run: |
109+
set -x
110+
sudo add-apt-repository -yu ppa:wireguard/wireguard
111+
sudo add-apt-repository -yu ppa:ubuntu-lxc/stable
112+
sudo apt update -y
113+
sudo apt install -y \
114+
python3-pip \
115+
lxd \
116+
expect-dev \
117+
debootstrap \
118+
tree \
119+
bridge-utils \
120+
dnsutils \
121+
build-essential \
122+
libssl-dev \
123+
libffi-dev \
124+
python3-dev \
125+
linux-headers-$(uname -r) \
126+
wireguard \
127+
libxml2-utils \
128+
crudini \
129+
fping \
130+
strongswan \
131+
libstrongswan-standard-plugins \
132+
resolvconf
133+
134+
python3 -m pip install --upgrade pip
135+
python3 -m pip install -r requirements.txt
136+
137+
- name: Provision
138+
env:
139+
DEPLOY: docker
140+
UBUNTU_VERSION: ${{ matrix.UBUNTU_VERSION }}
141+
run: |
142+
ssh-keygen -f ~/.ssh/id_rsa -t rsa -N ''
143+
sed -i "s/^reduce_mtu:\s0$/reduce_mtu: 80/" config.cfg
144+
sudo -E ./tests/pre-deploy.sh
145+
146+
- name: Deployment
147+
env:
148+
DEPLOY: docker
149+
UBUNTU_VERSION: ${{ matrix.UBUNTU_VERSION }}
150+
run: |
151+
docker build -t local/algo .
152+
./tests/local-deploy.sh
153+
./tests/update-users.sh
154+
155+
- name: Tests
156+
run: |
157+
set -x
158+
sudo bash -x ./tests/wireguard-client.sh
159+
sudo env "PATH=$PATH" bash -x ./tests/ipsec-client.sh
160+
sudo bash -x ./tests/ssh-tunnel.sh

‎.travis.yml

Lines changed: 0 additions & 129 deletions
This file was deleted.

‎server.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@
8787
ipsec_enabled: {{ ipsec_enabled }}
8888
wireguard_enabled: {{ wireguard_enabled }}
8989
{% if tests|default(false)|bool %}
90-
ca_password: {{ CA_password }}
91-
p12_password: {{ p12_export_password }}
90+
ca_password: '{{ CA_password }}'
91+
p12_password: '{{ p12_export_password }}'
9292
{% endif %}
9393
become: false
9494
delegate_to: localhost

‎tests/cloud-init.sh

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ export DNS_ADBLOCKING=true
99
export SSH_TUNNELING=true
1010
export ENDPOINT=10.0.8.100
1111
export USERS=desktop,user1,user2
12-
export EXTRA_VARS='install_headers=false tests=true apparmor_enabled=false local_service_ip=172.16.0.1'
13-
export ANSIBLE_EXTRA_ARGS='--skip-tags apparmor'
14-
export REPO_SLUG=${TRAVIS_PULL_REQUEST_SLUG:-${TRAVIS_REPO_SLUG:-trailofbits/algo}}
15-
export REPO_BRANCH=${TRAVIS_PULL_REQUEST_BRANCH:-${TRAVIS_BRANCH:-master}}
12+
export EXTRA_VARS='install_headers=false tests=true local_service_ip=172.16.0.1'
13+
export ANSIBLE_EXTRA_ARGS=''
14+
export REPO_SLUG=${REPOSITORY:-trailofbits/algo}
15+
export REPO_BRANCH=${BRANCH:-master}
1616
17-
curl -s https://raw.githubusercontent.com/${TRAVIS_PULL_REQUEST_SLUG:-${TRAVIS_REPO_SLUG}}/${TRAVIS_PULL_REQUEST_BRANCH:-${TRAVIS_BRANCH}}/install.sh | sudo -E bash -x"
17+
curl -s https://raw.githubusercontent.com/${REPOSITORY:-trailofbits/algo}/${BRANCH:-master}/install.sh | sudo -E bash -x"

‎tests/local-deploy.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
set -ex
44

5-
DEPLOY_ARGS="provider=local server=10.0.8.100 ssh_user=ubuntu endpoint=10.0.8.100 apparmor_enabled=false ondemand_cellular=true ondemand_wifi=true ondemand_wifi_exclude=test dns_adblocking=true ssh_tunneling=true store_pki=true install_headers=false tests=true local_service_ip=172.16.0.1"
5+
DEPLOY_ARGS="provider=local server=10.0.8.100 ssh_user=ubuntu endpoint=10.0.8.100 ondemand_cellular=true ondemand_wifi=true ondemand_wifi_exclude=test dns_adblocking=true ssh_tunneling=true store_pki=true install_headers=false tests=true local_service_ip=172.16.0.1"
66

77
if [ "${DEPLOY}" == "docker" ]
88
then
9-
docker run -it -v $(pwd)/config.cfg:/algo/config.cfg -v ~/.ssh:/root/.ssh -v $(pwd)/configs:/algo/configs -e "DEPLOY_ARGS=${DEPLOY_ARGS}" travis/algo /bin/sh -c "chown -R root: /root/.ssh && chmod -R 600 /root/.ssh && source .env/bin/activate && ansible-playbook main.yml -e \"${DEPLOY_ARGS}\" --skip-tags apparmor"
9+
docker run -i -v $(pwd)/config.cfg:/algo/config.cfg -v ~/.ssh:/root/.ssh -v $(pwd)/configs:/algo/configs -e "DEPLOY_ARGS=${DEPLOY_ARGS}" local/algo /bin/sh -c "chown -R root: /root/.ssh && chmod -R 600 /root/.ssh && source .env/bin/activate && ansible-playbook main.yml -e \"${DEPLOY_ARGS}\" --skip-tags debug"
1010
else
11-
ansible-playbook main.yml -e "${DEPLOY_ARGS}" --skip-tags apparmor
11+
ansible-playbook main.yml -e "${DEPLOY_ARGS}"
1212
fi

‎tests/pre-deploy.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ tar xf $HOME/lxc/cache.tar -C / || echo "Didn't extract cache."
88
cp -f tests/lxd-bridge /etc/default/lxd-bridge
99
cp -f tests/algo.conf /etc/default/algo.conf
1010

11+
export REPOSITORY=${GITHUB_REPOSITORY}
12+
export BRANCH=${GITHUB_REF#refs/heads/}
13+
1114
if [[ "$DEPLOY" == "cloud-init" ]]; then
1215
bash tests/cloud-init.sh | lxc profile set default user.user-data -
1316
else

‎tests/ssh-tunnel.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22

33
set -euxo pipefail
44

5-
PASS=$(grep ^p12_password: configs/10.0.8.100/.config.yml | awk '{print $2}')
5+
PASS=$(grep ^p12_password: configs/10.0.8.100/.config.yml | awk '{print $2}' | cut -f2 -d\')
66

77
ssh-keygen -p -P ${PASS} -N '' -f configs/10.0.8.100/ssh-tunnel/desktop.pem
88

99
ssh -o StrictHostKeyChecking=no -D 127.0.0.1:1080 -f -q -C -N [email protected] -i configs/10.0.8.100/ssh-tunnel/desktop.pem -F configs/10.0.8.100/ssh_config
1010

1111
git config --global http.proxy 'socks5://127.0.0.1:1080'
1212

13-
git clone -vv https://github.com/trailofbits/algo /tmp/ssh-tunnel-check
13+
for i in {1..10}; do git clone -vv https://github.com/trailofbits/algo /tmp/ssh-tunnel-check && break || sleep 1; done
1414

1515
echo "SSH tunneling tests passed"

‎tests/update-users.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ USER_ARGS="{ 'server': '10.0.8.100', 'users': ['desktop', 'user1', 'user2'], 'lo
66

77
if [ "${DEPLOY}" == "docker" ]
88
then
9-
docker run -it -v $(pwd)/config.cfg:/algo/config.cfg -v ~/.ssh:/root/.ssh -v $(pwd)/configs:/algo/configs -e "USER_ARGS=${USER_ARGS}" travis/algo /bin/sh -c "chown -R root: /root/.ssh && chmod -R 600 /root/.ssh && source .env/bin/activate && ansible-playbook users.yml -e \"${USER_ARGS}\" -t update-users"
9+
docker run -i -v $(pwd)/config.cfg:/algo/config.cfg -v ~/.ssh:/root/.ssh -v $(pwd)/configs:/algo/configs -e "USER_ARGS=${USER_ARGS}" local/algo /bin/sh -c "chown -R root: /root/.ssh && chmod -R 600 /root/.ssh && source .env/bin/activate && ansible-playbook users.yml -e \"${USER_ARGS}\" -t update-users --skip-tags debug -vvvvv"
1010
else
1111
ansible-playbook users.yml -e "${USER_ARGS}" -t update-users
1212
fi
@@ -23,7 +23,7 @@ if sudo openssl crl -inform pem -noout -text -in configs/10.0.8.100/ipsec/.pki/c
2323
exit 1
2424
fi
2525

26-
if sudo openssl x509 -inform pem -noout -text -in configs/10.0.8.100/ipsec/.pki/certs/user1.crt | grep CN=user1
26+
if sudo openssl x509 -inform pem -noout -text -in configs/10.0.8.100/ipsec/.pki/certs/user1.crt | grep -E "CN(=|\s+=\s+)user1"
2727
then
2828
echo "The new user exists"
2929
else

0 commit comments

Comments
 (0)