@Test public void rollback_is_attempted_when_applying_acl_fail() { Acl acl = new Acl.Builder().withTrustedPorts(22, 4443).withTrustedNode("hostname1", "3001::abcd").build(); NodeAgentContext context = contextGenerator.apply(acl); ipAddresses.addAddress(context.hostname().value(), "2001::1"); whenListRules(context, "filter", IPVersion.IPv4, EMPTY_FILTER_TABLE); whenListRules(context, "filter", IPVersion.IPv6, "-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p ipv6-icmp -j ACCEPT\n" + "-A INPUT -p tcp -m multiport --dports 22,4443 -j ACCEPT\n" + "-A INPUT -s 3001::abcd/128 -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp6-port-unreachable\n"); whenListRules(context, "nat", IPVersion.IPv6, "-P PREROUTING ACCEPT\n" + "-P INPUT ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-P POSTROUTING ACCEPT\n" + "-A OUTPUT -d 2001::1/128 -j REDIRECT\n"); when(containerOperations.executeCommandInNetworkNamespace(eq(context), eq("iptables-restore"), any())) .thenThrow(new RuntimeException("iptables restore failed")); aclMaintainer.converge(context); verify(containerOperations, times(3)).executeCommandInNetworkNamespace(eq(context), any(), eq("-S"), eq("-t"), any()); verify(containerOperations, times(1)).executeCommandInNetworkNamespace(eq(context), eq("iptables-restore"), any()); verify(containerOperations, times(1)).executeCommandInNetworkNamespace(eq(context), eq("iptables"), eq("-F"), eq("-t"), eq("filter")); verifyNoMoreInteractions(containerOperations); aclMaintainer.converge(context); }
public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } AclMaintainer(ContainerOperations containerOperations, IPAddresses ipAddresses); }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } AclMaintainer(ContainerOperations containerOperations, IPAddresses ipAddresses); synchronized void converge(NodeAgentContext context); }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } AclMaintainer(ContainerOperations containerOperations, IPAddresses ipAddresses); synchronized void converge(NodeAgentContext context);  }