@Test public void configures_minimal_container_acl_from_empty() { Acl acl = new Acl.Builder().withTrustedPorts().build(); NodeAgentContext context = contextGenerator.apply(acl); whenListRules(context, "filter", IPVersion.IPv4, EMPTY_FILTER_TABLE); whenListRules(context, "filter", IPVersion.IPv6, EMPTY_FILTER_TABLE); whenListRules(context, "nat", IPVersion.IPv4, EMPTY_NAT_TABLE); whenListRules(context, "nat", IPVersion.IPv6, EMPTY_NAT_TABLE); aclMaintainer.converge(context); verify(containerOperations, times(2)).executeCommandInNetworkNamespace(eq(context), any(), eq("-S"), eq("-t"), any()); verify(containerOperations, times(1)).executeCommandInNetworkNamespace(eq(context), eq("iptables-restore"), any()); verify(containerOperations, times(1)).executeCommandInNetworkNamespace(eq(context), eq("ip6tables-restore"), any()); verifyNoMoreInteractions(containerOperations); List<String> expected = List.of( "*filter\n" + "-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p icmp -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp-port-unreachable\n" + "COMMIT\n", "*filter\n" + "-P INPUT ACCEPT\n" + "-P FORWARD ACCEPT\n" + "-P OUTPUT ACCEPT\n" + "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" + "-A INPUT -i lo -j ACCEPT\n" + "-A INPUT -p ipv6-icmp -j ACCEPT\n" + "-A INPUT -j REJECT --reject-with icmp6-port-unreachable\n" + "COMMIT\n"); assertEquals(expected, writtenFileContents); }
public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } AclMaintainer(ContainerOperations containerOperations, IPAddresses ipAddresses); }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } AclMaintainer(ContainerOperations containerOperations, IPAddresses ipAddresses); synchronized void converge(NodeAgentContext context); }
AclMaintainer { public synchronized void converge(NodeAgentContext context) { if (context.isDisabled(NodeAgentTask.AclMaintainer)) return; editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4)); editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv4).ifPresent(addr -> applyRedirect(context, addr)); ipAddresses.getAddress(context.hostname().value(), IPVersion.IPv6).ifPresent(addr -> applyRedirect(context, addr)); } AclMaintainer(ContainerOperations containerOperations, IPAddresses ipAddresses); synchronized void converge(NodeAgentContext context);  }