test(portfwd): cover ignore without k8s template

Author: casey-quinn

.github/workflows/test.yml

@@ -383,12 +383,8 @@ jobs:
       run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/k8s.bats
       env:
         LIMA_BATS_ALL_TESTS_RETRIES: 3
-    - name: Cache image used by templates/k8s-no-portfwd.yaml
-      uses: ./.github/actions/setup_cache_for_template
-      with:
-        template: templates/k8s-no-portfwd.yaml
-    - name: "Run BATS k8s-no-portfwd tests"
-      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/k8s-no-portfwd.bats
+    - name: "Run BATS port-forwarding ignore tests"
+      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/port-forwarding-ignore.bats
       env:
         LIMA_BATS_ALL_TESTS_RETRIES: 3
 

hack/bats/extras/k8s-no-portfwd.bats

@@ -0,0 +1,92 @@
+# SPDX-FileCopyrightText: Copyright The Lima Authors
+# SPDX-License-Identifier: Apache-2.0
+
+# Verify that a Lima instance configured with ignore:true proto:any rules does
+# not forward guest ports back to the host, even when services listen on the
+# guest.
+
+load "../helpers/load"
+
+NAME="pf-ignore"
+CONFIG_PATH="${BATS_TEST_TMPDIR}/no-port-forwarding.yaml"
+
+local_setup() {
+    limactl delete --force "${NAME}" || :
+    cat <<'EOF' >"${CONFIG_PATH}"
+minimumLimaVersion: 2.0.0
+base:
+- template:default
+portForwards:
+- guestIP: "0.0.0.0"
+  guestIPMustBeZero: false
+  proto: "any"
+  ignore: true
+- guestIP: "::"
+  proto: "any"
+  ignore: true
+EOF
+    limactl start --tty=false --name "${NAME}" "${CONFIG_PATH}" 3>&- 4>&-
+    for _ in $(seq 1 30); do
+        if limactl shell "${NAME}" -- true 3>&- 4>&-; then
+            return 0
+        fi
+        sleep 5
+    done
+    echo "instance did not become reachable" >&2
+    return 1
+}
+
+local_teardown() {
+    limactl delete --force "${NAME}" || :
+}
+
+start_guest_services() {
+    limactl shell "${NAME}" -- bash -lc 'nohup python3 -m http.server 31080 --bind 0.0.0.0 >/tmp/http.log 2>&1 &' 3>&- 4>&-
+    limactl shell "${NAME}" -- bash -lc 'nohup python3 - <<"PY" >/tmp/udp.log 2>&1 &
+import socket
+
+sock = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+try:
+    sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
+except (AttributeError, OSError):
+    pass
+sock.bind(("::", 32053, 0, 0))
+while True:
+    data, addr = sock.recvfrom(1024)
+    if not data:
+        continue
+    sock.sendto(b"guest", addr)
+PY
+' 3>&- 4>&-
+    limactl shell "${NAME}" -- bash -lc 'for i in $(seq 1 10); do curl --silent --fail http://127.0.0.1:31080 >/dev/null 2>&1 && exit 0; sleep 1; done; exit 1'
+}
+
+@test 'Host cannot reach guest services when forwarding is ignored' {
+    start_guest_services
+
+    run curl --fail --silent --show-error --connect-timeout 5 --max-time 10 http://127.0.0.1:31080
+    assert_failure
+
+    run python3 - <<'PY'
+import socket
+import sys
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+sock.settimeout(2.0)
+destination = ("127.0.0.1", 32053)
+
+try:
+    sock.sendto(b"ping", destination)
+    data, _ = sock.recvfrom(16)
+except (ConnectionRefusedError, TimeoutError, socket.timeout, OSError):
+    sys.exit(0)
+else:
+    sys.exit(1 if data == b"guest" else 0)
+PY
+    assert_success
+
+    instance_dir=$(limactl list "${NAME}" --format '{{.Dir}}')
+    run grep -n "Forwarding " "${instance_dir}/ha.stderr.log"
+    assert_failure
+}

hack/bats/extras/port-forwarding-ignore.bats

@@ -111,7 +111,9 @@ func (pf *portForwarder) OnEvent(ctx context.Context, ev *api.Event) {
 		}
 		local, remote := pf.forwardingAddresses(f)
 		if local == "" {
-			logrus.Infof("Not forwarding %s %s", strings.ToUpper(f.Protocol), remote)
+			if !pf.ignore {
+				logrus.Infof("Not forwarding %s %s", strings.ToUpper(f.Protocol), remote)
+			}
 			continue
 		}
 		logrus.Infof("Forwarding %s from %s to %s", strings.ToUpper(f.Protocol), remote, local)