Browse code
Use golden testdata in TestUserChain
Signed-off-by: Rob Murray <rob.murray@docker.com>
Rob Murray authored on 2024/10/10 19:46:30Showing 17 changed files
- libnetwork/firewall_linux_test.go
- libnetwork/testdata/TestUserChain_iptables-false_append-false_fwdafter4
- libnetwork/testdata/TestUserChain_iptables-false_append-false_fwdafter6
- libnetwork/testdata/TestUserChain_iptables-false_append-false_fwdinit4
- libnetwork/testdata/TestUserChain_iptables-false_append-false_fwdinit6
- libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdafter4
- libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdafter6
- libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdinit4
- libnetwork/testdata/TestUserChain_iptables-true_append-false_fwdinit6
- libnetwork/testdata/TestUserChain_iptables-true_append-false_usrafter4
- libnetwork/testdata/TestUserChain_iptables-true_append-false_usrafter6
- libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdafter4
- libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdafter6
- libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdinit4
- libnetwork/testdata/TestUserChain_iptables-true_append-true_fwdinit6
- libnetwork/testdata/TestUserChain_iptables-true_append-true_usrafter4
- libnetwork/testdata/TestUserChain_iptables-true_append-true_usrafter6
| ... | ... |
@@ -2,7 +2,6 @@ package libnetwork |
| 2 | 2 |
|
| 3 | 3 |
import ( |
| 4 | 4 |
"fmt" |
| 5 |
- "strings" |
|
| 6 | 5 |
"testing" |
| 7 | 6 |
|
| 8 | 7 |
"github.com/docker/docker/internal/testutils/netnsutils" |
| ... | ... |
@@ -12,6 +11,7 @@ import ( |
| 12 | 12 |
"github.com/docker/docker/libnetwork/options" |
| 13 | 13 |
"gotest.tools/v3/assert" |
| 14 | 14 |
is "gotest.tools/v3/assert/cmp" |
| 15 |
+ "gotest.tools/v3/golden" |
|
| 15 | 16 |
) |
| 16 | 17 |
|
| 17 | 18 |
const ( |
| ... | ... |
@@ -24,32 +24,25 @@ func TestUserChain(t *testing.T) {
|
| 24 | 24 |
iptable6 := iptables.GetIptable(iptables.IPv6) |
| 25 | 25 |
|
| 26 | 26 |
tests := []struct {
|
| 27 |
- iptables bool |
|
| 28 |
- insert bool // insert other rules to FORWARD |
|
| 29 |
- fwdChain []string |
|
| 30 |
- userChain []string |
|
| 27 |
+ iptables bool |
|
| 28 |
+ append bool // append other rules to FORWARD |
|
| 31 | 29 |
}{
|
| 32 | 30 |
{
|
| 33 | 31 |
iptables: false, |
| 34 |
- insert: false, |
|
| 35 |
- fwdChain: []string{"-P FORWARD ACCEPT"},
|
|
| 32 |
+ append: false, |
|
| 36 | 33 |
}, |
| 37 | 34 |
{
|
| 38 |
- iptables: true, |
|
| 39 |
- insert: false, |
|
| 40 |
- fwdChain: []string{"-P FORWARD ACCEPT", "-A FORWARD -j DOCKER-USER"},
|
|
| 41 |
- userChain: []string{"-N DOCKER-USER", "-A DOCKER-USER -j RETURN"},
|
|
| 35 |
+ iptables: true, |
|
| 36 |
+ append: false, |
|
| 42 | 37 |
}, |
| 43 | 38 |
{
|
| 44 |
- iptables: true, |
|
| 45 |
- insert: true, |
|
| 46 |
- fwdChain: []string{"-P FORWARD ACCEPT", "-A FORWARD -j DOCKER-USER", "-A FORWARD -j DROP"},
|
|
| 47 |
- userChain: []string{"-N DOCKER-USER", "-A DOCKER-USER -j RETURN"},
|
|
| 39 |
+ iptables: true, |
|
| 40 |
+ append: true, |
|
| 48 | 41 |
}, |
| 49 | 42 |
} |
| 50 | 43 |
|
| 51 | 44 |
for _, tc := range tests {
|
| 52 |
- t.Run(fmt.Sprintf("iptables=%v,insert=%v", tc.iptables, tc.insert), func(t *testing.T) {
|
|
| 45 |
+ t.Run(fmt.Sprintf("iptables=%v,append=%v", tc.iptables, tc.append), func(t *testing.T) {
|
|
| 53 | 46 |
defer netnsutils.SetupTestOSContext(t)() |
| 54 | 47 |
defer resetIptables(t) |
| 55 | 48 |
|
| ... | ... |
@@ -64,25 +57,32 @@ func TestUserChain(t *testing.T) {
|
| 64 | 64 |
assert.NilError(t, err) |
| 65 | 65 |
defer c.Stop() |
| 66 | 66 |
|
| 67 |
- // init. condition, FORWARD chain empty DOCKER-USER not exist |
|
| 68 |
- assert.Check(t, is.DeepEqual(getRules(t, iptable4, fwdChainName), []string{"-P FORWARD ACCEPT"}))
|
|
| 69 |
- assert.Check(t, is.DeepEqual(getRules(t, iptable6, fwdChainName), []string{"-P FORWARD ACCEPT"}))
|
|
| 67 |
+ // init. condition |
|
| 68 |
+ golden.Assert(t, getRules(t, iptable4, fwdChainName), |
|
| 69 |
+ fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdinit4", tc.iptables, tc.append))
|
|
| 70 |
+ golden.Assert(t, getRules(t, iptable6, fwdChainName), |
|
| 71 |
+ fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdinit6", tc.iptables, tc.append))
|
|
| 70 | 72 |
|
| 71 |
- if tc.insert {
|
|
| 72 |
- _, err = iptable4.Raw("-A", fwdChainName, "-j", "DROP")
|
|
| 73 |
+ if tc.append {
|
|
| 74 |
+ _, err := iptable4.Raw("-A", fwdChainName, "-j", "DROP")
|
|
| 73 | 75 |
assert.Check(t, err) |
| 74 | 76 |
_, err = iptable6.Raw("-A", fwdChainName, "-j", "DROP")
|
| 75 | 77 |
assert.Check(t, err) |
| 76 | 78 |
} |
| 77 | 79 |
arrangeUserFilterRule() |
| 78 | 80 |
|
| 79 |
- assert.Check(t, is.DeepEqual(getRules(t, iptable4, fwdChainName), tc.fwdChain)) |
|
| 80 |
- assert.Check(t, is.DeepEqual(getRules(t, iptable6, fwdChainName), tc.fwdChain)) |
|
| 81 |
- if tc.userChain != nil {
|
|
| 82 |
- assert.Check(t, is.DeepEqual(getRules(t, iptable4, usrChainName), tc.userChain)) |
|
| 83 |
- assert.Check(t, is.DeepEqual(getRules(t, iptable6, usrChainName), tc.userChain)) |
|
| 81 |
+ golden.Assert(t, getRules(t, iptable4, fwdChainName), |
|
| 82 |
+ fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdafter4", tc.iptables, tc.append))
|
|
| 83 |
+ golden.Assert(t, getRules(t, iptable6, fwdChainName), |
|
| 84 |
+ fmt.Sprintf("TestUserChain_iptables-%v_append-%v_fwdafter6", tc.iptables, tc.append))
|
|
| 85 |
+ |
|
| 86 |
+ if tc.iptables {
|
|
| 87 |
+ golden.Assert(t, getRules(t, iptable4, usrChainName), |
|
| 88 |
+ fmt.Sprintf("TestUserChain_iptables-%v_append-%v_usrafter4", tc.iptables, tc.append))
|
|
| 89 |
+ golden.Assert(t, getRules(t, iptable6, usrChainName), |
|
| 90 |
+ fmt.Sprintf("TestUserChain_iptables-%v_append-%v_usrafter6", tc.iptables, tc.append))
|
|
| 84 | 91 |
} else {
|
| 85 |
- _, err = iptable4.Raw("-S", usrChainName)
|
|
| 92 |
+ _, err := iptable4.Raw("-S", usrChainName)
|
|
| 86 | 93 |
assert.Check(t, is.ErrorContains(err, "No chain/target/match by that name"), "ipv4 chain %v: created unexpectedly", usrChainName) |
| 87 | 94 |
_, err = iptable6.Raw("-S", usrChainName)
|
| 88 | 95 |
assert.Check(t, is.ErrorContains(err, "No chain/target/match by that name"), "ipv6 chain %v: created unexpectedly", usrChainName) |
| ... | ... |
@@ -91,16 +91,11 @@ func TestUserChain(t *testing.T) {
|
| 91 | 91 |
} |
| 92 | 92 |
} |
| 93 | 93 |
|
| 94 |
-func getRules(t *testing.T, iptable *iptables.IPTable, chain string) []string {
|
|
| 94 |
+func getRules(t *testing.T, iptable *iptables.IPTable, chain string) string {
|
|
| 95 | 95 |
t.Helper() |
| 96 | 96 |
output, err := iptable.Raw("-S", chain)
|
| 97 | 97 |
assert.NilError(t, err, "chain %s: failed to get rules", chain) |
| 98 |
- |
|
| 99 |
- rules := strings.Split(string(output), "\n") |
|
| 100 |
- if len(rules) > 0 {
|
|
| 101 |
- rules = rules[:len(rules)-1] |
|
| 102 |
- } |
|
| 103 |
- return rules |
|
| 98 |
+ return string(output) |
|
| 104 | 99 |
} |
| 105 | 100 |
|
| 106 | 101 |
func resetIptables(t *testing.T) {
|