setup_ip_tables_test.go 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138
  1. package bridge
  2. import (
  3. "net"
  4. "testing"
  5. "github.com/docker/libnetwork/iptables"
  6. "github.com/docker/libnetwork/portmapper"
  7. "github.com/docker/libnetwork/testutils"
  8. "github.com/vishvananda/netlink"
  9. )
  10. const (
  11. iptablesTestBridgeIP = "192.168.42.1"
  12. )
  13. func TestProgramIPTable(t *testing.T) {
  14. // Create a test bridge with a basic bridge configuration (name + IPv4).
  15. defer testutils.SetupTestOSContext(t)()
  16. nh, err := netlink.NewHandle()
  17. if err != nil {
  18. t.Fatal(err)
  19. }
  20. createTestBridge(getBasicTestConfig(), &bridgeInterface{nlh: nh}, t)
  21. // Store various iptables chain rules we care for.
  22. rules := []struct {
  23. rule iptRule
  24. descr string
  25. }{
  26. {iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-d", "127.1.2.3", "-i", "lo", "-o", "lo", "-j", "DROP"}}, "Test Loopback"},
  27. {iptRule{table: iptables.Nat, chain: "POSTROUTING", preArgs: []string{"-t", "nat"}, args: []string{"-s", iptablesTestBridgeIP, "!", "-o", DefaultBridgeName, "-j", "MASQUERADE"}}, "NAT Test"},
  28. {iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-o", DefaultBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}}, "Test ACCEPT INCOMING"},
  29. {iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-i", DefaultBridgeName, "!", "-o", DefaultBridgeName, "-j", "ACCEPT"}}, "Test ACCEPT NON_ICC OUTGOING"},
  30. {iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-i", DefaultBridgeName, "-o", DefaultBridgeName, "-j", "ACCEPT"}}, "Test enable ICC"},
  31. {iptRule{table: iptables.Filter, chain: "FORWARD", args: []string{"-i", DefaultBridgeName, "-o", DefaultBridgeName, "-j", "DROP"}}, "Test disable ICC"},
  32. }
  33. // Assert the chain rules' insertion and removal.
  34. for _, c := range rules {
  35. assertIPTableChainProgramming(c.rule, c.descr, t)
  36. }
  37. }
  38. func TestSetupIPChains(t *testing.T) {
  39. // Create a test bridge with a basic bridge configuration (name + IPv4).
  40. defer testutils.SetupTestOSContext(t)()
  41. nh, err := netlink.NewHandle()
  42. if err != nil {
  43. t.Fatal(err)
  44. }
  45. driverconfig := &configuration{
  46. EnableIPTables: true,
  47. }
  48. d := &driver{
  49. config: driverconfig,
  50. }
  51. assertChainConfig(d, t)
  52. config := getBasicTestConfig()
  53. br := &bridgeInterface{nlh: nh}
  54. createTestBridge(config, br, t)
  55. assertBridgeConfig(config, br, d, t)
  56. config.EnableIPMasquerade = true
  57. assertBridgeConfig(config, br, d, t)
  58. config.EnableICC = true
  59. assertBridgeConfig(config, br, d, t)
  60. config.EnableIPMasquerade = false
  61. assertBridgeConfig(config, br, d, t)
  62. }
  63. func getBasicTestConfig() *networkConfiguration {
  64. config := &networkConfiguration{
  65. BridgeName: DefaultBridgeName,
  66. AddressIPv4: &net.IPNet{IP: net.ParseIP(iptablesTestBridgeIP), Mask: net.CIDRMask(16, 32)}}
  67. return config
  68. }
  69. func createTestBridge(config *networkConfiguration, br *bridgeInterface, t *testing.T) {
  70. if err := setupDevice(config, br); err != nil {
  71. t.Fatalf("Failed to create the testing Bridge: %s", err.Error())
  72. }
  73. if err := setupBridgeIPv4(config, br); err != nil {
  74. t.Fatalf("Failed to bring up the testing Bridge: %s", err.Error())
  75. }
  76. }
  77. // Assert base function which pushes iptables chain rules on insertion and removal.
  78. func assertIPTableChainProgramming(rule iptRule, descr string, t *testing.T) {
  79. // Add
  80. if err := programChainRule(iptables.IPv4, rule, descr, true); err != nil {
  81. t.Fatalf("Failed to program iptable rule %s: %s", descr, err.Error())
  82. }
  83. iptable := iptables.GetIptable(iptables.IPv4)
  84. if iptable.Exists(rule.table, rule.chain, rule.args...) == false {
  85. t.Fatalf("Failed to effectively program iptable rule: %s", descr)
  86. }
  87. // Remove
  88. if err := programChainRule(iptables.IPv4, rule, descr, false); err != nil {
  89. t.Fatalf("Failed to remove iptable rule %s: %s", descr, err.Error())
  90. }
  91. if iptable.Exists(rule.table, rule.chain, rule.args...) == true {
  92. t.Fatalf("Failed to effectively remove iptable rule: %s", descr)
  93. }
  94. }
  95. // Assert function which create chains.
  96. func assertChainConfig(d *driver, t *testing.T) {
  97. var err error
  98. d.natChain, d.filterChain, d.isolationChain1, d.isolationChain2, err = setupIPChains(d.config, iptables.IPv4)
  99. if err != nil {
  100. t.Fatal(err)
  101. }
  102. }
  103. // Assert function which pushes chains based on bridge config parameters.
  104. func assertBridgeConfig(config *networkConfiguration, br *bridgeInterface, d *driver, t *testing.T) {
  105. nw := bridgeNetwork{portMapper: portmapper.New(""),
  106. config: config}
  107. nw.driver = d
  108. // Attempt programming of ip tables.
  109. err := nw.setupIP4Tables(config, br)
  110. if err != nil {
  111. t.Fatalf("%v", err)
  112. }
  113. }