live kernel tests
This commit is contained in:
Alexis PIRES
parent
e039031c22
commit
e263836a09
273
nftables_test.go
273
nftables_test.go
|
|
@ -112,57 +112,15 @@ func cleanupSystemNFTConn(t *testing.T, newNS netns.NsHandle) {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestAddRule(t *testing.T) {
|
func TestRuleOperations(t *testing.T) {
|
||||||
|
|
||||||
want := [][]byte{
|
// Create a new network namespace to test these operations,
|
||||||
// batch begin
|
// and tear down the namespace at test completion.
|
||||||
[]byte("\x00\x00\x00\x0a"),
|
c, newNS := openSystemNFTConn(t)
|
||||||
// nft add table ip filter
|
defer cleanupSystemNFTConn(t, newNS)
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"),
|
// Clear all rules at the beginning + end of the test.
|
||||||
// nft add chain ip filter base-chain { type filter hook prerouting priority 0 \; }
|
c.FlushRuleset()
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x03\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x0b\x00\x07\x00\x66\x69\x6c\x74\x65\x72\x00\x00"),
|
defer c.FlushRuleset()
|
||||||
// nft add rule filter base-chain drop
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x02\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x34\x00\x04\x80\x30\x00\x01\x80\x0e\x00\x01\x00\x69\x6d\x6d\x65\x64\x69\x61\x74\x65\x00\x00\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00\x10\x00\x02\x80\x0c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00"),
|
|
||||||
// batch end
|
|
||||||
[]byte("\x00\x00\x00\x0a"),
|
|
||||||
}
|
|
||||||
|
|
||||||
wantFlags := []netlink.HeaderFlags{
|
|
||||||
netlink.Request,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Atomic,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Atomic,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Echo | netlink.Create | netlink.Append,
|
|
||||||
netlink.Request,
|
|
||||||
}
|
|
||||||
|
|
||||||
c := &nftables.Conn{
|
|
||||||
TestDial: func(req []netlink.Message) ([]netlink.Message, error) {
|
|
||||||
for idx, msg := range req {
|
|
||||||
b, err := msg.MarshalBinary()
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
if len(b) < 16 {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
b = b[16:]
|
|
||||||
if len(want) == 0 {
|
|
||||||
t.Errorf("no want entry for message %d: %x", idx, b)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if got, want := b, want[0]; !bytes.Equal(got, want) {
|
|
||||||
t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(want)))
|
|
||||||
}
|
|
||||||
|
|
||||||
if msg.Header.Flags != wantFlags[idx] {
|
|
||||||
t.Errorf("message %d: %s", idx, linediff(msg.Header.Flags.String(), wantFlags[idx].String()))
|
|
||||||
}
|
|
||||||
|
|
||||||
want = want[1:]
|
|
||||||
}
|
|
||||||
return req, nil
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
filter := c.AddTable(&nftables.Table{
|
filter := c.AddTable(&nftables.Table{
|
||||||
Family: nftables.TableFamilyIPv4,
|
Family: nftables.TableFamilyIPv4,
|
||||||
|
|
@ -188,78 +146,7 @@ func TestAddRule(t *testing.T) {
|
||||||
},
|
},
|
||||||
})
|
})
|
||||||
|
|
||||||
if err := c.Flush(); err != nil {
|
c.AddRule(&nftables.Rule{
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestInsertRule(t *testing.T) {
|
|
||||||
|
|
||||||
want := [][]byte{
|
|
||||||
// batch begin
|
|
||||||
[]byte("\x00\x00\x00\x0a"),
|
|
||||||
// nft add table ip filter
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"),
|
|
||||||
// nft add chain ip filter base-chain { type filter hook prerouting priority 0 \; }
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x03\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x0b\x00\x07\x00\x66\x69\x6c\x74\x65\x72\x00\x00"),
|
|
||||||
// nft insert rule filter base-chain drop
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x02\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x34\x00\x04\x80\x30\x00\x01\x80\x0e\x00\x01\x00\x69\x6d\x6d\x65\x64\x69\x61\x74\x65\x00\x00\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00\x10\x00\x02\x80\x0c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00"),
|
|
||||||
// batch end
|
|
||||||
[]byte("\x00\x00\x00\x0a"),
|
|
||||||
}
|
|
||||||
|
|
||||||
wantFlags := []netlink.HeaderFlags{
|
|
||||||
netlink.Request,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Atomic,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Atomic,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Echo | netlink.Create,
|
|
||||||
netlink.Request,
|
|
||||||
}
|
|
||||||
|
|
||||||
c := &nftables.Conn{
|
|
||||||
TestDial: func(req []netlink.Message) ([]netlink.Message, error) {
|
|
||||||
for idx, msg := range req {
|
|
||||||
b, err := msg.MarshalBinary()
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
if len(b) < 16 {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
b = b[16:]
|
|
||||||
if len(want) == 0 {
|
|
||||||
t.Errorf("no want entry for message %d: %x", idx, b)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if got, want := b, want[0]; !bytes.Equal(got, want) {
|
|
||||||
t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(want)))
|
|
||||||
}
|
|
||||||
|
|
||||||
if msg.Header.Flags != wantFlags[idx] {
|
|
||||||
t.Errorf("message %d: %s", idx, linediff(msg.Header.Flags.String(), wantFlags[idx].String()))
|
|
||||||
}
|
|
||||||
|
|
||||||
want = want[1:]
|
|
||||||
}
|
|
||||||
return req, nil
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
filter := c.AddTable(&nftables.Table{
|
|
||||||
Family: nftables.TableFamilyIPv4,
|
|
||||||
Name: "filter",
|
|
||||||
})
|
|
||||||
|
|
||||||
prerouting := c.AddChain(&nftables.Chain{
|
|
||||||
Name: "base-chain",
|
|
||||||
Table: filter,
|
|
||||||
Type: nftables.ChainTypeFilter,
|
|
||||||
Hooknum: nftables.ChainHookPrerouting,
|
|
||||||
Priority: nftables.ChainPriorityFilter,
|
|
||||||
})
|
|
||||||
|
|
||||||
c.InsertRule(&nftables.Rule{
|
|
||||||
Table: filter,
|
Table: filter,
|
||||||
Chain: prerouting,
|
Chain: prerouting,
|
||||||
Exprs: []expr.Any{
|
Exprs: []expr.Any{
|
||||||
|
|
@ -270,85 +157,24 @@ func TestInsertRule(t *testing.T) {
|
||||||
},
|
},
|
||||||
})
|
})
|
||||||
|
|
||||||
if err := c.Flush(); err != nil {
|
c.InsertRule(&nftables.Rule{
|
||||||
t.Fatal(err)
|
Table: filter,
|
||||||
}
|
Chain: prerouting,
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReplaceRule(t *testing.T) {
|
|
||||||
|
|
||||||
want := [][]byte{
|
|
||||||
// batch begin
|
|
||||||
[]byte("\x00\x00\x00\x0a"),
|
|
||||||
// nft add table ip filter
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"),
|
|
||||||
// nft add chain ip filter base-chain { type filter hook prerouting priority 0 \; }
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x03\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x0b\x00\x07\x00\x66\x69\x6c\x74\x65\x72\x00\x00"),
|
|
||||||
// nft replace rule filter base-chain handle 2 drop
|
|
||||||
[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x02\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x0c\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x02\x34\x00\x04\x80\x30\x00\x01\x80\x0e\x00\x01\x00\x69\x6d\x6d\x65\x64\x69\x61\x74\x65\x00\x00\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00\x10\x00\x02\x80\x0c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00"),
|
|
||||||
// batch end
|
|
||||||
[]byte("\x00\x00\x00\x0a"),
|
|
||||||
}
|
|
||||||
|
|
||||||
wantFlags := []netlink.HeaderFlags{
|
|
||||||
netlink.Request,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Atomic,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Atomic,
|
|
||||||
netlink.Request | netlink.Acknowledge | netlink.Echo | netlink.Replace,
|
|
||||||
netlink.Request,
|
|
||||||
}
|
|
||||||
|
|
||||||
c := &nftables.Conn{
|
|
||||||
TestDial: func(req []netlink.Message) ([]netlink.Message, error) {
|
|
||||||
for idx, msg := range req {
|
|
||||||
b, err := msg.MarshalBinary()
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
if len(b) < 16 {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
b = b[16:]
|
|
||||||
if len(want) == 0 {
|
|
||||||
t.Errorf("no want entry for message %d: %x", idx, b)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if got, want := b, want[0]; !bytes.Equal(got, want) {
|
|
||||||
t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(want)))
|
|
||||||
}
|
|
||||||
|
|
||||||
if msg.Header.Flags != wantFlags[idx] {
|
|
||||||
t.Errorf("message %d: %s", idx, linediff(msg.Header.Flags.String(), wantFlags[idx].String()))
|
|
||||||
}
|
|
||||||
|
|
||||||
want = want[1:]
|
|
||||||
}
|
|
||||||
return req, nil
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
filter := c.AddTable(&nftables.Table{
|
|
||||||
Family: nftables.TableFamilyIPv4,
|
|
||||||
Name: "filter",
|
|
||||||
})
|
|
||||||
|
|
||||||
prerouting := c.AddChain(&nftables.Chain{
|
|
||||||
Name: "base-chain",
|
|
||||||
Table: filter,
|
|
||||||
Type: nftables.ChainTypeFilter,
|
|
||||||
Hooknum: nftables.ChainHookPrerouting,
|
|
||||||
Priority: nftables.ChainPriorityFilter,
|
|
||||||
})
|
|
||||||
|
|
||||||
c.ReplaceRule(&nftables.Rule{
|
|
||||||
Table: filter,
|
|
||||||
Chain: prerouting,
|
|
||||||
Handle: 2,
|
|
||||||
Exprs: []expr.Any{
|
Exprs: []expr.Any{
|
||||||
&expr.Verdict{
|
&expr.Verdict{
|
||||||
// [ immediate reg 0 drop ]
|
// [ immediate reg 0 accept ]
|
||||||
Kind: expr.VerdictDrop,
|
Kind: expr.VerdictAccept,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
c.InsertRule(&nftables.Rule{
|
||||||
|
Table: filter,
|
||||||
|
Chain: prerouting,
|
||||||
|
Exprs: []expr.Any{
|
||||||
|
&expr.Verdict{
|
||||||
|
// [ immediate reg 0 queue ]
|
||||||
|
Kind: expr.VerdictQueue,
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
})
|
})
|
||||||
|
|
@ -357,6 +183,55 @@ func TestReplaceRule(t *testing.T) {
|
||||||
t.Fatal(err)
|
t.Fatal(err)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
rules, _ := c.GetRule(filter, prerouting)
|
||||||
|
|
||||||
|
want := []expr.VerdictKind{
|
||||||
|
expr.VerdictQueue,
|
||||||
|
expr.VerdictAccept,
|
||||||
|
expr.VerdictDrop,
|
||||||
|
expr.VerdictDrop,
|
||||||
|
}
|
||||||
|
|
||||||
|
for i, r := range rules {
|
||||||
|
rr, _ := r.Exprs[0].(*expr.Verdict)
|
||||||
|
|
||||||
|
if rr.Kind != want[i] {
|
||||||
|
t.Fatalf("bad verdict kind at %d", i)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
c.ReplaceRule(&nftables.Rule{
|
||||||
|
Table: filter,
|
||||||
|
Chain: prerouting,
|
||||||
|
Handle: rules[2].Handle,
|
||||||
|
Exprs: []expr.Any{
|
||||||
|
&expr.Verdict{
|
||||||
|
// [ immediate reg 0 accept ]
|
||||||
|
Kind: expr.VerdictAccept,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
if err := c.Flush(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
rules, _ = c.GetRule(filter, prerouting)
|
||||||
|
|
||||||
|
want = []expr.VerdictKind{
|
||||||
|
expr.VerdictQueue,
|
||||||
|
expr.VerdictAccept,
|
||||||
|
expr.VerdictAccept,
|
||||||
|
expr.VerdictDrop,
|
||||||
|
}
|
||||||
|
|
||||||
|
for i, r := range rules {
|
||||||
|
rr, _ := r.Exprs[0].(*expr.Verdict)
|
||||||
|
|
||||||
|
if rr.Kind != want[i] {
|
||||||
|
t.Fatalf("bad verdict kind at %d", i)
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestConfigureNAT(t *testing.T) {
|
func TestConfigureNAT(t *testing.T) {
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue