Skip to content

Commit f2c8c38

Browse files
jaer-tsunYongli Chen
jaer-tsun
authored and
Yongli Chen
committed
Adding tests to verify that allow policies should take precedence over deny (#405)
1 parent d2b3f58 commit f2c8c38

File tree

1 file changed

+298
-0
lines changed

1 file changed

+298
-0
lines changed

‎npm/translatePolicy_test.go‎

Lines changed: 298 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2816,3 +2816,301 @@ func TestTranslatePolicy(t *testing.T) {
28162816
t.Errorf("expectedIptEntries: %s", marshalledExpectedIptEntries)
28172817
}
28182818
}
2819+
2820+
func TestAllowPrecedenceOverDeny(t *testing.T) {
2821+
targetSelector := metav1.LabelSelector{}
2822+
targetSelectorA := metav1.LabelSelector{
2823+
MatchLabels: map[string]string{
2824+
"app": "test",
2825+
},
2826+
MatchExpressions: []metav1.LabelSelectorRequirement{
2827+
metav1.LabelSelectorRequirement{
2828+
Key: "testIn",
2829+
Operator: metav1.LabelSelectorOpIn,
2830+
Values: []string{
2831+
"pod-A",
2832+
},
2833+
},
2834+
},
2835+
}
2836+
denyAllPolicy := &networkingv1.NetworkPolicy{
2837+
ObjectMeta: metav1.ObjectMeta{
2838+
Name: "default-deny",
2839+
Namespace: "default",
2840+
},
2841+
Spec: networkingv1.NetworkPolicySpec{
2842+
PodSelector: targetSelector,
2843+
PolicyTypes: []networkingv1.PolicyType{
2844+
networkingv1.PolicyTypeIngress,
2845+
},
2846+
Ingress: []networkingv1.NetworkPolicyIngressRule{},
2847+
},
2848+
}
2849+
allowToPodPolicy := &networkingv1.NetworkPolicy{
2850+
ObjectMeta: metav1.ObjectMeta{
2851+
Name: "pod-A",
2852+
Namespace: "default",
2853+
},
2854+
Spec: networkingv1.NetworkPolicySpec{
2855+
PodSelector: targetSelectorA,
2856+
PolicyTypes: []networkingv1.PolicyType{
2857+
networkingv1.PolicyTypeIngress,
2858+
networkingv1.PolicyTypeEgress,
2859+
},
2860+
Ingress: []networkingv1.NetworkPolicyIngressRule{
2861+
networkingv1.NetworkPolicyIngressRule{
2862+
From: []networkingv1.NetworkPolicyPeer{
2863+
networkingv1.NetworkPolicyPeer{
2864+
PodSelector: &metav1.LabelSelector{
2865+
MatchLabels: map[string]string{
2866+
"app": "test",
2867+
},
2868+
MatchExpressions: []metav1.LabelSelectorRequirement{
2869+
metav1.LabelSelectorRequirement{
2870+
Key: "testIn",
2871+
Operator: metav1.LabelSelectorOpIn,
2872+
Values: []string{
2873+
"pod-B",
2874+
},
2875+
},
2876+
},
2877+
},
2878+
},
2879+
networkingv1.NetworkPolicyPeer{
2880+
PodSelector: &metav1.LabelSelector{
2881+
MatchLabels: map[string]string{
2882+
"app": "test",
2883+
},
2884+
MatchExpressions: []metav1.LabelSelectorRequirement{
2885+
metav1.LabelSelectorRequirement{
2886+
Key: "testIn",
2887+
Operator: metav1.LabelSelectorOpIn,
2888+
Values: []string{
2889+
"pod-C",
2890+
},
2891+
},
2892+
},
2893+
},
2894+
},
2895+
},
2896+
},
2897+
},
2898+
Egress: []networkingv1.NetworkPolicyEgressRule{
2899+
networkingv1.NetworkPolicyEgressRule{
2900+
To: []networkingv1.NetworkPolicyPeer{
2901+
networkingv1.NetworkPolicyPeer{
2902+
NamespaceSelector: &metav1.LabelSelector{},
2903+
},
2904+
},
2905+
},
2906+
},
2907+
},
2908+
}
2909+
2910+
sets, lists, iptEntries := translatePolicy(denyAllPolicy)
2911+
expectedSets := []string{
2912+
"ns-default",
2913+
}
2914+
if !reflect.DeepEqual(sets, expectedSets) {
2915+
t.Errorf("translatedPolicy failed @ k8s-example-policy sets comparison")
2916+
t.Errorf("sets: %v", sets)
2917+
t.Errorf("expectedSets: %v", expectedSets)
2918+
}
2919+
2920+
expectedLists := []string{}
2921+
if !reflect.DeepEqual(lists, expectedLists) {
2922+
t.Errorf("translatedPolicy failed @ k8s-example-policy lists comparison")
2923+
t.Errorf("lists: %v", lists)
2924+
t.Errorf("expectedLists: %v", expectedLists)
2925+
}
2926+
2927+
sets, lists, finalIptEntries := translatePolicy(allowToPodPolicy)
2928+
expectedSets = []string{
2929+
"app:test",
2930+
"testIn:pod-A",
2931+
"testIn:pod-B",
2932+
"testIn:pod-C",
2933+
}
2934+
if !reflect.DeepEqual(sets, expectedSets) {
2935+
t.Errorf("translatedPolicy failed @ k8s-example-policy sets comparison")
2936+
t.Errorf("sets: %v", sets)
2937+
t.Errorf("expectedSets: %v", expectedSets)
2938+
}
2939+
2940+
expectedLists = []string{
2941+
"all-namespaces",
2942+
}
2943+
if !reflect.DeepEqual(lists, expectedLists) {
2944+
t.Errorf("translatedPolicy failed @ k8s-example-policy lists comparison")
2945+
t.Errorf("lists: %v", lists)
2946+
t.Errorf("expectedLists: %v", expectedLists)
2947+
}
2948+
2949+
iptEntries = append(iptEntries, finalIptEntries...)
2950+
2951+
nonKubeSystemEntries := []*iptm.IptEntry{
2952+
&iptm.IptEntry{
2953+
Chain: util.IptablesAzureTargetSetsChain,
2954+
Specs: []string{
2955+
util.IptablesModuleFlag,
2956+
util.IptablesSetModuleFlag,
2957+
util.IptablesMatchSetFlag,
2958+
util.GetHashedName("ns-default"),
2959+
util.IptablesDstFlag,
2960+
util.IptablesJumpFlag,
2961+
util.IptablesDrop,
2962+
util.IptablesModuleFlag,
2963+
util.IptablesCommentModuleFlag,
2964+
util.IptablesCommentFlag,
2965+
"DROP-ALL-TO-ns-default",
2966+
},
2967+
},
2968+
}
2969+
nonKubeSystemEntries2 := []*iptm.IptEntry{
2970+
&iptm.IptEntry{
2971+
Chain: util.IptablesAzureIngressPortChain,
2972+
Specs: []string{
2973+
util.IptablesModuleFlag,
2974+
util.IptablesSetModuleFlag,
2975+
util.IptablesMatchSetFlag,
2976+
util.GetHashedName("app:test"),
2977+
util.IptablesDstFlag,
2978+
util.IptablesModuleFlag,
2979+
util.IptablesSetModuleFlag,
2980+
util.IptablesMatchSetFlag,
2981+
util.GetHashedName("testIn:pod-A"),
2982+
util.IptablesDstFlag,
2983+
util.IptablesJumpFlag,
2984+
util.IptablesAzureIngressFromChain,
2985+
util.IptablesModuleFlag,
2986+
util.IptablesCommentModuleFlag,
2987+
util.IptablesCommentFlag,
2988+
"ALLOW-ALL-TO-app:test-AND-testIn:pod-A-TO-JUMP-TO-" +
2989+
util.IptablesAzureIngressFromChain,
2990+
},
2991+
},
2992+
&iptm.IptEntry{
2993+
Chain: util.IptablesAzureIngressFromChain,
2994+
Specs: []string{
2995+
util.IptablesModuleFlag,
2996+
util.IptablesSetModuleFlag,
2997+
util.IptablesMatchSetFlag,
2998+
util.GetHashedName("app:test"),
2999+
util.IptablesSrcFlag,
3000+
util.IptablesModuleFlag,
3001+
util.IptablesSetModuleFlag,
3002+
util.IptablesMatchSetFlag,
3003+
util.GetHashedName("testIn:pod-B"),
3004+
util.IptablesSrcFlag,
3005+
util.IptablesModuleFlag,
3006+
util.IptablesSetModuleFlag,
3007+
util.IptablesMatchSetFlag,
3008+
util.GetHashedName("app:test"),
3009+
util.IptablesDstFlag,
3010+
util.IptablesModuleFlag,
3011+
util.IptablesSetModuleFlag,
3012+
util.IptablesMatchSetFlag,
3013+
util.GetHashedName("testIn:pod-A"),
3014+
util.IptablesDstFlag,
3015+
util.IptablesJumpFlag,
3016+
util.IptablesAccept,
3017+
util.IptablesModuleFlag,
3018+
util.IptablesCommentModuleFlag,
3019+
util.IptablesCommentFlag,
3020+
"ALLOW-app:test-AND-testIn:pod-B-TO-app:test-AND-testIn:pod-A",
3021+
},
3022+
},
3023+
&iptm.IptEntry{
3024+
Chain: util.IptablesAzureIngressFromChain,
3025+
Specs: []string{
3026+
util.IptablesModuleFlag,
3027+
util.IptablesSetModuleFlag,
3028+
util.IptablesMatchSetFlag,
3029+
util.GetHashedName("app:test"),
3030+
util.IptablesSrcFlag,
3031+
util.IptablesModuleFlag,
3032+
util.IptablesSetModuleFlag,
3033+
util.IptablesMatchSetFlag,
3034+
util.GetHashedName("testIn:pod-C"),
3035+
util.IptablesSrcFlag,
3036+
util.IptablesModuleFlag,
3037+
util.IptablesSetModuleFlag,
3038+
util.IptablesMatchSetFlag,
3039+
util.GetHashedName("app:test"),
3040+
util.IptablesDstFlag,
3041+
util.IptablesModuleFlag,
3042+
util.IptablesSetModuleFlag,
3043+
util.IptablesMatchSetFlag,
3044+
util.GetHashedName("testIn:pod-A"),
3045+
util.IptablesDstFlag,
3046+
util.IptablesJumpFlag,
3047+
util.IptablesAccept,
3048+
util.IptablesModuleFlag,
3049+
util.IptablesCommentModuleFlag,
3050+
util.IptablesCommentFlag,
3051+
"ALLOW-app:test-AND-testIn:pod-C-TO-app:test-AND-testIn:pod-A",
3052+
},
3053+
},
3054+
&iptm.IptEntry{
3055+
Chain: util.IptablesAzureEgressPortChain,
3056+
Specs: []string{
3057+
util.IptablesModuleFlag,
3058+
util.IptablesSetModuleFlag,
3059+
util.IptablesMatchSetFlag,
3060+
util.GetHashedName("app:test"),
3061+
util.IptablesSrcFlag,
3062+
util.IptablesModuleFlag,
3063+
util.IptablesSetModuleFlag,
3064+
util.IptablesMatchSetFlag,
3065+
util.GetHashedName("testIn:pod-A"),
3066+
util.IptablesSrcFlag,
3067+
util.IptablesJumpFlag,
3068+
util.IptablesAzureEgressToChain,
3069+
util.IptablesModuleFlag,
3070+
util.IptablesCommentModuleFlag,
3071+
util.IptablesCommentFlag,
3072+
"ALLOW-ALL-FROM-app:test-AND-testIn:pod-A-TO-JUMP-TO-" +
3073+
util.IptablesAzureEgressToChain,
3074+
},
3075+
},
3076+
&iptm.IptEntry{
3077+
Chain: util.IptablesAzureEgressToChain,
3078+
Specs: []string{
3079+
util.IptablesModuleFlag,
3080+
util.IptablesSetModuleFlag,
3081+
util.IptablesMatchSetFlag,
3082+
util.GetHashedName("app:test"),
3083+
util.IptablesSrcFlag,
3084+
util.IptablesModuleFlag,
3085+
util.IptablesSetModuleFlag,
3086+
util.IptablesMatchSetFlag,
3087+
util.GetHashedName("testIn:pod-A"),
3088+
util.IptablesSrcFlag,
3089+
util.IptablesModuleFlag,
3090+
util.IptablesSetModuleFlag,
3091+
util.IptablesMatchSetFlag,
3092+
util.GetHashedName("all-namespaces"),
3093+
util.IptablesDstFlag,
3094+
util.IptablesJumpFlag,
3095+
util.IptablesAccept,
3096+
util.IptablesModuleFlag,
3097+
util.IptablesCommentModuleFlag,
3098+
util.IptablesCommentFlag,
3099+
"ALLOW-app:test-AND-testIn:pod-A-TO-all-namespaces",
3100+
},
3101+
},
3102+
}
3103+
expectedIptEntries := []*iptm.IptEntry{}
3104+
expectedIptEntries = append(expectedIptEntries, getAllowKubeSystemEntries("default", targetSelector)...)
3105+
expectedIptEntries = append(expectedIptEntries, nonKubeSystemEntries...)
3106+
expectedIptEntries = append(expectedIptEntries, getAllowKubeSystemEntries("default", targetSelectorA)...)
3107+
expectedIptEntries = append(expectedIptEntries, nonKubeSystemEntries2...)
3108+
expectedIptEntries = append(expectedIptEntries, getDefaultDropEntries("default", targetSelectorA, true, true)...)
3109+
if !reflect.DeepEqual(iptEntries, expectedIptEntries) {
3110+
t.Errorf("TestAllowPrecedenceOverDeny failed @ k8s-example-policy policy comparison")
3111+
marshalledIptEntries, _ := json.Marshal(iptEntries)
3112+
marshalledExpectedIptEntries, _ := json.Marshal(expectedIptEntries)
3113+
t.Errorf("iptEntries: %s", marshalledIptEntries)
3114+
t.Errorf("expectedIptEntries: %s", marshalledExpectedIptEntries)
3115+
}
3116+
}

0 commit comments

Comments
 (0)