17723691e5
This reverts commit 2d397beb00.
moby#44706 and moby#44805 were both merged, and both refactored the same
file. The combination broke the build, and was not detected in CI as
only the combination of the two, applied to the same parent commit,
caused the failure.
moby#44706 should be carried forward, based on the current master, in
order to resolve this conflict.
Signed-off-by: Bjorn Neergaard <bneergaard@mirantis.com>
104 lines
2.6 KiB
Go
104 lines
2.6 KiB
Go
package libnetwork
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/docker/docker/libnetwork/iptables"
|
|
"github.com/docker/docker/libnetwork/netlabel"
|
|
"github.com/docker/docker/libnetwork/options"
|
|
"github.com/docker/docker/libnetwork/testutils"
|
|
"gotest.tools/v3/assert"
|
|
)
|
|
|
|
const (
|
|
fwdChainName = "FORWARD"
|
|
usrChainName = userChain
|
|
)
|
|
|
|
func TestUserChain(t *testing.T) {
|
|
iptable := iptables.GetIptable(iptables.IPv4)
|
|
|
|
tests := []struct {
|
|
iptables bool
|
|
insert bool // insert other rules to FORWARD
|
|
fwdChain []string
|
|
userChain []string
|
|
}{
|
|
{
|
|
iptables: false,
|
|
insert: false,
|
|
fwdChain: []string{"-P FORWARD ACCEPT"},
|
|
},
|
|
{
|
|
iptables: true,
|
|
insert: false,
|
|
fwdChain: []string{"-P FORWARD ACCEPT", "-A FORWARD -j DOCKER-USER"},
|
|
userChain: []string{"-N DOCKER-USER", "-A DOCKER-USER -j RETURN"},
|
|
},
|
|
{
|
|
iptables: true,
|
|
insert: true,
|
|
fwdChain: []string{"-P FORWARD ACCEPT", "-A FORWARD -j DOCKER-USER", "-A FORWARD -j DROP"},
|
|
userChain: []string{"-N DOCKER-USER", "-A DOCKER-USER -j RETURN"},
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
tc := tc
|
|
t.Run(fmt.Sprintf("iptables=%v,insert=%v", tc.iptables, tc.insert), func(t *testing.T) {
|
|
defer testutils.SetupTestOSContext(t)()
|
|
defer resetIptables(t)
|
|
|
|
c, err := New()
|
|
assert.NilError(t, err)
|
|
defer c.Stop()
|
|
c.cfg.DriverCfg["bridge"] = map[string]interface{}{
|
|
netlabel.GenericData: options.Generic{
|
|
"EnableIPTables": tc.iptables,
|
|
},
|
|
}
|
|
|
|
// init. condition, FORWARD chain empty DOCKER-USER not exist
|
|
assert.DeepEqual(t, getRules(t, fwdChainName), []string{"-P FORWARD ACCEPT"})
|
|
|
|
if tc.insert {
|
|
_, err = iptable.Raw("-A", fwdChainName, "-j", "DROP")
|
|
assert.NilError(t, err)
|
|
}
|
|
arrangeUserFilterRule()
|
|
|
|
assert.DeepEqual(t, getRules(t, fwdChainName), tc.fwdChain)
|
|
if tc.userChain != nil {
|
|
assert.DeepEqual(t, getRules(t, usrChainName), tc.userChain)
|
|
} else {
|
|
_, err := iptable.Raw("-S", usrChainName)
|
|
assert.Assert(t, err != nil, "chain %v: created unexpectedly", usrChainName)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func getRules(t *testing.T, chain string) []string {
|
|
iptable := iptables.GetIptable(iptables.IPv4)
|
|
|
|
t.Helper()
|
|
output, err := iptable.Raw("-S", chain)
|
|
assert.NilError(t, err, "chain %s: failed to get rules", chain)
|
|
|
|
rules := strings.Split(string(output), "\n")
|
|
if len(rules) > 0 {
|
|
rules = rules[:len(rules)-1]
|
|
}
|
|
return rules
|
|
}
|
|
|
|
func resetIptables(t *testing.T) {
|
|
iptable := iptables.GetIptable(iptables.IPv4)
|
|
|
|
t.Helper()
|
|
_, err := iptable.Raw("-F", fwdChainName)
|
|
assert.NilError(t, err)
|
|
_ = iptable.RemoveExistingChain(usrChainName, "")
|
|
}
|