2019-12-12 22:40:36 +00:00
|
|
|
// Copyright 2019 The gVisor Authors.
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package iptables
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"net"
|
|
|
|
"testing"
|
|
|
|
|
2020-04-23 18:32:08 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/test/dockerutil"
|
|
|
|
"gvisor.dev/gvisor/pkg/test/testutil"
|
2019-12-12 22:40:36 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// singleTest runs a TestCase. Each test follows a pattern:
|
|
|
|
// - Create a container.
|
|
|
|
// - Get the container's IP.
|
|
|
|
// - Send the container our IP.
|
|
|
|
// - Start a new goroutine running the local action of the test.
|
|
|
|
// - Wait for both the container and local actions to finish.
|
|
|
|
//
|
|
|
|
// Container output is logged to $TEST_UNDECLARED_OUTPUTS_DIR if it exists, or
|
|
|
|
// to stderr.
|
2020-04-23 18:32:08 +00:00
|
|
|
func singleTest(t *testing.T, test TestCase) {
|
2019-12-12 22:40:36 +00:00
|
|
|
if _, ok := Tests[test.Name()]; !ok {
|
2020-04-23 18:32:08 +00:00
|
|
|
t.Fatalf("no test found with name %q. Has it been registered?", test.Name())
|
2019-12-12 22:40:36 +00:00
|
|
|
}
|
|
|
|
|
2020-04-23 18:32:08 +00:00
|
|
|
d := dockerutil.MakeDocker(t)
|
|
|
|
defer d.CleanUp()
|
|
|
|
|
2019-12-12 22:40:36 +00:00
|
|
|
// Create and start the container.
|
2020-04-23 18:32:08 +00:00
|
|
|
d.CopyFiles("/runner", "test/iptables/runner/runner")
|
|
|
|
if err := d.Spawn(dockerutil.RunOpts{
|
|
|
|
Image: "iptables",
|
|
|
|
CapAdd: []string{"NET_ADMIN"},
|
|
|
|
}, "/runner/runner", "-name", test.Name()); err != nil {
|
|
|
|
t.Fatalf("docker run failed: %v", err)
|
|
|
|
}
|
2019-12-12 22:40:36 +00:00
|
|
|
|
|
|
|
// Get the container IP.
|
2020-04-23 18:32:08 +00:00
|
|
|
ip, err := d.FindIP()
|
2019-12-12 22:40:36 +00:00
|
|
|
if err != nil {
|
2020-04-23 18:32:08 +00:00
|
|
|
t.Fatalf("failed to get container IP: %v", err)
|
2019-12-12 22:40:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Give the container our IP.
|
|
|
|
if err := sendIP(ip); err != nil {
|
2020-04-23 18:32:08 +00:00
|
|
|
t.Fatalf("failed to send IP to container: %v", err)
|
2019-12-12 22:40:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Run our side of the test.
|
2020-04-23 18:32:08 +00:00
|
|
|
if err := test.LocalAction(ip); err != nil {
|
|
|
|
t.Fatalf("LocalAction failed: %v", err)
|
2019-12-12 22:40:36 +00:00
|
|
|
}
|
|
|
|
|
2020-04-23 18:32:08 +00:00
|
|
|
// Wait for the final statement. This structure has the side effect
|
|
|
|
// that all container logs will appear within the individual test
|
|
|
|
// context.
|
|
|
|
if _, err := d.WaitForOutput(TerminalStatement, TestTimeout); err != nil {
|
|
|
|
t.Fatalf("test failed: %v", err)
|
2019-12-12 22:40:36 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func sendIP(ip net.IP) error {
|
|
|
|
contAddr := net.TCPAddr{
|
|
|
|
IP: ip,
|
|
|
|
Port: IPExchangePort,
|
|
|
|
}
|
|
|
|
var conn *net.TCPConn
|
|
|
|
// The container may not be listening when we first connect, so retry
|
|
|
|
// upon error.
|
|
|
|
cb := func() error {
|
|
|
|
c, err := net.DialTCP("tcp4", nil, &contAddr)
|
|
|
|
conn = c
|
|
|
|
return err
|
|
|
|
}
|
2020-04-23 18:32:08 +00:00
|
|
|
if err := testutil.Poll(cb, TestTimeout); err != nil {
|
2019-12-12 22:40:36 +00:00
|
|
|
return fmt.Errorf("timed out waiting to send IP, most recent error: %v", err)
|
|
|
|
}
|
|
|
|
if _, err := conn.Write([]byte{0}); err != nil {
|
|
|
|
return fmt.Errorf("error writing to container: %v", err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-01-21 21:37:25 +00:00
|
|
|
func TestFilterInputDropUDP(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropUDP{})
|
2020-01-21 21:37:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputDropUDPPort(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropUDPPort{})
|
2020-01-21 21:37:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputDropDifferentUDPPort(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropDifferentUDPPort{})
|
2020-01-21 21:37:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputDropAll(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropAll{})
|
2020-01-21 21:37:25 +00:00
|
|
|
}
|
2020-01-09 21:41:52 +00:00
|
|
|
|
|
|
|
func TestFilterInputDropOnlyUDP(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropOnlyUDP{})
|
2020-01-09 21:41:52 +00:00
|
|
|
}
|
2020-01-21 20:08:52 +00:00
|
|
|
|
2020-01-13 17:11:40 +00:00
|
|
|
func TestFilterInputDropTCPDestPort(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropTCPDestPort{})
|
2020-01-13 17:11:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputDropTCPSrcPort(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDropTCPSrcPort{})
|
2020-01-13 17:11:40 +00:00
|
|
|
}
|
|
|
|
|
2020-02-07 19:21:07 +00:00
|
|
|
func TestFilterInputCreateUserChain(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputCreateUserChain{})
|
2020-02-07 19:21:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputDefaultPolicyAccept(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDefaultPolicyAccept{})
|
2020-02-07 19:21:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputDefaultPolicyDrop(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDefaultPolicyDrop{})
|
2020-02-07 19:21:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterInputReturnUnderflow(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputReturnUnderflow{})
|
2020-02-07 19:21:07 +00:00
|
|
|
}
|
|
|
|
|
2020-01-13 17:11:40 +00:00
|
|
|
func TestFilterOutputDropTCPDestPort(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputDropTCPDestPort{})
|
2020-01-13 17:11:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputDropTCPSrcPort(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputDropTCPSrcPort{})
|
2020-01-13 17:11:40 +00:00
|
|
|
}
|
2020-02-13 00:19:06 +00:00
|
|
|
|
2020-03-20 19:00:21 +00:00
|
|
|
func TestFilterOutputAcceptTCPOwner(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputAcceptTCPOwner{})
|
2020-03-20 19:00:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputDropTCPOwner(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputDropTCPOwner{})
|
2020-03-20 19:00:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputAcceptUDPOwner(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputAcceptUDPOwner{})
|
2020-03-20 19:00:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputDropUDPOwner(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputDropUDPOwner{})
|
2020-03-20 19:00:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputOwnerFail(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputOwnerFail{})
|
2020-03-20 19:00:21 +00:00
|
|
|
}
|
|
|
|
|
2020-05-12 19:14:56 +00:00
|
|
|
func TestFilterOutputAcceptGIDOwner(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputAcceptGIDOwner{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputDropGIDOwner(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputDropGIDOwner{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInvertGIDOwner(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInvertGIDOwner{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInvertUIDOwner(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInvertUIDOwner{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInvertUIDAndGIDOwner(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInvertUIDAndGIDOwner{})
|
|
|
|
}
|
|
|
|
|
2020-05-08 22:39:04 +00:00
|
|
|
func TestFilterOutputInterfaceAccept(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInterfaceAccept{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInterfaceDrop(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInterfaceDrop{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInterface(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInterface{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInterfaceBeginsWith(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInterfaceBeginsWith{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInterfaceInvertDrop(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInterfaceInvertDrop{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestFilterOutputInterfaceInvertAccept(t *testing.T) {
|
|
|
|
singleTest(t, FilterOutputInterfaceInvertAccept{})
|
|
|
|
}
|
|
|
|
|
2020-02-13 00:19:06 +00:00
|
|
|
func TestJumpSerialize(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputSerializeJump{})
|
2020-02-13 00:19:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestJumpBasic(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputJumpBasic{})
|
2020-02-13 00:19:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestJumpReturn(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputJumpReturn{})
|
2020-02-13 00:19:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestJumpReturnDrop(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputJumpReturnDrop{})
|
2020-02-13 00:19:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestJumpBuiltin(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputJumpBuiltin{})
|
2020-02-13 00:19:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestJumpTwice(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputJumpTwice{})
|
2020-02-13 00:19:06 +00:00
|
|
|
}
|
2020-02-15 01:19:32 +00:00
|
|
|
|
|
|
|
func TestInputDestination(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputDestination{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestInputInvertDestination(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterInputInvertDestination{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestOutputDestination(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputDestination{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestOutputInvertDestination(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, FilterOutputInvertDestination{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
2020-03-27 19:18:45 +00:00
|
|
|
func TestNATPreRedirectUDPPort(t *testing.T) {
|
|
|
|
singleTest(t, NATPreRedirectUDPPort{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATPreRedirectTCPPort(t *testing.T) {
|
|
|
|
singleTest(t, NATPreRedirectTCPPort{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATOutRedirectUDPPort(t *testing.T) {
|
|
|
|
singleTest(t, NATOutRedirectUDPPort{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATOutRedirectTCPPort(t *testing.T) {
|
|
|
|
singleTest(t, NATOutRedirectTCPPort{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATDropUDP(t *testing.T) {
|
|
|
|
singleTest(t, NATDropUDP{})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATAcceptAll(t *testing.T) {
|
|
|
|
singleTest(t, NATAcceptAll{})
|
|
|
|
}
|
|
|
|
|
2020-02-15 01:19:32 +00:00
|
|
|
func TestNATOutRedirectIP(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATOutRedirectIP{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATOutDontRedirectIP(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATOutDontRedirectIP{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATOutRedirectInvert(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATOutRedirectInvert{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATPreRedirectIP(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATPreRedirectIP{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATPreDontRedirectIP(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATPreDontRedirectIP{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATPreRedirectInvert(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATPreRedirectInvert{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestNATRedirectRequiresProtocol(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
singleTest(t, NATRedirectRequiresProtocol{})
|
2020-02-15 01:19:32 +00:00
|
|
|
}
|