test/e2e: improve pcap interface detection with route verification (#1021)

Extract shared get_default_interface, get_route_interface, and
verify_traffic_interface functions into common.sh to eliminate
duplicate definitions across tls_e2e_test, tls_pcap_advanced_test,
and gotls_advanced_test scripts.

verify_traffic_interface uses 'ip route get' to confirm the kernel
actually routes traffic to the test target through the detected
interface, correcting DEFAULT_IFACE when a mismatch is found
(e.g., multi-homed hosts, Docker bridges, VPN tunnels).

This fixes the "[303] nothing captured" error on GitHub Actions
runners where the default route interface may differ from the
interface actually used for outbound traffic.

Co-authored-by: Claude <noreply@anthropic.com>

Author: cfc4n

test/e2e/common.sh

@@ -267,3 +267,61 @@ verify_content_match() {
         return 1
     fi
 }
+
+# ============================================================================
+# Network Interface Detection (shared by all e2e test scripts)
+# ============================================================================
+
+# Get default network interface from routing table (needed for pcap mode)
+get_default_interface() {
+    ip route | grep default | awk '{print $5}' | head -1 || echo ""
+}
+
+# Get the interface that would actually be used to reach a given target.
+# Uses "ip route get" to query the kernel's routing decision.
+# Args: target hostname or IP
+# Returns: interface name (e.g., eth0, ens5) or empty string
+get_route_interface() {
+    local target="${1:-1.1.1.1}"
+    # Resolve hostname to IP (use first result) if target is not already an IP
+    local target_ip
+    target_ip=$(dig +short "$target" 2>/dev/null | grep -E '^[0-9]' | head -1 || echo "")
+    if [ -z "$target_ip" ]; then
+        # dig failed or returned no result, try getent as fallback
+        target_ip=$(getent ahosts "$target" 2>/dev/null | awk '{print $1; exit}' || echo "$target")
+    fi
+    # Query kernel routing table: which dev would be used for this IP?
+    ip route get "$target_ip" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") {print $(i+1); exit}}' || echo ""
+}
+
+# Verify that traffic to the test target actually goes through the detected interface.
+# Corrects DEFAULT_IFACE (global variable) if a mismatch is found.
+# Must be called after DEFAULT_IFACE is set via get_default_interface.
+# Args: target hostname (e.g., "api.github.com")
+verify_traffic_interface() {
+    local target="${1:-api.github.com}"
+    local route_iface
+    route_iface=$(get_route_interface "$target")
+
+    if [ -z "$route_iface" ]; then
+        log_warn "Could not determine route interface for $target (dig/getent may be unavailable)"
+        return 1
+    fi
+
+    log_info "Kernel routes traffic to $target via interface: $route_iface"
+
+    if [ -z "$DEFAULT_IFACE" ]; then
+        log_info "No default interface was set, using route-detected interface: $route_iface"
+        DEFAULT_IFACE="$route_iface"
+        return 0
+    fi
+
+    if [ "$DEFAULT_IFACE" != "$route_iface" ]; then
+        log_warn "Default route interface ($DEFAULT_IFACE) != route to $target ($route_iface)"
+        log_warn "Using $route_iface for pcap capture (matches actual traffic path)"
+        DEFAULT_IFACE="$route_iface"
+    else
+        log_success "Traffic to $target matches default interface: $DEFAULT_IFACE"
+    fi
+    return 0
+}

test/e2e/gotls_advanced_test.sh

@@ -39,10 +39,6 @@ cleanup_handler() {
 
 setup_cleanup_trap
 
-# Get default network interface (needed for pcap mode)
-get_default_interface() {
-    ip route | grep default | awk '{print $5}' | head -1 || echo ""
-}
 DEFAULT_IFACE=""
 
 # Build Go test programs
@@ -519,8 +515,11 @@ main() {
     # Detect default network interface (required for pcap mode)
     DEFAULT_IFACE=$(get_default_interface)
     if [ -z "$DEFAULT_IFACE" ]; then
-        log_warn "Could not determine default network interface, pcap tests may fail"
+        log_warn "Could not determine default network interface from routing table"
     fi
+
+    # Verify traffic to test target actually uses the detected interface
+    verify_traffic_interface "api.github.com" || true
 
     test_gotls_text_mode || true
     kill_by_pattern "$ECAPTURE_BINARY.*gotls" || true

test/e2e/tls_e2e_test.sh

@@ -50,10 +50,6 @@ cleanup_handler() {
 # Setup trap
 setup_cleanup_trap
 
-# Get default network interface (needed for pcap mode)
-get_default_interface() {
-    ip route | grep default | awk '{print $5}' | head -1 || echo ""
-}
 DEFAULT_IFACE=""
 
 # Test text mode - captures plaintext directly
@@ -334,8 +330,13 @@ main() {
     # Detect default network interface (required for pcap mode)
     DEFAULT_IFACE=$(get_default_interface)
     if [ -z "$DEFAULT_IFACE" ]; then
-        log_warn "Could not determine default network interface, pcap tests may fail"
+        log_warn "Could not determine default network interface from routing table"
     fi
+
+    # Verify traffic to test target actually uses the detected interface.
+    # This corrects DEFAULT_IFACE if the kernel routes traffic differently
+    # (e.g., multi-homed hosts, Docker bridges, VPN tunnels).
+    verify_traffic_interface "$(echo "$TEST_URL" | sed 's|https://||')" || true
 
     # Test text mode
     if test_text_mode; then

test/e2e/tls_pcap_advanced_test.sh

@@ -32,10 +32,6 @@ cleanup_handler() {
 
 setup_cleanup_trap
 
-# Get default network interface (needed for pcap mode)
-get_default_interface() {
-    ip route | grep default | awk '{print $5}' | head -1 || echo ""
-}
 DEFAULT_IFACE=""
 
 # Verify pcapng file format
@@ -442,9 +438,12 @@ main() {
     # Detect default network interface (required for pcap mode)
     DEFAULT_IFACE=$(get_default_interface)
     if [ -z "$DEFAULT_IFACE" ]; then
-        log_warn "Could not determine default network interface, pcap tests may fail"
+        log_warn "Could not determine default network interface from routing table"
     fi
-    
+
+    # Verify traffic to test target actually uses the detected interface
+    verify_traffic_interface "api.github.com" || true
+
     test_pcapng_basic || true
     kill_by_pattern "$ECAPTURE_BINARY.*tls" || true
     sleep 1