search

coreos / go-iptables

Go wrapper around iptables utility
Apache License 2.0
1.11k stars 257 forks source link

iptables 1.8.4 (nf_tables) - Test Failures #101

Open chriswhite199 opened 1 year ago

chriswhite199 commented 1 year ago

Test failures observed for iptables 1.8.4 (nf_tables) on a 4.18 kernel. They appear to just be ordering of the jump and counter args. This appears to have originally been addressed in 5c15b20b (#51), but i'm assuming that a more recent version of iptables has amended this output.

# uname -a
Linux worker-2 4.18.0-425.10.1.el8_7.x86_64 #1 SMP Thu Jan 12 16:32:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

# iptables -V
iptables v1.8.4 (nf_tables)

# go test
--- FAIL: TestRules (0.08s)
    --- FAIL: TestRules/0 (0.02s)
        iptables_test.go:254: testing iptables (hasWait=true, hasCheck=true)
        iptables_test.go:353: ListWithCounters mismatch: 
            got  []string{"-N TEST-195596", "-A TEST-195596 -s 192.0.2.0/24 -d 203.0.113.1/32 -c 0 0 -j ACCEPT", "-A TEST-195596 -s 198.51.100.0/24 -d 203.0.113.2/32 -c 0 0 -j ACCEPT", "-A TEST-195596 -s 198.51.100.0/24 -d 203.0.113.1/32 -c 0 0 -j ACCEPT", "-A TEST-195596 -s 203.0.113.1/32 -d 198.51.100.0/24 -c 0 0 -j ACCEPT"} 
            need []string{"-N TEST-195596", "-A TEST-195596 -s 192.0.2.0/24 -d 203.0.113.1/32 -j ACCEPT -c 0 0", "-A TEST-195596 -s 198.51.100.0/24 -d 203.0.113.2/32 -j ACCEPT -c 0 0", "-A TEST-195596 -s 198.51.100.0/24 -d 203.0.113.1/32 -j ACCEPT -c 0 0", "-A TEST-195596 -s 203.0.113.1/32 -d 198.51.100.0/24 -j ACCEPT -c 0 0"}
    --- FAIL: TestRules/1 (0.02s)
        iptables_test.go:254: testing ip6tables (hasWait=true, hasCheck=true)
        iptables_test.go:353: ListWithCounters mismatch: 
            got  []string{"-N TEST-462060", "-A TEST-462060 -s 2001:db8:a::/48 -d 2001:db8::1/128 -c 0 0 -j ACCEPT", "-A TEST-462060 -s 2001:db8:b::/48 -d 2001:db8::2/128 -c 0 0 -j ACCEPT", "-A TEST-462060 -s 2001:db8:b::/48 -d 2001:db8::1/128 -c 0 0 -j ACCEPT", "-A TEST-462060 -s 2001:db8::1/128 -d 2001:db8:b::/48 -c 0 0 -j ACCEPT"} 
            need []string{"-N TEST-462060", "-A TEST-462060 -s 2001:db8:a::/48 -d 2001:db8::1/128 -j ACCEPT -c 0 0", "-A TEST-462060 -s 2001:db8:b::/48 -d 2001:db8::2/128 -j ACCEPT -c 0 0", "-A TEST-462060 -s 2001:db8:b::/48 -d 2001:db8::1/128 -j ACCEPT -c 0 0", "-A TEST-462060 -s 2001:db8::1/128 -d 2001:db8:b::/48 -j ACCEPT -c 0 0"}
    --- FAIL: TestRules/2 (0.02s)
        iptables_test.go:254: testing iptables (hasWait=true, hasCheck=false)
        iptables_test.go:353: ListWithCounters mismatch: 
            got  []string{"-N TEST-331035", "-A TEST-331035 -s 192.0.2.0/24 -d 203.0.113.1/32 -c 0 0 -j ACCEPT", "-A TEST-331035 -s 198.51.100.0/24 -d 203.0.113.2/32 -c 0 0 -j ACCEPT", "-A TEST-331035 -s 198.51.100.0/24 -d 203.0.113.1/32 -c 0 0 -j ACCEPT", "-A TEST-331035 -s 203.0.113.1/32 -d 198.51.100.0/24 -c 0 0 -j ACCEPT"} 
            need []string{"-N TEST-331035", "-A TEST-331035 -s 192.0.2.0/24 -d 203.0.113.1/32 -j ACCEPT -c 0 0", "-A TEST-331035 -s 198.51.100.0/24 -d 203.0.113.2/32 -j ACCEPT -c 0 0", "-A TEST-331035 -s 198.51.100.0/24 -d 203.0.113.1/32 -j ACCEPT -c 0 0", "-A TEST-331035 -s 203.0.113.1/32 -d 198.51.100.0/24 -j ACCEPT -c 0 0"}
    --- FAIL: TestRules/3 (0.02s)
        iptables_test.go:254: testing ip6tables (hasWait=true, hasCheck=false)
        iptables_test.go:353: ListWithCounters mismatch: 
            got  []string{"-N TEST-814892", "-A TEST-814892 -s 2001:db8:a::/48 -d 2001:db8::1/128 -c 0 0 -j ACCEPT", "-A TEST-814892 -s 2001:db8:b::/48 -d 2001:db8::2/128 -c 0 0 -j ACCEPT", "-A TEST-814892 -s 2001:db8:b::/48 -d 2001:db8::1/128 -c 0 0 -j ACCEPT", "-A TEST-814892 -s 2001:db8::1/128 -d 2001:db8:b::/48 -c 0 0 -j ACCEPT"} 
            need []string{"-N TEST-814892", "-A TEST-814892 -s 2001:db8:a::/48 -d 2001:db8::1/128 -j ACCEPT -c 0 0", "-A TEST-814892 -s 2001:db8:b::/48 -d 2001:db8::2/128 -j ACCEPT -c 0 0", "-A TEST-814892 -s 2001:db8:b::/48 -d 2001:db8::1/128 -j ACCEPT -c 0 0", "-A TEST-814892 -s 2001:db8::1/128 -d 2001:db8:b::/48 -j ACCEPT -c 0 0"}
-A PREROUTING -i lo -p tcp -m tcp --dport 3000 -j DNAT --to-destination 127.0.0.1:3000
-A PREROUTING -i lo -p tcp -m tcp --dport 3000 -j DNAT --to-destination 127.0.0.1:3001
-A PREROUTING -i lo -p tcp -m tcp --dport 3000 -j DNAT --to-destination 127.0.0.1:3002
FAIL

# iptables -v -S TEST-346908
-N TEST-346908
-A TEST-346908 -s 192.0.2.0/24 -d 203.0.113.1/32 -c 0 0 -j ACCEPT
-A TEST-346908 -s 198.51.100.0/24 -d 203.0.113.2/32 -c 0 0 -j ACCEPT
-A TEST-346908 -s 198.51.100.0/24 -d 203.0.113.1/32 -c 0 0 -j ACCEPT
-A TEST-346908 -s 203.0.113.1/32 -d 198.51.100.0/24 -c 0 0 -j ACCEPT