# The extension sandbox's deny rules, proven on real traffic.
#
# scripts/sandbox-rules-test.py loads meta-forgefirm's ffx.nft into a network
# namespace of its own, joins a second namespace to it with a veth pair (a
# peer that is not the machine), and sends from real uids: a pool uid is
# refused on loopback, at its own LAN address, and at the peer (TCP at once,
# UDP with EPERM), the uids on either side of the pool and root are not
# touched, an allowlist chain opens one port of the peer to one uid, the
# machine's own addresses stay shut even on an allowlist, and loading the
# file again takes the allowlist away. The
# runner's nft is the version the image carries or newer; the kernel side is
# the image's own business and is proven on the machine (exthost.platform).

name: sandbox-ci

on:
  push:
    branches: [master]
    paths:
      - 'meta-forgefirm/recipes-forgefirm/forgefirm-sandbox/**'
      - 'scripts/sandbox-rules-test.py'
      - '.github/workflows/sandbox-ci.yml'
  pull_request:
  workflow_dispatch:

jobs:
  rules:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - name: nft
        run: sudo apt-get update && sudo apt-get install -y nftables

      - name: The deny rules on real traffic
        run: |
          # 77 is the script's "could not run here": on this runner that is a failure.
          sudo python3 -B scripts/sandbox-rules-test.py