test: Extend coverage for host policies enforcement #14822
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pchaigno
added
area/CI-improvement
pchaigno
added
the
sig/datapath
pchaigno
force-pushed
the
pr/pchaigno/hostfw-basic-tests
branch
4 times, most recently
from
0ce63d4
to
5de54ec
Compare
nbusseneau
approved these changes
Feb 5, 2021
joestringer
approved these changes
Feb 8, 2021
There was a problem hiding this comment.
Couple of minor concerns below. On the defer side, apparently we're using defer quite a bit in CI but I don't know if we've fully considered that. Either way it seems like we should double-check that defer is OK and there's a bunch of other code to clean up unrelated to this PR, so I don't really feel it is so fair to push back on this particular PR for the same thing that other tests already do.
aditighag
reviewed
Feb 8, 2021
aditighag
approved these changes
Feb 8, 2021
pchaigno
force-pushed
the
pr/pchaigno/hostfw-basic-tests
branch
from
5de54ec
to
059d4dd
Compare
We currently have a couple of host firewall tests, but they don't cover all possible packet paths. [1] added two tests for the path node <-> world (one with fromCIDR+toPorts and one combined with NodePort handling). Other firewall tests [2] are only validating correct loading without enforcing policies. This commit fills this gap by adding VXLAN and direct routing tests for the host firewall, with L3+L4 policies enforced on the paths node <-> local pod, node <-> remote pod, and node <-> remote node. The test design draws inspiration from early host firewall bugs and regressions: - Test ingress and egress at the same time with restrictions on allowed ports. This is meant to ensure we detect a regression where only one direction bypasses policy enforcement. If such a case arises, we will fail because the source port won't be allowed and the connection will be dropped. - Allow connections to/from world and pods not used in tests. This is meant to reduce the risk of bricking the nodes. Node to node communications are still strongly restricted, but the ports defined there have been stable for a while. - Test connections to local and remote pods separately. They follow very different paths through our datapath. 1 - #12621 2 - #14255 Signed-off-by: Paul Chaignon <paul@cilium.io>
pchaigno
force-pushed
the
pr/pchaigno/hostfw-basic-tests
branch
from
059d4dd
to
6d557b9
Compare
|
test-me-please |
qmonnet
approved these changes
Feb 9, 2021
|
Needs to be backported to 1.9 to solve conflicts with #16064 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We currently have a couple of host firewall tests, but they don't cover all possible packet paths. #12621 added two tests for the path node <-> world (one with fromCIDR+toPorts and one combined with NodePort handling). Other firewall tests (cf. #14255) are only validating correct loading without enforcing policies.
This pull request fills this gap by adding VXLAN and direct routing tests for the host firewall, with L3+L4 policies enforced on the paths node <-> local pod, node <-> remote pod, and node <-> remote node.
The test design draws inspiration from early host firewall bugs and regressions:
communications are still strongly restricted, but the ports defined there have been stable for a while.