Skip to content

Commit

Permalink
add unit tests
Browse files Browse the repository at this point in the history
  • Loading branch information
@leosarra
leosarra committed May 16, 2024
1 parent 7147a12 commit 40bcfbd
Show file tree
Hide file tree
Showing 3 changed files with 92 additions and 0 deletions.
37 changes: 37 additions & 0 deletions tools/istio-iptables/pkg/capture/run_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,43 @@ func TestSeparateV4V6(t *testing.T) {
}
}

func TestCleanup(t *testing.T) {
cases := []struct {
name string
config func(cfg *config.Config)
}{
{
"cleanup-empty",
func(cfg *config.Config) {
cfg.PreemptiveCleanup = true
},
},
{
"cleanup-dns",
func(cfg *config.Config) {
cfg.RedirectDNS = true
cfg.DNSServersV4 = []string{"127.0.0.53"}
cfg.DNSServersV6 = []string{"::127.0.0.53"}
cfg.ProxyGID = "1,2"
cfg.ProxyUID = "3,4"
cfg.EnableInboundIPv6 = true
cfg.PreemptiveCleanup = true
},
},
}
for _, tt := range cases {
t.Run(tt.name, func(t *testing.T) {
cfg := constructTestConfig()
tt.config(cfg)

ext := &dep.DependenciesStub{}
iptConfigurator := NewIptablesConfigurator(cfg, ext)
iptConfigurator.Run()
compareToGolden(t, tt.name, ext.ExecutedQuietly)
})
}
}

func compareToGolden(t *testing.T, name string, actual []string) {
t.Helper()
gotBytes := []byte(strings.Join(actual, "\n"))
Expand Down
48 changes: 48 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/cleanup-dns.golden
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
iptables -t raw -D PREROUTING -p udp --sport 53 -s 127.0.0.53/32 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1
iptables -t nat -D OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j RETURN
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 4 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 3 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -X ISTIO_OUTPUT
iptables -X ISTIO_IN_REDIRECT
iptables -X ISTIO_REDIRECT
iptables -X ISTIO_INBOUND
ip6tables -t raw -D PREROUTING -p udp --sport 53 -s ::127.0.0.53/128 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --dport 53 -d ::127.0.0.53/128 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1
ip6tables -t nat -D OUTPUT -p udp --dport 53 -d ::127.0.0.53/128 -j REDIRECT --to-port 15053
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j RETURN
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 4 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 3 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
ip6tables -X ISTIO_OUTPUT
ip6tables -X ISTIO_IN_REDIRECT
ip6tables -X ISTIO_REDIRECT
ip6tables -X ISTIO_INBOUND
7 changes: 7 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/cleanup-empty.golden
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -X ISTIO_OUTPUT
iptables -X ISTIO_IN_REDIRECT
iptables -X ISTIO_REDIRECT
iptables -X ISTIO_INBOUND

0 comments on commit 40bcfbd

Please sign in to comment.