nftables

package
v0.0.0-...-648dfe1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: Apache-2.0, BSD-3-Clause, MIT Imports: 11 Imported by: 0

README

nftables Tests

nftables tests are run via make nftables-tests.

nftables require some extra Docker configuration to work. Enable IPv6 in /etc/docker/daemon.json (make sure to restart Docker if you change this file):

{
    "experimental": true,
    "fixed-cidr-v6": "2001:db8:1::/64",
    "ipv6": true,
    // Runtimes and other Docker config...
}

And if you're running manually (i.e. not using the make target), you'll need to:

  • Enable nftables via modprobe nfnetlink && modprobe nf_tables.
  • Enable --net-raw in your chosen runtime in /etc/docker/daemon.json (make sure to restart Docker if you change this file).

The resulting runtime should look something like this:

"runsc": {
    "path": "/tmp/nftables/runsc",
    "runtimeArgs": [
        "--debug-log",
        "/tmp/nftables/logs/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%",
        "--net-raw"
    ]
},
// ...

Test Structure

Each test implements TestCase, providing (1) a function to run inside the container and (2) a function to run locally. Those processes are given each others' IP addresses. The test succeeds when both functions succeed.

The function inside the container (ContainerAction) typically sets some nftables rules and then tries to send or receive packets. The local function (LocalAction) will typically just send or receive packets.

Adding Tests

  1. Add your test to the nftables package.

  2. Register the test in an init function via RegisterTestCase (see filter_input.go as an example).

  3. Add it to nftables_test.go (see the other tests in that file).

Your test is now runnable with bazel!

Run individual tests

Build and install runsc. Re-run this when you modify gVisor:

$ bazel build //runsc && sudo cp bazel-out/k8-fastbuild-ST-4c64f0b3d5c7/bin/runsc/runsc_/runsc $(which runsc)

Build the testing Docker container. Re-run this when you modify the test code in this directory:

$ make load-nftables

Run an individual test via:

$ bazel test //test/nftables:nftables_test --test_filter=<TESTNAME>

To run an individual test with runc:

$ bazel test //test/nftables:nftables_test --test_filter=<TESTNAME> --test_env=RUNTIME=runc

Documentation

Overview

Package nftables contains a set of nftables tests implemented as TestCases

Index

Constants

View Source 
const IPExchangePort = 2349

IPExchangePort is the port the container listens on to receive the IP address of the local process.

View Source 
const NegativeTimeout = 2 * time.Second

NegativeTimeout is the time tests should wait to establish the negative case, i.e. that connections are not made.

View Source 
const TerminalStatement = "Finished!"

TerminalStatement is the last statement in the test runner.

Variables

View Source 
var Tests = map[string]TestCase{}

Tests maps test names to TestCase.

New TestCases are added by calling RegisterTestCase in an init function.

Functions

func RegisterTestCase 

func RegisterTestCase(tc TestCase)

RegisterTestCase registers tc so it can be run.

Types

type FilterInputDropAll 

type FilterInputDropAll struct {
	// contains filtered or unexported fields
}

FilterInputDropAll tests that we can drop all traffic to the INPUT chain.

func (*FilterInputDropAll) ContainerAction 

func (*FilterInputDropAll) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*FilterInputDropAll) ContainerSufficient 

func (*FilterInputDropAll) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*FilterInputDropAll) LocalAction 

func (*FilterInputDropAll) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*FilterInputDropAll) LocalSufficient 

func (*FilterInputDropAll) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*FilterInputDropAll) Name 

func (*FilterInputDropAll) Name() string

Name implements TestCase.Name.

func (*FilterInputDropAll) Timeout 

func (*FilterInputDropAll) Timeout() time.Duration

Timeout returns the timeout for the test case.

type FilterInputMultiUDPRules 

type FilterInputMultiUDPRules struct {
	// contains filtered or unexported fields
}

FilterInputMultiUDPRules verifies that multiple UDP rules are applied correctly. This has the added benefit of testing whether we're serializing rules correctly -- if we do it incorrectly, the iptables tool will misunderstand and save the wrong tables.

func (*FilterInputMultiUDPRules) ContainerAction 

func (*FilterInputMultiUDPRules) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*FilterInputMultiUDPRules) ContainerSufficient 

func (*FilterInputMultiUDPRules) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*FilterInputMultiUDPRules) LocalAction 

func (*FilterInputMultiUDPRules) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*FilterInputMultiUDPRules) LocalSufficient 

func (*FilterInputMultiUDPRules) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*FilterInputMultiUDPRules) Name 

func (*FilterInputMultiUDPRules) Name() string

Name implements TestCase.Name.

func (*FilterInputMultiUDPRules) Timeout 

func (*FilterInputMultiUDPRules) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type FilterInputRequireProtocolUDP 

type FilterInputRequireProtocolUDP struct {
	// contains filtered or unexported fields
}

FilterInputRequireProtocolUDP checks that "-m udp" requires "-p udp" to be specified.

func (*FilterInputRequireProtocolUDP) ContainerAction 

func (*FilterInputRequireProtocolUDP) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*FilterInputRequireProtocolUDP) ContainerSufficient 

func (*FilterInputRequireProtocolUDP) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*FilterInputRequireProtocolUDP) LocalAction 

func (*FilterInputRequireProtocolUDP) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*FilterInputRequireProtocolUDP) LocalSufficient 

func (*FilterInputRequireProtocolUDP) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*FilterInputRequireProtocolUDP) Name 

func (*FilterInputRequireProtocolUDP) Name() string

Name implements TestCase.Name.

func (*FilterInputRequireProtocolUDP) Timeout 

func (*FilterInputRequireProtocolUDP) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputCreateUserChain 

type IptFilterInputCreateUserChain struct {
	// contains filtered or unexported fields
}

IptFilterInputCreateUserChain tests chain creation.

func (*IptFilterInputCreateUserChain) ContainerAction 

func (*IptFilterInputCreateUserChain) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputCreateUserChain) ContainerSufficient 

func (*IptFilterInputCreateUserChain) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputCreateUserChain) LocalAction 

func (*IptFilterInputCreateUserChain) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputCreateUserChain) LocalSufficient 

func (*IptFilterInputCreateUserChain) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputCreateUserChain) Name 

func (*IptFilterInputCreateUserChain) Name() string

Name implements TestCase.Name.

func (*IptFilterInputCreateUserChain) Timeout 

func (*IptFilterInputCreateUserChain) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDefaultPolicyAccept 

type IptFilterInputDefaultPolicyAccept struct {
	// contains filtered or unexported fields
}

IptFilterInputDefaultPolicyAccept tests the default ACCEPT policy.

func (*IptFilterInputDefaultPolicyAccept) ContainerAction 

func (*IptFilterInputDefaultPolicyAccept) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDefaultPolicyAccept) ContainerSufficient 

func (*IptFilterInputDefaultPolicyAccept) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDefaultPolicyAccept) LocalAction 

func (*IptFilterInputDefaultPolicyAccept) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDefaultPolicyAccept) LocalSufficient 

func (*IptFilterInputDefaultPolicyAccept) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDefaultPolicyAccept) Name 

func (*IptFilterInputDefaultPolicyAccept) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDefaultPolicyAccept) Timeout 

func (*IptFilterInputDefaultPolicyAccept) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDefaultPolicyDrop 

type IptFilterInputDefaultPolicyDrop struct {
	// contains filtered or unexported fields
}

IptFilterInputDefaultPolicyDrop tests the default DROP policy.

func (*IptFilterInputDefaultPolicyDrop) ContainerAction 

func (*IptFilterInputDefaultPolicyDrop) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDefaultPolicyDrop) ContainerSufficient 

func (*IptFilterInputDefaultPolicyDrop) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDefaultPolicyDrop) LocalAction 

func (*IptFilterInputDefaultPolicyDrop) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDefaultPolicyDrop) LocalSufficient 

func (*IptFilterInputDefaultPolicyDrop) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDefaultPolicyDrop) Name 

func (*IptFilterInputDefaultPolicyDrop) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDefaultPolicyDrop) Timeout 

func (*IptFilterInputDefaultPolicyDrop) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDestination 

type IptFilterInputDestination struct {
	// contains filtered or unexported fields
}

IptFilterInputDestination verifies that we can filter packets via `-d <ipaddr>`.

func (*IptFilterInputDestination) ContainerAction 

func (*IptFilterInputDestination) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDestination) ContainerSufficient 

func (*IptFilterInputDestination) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDestination) LocalAction 

func (*IptFilterInputDestination) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDestination) LocalSufficient 

func (*IptFilterInputDestination) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDestination) Name 

func (*IptFilterInputDestination) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDestination) Timeout 

func (*IptFilterInputDestination) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropAll 

type IptFilterInputDropAll struct {
	// contains filtered or unexported fields
}

IptFilterInputDropAll tests that we can drop all traffic to the INPUT chain.

func (*IptFilterInputDropAll) ContainerAction 

func (*IptFilterInputDropAll) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropAll) ContainerSufficient 

func (*IptFilterInputDropAll) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropAll) LocalAction 

func (*IptFilterInputDropAll) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropAll) LocalSufficient 

func (*IptFilterInputDropAll) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropAll) Name 

func (*IptFilterInputDropAll) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropAll) Timeout 

func (*IptFilterInputDropAll) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropAllExceptOneDstPort 

type IptFilterInputDropAllExceptOneDstPort struct {
	// contains filtered or unexported fields
}

IptFilterInputDropAllExceptOneDstPort tests that only packets destined to a specific port are accepted, while connections to any other port are dropped. The rule uses a negated multiport destination port specification to allow only one port.

Rule(s): 

-P INPUT DROP
-A INPUT -p tcp -m multiport ! --dports 0:442,444:32000,32001:65535 -j ACCEPT

func (*IptFilterInputDropAllExceptOneDstPort) ContainerAction 

func (*IptFilterInputDropAllExceptOneDstPort) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction. It installs a catch-all DROP policy for the input chain and a single ACCEPT rule for packets destined to the allowed port. The container listens on allowed and blocked ports; only the former should receive a connection.

func (*IptFilterInputDropAllExceptOneDstPort) ContainerSufficient 

func (*IptFilterInputDropAllExceptOneDstPort) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropAllExceptOneDstPort) LocalAction 

func (*IptFilterInputDropAllExceptOneDstPort) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction. It connects to both the allowed port and the blocked port, only the former should succeed.

func (*IptFilterInputDropAllExceptOneDstPort) LocalSufficient 

func (*IptFilterInputDropAllExceptOneDstPort) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropAllExceptOneDstPort) Name 

func (*IptFilterInputDropAllExceptOneDstPort) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropAllExceptOneDstPort) Timeout 

func (*IptFilterInputDropAllExceptOneDstPort) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropAllSrcPorts 

type IptFilterInputDropAllSrcPorts struct {
	// contains filtered or unexported fields
}

IptFilterInputDropAllSrcPorts tests that all TCP packets, regardless of source port, are dropped. The rule covers all the source ports so that no incoming TCP packet on INPUT is accepted.

Rule(s): 

-A INPUT -p tcp -m multiport --sports 0,1,2:32000,32001:65535 -j DROP

func (*IptFilterInputDropAllSrcPorts) ContainerAction 

func (*IptFilterInputDropAllSrcPorts) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction. The container will then attempt to receive a UDP packet, which should never arrive due to the DROP rule.

func (*IptFilterInputDropAllSrcPorts) ContainerSufficient 

func (*IptFilterInputDropAllSrcPorts) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropAllSrcPorts) LocalAction 

func (*IptFilterInputDropAllSrcPorts) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction. It tries to connect to the container's test port, but the DROP rule ensures the packet never arrives at the port.

func (*IptFilterInputDropAllSrcPorts) LocalSufficient 

func (*IptFilterInputDropAllSrcPorts) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropAllSrcPorts) Name 

func (*IptFilterInputDropAllSrcPorts) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropAllSrcPorts) Timeout 

func (*IptFilterInputDropAllSrcPorts) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropDifferentUDPPort 

type IptFilterInputDropDifferentUDPPort struct {
	// contains filtered or unexported fields
}

IptFilterInputDropDifferentUDPPort tests that dropping traffic for a single UDP port doesn't drop packets on other ports.

func (*IptFilterInputDropDifferentUDPPort) ContainerAction 

func (*IptFilterInputDropDifferentUDPPort) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropDifferentUDPPort) ContainerSufficient 

func (*IptFilterInputDropDifferentUDPPort) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropDifferentUDPPort) LocalAction 

func (*IptFilterInputDropDifferentUDPPort) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropDifferentUDPPort) LocalSufficient 

func (*IptFilterInputDropDifferentUDPPort) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropDifferentUDPPort) Name 

func (*IptFilterInputDropDifferentUDPPort) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropDifferentUDPPort) Timeout 

func (*IptFilterInputDropDifferentUDPPort) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropOnlyUDP 

type IptFilterInputDropOnlyUDP struct {
	// contains filtered or unexported fields
}

IptFilterInputDropOnlyUDP tests that "-p udp -j DROP" only affects UDP traffic.

func (*IptFilterInputDropOnlyUDP) ContainerAction 

func (*IptFilterInputDropOnlyUDP) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropOnlyUDP) ContainerSufficient 

func (*IptFilterInputDropOnlyUDP) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropOnlyUDP) LocalAction 

func (*IptFilterInputDropOnlyUDP) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropOnlyUDP) LocalSufficient 

func (*IptFilterInputDropOnlyUDP) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropOnlyUDP) Name 

func (*IptFilterInputDropOnlyUDP) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropOnlyUDP) Timeout 

func (*IptFilterInputDropOnlyUDP) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropTCPDestPort 

type IptFilterInputDropTCPDestPort struct {
	// contains filtered or unexported fields
}

IptFilterInputDropTCPDestPort tests that connections are not accepted on specified source ports.

func (*IptFilterInputDropTCPDestPort) ContainerAction 

func (*IptFilterInputDropTCPDestPort) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropTCPDestPort) ContainerSufficient 

func (*IptFilterInputDropTCPDestPort) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropTCPDestPort) LocalAction 

func (*IptFilterInputDropTCPDestPort) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropTCPDestPort) LocalSufficient 

func (*IptFilterInputDropTCPDestPort) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropTCPDestPort) Name 

func (*IptFilterInputDropTCPDestPort) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropTCPDestPort) Timeout 

func (*IptFilterInputDropTCPDestPort) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropTCPSrcPort 

type IptFilterInputDropTCPSrcPort struct {
	// contains filtered or unexported fields
}

IptFilterInputDropTCPSrcPort tests that connections are not accepted on specified source ports.

func (*IptFilterInputDropTCPSrcPort) ContainerAction 

func (*IptFilterInputDropTCPSrcPort) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropTCPSrcPort) ContainerSufficient 

func (*IptFilterInputDropTCPSrcPort) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropTCPSrcPort) LocalAction 

func (*IptFilterInputDropTCPSrcPort) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropTCPSrcPort) LocalSufficient 

func (*IptFilterInputDropTCPSrcPort) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropTCPSrcPort) Name 

func (*IptFilterInputDropTCPSrcPort) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropTCPSrcPort) Timeout 

func (*IptFilterInputDropTCPSrcPort) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropUDP 

type IptFilterInputDropUDP struct {
	// contains filtered or unexported fields
}

IptFilterInputDropUDP tests that we can drop UDP traffic.

func (*IptFilterInputDropUDP) ContainerAction 

func (*IptFilterInputDropUDP) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropUDP) ContainerSufficient 

func (*IptFilterInputDropUDP) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropUDP) LocalAction 

func (*IptFilterInputDropUDP) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropUDP) LocalSufficient 

func (*IptFilterInputDropUDP) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropUDP) Name 

func (*IptFilterInputDropUDP) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropUDP) Timeout 

func (*IptFilterInputDropUDP) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputDropUDPPort 

type IptFilterInputDropUDPPort struct {
	// contains filtered or unexported fields
}

IptFilterInputDropUDPPort tests that we can drop UDP traffic by port.

func (*IptFilterInputDropUDPPort) ContainerAction 

func (*IptFilterInputDropUDPPort) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputDropUDPPort) ContainerSufficient 

func (*IptFilterInputDropUDPPort) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputDropUDPPort) LocalAction 

func (*IptFilterInputDropUDPPort) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputDropUDPPort) LocalSufficient 

func (*IptFilterInputDropUDPPort) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputDropUDPPort) Name 

func (*IptFilterInputDropUDPPort) Name() string

Name implements TestCase.Name.

func (*IptFilterInputDropUDPPort) Timeout 

func (*IptFilterInputDropUDPPort) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInterface 

type IptFilterInputInterface struct {
	// contains filtered or unexported fields
}

IptFilterInputInterface tests that packets are not dropped from interface which is not matching the interface name in the iptables rule.

func (*IptFilterInputInterface) ContainerAction 

func (*IptFilterInputInterface) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInterface) ContainerSufficient 

func (*IptFilterInputInterface) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInterface) LocalAction 

func (*IptFilterInputInterface) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInterface) LocalSufficient 

func (*IptFilterInputInterface) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInterface) Name 

func (*IptFilterInputInterface) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInterface) Timeout 

func (*IptFilterInputInterface) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInterfaceAccept 

type IptFilterInputInterfaceAccept struct {
	// contains filtered or unexported fields
}

IptFilterInputInterfaceAccept tests that packets are accepted from interface matching the iptables rule.

func (*IptFilterInputInterfaceAccept) ContainerAction 

func (*IptFilterInputInterfaceAccept) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInterfaceAccept) ContainerSufficient 

func (*IptFilterInputInterfaceAccept) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInterfaceAccept) LocalAction 

func (*IptFilterInputInterfaceAccept) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInterfaceAccept) LocalSufficient 

func (*IptFilterInputInterfaceAccept) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInterfaceAccept) Name 

func (*IptFilterInputInterfaceAccept) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInterfaceAccept) Timeout 

func (*IptFilterInputInterfaceAccept) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInterfaceBeginsWith 

type IptFilterInputInterfaceBeginsWith struct {
	// contains filtered or unexported fields
}

IptFilterInputInterfaceBeginsWith tests that packets are dropped from an interface which begins with the given interface name.

func (*IptFilterInputInterfaceBeginsWith) ContainerAction 

func (*IptFilterInputInterfaceBeginsWith) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInterfaceBeginsWith) ContainerSufficient 

func (*IptFilterInputInterfaceBeginsWith) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInterfaceBeginsWith) LocalAction 

func (*IptFilterInputInterfaceBeginsWith) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInterfaceBeginsWith) LocalSufficient 

func (*IptFilterInputInterfaceBeginsWith) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInterfaceBeginsWith) Name 

func (*IptFilterInputInterfaceBeginsWith) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInterfaceBeginsWith) Timeout 

func (*IptFilterInputInterfaceBeginsWith) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInterfaceDrop 

type IptFilterInputInterfaceDrop struct {
	// contains filtered or unexported fields
}

IptFilterInputInterfaceDrop tests that packets are dropped from interface matching the iptables rule.

func (*IptFilterInputInterfaceDrop) ContainerAction 

func (*IptFilterInputInterfaceDrop) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInterfaceDrop) ContainerSufficient 

func (*IptFilterInputInterfaceDrop) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInterfaceDrop) LocalAction 

func (*IptFilterInputInterfaceDrop) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInterfaceDrop) LocalSufficient 

func (*IptFilterInputInterfaceDrop) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInterfaceDrop) Name 

func (*IptFilterInputInterfaceDrop) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInterfaceDrop) Timeout 

func (*IptFilterInputInterfaceDrop) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInterfaceInvertAccept 

type IptFilterInputInterfaceInvertAccept struct {
	// contains filtered or unexported fields
}

IptFilterInputInterfaceInvertAccept tests that we can selectively accept packets not matching the specific incoming interface.

func (*IptFilterInputInterfaceInvertAccept) ContainerAction 

func (*IptFilterInputInterfaceInvertAccept) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInterfaceInvertAccept) ContainerSufficient 

func (*IptFilterInputInterfaceInvertAccept) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInterfaceInvertAccept) LocalAction 

func (*IptFilterInputInterfaceInvertAccept) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInterfaceInvertAccept) LocalSufficient 

func (*IptFilterInputInterfaceInvertAccept) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInterfaceInvertAccept) Name 

func (*IptFilterInputInterfaceInvertAccept) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInterfaceInvertAccept) Timeout 

func (*IptFilterInputInterfaceInvertAccept) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInterfaceInvertDrop 

type IptFilterInputInterfaceInvertDrop struct {
	// contains filtered or unexported fields
}

IptFilterInputInterfaceInvertDrop tests that we selectively drop packets from interface not matching the interface name.

func (*IptFilterInputInterfaceInvertDrop) ContainerAction 

func (*IptFilterInputInterfaceInvertDrop) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInterfaceInvertDrop) ContainerSufficient 

func (*IptFilterInputInterfaceInvertDrop) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInterfaceInvertDrop) LocalAction 

func (*IptFilterInputInterfaceInvertDrop) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInterfaceInvertDrop) LocalSufficient 

func (*IptFilterInputInterfaceInvertDrop) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInterfaceInvertDrop) Name 

func (*IptFilterInputInterfaceInvertDrop) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInterfaceInvertDrop) Timeout 

func (*IptFilterInputInterfaceInvertDrop) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInvertDestination 

type IptFilterInputInvertDestination struct {
	// contains filtered or unexported fields
}

IptFilterInputInvertDestination verifies that we can filter packets via `! -d <ipaddr>`.

func (*IptFilterInputInvertDestination) ContainerAction 

func (*IptFilterInputInvertDestination) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInvertDestination) ContainerSufficient 

func (*IptFilterInputInvertDestination) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInvertDestination) LocalAction 

func (*IptFilterInputInvertDestination) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInvertDestination) LocalSufficient 

func (*IptFilterInputInvertDestination) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInvertDestination) Name 

func (*IptFilterInputInvertDestination) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInvertDestination) Timeout 

func (*IptFilterInputInvertDestination) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInvertDportAccept 

type IptFilterInputInvertDportAccept struct {
	// contains filtered or unexported fields
}

IptFilterInputInvertDportAccept tests that we can send packets on a negated --dport match

func (*IptFilterInputInvertDportAccept) ContainerAction 

func (*IptFilterInputInvertDportAccept) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInvertDportAccept) ContainerSufficient 

func (*IptFilterInputInvertDportAccept) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInvertDportAccept) LocalAction 

func (*IptFilterInputInvertDportAccept) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInvertDportAccept) LocalSufficient 

func (*IptFilterInputInvertDportAccept) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInvertDportAccept) Name 

func (*IptFilterInputInvertDportAccept) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInvertDportAccept) Timeout 

func (*IptFilterInputInvertDportAccept) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInvertDportDrop 

type IptFilterInputInvertDportDrop struct {
	// contains filtered or unexported fields
}

IptFilterInputInvertDportDrop tests that we can send packets on a negated --dport match

func (*IptFilterInputInvertDportDrop) ContainerAction 

func (*IptFilterInputInvertDportDrop) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInvertDportDrop) ContainerSufficient 

func (*IptFilterInputInvertDportDrop) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInvertDportDrop) LocalAction 

func (*IptFilterInputInvertDportDrop) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInvertDportDrop) LocalSufficient 

func (*IptFilterInputInvertDportDrop) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInvertDportDrop) Name 

func (*IptFilterInputInvertDportDrop) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInvertDportDrop) Timeout 

func (*IptFilterInputInvertDportDrop) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputInvertSource 

type IptFilterInputInvertSource struct {
	// contains filtered or unexported fields
}

IptFilterInputInvertSource verifies that we can filter packets via `! -s <ipaddr>`.

func (*IptFilterInputInvertSource) ContainerAction 

func (*IptFilterInputInvertSource) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputInvertSource) ContainerSufficient 

func (*IptFilterInputInvertSource) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputInvertSource) LocalAction 

func (*IptFilterInputInvertSource) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputInvertSource) LocalSufficient 

func (*IptFilterInputInvertSource) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputInvertSource) Name 

func (*IptFilterInputInvertSource) Name() string

Name implements TestCase.Name.

func (*IptFilterInputInvertSource) Timeout 

func (*IptFilterInputInvertSource) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputJumpBasic 

type IptFilterInputJumpBasic struct {
	// contains filtered or unexported fields
}

IptFilterInputJumpBasic jumps to a chain and executes a rule there.

func (*IptFilterInputJumpBasic) ContainerAction 

func (*IptFilterInputJumpBasic) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputJumpBasic) ContainerSufficient 

func (*IptFilterInputJumpBasic) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputJumpBasic) LocalAction 

func (*IptFilterInputJumpBasic) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputJumpBasic) LocalSufficient 

func (*IptFilterInputJumpBasic) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputJumpBasic) Name 

func (*IptFilterInputJumpBasic) Name() string

Name implements TestCase.Name.

func (*IptFilterInputJumpBasic) Timeout 

func (*IptFilterInputJumpBasic) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputJumpBuiltin 

type IptFilterInputJumpBuiltin struct {
	// contains filtered or unexported fields
}

IptFilterInputJumpBuiltin verifies that jumping to a top-levl chain is illegal.

func (*IptFilterInputJumpBuiltin) ContainerAction 

func (*IptFilterInputJumpBuiltin) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputJumpBuiltin) ContainerSufficient 

func (*IptFilterInputJumpBuiltin) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputJumpBuiltin) LocalAction 

func (*IptFilterInputJumpBuiltin) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputJumpBuiltin) LocalSufficient 

func (*IptFilterInputJumpBuiltin) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputJumpBuiltin) Name 

func (*IptFilterInputJumpBuiltin) Name() string

Name implements TestCase.Name.

func (*IptFilterInputJumpBuiltin) Timeout 

func (*IptFilterInputJumpBuiltin) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputJumpReturn 

type IptFilterInputJumpReturn struct {
	// contains filtered or unexported fields
}

IptFilterInputJumpReturn jumps, returns, and executes a rule.

func (*IptFilterInputJumpReturn) ContainerAction 

func (*IptFilterInputJumpReturn) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputJumpReturn) ContainerSufficient 

func (*IptFilterInputJumpReturn) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputJumpReturn) LocalAction 

func (*IptFilterInputJumpReturn) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputJumpReturn) LocalSufficient 

func (*IptFilterInputJumpReturn) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputJumpReturn) Name 

func (*IptFilterInputJumpReturn) Name() string

Name implements TestCase.Name.

func (*IptFilterInputJumpReturn) Timeout 

func (*IptFilterInputJumpReturn) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputJumpReturnDrop 

type IptFilterInputJumpReturnDrop struct {
	// contains filtered or unexported fields
}

IptFilterInputJumpReturnDrop jumps to a chain, returns, and DROPs packets.

func (*IptFilterInputJumpReturnDrop) ContainerAction 

func (*IptFilterInputJumpReturnDrop) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputJumpReturnDrop) ContainerSufficient 

func (*IptFilterInputJumpReturnDrop) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputJumpReturnDrop) LocalAction 

func (*IptFilterInputJumpReturnDrop) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputJumpReturnDrop) LocalSufficient 

func (*IptFilterInputJumpReturnDrop) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputJumpReturnDrop) Name 

func (*IptFilterInputJumpReturnDrop) Name() string

Name implements TestCase.Name.

func (*IptFilterInputJumpReturnDrop) Timeout 

func (*IptFilterInputJumpReturnDrop) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputJumpTwice 

type IptFilterInputJumpTwice struct {
	// contains filtered or unexported fields
}

IptFilterInputJumpTwice jumps twice, then returns twice and executes a rule.

func (*IptFilterInputJumpTwice) ContainerAction 

func (*IptFilterInputJumpTwice) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputJumpTwice) ContainerSufficient 

func (*IptFilterInputJumpTwice) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputJumpTwice) LocalAction 

func (*IptFilterInputJumpTwice) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputJumpTwice) LocalSufficient 

func (*IptFilterInputJumpTwice) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputJumpTwice) Name 

func (*IptFilterInputJumpTwice) Name() string

Name implements TestCase.Name.

func (*IptFilterInputJumpTwice) Timeout 

func (*IptFilterInputJumpTwice) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputReturnUnderflow 

type IptFilterInputReturnUnderflow struct {
	// contains filtered or unexported fields
}

IptFilterInputReturnUnderflow tests that -j RETURN in a built-in chain causes the underflow rule (i.e. default policy) to be executed.

func (*IptFilterInputReturnUnderflow) ContainerAction 

func (*IptFilterInputReturnUnderflow) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputReturnUnderflow) ContainerSufficient 

func (*IptFilterInputReturnUnderflow) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputReturnUnderflow) LocalAction 

func (*IptFilterInputReturnUnderflow) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputReturnUnderflow) LocalSufficient 

func (*IptFilterInputReturnUnderflow) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputReturnUnderflow) Name 

func (*IptFilterInputReturnUnderflow) Name() string

Name implements TestCase.Name.

func (*IptFilterInputReturnUnderflow) Timeout 

func (*IptFilterInputReturnUnderflow) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputSerializeJump 

type IptFilterInputSerializeJump struct {
	// contains filtered or unexported fields
}

IptFilterInputSerializeJump verifies that we can serialize jumps.

func (*IptFilterInputSerializeJump) ContainerAction 

func (*IptFilterInputSerializeJump) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputSerializeJump) ContainerSufficient 

func (*IptFilterInputSerializeJump) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputSerializeJump) LocalAction 

func (*IptFilterInputSerializeJump) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputSerializeJump) LocalSufficient 

func (*IptFilterInputSerializeJump) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputSerializeJump) Name 

func (*IptFilterInputSerializeJump) Name() string

Name implements TestCase.Name.

func (*IptFilterInputSerializeJump) Timeout 

func (*IptFilterInputSerializeJump) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type IptFilterInputSource 

type IptFilterInputSource struct {
	// contains filtered or unexported fields
}

IptFilterInputSource verifies that we can filter packets via `-s <ipaddr>`.

func (*IptFilterInputSource) ContainerAction 

func (*IptFilterInputSource) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction implements TestCase.ContainerAction.

func (*IptFilterInputSource) ContainerSufficient 

func (*IptFilterInputSource) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*IptFilterInputSource) LocalAction 

func (*IptFilterInputSource) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction implements TestCase.LocalAction.

func (*IptFilterInputSource) LocalSufficient 

func (*IptFilterInputSource) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*IptFilterInputSource) Name 

func (*IptFilterInputSource) Name() string

Name implements TestCase.Name.

func (*IptFilterInputSource) Timeout 

func (*IptFilterInputSource) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type JumpAndDropAll 

type JumpAndDropAll struct {
	// contains filtered or unexported fields
}

JumpAndDropAll is a test case that verifies that a jump to a chain with a drop rule works.

func (*JumpAndDropAll) ContainerAction 

func (*JumpAndDropAll) ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

ContainerAction are the commands that are ran in the container.

func (*JumpAndDropAll) ContainerSufficient 

func (*JumpAndDropAll) ContainerSufficient() bool

ContainerSufficient implements TestCase.ContainerSufficient.

func (*JumpAndDropAll) LocalAction 

func (*JumpAndDropAll) LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

LocalAction are the commands that are ran on the test runner.

func (*JumpAndDropAll) LocalSufficient 

func (*JumpAndDropAll) LocalSufficient() bool

LocalSufficient implements TestCase.LocalSufficient.

func (*JumpAndDropAll) Name 

func (*JumpAndDropAll) Name() string

Name returns the name of the test case.

func (*JumpAndDropAll) Timeout 

func (*JumpAndDropAll) Timeout() time.Duration

Timeout implements TestCase.Timeout.

type TestCase 

type TestCase interface {
	// Name returns the name of the test.
	Name() string

	// ContainerAction runs inside the container. It receives the IP of the
	// local process.
	ContainerAction(ctx context.Context, ip net.IP, ipv6 bool) error

	// LocalAction runs locally. It receives the IP of the container.
	LocalAction(ctx context.Context, ip net.IP, ipv6 bool) error

	// ContainerSufficient indicates whether ContainerAction's return value
	// alone indicates whether the test succeeded.
	ContainerSufficient() bool

	// LocalSufficient indicates whether LocalAction's return value alone
	// indicates whether the test succeeded.
	LocalSufficient() bool

	// Timeout indicates the time to wait for the test to finish.
	Timeout() time.Duration
}

A TestCase contains one action to run in the container and one to run locally. The actions run concurrently and each must succeed for the test pass.

Source Files

View all Source files

Directories

Path Synopsis
Package main runs nftables tests from within a docker container.
 Package main runs nftables tests from within a docker container.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.