reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adds a CANARY chain and Monitor loop instead of reapplying iptables

Browse Source
This commit is contained in:
Simon Howe committed 2020-07-15 11:37:16 +02:00
1 parent 94e75e45af
commit 66eb80d841
5 files changed
+135 -47
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/130_expose_2_test.sh
+1 -20
View File
@@ -27,10 +27,6 @@ exec_on1() {
assert_raises "exec_on $HOST1 $@"
}
wait_for_iptable_refresh() {
sleep 2
}
# Containers in the same subnet should be able to talk; different subnet not.
check_container_connectivity() {
exec_on1 "c1 $PING $C2"
@@ -43,7 +39,7 @@ check_container_connectivity() {
start_suite "exposing weave network to host"
weave_on $HOST1 launch --ipalloc-range $UNIVERSE --iptables-refresh-interval=1s
weave_on $HOST1 launch --ipalloc-range $UNIVERSE
start_container $HOST1 $C1/24 --name=c1
start_container $HOST1 $C2/24 --name=c2
@@ -65,20 +61,11 @@ weave_on1 "expose $EXP/24"
run_on1 "! $PING $C1"
run_on1 " $PING $C3"
run_on1 "! $PING $C5"
wait_for_iptable_refresh
run_on1 "! $PING $C1"
run_on1 " $PING $C3"
run_on1 "! $PING $C5"
weave_on1 "expose"
weave_on1 "expose"
run_on1 "! $PING $C1"
run_on1 " $PING $C3"
run_on1 " $PING $C5"
wait_for_iptable_refresh
run_on1 "! $PING $C1"
run_on1 " $PING $C3"
run_on1 " $PING $C5"
check_container_connectivity
# no host connectivity after 'hide', and idempotence of 'hide'
@@ -86,15 +73,9 @@ weave_on1 "hide $EXP/24"
weave_on1 "hide $EXP/24"
run_on1 "! $PING $C3"
run_on1 " $PING $C5"
wait_for_iptable_refresh
run_on1 "! $PING $C3"
run_on1 " $PING $C5"
weave_on1 "hide"
weave_on1 "hide"
run_on1 "! $PING $C5"
wait_for_iptable_refresh
run_on1 "! $PING $C5"
# remote host connectivity after 'expose'
docker_on $HOST1 exec -d c3 nc -l -p $PORT
test/135_expose_iptables_refresh.sh
+4 -4
View File
@@ -29,7 +29,7 @@ start_suite "exposing weave network to host"
## Check no refreshing
weave_on1 "launch --iptables-refresh-interval=0s"
IPT_BEFORE=$(get_weave_iptable_rules)
run_on1 "sudo iptables -t nat -D POSTROUTING -j WEAVE"
run_on1 "sudo iptables -t nat -X WEAVE-CANARY"
wait_for_iptable_refresh
IPT_AFTER=$(get_weave_iptable_rules)
assert_raises "diff <(echo $IPT_BEFORE) <(echo $IPT_AFTER)" 1
@@ -38,7 +38,7 @@ stop_weave_on1
## Check refreshing
weave_on1 "launch --iptables-refresh-interval=1s"
IPT_BEFORE=$(get_weave_iptable_rules)
run_on1 "sudo iptables -t nat -D POSTROUTING -j WEAVE"
run_on1 "sudo iptables -t nat -X WEAVE-CANARY"
wait_for_iptable_refresh
IPT_AFTER=$(get_weave_iptable_rules)
assert_raises "diff <(echo $IPT_BEFORE) <(echo $IPT_AFTER)" 0
@@ -50,7 +50,7 @@ stop_weave_on1
weave_on1 "launch --iptables-refresh-interval=0s"
weave_on1 "expose"
IPT_BEFORE=$(get_weave_iptable_rules)
run_on1 "sudo iptables -D FORWARD -o weave -j WEAVE-EXPOSE"
run_on1 "sudo iptables -t nat -X WEAVE-CANARY"
wait_for_iptable_refresh
IPT_AFTER=$(get_weave_iptable_rules)
assert_raises "diff <(echo $IPT_BEFORE) <(echo $IPT_AFTER)" 1
@@ -60,7 +60,7 @@ stop_weave_on1
weave_on1 "launch --iptables-refresh-interval=1s"
weave_on1 "expose"
IPT_BEFORE=$(get_weave_iptable_rules)
run_on1 "sudo iptables -D FORWARD -o weave -j WEAVE-EXPOSE"
run_on1 "sudo iptables -t nat -X WEAVE-CANARY"
wait_for_iptable_refresh
IPT_AFTER=$(get_weave_iptable_rules)
assert_raises "diff <(echo $IPT_BEFORE) <(echo $IPT_AFTER)" 0