mirror of
https://github.com/mudler/LocalAI.git
synced 2026-09-12 22:33:54 -04:00
test: enforce offline resource replay
Assisted-by: Codex:gpt-5 Signed-off-by: Richard Palethorpe <io@richiejp.com>
This commit is contained in:
Richard Palethorpe committed
1 parent
d4b47a6e36
commit
bf9ebbf2d4
28 files changed
+903
-143
No files matched your search
Executable
+42
@@ -0,0 +1,42 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: MIT
|
||||
set -euo pipefail
|
||||
|
||||
if [[ $(uname -s) != Linux ]]; then
|
||||
echo 'kernel-level test egress enforcement is Linux-only' >&2
|
||||
exit 2
|
||||
fi
|
||||
if [[ $# -lt 2 ]]; then
|
||||
echo "usage: $0 TARGET COMMAND [ARG...]" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
root=$(cd "$(dirname "$0")/.." && pwd)
|
||||
group="localai-test-$$"
|
||||
cgroup="/sys/fs/cgroup/$group"
|
||||
parent_cgroup="/sys/fs/cgroup$(awk -F: '$1 == "0" {print $3}' /proc/self/cgroup)"
|
||||
|
||||
sudo mkdir "$cgroup"
|
||||
cleanup() {
|
||||
echo $$ | sudo tee "$parent_cgroup/cgroup.procs" >/dev/null 2>&1 || true
|
||||
sudo iptables -D OUTPUT -m cgroup --path "$group" -j REJECT 2>/dev/null || true
|
||||
sudo iptables -D OUTPUT -m cgroup --path "$group" -d 192.168.0.0/16 -j ACCEPT 2>/dev/null || true
|
||||
sudo iptables -D OUTPUT -m cgroup --path "$group" -d 172.16.0.0/12 -j ACCEPT 2>/dev/null || true
|
||||
sudo iptables -D OUTPUT -m cgroup --path "$group" -d 10.0.0.0/8 -j ACCEPT 2>/dev/null || true
|
||||
sudo iptables -D OUTPUT -m cgroup --path "$group" -d 127.0.0.0/8 -j ACCEPT 2>/dev/null || true
|
||||
sudo ip6tables -D OUTPUT -m cgroup --path "$group" -d ::1/128 -j ACCEPT 2>/dev/null || true
|
||||
sudo ip6tables -D OUTPUT -m cgroup --path "$group" -j REJECT 2>/dev/null || true
|
||||
sudo rmdir "$cgroup" 2>/dev/null || true
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -j REJECT
|
||||
sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 192.168.0.0/16 -j ACCEPT
|
||||
sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 172.16.0.0/12 -j ACCEPT
|
||||
sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 10.0.0.0/8 -j ACCEPT
|
||||
sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 127.0.0.0/8 -j ACCEPT
|
||||
sudo ip6tables -I OUTPUT 1 -m cgroup --path "$group" -j REJECT
|
||||
sudo ip6tables -I OUTPUT 1 -m cgroup --path "$group" -d ::1/128 -j ACCEPT
|
||||
echo $$ | sudo tee "$cgroup/cgroup.procs" >/dev/null
|
||||
|
||||
LOCALAI_TEST_KERNEL_ACTIVE=1 "$root/scripts/run-test-offline.sh" "$@"
|
||||
+11
-14
@@ -2,21 +2,18 @@
|
||||
# SPDX-License-Identifier: MIT
|
||||
set -euo pipefail
|
||||
|
||||
if [[ $# -lt 1 ]]; then
|
||||
echo "usage: $0 COMMAND [ARG...]" >&2
|
||||
if [[ $# -lt 2 ]]; then
|
||||
echo "usage: $0 TARGET COMMAND [ARG...]" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# A closed loopback proxy fails accidental HTTP(S) immediately while keeping
|
||||
# existing loopback fixtures and isolated container networks reachable.
|
||||
export HTTP_PROXY="http://127.0.0.1:1"
|
||||
export HTTPS_PROXY="$HTTP_PROXY"
|
||||
export ALL_PROXY="$HTTP_PROXY"
|
||||
export http_proxy="$HTTP_PROXY"
|
||||
export https_proxy="$HTTP_PROXY"
|
||||
export all_proxy="$HTTP_PROXY"
|
||||
export NO_PROXY="localhost,127.0.0.0/8,::1,172.16.0.0/12,192.168.0.0/16"
|
||||
export no_proxy="$NO_PROXY"
|
||||
export TESTCONTAINERS_RYUK_DISABLED=true
|
||||
target=$1
|
||||
shift
|
||||
root=$(cd "$(dirname "$0")/.." && pwd)
|
||||
|
||||
exec "$@"
|
||||
if [[ ${LOCALAI_TEST_KERNEL_ENFORCE:-0} == 1 && ${LOCALAI_TEST_KERNEL_ACTIVE:-0} != 1 ]]; then
|
||||
exec "$root/scripts/run-test-linux-offline.sh" "$target" "$@"
|
||||
fi
|
||||
|
||||
exec go run "$root/cmd/test-resources" run "$target" \
|
||||
"$root/test-resources/manifests" "${TEST_RESOURCE_CACHE:-$root/.cache/test-resources}" -- "$@"
|
||||
@@ -2,9 +2,32 @@
|
||||
# SPDX-License-Identifier: MIT
|
||||
set -euo pipefail
|
||||
|
||||
# Enforce the policy on additions while the existing loopback-only test client
|
||||
# call sites are migrated. The normal lint baseline must not make unrelated
|
||||
# changes responsible for historical debt.
|
||||
# The full-tree fingerprint makes this effective on a clean CI checkout (where
|
||||
# a worktree-only diff would always be empty). Most existing direct clients are
|
||||
# loopback fixtures; changing the inventory requires an intentional baseline
|
||||
# update after review.
|
||||
expected_inventory=2885a428cdab55eea357dae3ec47b3d44f9999b59542d06cd3d792cf491c76b3
|
||||
inventory=$(
|
||||
{
|
||||
rg --no-heading --no-line-number --glob '*_test.go' \
|
||||
'(http\.(Get|Post|Head)\(|http\.Default(Client|Transport)|net\.Dial\(|exec\.Command\([^,]+,[[:space:]]*"(curl|wget)")' \
|
||||
pkg core tests backend || true
|
||||
rg --no-heading --no-line-number --glob '*.sh' '(curl|wget)[[:space:]]' tests backend || true
|
||||
} | LC_ALL=C sort
|
||||
)
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
actual_inventory=$(printf '%s\n' "$inventory" | sha256sum | awk '{print $1}')
|
||||
else
|
||||
actual_inventory=$(printf '%s\n' "$inventory" | shasum -a 256 | awk '{print $1}')
|
||||
fi
|
||||
if [[ $actual_inventory != "$expected_inventory" ]]; then
|
||||
echo 'Test network mechanism inventory changed; remove the direct access or review and update the lint baseline:' >&2
|
||||
echo "$inventory" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Also give contributors a focused diagnostic for newly introduced remote
|
||||
# literals and direct mechanisms instead of only reporting the fingerprint.
|
||||
base=${TEST_NETWORK_LINT_BASE:-HEAD}
|
||||
violations=$(git diff --unified=0 "$base" -- api pkg core tests backend | \
|
||||
rg '^\+[^+].*(http\.(Get|Post|Head)\(|http\.Default(Client|Transport)|net\.Dial\(|exec\.Command\([^,]+,[[:space:]]*"(curl|wget)"|https?://)' | \
|
||||
|
||||
Reference in new issue
Block a user