update README

Author: ncode

README.md

@@ -145,6 +145,9 @@ Plugin-Specific Configuration Parameters:
 - `chainName`: Defines the name of the primary iptables chain. If not specified, it defaults to `"CNI-OUTBOUND"`.
 - `defaultAction`: Determines the default action (e.g., `"DROP"`, `"ACCEPT"`) for the container-specific chains. The default value is `"DROP"`.
 - `outboundRules`: An array of outbound rules that will be applied to each container.
+- `dryRun`: When set to `true`, all traffic will be logged but not blocked.
+- `logDrops`: When set to `true`, any dropped traffic will be logged via iptables.
+- `metadata`: A map of key-value pairs that will be included in log messages.
 - `logging`:
   - `enable`: A boolean value to enable (`true`) or disable (`false`) logging.
   - `directory`: Specifies the directory where log files will be stored.
@@ -254,4 +257,4 @@ This project is licensed under Apache-2.0
 - [go-iptables](https://github.com/coreos/go-iptables)
 - [Nomad by HashiCorp](https://www.nomadproject.io/)
 
-For more information on CNI plugins and their use with Nomad, refer to the [Nomad CNI documentation](https://www.nomadproject.io/docs/networking/cni).
+For more information on CNI plugins and their use with Nomad, refer to the [Nomad CNI documentation](https://www.nomadproject.io/docs/networking/cni).

outbound_test.go

@@ -1847,3 +1847,87 @@ func TestParseConfigComplete(t *testing.T) {
 		})
 	}
 }
+
+func TestParseConfig_LogDrops(t *testing.T) {
+	testCases := []struct {
+		name           string
+		stdin          []byte
+		args           string
+		expectError    bool
+		expectDryRun   bool
+		expectLogDrops bool
+	}{
+		{
+			name: "Config with dryRun and logDrops enabled",
+			stdin: []byte(`{
+				"cniVersion": "1.0.0",
+				"name": "test-net",
+				"type": "outbound",
+				"dryRun": true,
+				"logDrops": true,
+				"mainChainName": "TEST-OUTBOUND",
+				"defaultAction": "DROP"
+			}`),
+			args:           "",
+			expectDryRun:   true,
+			expectLogDrops: true,
+		},
+		{
+			name: "Config with only logDrops enabled",
+			stdin: []byte(`{
+				"cniVersion": "1.0.0",
+				"name": "test-net",
+				"type": "outbound",
+				"logDrops": true,
+				"mainChainName": "TEST-OUTBOUND",
+				"defaultAction": "DROP"
+			}`),
+			args:           "",
+			expectDryRun:   false,
+			expectLogDrops: true,
+		},
+		{
+			name: "Config with only dryRun enabled",
+			stdin: []byte(`{
+				"cniVersion": "1.0.0",
+				"name": "test-net",
+				"type": "outbound",
+				"dryRun": true,
+				"mainChainName": "TEST-OUTBOUND",
+				"defaultAction": "DROP"
+			}`),
+			args:           "",
+			expectDryRun:   true,
+			expectLogDrops: false,
+		},
+		{
+			name: "Config with both disabled",
+			stdin: []byte(`{
+				"cniVersion": "1.0.0",
+				"name": "test-net",
+				"type": "outbound",
+				"mainChainName": "TEST-OUTBOUND",
+				"defaultAction": "DROP"
+			}`),
+			args:           "",
+			expectDryRun:   false,
+			expectLogDrops: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			conf, err := parseConfig(tc.stdin, tc.args, "test-container")
+
+			if tc.expectError {
+				assert.Error(t, err)
+				return
+			}
+
+			assert.NoError(t, err)
+			assert.NotNil(t, conf)
+			assert.Equal(t, tc.expectDryRun, conf.DryRun)
+			assert.Equal(t, tc.expectLogDrops, conf.LogDrops)
+		})
+	}
+}