Skip to content

Mereta/fix iptables legacy with ubuntu2404 #3789

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 8 commits into from
Closed

Mereta/fix iptables legacy with ubuntu2404 #3789

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
478813b
fix: [NPM] [Backport] Update Ubuntu Base Image to 24.04 (#3743)
rayaisaiah Jun 18, 2025
273a2fe
[Service Tags] ci: Backport service/virtual tag updates to release/v1…
k-routhu Jun 25, 2025
dda6b0c
[NPM] [CVE] Resolve CVE-2025-6020 (#3763)
rayaisaiah Jun 27, 2025
1ba39f7
[NPM] [Vulnerability] Resolve ghsa-fv92-fjc5-jj9h Vulnerability (#3767)
rayaisaiah Jun 30, 2025
58277d4
added legacy
rayaisaiah Jul 10, 2025
14b0315
typo
rayaisaiah Jul 10, 2025
38ff048
updated tests
rayaisaiah Jul 10, 2025
59f1f4d
updated for all tests
rayaisaiah Jul 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ require (
github.com/go-openapi/spec v0.20.11 // indirect
github.com/go-openapi/strfmt v0.21.9 // indirect
github.com/go-openapi/validate v0.22.3 // indirect
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
github.com/google/gopacket v1.1.19 // indirect
github.com/gorilla/websocket v1.5.1 // indirect
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,8 +161,8 @@ github.com/go-openapi/validate v0.22.3/go.mod h1:kVxh31KbfsxU8ZyoHaDbLBWU5CnMdqB
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
github.com/gofrs/uuid v3.3.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
github.com/gofrs/uuid v4.2.0+incompatible h1:yyYWMnhkhrKwwr8gAOcOCYxOOscHgDS9yZgBrnJfGa0=
github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
Expand Down
2 changes: 1 addition & 1 deletion hack/aks/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ OS_SKU_WIN ?= Windows2022
REGION ?= westus2
VM_SIZE ?= Standard_B2s
VM_SIZE_WIN ?= Standard_B2s
IP_TAG ?= FirstPartyUsage=/DelegatedNetworkControllerTest
IP_TAG ?= FirstPartyUsage=/NonProd
Copy link

Copilot AI Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change from '/DelegatedNetworkControllerTest' to '/NonProd' appears unrelated to the main iptables fix. This configuration change should be documented or moved to a separate commit.

Suggested change
IP_TAG ?= FirstPartyUsage=/NonProd
IP_TAG ?= FirstPartyUsage=/DelegatedNetworkControllerTest

Copilot uses AI. Check for mistakes.
IP_PREFIX ?= serviceTaggedIp
PUBLIC_IP_ID ?= /subscriptions/$(SUB)/resourceGroups/$(GROUP)/providers/Microsoft.Network/publicIPAddresses
PUBLIC_IPv4 ?= $(PUBLIC_IP_ID)/$(IP_PREFIX)-$(CLUSTER)-v4
Expand Down
4 changes: 2 additions & 2 deletions npm/linux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ WORKDIR /usr/local/src
COPY . .
RUN CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm -ldflags "-X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go

FROM mcr.microsoft.com/mirror/docker/library/ubuntu:20.04 as linux
FROM mcr.microsoft.com/mirror/docker/library/ubuntu:24.04 as linux
COPY --from=builder /usr/local/bin/azure-npm /usr/bin/azure-npm
RUN apt-get update && apt-get install -y iptables ipset ca-certificates && apt-get autoremove -y && apt-get clean
RUN apt-get update && apt-get install -y libsystemd0=255.4-1ubuntu8.8 libudev1=255.4-1ubuntu8.8 libpam-modules=1.5.3-5ubuntu5.4 libpam-modules-bin=1.5.3-5ubuntu5.4 libpam-runtime=1.5.3-5ubuntu5.4 libpam0g=1.5.3-5ubuntu5.4 iptables ipset ca-certificates && apt-get autoremove -y && apt-get clean
Copy link

Copilot AI Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The package installation command is very long and hard to read. Consider breaking it into multiple lines or using a separate package list for better maintainability.

Suggested change
RUN apt-get update && apt-get install -y libsystemd0=255.4-1ubuntu8.8 libudev1=255.4-1ubuntu8.8 libpam-modules=1.5.3-5ubuntu5.4 libpam-modules-bin=1.5.3-5ubuntu5.4 libpam-runtime=1.5.3-5ubuntu5.4 libpam0g=1.5.3-5ubuntu5.4 iptables ipset ca-certificates && apt-get autoremove -y && apt-get clean
RUN apt-get update && apt-get install -y \
libsystemd0=255.4-1ubuntu8.8 \
libudev1=255.4-1ubuntu8.8 \
libpam-modules=1.5.3-5ubuntu5.4 \
libpam-modules-bin=1.5.3-5ubuntu5.4 \
libpam-runtime=1.5.3-5ubuntu5.4 \
libpam0g=1.5.3-5ubuntu5.4 \
iptables \
ipset \
ca-certificates && \
apt-get autoremove -y && \
apt-get clean

Copilot uses AI. Check for mistakes.
RUN chmod +x /usr/bin/azure-npm
ENTRYPOINT ["/usr/bin/azure-npm", "start"]
132 changes: 66 additions & 66 deletions npm/pkg/dataplane/policies/chain-management_linux_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -936,7 +936,7 @@ func TestDetectIptablesVersion(t *testing.T) {
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-L", "KUBE-IPTABLES-HINT", "-t", "mangle", "-n"},
Cmd: []string{"iptables-legacy", "-w", "60", "-L", "KUBE-IPTABLES-HINT", "-t", "mangle", "-n"},
ExitCode: 0,
},
},
Expand All @@ -954,11 +954,11 @@ func TestDetectIptablesVersion(t *testing.T) {
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-L", "KUBE-IPTABLES-HINT", "-t", "mangle", "-n"},
Cmd: []string{"iptables-legacy", "-w", "60", "-L", "KUBE-IPTABLES-HINT", "-t", "mangle", "-n"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-L", "KUBE-KUBELET-CANARY", "-t", "mangle", "-n"},
Cmd: []string{"iptables-legacy", "-w", "60", "-L", "KUBE-KUBELET-CANARY", "-t", "mangle", "-n"},
ExitCode: 1,
},
},
Expand All @@ -976,11 +976,11 @@ func TestDetectIptablesVersion(t *testing.T) {
ExitCode: 2,
},
{
Cmd: []string{"iptables", "-w", "60", "-L", "KUBE-IPTABLES-HINT", "-t", "mangle", "-n"},
Cmd: []string{"iptables-legacy", "-w", "60", "-L", "KUBE-IPTABLES-HINT", "-t", "mangle", "-n"},
ExitCode: 2,
},
{
Cmd: []string{"iptables", "-w", "60", "-L", "KUBE-KUBELET-CANARY", "-t", "mangle", "-n"},
Cmd: []string{"iptables-legacy", "-w", "60", "-L", "KUBE-KUBELET-CANARY", "-t", "mangle", "-n"},
ExitCode: 2,
},
},
Expand Down Expand Up @@ -1027,12 +1027,12 @@ func TestCleanupOtherChains(t *testing.T) {
name: "cleanup legacy jump no chains",
startWithNft: true,
calls: []testutils.TestCmd{
{Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}}, // deprecated rule existed
{Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}}, // deprecated rule existed
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
ExitCode: 1,
Expand All @@ -1044,19 +1044,19 @@ func TestCleanupOtherChains(t *testing.T) {
name: "cleanup legacy jump and chains",
startWithNft: true,
calls: []testutils.TestCmd{
{Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}}, // deprecated rule existed
{Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}}, // deprecated rule existed
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: grepOutputTwoAzureChains,
},
{Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"}},
{Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM"}},
{Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM-INGRESS"}},
},
expectedErr: false,
},
Expand All @@ -1065,30 +1065,30 @@ func TestCleanupOtherChains(t *testing.T) {
startWithNft: true,
calls: []testutils.TestCmd{
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: grepOutputTwoAzureChains,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM"}},
{Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM"}},
{Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM-INGRESS"}},
},
expectedErr: false,
},
Expand All @@ -1097,28 +1097,28 @@ func TestCleanupOtherChains(t *testing.T) {
startWithNft: true,
calls: []testutils.TestCmd{
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: grepOutputTwoAzureChains,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM"},
ExitCode: 1,
},
},
Expand All @@ -1129,28 +1129,28 @@ func TestCleanupOtherChains(t *testing.T) {
startWithNft: true,
calls: []testutils.TestCmd{
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: "Chain AZURE-NPM-INGRESS (1 references)\n",
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM-INGRESS"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM-INGRESS"}},
},
expectedErr: false,
},
Expand All @@ -1159,37 +1159,37 @@ func TestCleanupOtherChains(t *testing.T) {
startWithNft: true,
calls: []testutils.TestCmd{
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"}},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: grepOutputTwoAzureChains,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM-INGRESS"},
Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM-INGRESS"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM-INGRESS"},
Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM-INGRESS"},
ExitCode: 1,
},
},
Expand All @@ -1199,38 +1199,38 @@ func TestCleanupOtherChains(t *testing.T) {
name: "cleanup legacy errors ok if deleted jump (deprecated)",
startWithNft: true,
calls: []testutils.TestCmd{
{Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}},
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: grepOutputTwoAzureChains,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM"},
ExitCode: 2,
},
{
Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM-INGRESS"},
Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM-INGRESS"},
ExitCode: 2,
},
{
Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM"},
ExitCode: 2,
},
{
Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM-INGRESS"},
Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM-INGRESS"},
ExitCode: 2,
},
},
Expand All @@ -1240,35 +1240,35 @@ func TestCleanupOtherChains(t *testing.T) {
name: "cleanup legacy other flush errors ok",
startWithNft: true,
calls: []testutils.TestCmd{
{Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"}},
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true,
Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true,
ExitCode: 1,
},
{
Cmd: []string{"grep", "Chain AZURE-NPM"},
Stdout: grepOutputTwoAzureChains,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-legacy-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM"}},
{
Cmd: []string{"iptables", "-w", "60", "-F", "AZURE-NPM-INGRESS"},
Cmd: []string{"iptables-legacy", "-w", "60", "-F", "AZURE-NPM-INGRESS"},
ExitCode: 1,
},
{Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM"}},
{Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM"}},
{
Cmd: []string{"iptables", "-w", "60", "-X", "AZURE-NPM-INGRESS"},
Cmd: []string{"iptables-legacy", "-w", "60", "-X", "AZURE-NPM-INGRESS"},
ExitCode: 1,
},
},
Expand All @@ -1279,15 +1279,15 @@ func TestCleanupOtherChains(t *testing.T) {
startWithNft: true,
calls: []testutils.TestCmd{
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
Cmd: []string{"iptables-legacy", "-w", "60", "-D", "FORWARD", "-j", "AZURE-NPM", "-m", "conntrack", "--ctstate", "NEW"},
ExitCode: 1,
},
{
Cmd: []string{"iptables", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true, HasStartError: true,
Cmd: []string{"iptables-legacy", "-w", "60", "-t", "filter", "-n", "-L"}, PipedToCommand: true, HasStartError: true,
ExitCode: 1,
},
{Cmd: []string{"grep", "Chain AZURE-NPM"}},
Expand Down
Loading
Loading