41 lines
2.0 KiB
Bash
Executable File
41 lines
2.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# Container egress smoke: verify the render service's security boundary holds —
|
|
# a NEW outbound connection from the render container is blocked, while loopback
|
|
# (the producer's file server) and inbound-response traffic still work.
|
|
#
|
|
# Run against a built image (default: openmaic-render-service:pr937):
|
|
# render-service/scripts/egress-smoke.sh [image]
|
|
#
|
|
# Requires Docker with CAP_NET_ADMIN available (the compose default). Exits 0
|
|
# only if: the container boots with lockdown active, /health answers over
|
|
# loopback, and a new outbound connection is refused/timed out.
|
|
set -eu
|
|
|
|
IMAGE="${1:-openmaic-render-service:pr937}"
|
|
NAME="rs-egress-smoke-$$"
|
|
|
|
cleanup() { docker rm -f "$NAME" >/dev/null 2>&1 || true; }
|
|
trap cleanup EXIT
|
|
|
|
echo "[smoke] starting $IMAGE with CAP_NET_ADMIN..."
|
|
docker run --rm -d --name "$NAME" --cap-add NET_ADMIN "$IMAGE" >/dev/null
|
|
sleep 6
|
|
|
|
echo "[smoke] checking lockdown is reported active..."
|
|
docker logs "$NAME" 2>&1 | grep -q "egress lockdown active" || {
|
|
echo "[smoke] FAIL: lockdown not active in logs"; docker logs "$NAME" 2>&1 | tail; exit 1;
|
|
}
|
|
|
|
echo "[smoke] loopback /health must answer..."
|
|
HEALTH=$(docker exec "$NAME" node -e 'fetch("http://127.0.0.1:9000/health").then(r=>r.json()).then(j=>{console.log(j.ok===true?"OK":"BAD");process.exit(0)}).catch(()=>{console.log("ERR");process.exit(0)})')
|
|
[ "$HEALTH" = "OK" ] || { echo "[smoke] FAIL: loopback health = $HEALTH"; exit 1; }
|
|
|
|
echo "[smoke] a NEW outbound connection must be blocked..."
|
|
OUT=$(docker exec "$NAME" node -e 'const s=require("net").connect({host:"deb.debian.org",port:80});s.setTimeout(4000);s.on("connect",()=>{console.log("REACHABLE");process.exit(0)});s.on("timeout",()=>{console.log("BLOCKED");process.exit(0)});s.on("error",e=>{console.log("BLOCKED_"+e.code);process.exit(0)})')
|
|
case "$OUT" in
|
|
BLOCKED*) echo "[smoke] outbound blocked ($OUT)";;
|
|
*) echo "[smoke] FAIL: outbound was $OUT (expected blocked)"; exit 1;;
|
|
esac
|
|
|
|
echo "[smoke] PASS: lockdown active, loopback works, egress blocked."
|