Skip to content

Commit 8779d86

Browse files
pjbgfpjbgf
committed
tests: Add tests to confirm iptables wrapper works
Pull some of the upstream tests for iptables-wrapper and use them during CI to reduce the likelihood of regression with iptables-wrapper on this image. Signed-off-by: Paulo Gomes <[email protected]>
1 parent 9741732 commit 8779d86

File tree

7 files changed

+230
-5
lines changed

7 files changed

+230
-5
lines changed

‎.github/workflows/ci-on-pr.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@ on:
55
branches:
66
- master
77
push:
8-
branches:
9-
- master
108

119
jobs:
1210
test-prepare-binaries:
@@ -49,3 +47,5 @@ jobs:
4947
labels: "${{ steps.meta.outputs.labels }}"
5048
build-args: |
5149
ARCH="${{ matrix.arch }}"
50+
51+
- run: make test

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ RUN echo CACHEBUST>/dev/null \
7979

8080
# iptables-wrapper-installer.sh uses `iptables-nft --version` to check whether iptables-nft exists, iptables-nft returns
8181
# the error "protocol not supported" when being invoked in an emulated enviroment whose arch (for example, arm64)
82-
# is differnt from the host (amd64). So we do the check ourselves before running iptables-wrapper-installer.sh.
82+
# is different from the host (amd64). So we do the check ourselves before running iptables-wrapper-installer.sh.
8383
RUN which iptables-legacy && which iptables-nft
8484
RUN /usr/sbin/iptables-wrapper-installer.sh --no-sanity-check
8585

‎Makefile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ARCH ?=amd64
22
ALL_ARCH = amd64 arm64
33

4-
IMAGE ?= docker.io/oats87/hyperkube-base
4+
IMAGE ?= docker.io/rancher/hyperkube-base
55
TAG ?= v0.0.1
66

77
BASEIMAGE ?= ubuntu:22.04
@@ -35,6 +35,10 @@ build: clean scripts/iptables-wrapper-installer.sh
3535
push: build
3636
docker push $(IMAGE):$(TAG)-$(ARCH)
3737

38+
test: clean scripts/iptables-wrapper-installer.sh
39+
IMAGE=test-hyperkube-base DEBUG=true \
40+
./tests/run-wrapper-tests.sh bci
41+
3842
.PHONY: all build push clean all-build all-push-images all-push
3943

4044
.DEFAULT_GOAL := build

‎scripts/hyperkube‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,4 +72,4 @@ function main() {
7272
exec "${command}" "${@}"
7373
}
7474

75-
main "${@}"
75+
main "${@}"

‎tests/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
ARG IMAGE
2+
FROM ${IMAGE}
3+
4+
COPY tests/test.sh /
5+
6+
ENTRYPOINT []

‎tests/run-wrapper-tests.sh‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
#!/bin/bash
2+
#
3+
# Copyright 2020 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Adapted from: https://github.com/kubernetes-sigs/iptables-wrappers/blob/master/test/run-test.sh
18+
19+
set -o errexit
20+
set -o nounset
21+
set -o pipefail
22+
23+
if [[ -n "${DEBUG:-}" ]]; then
24+
set -x
25+
dash_x="-x"
26+
fi
27+
28+
build_arg=""
29+
build_fail=0
30+
nft_fail=0
31+
32+
while [[ $# -gt 1 ]]; do
33+
case "$1" in
34+
--build-arg=*)
35+
build_arg="${1#--build_arg=}"
36+
;;
37+
--build-arg)
38+
shift
39+
build_arg="$1"
40+
;;
41+
--build-fail)
42+
build_fail=1
43+
;;
44+
--nft-fail)
45+
nft_fail=1
46+
;;
47+
*)
48+
echo "Unrecognized flag '$1'" 1>&2
49+
exit 1
50+
;;
51+
esac
52+
shift
53+
done
54+
55+
if podman -h &> /dev/null; then
56+
docker_binary=podman
57+
elif docker -h &> /dev/null; then
58+
if docker version &> /dev/null; then
59+
docker_binary=docker
60+
else
61+
docker_binary="sudo docker"
62+
# Get the password prompting out of the way now
63+
sudo docker version > /dev/null
64+
fi
65+
else
66+
echo "Could not find podman or docker" 1>&2
67+
exit 1
68+
fi
69+
70+
function docker() {
71+
if [[ -n "${DEBUG:-}" ]]; then
72+
command ${docker_binary} "$@"
73+
else
74+
if [[ "$1" == "build" ]]; then
75+
echo " docker $*"
76+
fi
77+
# Redirect stdout to /dev/null and indent stderr
78+
command ${docker_binary} "$@" 2>&1 > /dev/null | \
79+
sed -e '/debconf: delaying package configuration/ d' \
80+
-e 's/^/ /'
81+
fi
82+
}
83+
84+
function build() {
85+
shift
86+
87+
if ! docker buildx build -t test-hyperkube-base . --load; then
88+
FAIL "building base image failed"
89+
fi
90+
if ! docker buildx build --build-arg IMAGE=test-hyperkube-base -q -t iptables-wrapper-test -f tests/Dockerfile "$@" . --load; then
91+
FAIL "building test image failed"
92+
fi
93+
94+
}
95+
96+
function PASS() {
97+
printf "\033[1;92mPASS: $@\033[0m\n\n"
98+
exit 0
99+
}
100+
101+
function FAIL() {
102+
echo "update-alternatives configuration:"
103+
docker run iptables-wrapper-test update-alternatives --query iptables
104+
105+
printf "\033[1;31mFAIL: $@\033[0m\n" 1>&2
106+
107+
exit 1
108+
}
109+
110+
if ! build iptables-wrapper-test ${build_arg}; then
111+
if [[ "${build_fail}" = 1 ]]; then
112+
PASS "build failed as expected"
113+
fi
114+
FAIL "build failed unexpectedly"
115+
fi
116+
117+
if ! docker run --privileged -e iptables_binary=/usr/sbin/iptables iptables-wrapper-test /bin/sh ${dash_x:-} /test.sh legacy; then
118+
FAIL "failed legacy iptables / new rules test"
119+
fi
120+
if ! docker run --privileged -e iptables_binary=/usr/sbin/iptables iptables-wrapper-test /bin/sh ${dash_x:-} /test.sh nft; then
121+
FAIL "failed nft iptables / new rules test"
122+
fi
123+
if ! docker run --privileged -e iptables_binary=/usr/sbin/ip6tables iptables-wrapper-test /bin/sh ${dash_x:-} /test.sh legacy; then
124+
FAIL "failed legacy ip6tables / new rules test"
125+
fi
126+
if ! docker run --privileged -e iptables_binary=/usr/sbin/ip6tables iptables-wrapper-test /bin/sh ${dash_x:-} /test.sh nft; then
127+
FAIL "failed nft ip6tables / new rules test"
128+
fi
129+
130+
PASS "success"

‎tests/test.sh‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#!/bin/sh
2+
#
3+
# Copyright 2020 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Adapted from: https://github.com/kubernetes-sigs/iptables-wrappers/blob/master/test/test.sh
18+
19+
set -eu
20+
21+
mode=$1
22+
iptables_binary=${iptables_binary:-/usr/sbin/iptables}
23+
24+
case "${mode}" in
25+
legacy)
26+
wrongmode=nft
27+
;;
28+
nft)
29+
wrongmode=legacy
30+
;;
31+
*)
32+
echo "ERROR: bad mode '${mode}'" 1>&2
33+
exit 1
34+
;;
35+
esac
36+
37+
sbin="/usr/sbin"
38+
if [ ! -d /usr/sbin -a -e "${iptables_binary}" ]; then
39+
echo "ERROR: ${iptables_binary} not found" 1>&2
40+
exit 1
41+
fi
42+
43+
ensure_iptables_undecided() {
44+
iptables=$(realpath "${iptables_binary}")
45+
if [ "${iptables}" != "${sbin}/iptables-wrapper" ]; then
46+
echo "iptables link was resolved prematurely! (${iptables})" 1>&2
47+
exit 1
48+
fi
49+
}
50+
51+
ensure_iptables_resolved() {
52+
expected=$1
53+
iptables=$(realpath "${iptables_binary}")
54+
if [ "${iptables}" = "${sbin}/iptables-wrapper" ]; then
55+
echo "iptables link is not yet resolved!" 1>&2
56+
exit 1
57+
fi
58+
version=$(iptables -V | sed -e 's/.*(\(.*\)).*/\1/')
59+
case "${version}/${expected}" in
60+
legacy/legacy|nf_tables/nft)
61+
return
62+
;;
63+
*)
64+
echo "iptables link resolved incorrectly (expected ${expected}, got ${version})" 1>&2
65+
exit 1
66+
;;
67+
esac
68+
}
69+
70+
ensure_iptables_undecided
71+
72+
# Initialize the chosen iptables mode with just a hint chain
73+
iptables-${mode} -t mangle -N KUBE-IPTABLES-HINT
74+
75+
# Put some junk in the other iptables system
76+
iptables-${wrongmode} -t filter -N BAD-1
77+
iptables-${wrongmode} -t filter -A BAD-1 -j ACCEPT
78+
iptables-${wrongmode} -t filter -N BAD-2
79+
iptables-${wrongmode} -t filter -A BAD-2 -j DROP
80+
81+
ensure_iptables_undecided
82+
83+
iptables -L > /dev/null
84+
85+
ensure_iptables_resolved ${mode}

0 commit comments

Comments
 (0)