gvisor/test/iptables
Kevin Krakauer 4054b021f0 iptables: ready tests to be enabled in kokoro
Fixed flakes (tested via --runs_per_test=100) and added skips for
not-yet-implemented features. Once submitted, the iptables tests will be
ready to enable in kokoro.
2020-03-11 15:13:58 -07:00
..
runner Standardize on tools directory. 2020-01-27 12:21:00 -08:00
BUILD Standardize on tools directory. 2020-01-27 12:21:00 -08:00
README.md iptables: add instructions for runsc building. 2020-02-10 11:09:19 -08:00
filter_input.go iptables: ready tests to be enabled in kokoro 2020-03-11 15:13:58 -07:00
filter_output.go iptables: ready tests to be enabled in kokoro 2020-03-11 15:13:58 -07:00
iptables.go Add iptables testing framework. 2019-12-12 14:42:11 -08:00
iptables_test.go iptables: ready tests to be enabled in kokoro 2020-03-11 15:13:58 -07:00
iptables_util.go iptables: ready tests to be enabled in kokoro 2020-03-11 15:13:58 -07:00
nat.go iptables: ready tests to be enabled in kokoro 2020-03-11 15:13:58 -07:00

README.md

iptables Tests

iptables tests are run via scripts/iptables_test.sh.

iptables requires raw socket support, so you must add the --net-raw=true flag to /etc/docker/daemon.json in order to use it.

Test Structure

Each test implements TestCase, providing (1) a function to run inside the container and (2) a function to run locally. Those processes are given each others' IP addresses. The test succeeds when both functions succeed.

The function inside the container (ContainerAction) typically sets some iptables rules and then tries to send or receive packets. The local function (LocalAction) will typically just send or receive packets.

Adding Tests

  1. Add your test to the iptables package.

  2. Register the test in an init function via RegisterTestCase (see filter_input.go as an example).

  3. Add it to iptables_test.go (see the other tests in that file).

Your test is now runnable with bazel!

Run individual tests

Build and install runsc. Re-run this when you modify gVisor:

$ bazel build //runsc && sudo cp bazel-bin/runsc/linux_amd64_pure_stripped/runsc $(which runsc)

Build the testing Docker container. Re-run this when you modify the test code in this directory:

$ bazel run //test/iptables/runner:runner-image -- --norun

Run an individual test via:

$ bazel test //test/iptables:iptables_test --test_filter=<TESTNAME>

To run an individual test with runc:

$ bazel test //test/iptables:iptables_test --test_filter=<TESTNAME> --test_arg=--runtime=runc