Skip to content

Commit

Permalink
update golden files
Browse files Browse the repository at this point in the history
  • Loading branch information
@leosarra
leosarra committed May 16, 2024
1 parent 81b17cf commit cdc652b
Show file tree
Hide file tree
Showing 29 changed files with 555 additions and 40 deletions.
40 changes: 0 additions & 40 deletions tools/istio-iptables/pkg/capture/run_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@
package capture

import (
"fmt"
"net/netip"
"path/filepath"
"reflect"
Expand Down Expand Up @@ -338,45 +337,6 @@ func TestSeparateV4V6(t *testing.T) {
}
}

func TestCleanup(t *testing.T) {
cases := []struct {
name string
config func(cfg *config.Config)
}{
{
"cleanup-empty",
func(cfg *config.Config) {
cfg.RestoreFormat = true
},
},
{
"cleanup-dns",
func(cfg *config.Config) {
cfg.RedirectDNS = true
cfg.DNSServersV4 = []string{"127.0.0.53"}
cfg.DNSServersV6 = []string{"::127.0.0.53"}
cfg.ProxyGID = "1,2"
cfg.ProxyUID = "3,4"
cfg.EnableInboundIPv6 = true
cfg.RestoreFormat = false
},
},
}
for _, tt := range cases {
t.Run(tt.name, func(t *testing.T) {
cfg := constructTestConfig()
tt.config(cfg)

ext := &dep.DependenciesStub{}
iptConfigurator := NewIptablesConfigurator(cfg, ext)
iptConfigurator.Run()
for _, cmd := range ext.ExecutedQuietly {
fmt.Println(cmd)
}
})
}
}

func compareToGolden(t *testing.T, name string, actual []string) {
t.Helper()
gotBytes := []byte(strings.Join(actual, "\n"))
Expand Down
9 changes: 9 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/basic-exclude-nic.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,12 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -D OUTPUT -o not-istio-nic -j RETURN
iptables -t nat -D PREROUTING -i not-istio-nic -j RETURN
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
48 changes: 48 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/dns-uid-gid.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,51 @@
iptables -t raw -D PREROUTING -p udp --sport 53 -s 127.0.0.53/32 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1
iptables -t nat -D OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j RETURN
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 4 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 3 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
ip6tables -t raw -D PREROUTING -p udp --sport 53 -s ::127.0.0.53/128 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --dport 53 -d ::127.0.0.53/128 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1
ip6tables -t nat -D OUTPUT -p udp --dport 53 -d ::127.0.0.53/128 -j REDIRECT --to-port 15053
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j RETURN
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 4 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 3 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
ip6tables -t nat -X ISTIO_OUTPUT
ip6tables -t nat -X ISTIO_IN_REDIRECT
ip6tables -t nat -X ISTIO_REDIRECT
ip6tables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
8 changes: 8 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/drop-invalid.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,11 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t mangle -D PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
7 changes: 7 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/empty.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
7 changes: 7 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/host-ipv4-loopback-cidr.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/8 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/8 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
10 changes: 10 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/inbound-ports-include.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,13 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -D ISTIO_INBOUND -p tcp --dport 31000 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_INBOUND -p tcp --dport 32000 -j ISTIO_IN_REDIRECT
iptables -t nat -D PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
23 changes: 23 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/inbound-ports-tproxy.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,26 @@
iptables -t mangle -I ISTIO_INBOUND 3 -p tcp -i lo -m mark ! --mark 1338 -j RETURN
iptables -t mangle -I ISTIO_INBOUND 2 -p tcp -s 127.0.0.6/32 -i lo -j RETURN
iptables -t mangle -I ISTIO_INBOUND 1 -p tcp -m mark --mark 1337 -j RETURN
iptables -t mangle -D OUTPUT -p tcp -m connmark --mark 1337 -j CONNMARK --restore-mark
iptables -t mangle -D OUTPUT ! -d 127.0.0.1/32 -p tcp -o lo -m owner --gid-owner 1337 -j MARK --set-mark 1338
iptables -t mangle -D OUTPUT ! -d 127.0.0.1/32 -p tcp -o lo -m owner --uid-owner 1337 -j MARK --set-mark 1338
iptables -t mangle -D OUTPUT -p tcp -o lo -m mark --mark 1337 -j RETURN
iptables -t mangle -D PREROUTING -p tcp -m mark --mark 1337 -j CONNMARK --save-mark
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t mangle -D ISTIO_INBOUND -p tcp --dport 31000 -j ISTIO_TPROXY
iptables -t mangle -D ISTIO_INBOUND -p tcp --dport 31000 -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT
iptables -t mangle -D ISTIO_INBOUND -p tcp --dport 32000 -j ISTIO_TPROXY
iptables -t mangle -D ISTIO_INBOUND -p tcp --dport 32000 -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT
iptables -t mangle -D PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t mangle -X ISTIO_INBOUND
iptables -t nat -X ISTIO_OUTPUT
iptables -t mangle -X ISTIO_TPROXY
iptables -t mangle -X ISTIO_DIVERT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
21 changes: 21 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/inbound-ports-wildcard-tproxy.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,24 @@
iptables -t mangle -I ISTIO_INBOUND 3 -p tcp -i lo -m mark ! --mark 1338 -j RETURN
iptables -t mangle -I ISTIO_INBOUND 2 -p tcp -s 127.0.0.6/32 -i lo -j RETURN
iptables -t mangle -I ISTIO_INBOUND 1 -p tcp -m mark --mark 1337 -j RETURN
iptables -t mangle -D OUTPUT -p tcp -m connmark --mark 1337 -j CONNMARK --restore-mark
iptables -t mangle -D OUTPUT ! -d 127.0.0.1/32 -p tcp -o lo -m owner --gid-owner 1337 -j MARK --set-mark 1338
iptables -t mangle -D OUTPUT ! -d 127.0.0.1/32 -p tcp -o lo -m owner --uid-owner 1337 -j MARK --set-mark 1338
iptables -t mangle -D OUTPUT -p tcp -o lo -m mark --mark 1337 -j RETURN
iptables -t mangle -D PREROUTING -p tcp -m mark --mark 1337 -j CONNMARK --save-mark
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t mangle -D ISTIO_INBOUND -p tcp -j ISTIO_TPROXY
iptables -t mangle -D ISTIO_INBOUND -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT
iptables -t mangle -D PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t mangle -X ISTIO_INBOUND
iptables -t nat -X ISTIO_OUTPUT
iptables -t mangle -X ISTIO_TPROXY
iptables -t mangle -X ISTIO_DIVERT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
9 changes: 9 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/inbound-ports-wildcard.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,12 @@
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -D ISTIO_INBOUND -p tcp -j ISTIO_IN_REDIRECT
iptables -t nat -D PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
25 changes: 25 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/ip-range.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,28 @@
iptables -t raw -D PREROUTING -p udp --sport 53 -s 127.0.0.53/32 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1
iptables -t nat -D OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j RETURN
iptables -t nat -D ISTIO_OUTPUT -d 9.9.0.0/16 -j ISTIO_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 4 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 3 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
12 changes: 12 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/ipnets-with-kube-virt-interfaces.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,15 @@
iptables -t nat -D ISTIO_OUTPUT -d 10.0.0.0/8 -j ISTIO_REDIRECT
iptables -t nat -I PREROUTING 1 -i eth2 -d 10.0.0.0/8 -j ISTIO_REDIRECT
iptables -t nat -I PREROUTING 1 -i eth1 -d 10.0.0.0/8 -j ISTIO_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -I PREROUTING 1 -i eth2 -j RETURN
iptables -t nat -I PREROUTING 1 -i eth1 -j RETURN
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
8 changes: 8 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/ipnets.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,11 @@
iptables -t nat -D ISTIO_OUTPUT -d 10.0.0.0/8 -j ISTIO_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down
30 changes: 30 additions & 0 deletions tools/istio-iptables/pkg/capture/testdata/ipv6-dns-outbound-owner-groups-exclude.golden
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,33 @@
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
iptables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
iptables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner ftp -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 888 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j RETURN
iptables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j RETURN
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
iptables -t nat -X ISTIO_OUTPUT
iptables -t nat -X ISTIO_IN_REDIRECT
iptables -t nat -X ISTIO_REDIRECT
iptables -t nat -X ISTIO_INBOUND
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
ip6tables -t raw -D OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
ip6tables -t raw -D OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner ftp -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 888 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j RETURN
ip6tables -t nat -D OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j RETURN
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D ISTIO_OUTPUT -o lo ! -d ::1/128 -p tcp -m multiport ! --dports 53,15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
ip6tables -t nat -D OUTPUT -p tcp -j ISTIO_OUTPUT
ip6tables -t nat -X ISTIO_OUTPUT
ip6tables -t nat -X ISTIO_IN_REDIRECT
ip6tables -t nat -X ISTIO_REDIRECT
ip6tables -t nat -X ISTIO_INBOUND
iptables -t nat -N ISTIO_INBOUND
iptables -t nat -N ISTIO_REDIRECT
iptables -t nat -N ISTIO_IN_REDIRECT
Expand Down

0 comments on commit cdc652b

Please sign in to comment.