GRMrGecko/go-firewall
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
go-firewall/iptables_linux_test.go
James Coleman 0c7ce9e334 first commit
2026-08-10 17:17:03 -05:00

1534 lines
71 KiB
Go
Raw Blame History

package firewall
import (
"context"
"fmt"
"net"
"os"
"path/filepath"
"strings"
"testing"
"github.com/stretchr/testify/require"
"github.com/vishvananda/netlink"
)
func TestIPTablesRules(t *testing.T) {
fw := new(IPTables)
// Parse a rule that is expected to parse right.
rule, err := fw.UnmarshalRule(`-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 23 -j ACCEPT`, IPv4)
require.NoError(t, err)
// Re-encode the rule which should result in expected rich rule.
richRule, err := fw.MarshalRule(rule)
require.NoError(t, err)
require.Equal(t, `-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 23 -j ACCEPT`, richRule,
"the rich rule did not encode as expected")
// Try encoding a bunch of invalid rules.
invalidRules := []string{
`-A TEST -s 192.168.0.0/24 -j DROP`,
`-s 192.168.0.0/24 -p udp -m udp --dport 23 -j ACCEPT`,
`-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 23`,
`-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 23 -j MARK`,
`-A INPUT -s 192.168.0.0/24 -p tcp -m udp --dport 23 -j DROP`,
}
for _, richRule := range invalidRules {
_, err := fw.UnmarshalRule(richRule, IPv4)
require.Error(t, err, "this rich rule was parsed when it should be invalid: %s", richRule)
}
// Test rules we typically set.
validRules := []string{
`-A INPUT -p udp -m udp --dport 4789 -j ACCEPT`,
`-A OUTPUT -p udp -m udp --dport 4789 -j ACCEPT`,
`-A INPUT -s 203.0.113.10 -p tcp -m tcp --dport 4789 -j ACCEPT`,
`-A OUTPUT -d 203.0.113.10 -p tcp -m tcp --dport 4791 -j ACCEPT`,
}
for _, richRule := range validRules {
_, err := fw.UnmarshalRule(richRule, IPv4)
require.NoError(t, err, "this rich rule was not parsed when it should be valid: %s", richRule)
}
// A port without a concrete protocol cannot be expressed in iptables
// (`-m tcp/udp --dport` is invalid without `-p tcp/udp`), so validateRule
// must reject it before the encoder emits an invalid rule.
require.Error(t, fw.validateRule(&Rule{Port: 80, Proto: ProtocolAny, Action: Accept}),
"expected a port with no protocol to be rejected")
}
func TestIPTablesFeatureRules(t *testing.T) {
fw := new(IPTables)
// Confirm representative encodings.
cases := []struct {
rule *Rule
want string
}{
{&Rule{Proto: ICMP, Action: Reject}, "-A INPUT -p icmp -j REJECT"},
{&Rule{Proto: ICMPv6, Action: Accept}, "-A INPUT -p icmpv6 -j ACCEPT"},
{&Rule{Proto: ICMP, ICMPType: Ptr[uint8](8), Action: Accept}, "-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT"},
{&Rule{Family: IPv6, Proto: ICMPv6, ICMPType: Ptr[uint8](128), Action: Accept}, "-A INPUT -p icmpv6 -m icmp6 --icmpv6-type 128 -j ACCEPT"},
{&Rule{Proto: TCP, Ports: []PortRange{{Start: 80}, {Start: 443}}, Action: Accept}, "-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT"},
{&Rule{Proto: UDP, Ports: []PortRange{{Start: 1000, End: 2000}}, Action: Accept}, "-A INPUT -p udp -m multiport --dports 1000:2000 -j ACCEPT"},
{&Rule{Proto: TCP, Port: 22, State: StateNew | StateEstablished, Action: Accept}, "-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT"},
{&Rule{InInterface: "eth0", Proto: TCP, Port: 22, Action: Accept}, "-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT"},
{&Rule{Direction: DirOutput, OutInterface: "eth1", Action: Drop}, "-A OUTPUT -o eth1 -j DROP"},
}
for _, c := range cases {
got, err := fw.MarshalRule(c.rule)
require.NoError(t, err, "failed to marshal %+v", *c.rule)
require.Equal(t, c.want, got, "marshal %+v", *c.rule)
}
// Round-trip every new-feature rule shape.
rules := []*Rule{
{Proto: TCP, Ports: []PortRange{{Start: 80}, {Start: 443}, {Start: 8000, End: 8100}}, Action: Accept},
{Proto: UDP, Ports: []PortRange{{Start: 1000, End: 2000}}, Action: Accept},
{Proto: TCP, Port: 22, State: StateEstablished | StateRelated, Action: Accept},
{Source: "10.0.0.0/8", Proto: TCP, Port: 22, State: StateNew, Action: Accept},
{InInterface: "eth0", Proto: TCP, Port: 22, Action: Accept},
{Direction: DirOutput, OutInterface: "eth1", Proto: UDP, Port: 53, Action: Accept},
{Proto: ICMP, Action: Accept},
{Proto: ICMPv6, Action: Accept},
{Proto: ICMP, ICMPType: Ptr[uint8](8), Action: Accept},
{Family: IPv6, Proto: ICMPv6, ICMPType: Ptr[uint8](135), Action: Accept},
}
for _, r := range rules {
spec, err := fw.MarshalRule(r)
require.NoError(t, err, "failed to marshal %+v", *r)
parsed, err := fw.UnmarshalRule(spec, r.Family)
require.NoError(t, err, "failed to parse %q", spec)
require.True(t, parsed.Equal(r, true),
"round-trip mismatch: input %+v, spec %q, output %+v", *r, spec, parsed)
}
// Bare `--icmp-type <name>` and `--dport`/`--sport` (without an explicit `-m`),
// as used in ufw's iptables rules files, must parse.
icmpRule, err := fw.UnmarshalRule("-A INPUT -p icmp --icmp-type echo-request -j ACCEPT", IPv4)
require.NoError(t, err)
require.Equal(t, ICMP, icmpRule.Proto, "unexpected bare icmp-type parse: %+v", *icmpRule)
require.NotNil(t, icmpRule.ICMPType, "unexpected bare icmp-type parse: %+v", *icmpRule)
require.EqualValues(t, 8, *icmpRule.ICMPType, "unexpected bare icmp-type parse: %+v", *icmpRule)
dportRule, err := fw.UnmarshalRule("-A INPUT -p udp --dport 5353 -j ACCEPT", IPv4)
require.NoError(t, err)
require.Equal(t, UDP, dportRule.Proto, "unexpected bare dport parse: %+v", *dportRule)
require.EqualValues(t, 5353, dportRule.Port, "unexpected bare dport parse: %+v", *dportRule)
sportRule, err := fw.UnmarshalRule("-A INPUT -p tcp --sport 1234 -j ACCEPT", IPv4)
require.NoError(t, err)
require.Equal(t, TCP, sportRule.Proto, "unexpected bare sport parse: %+v", *sportRule)
require.EqualValues(t, 1234, sportRule.SourcePort, "unexpected bare sport parse: %+v", *sportRule)
// The legacy `-m state --state` match must also parse.
r, err := fw.UnmarshalRule("-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT", IPv4)
require.NoError(t, err)
require.Equal(t, StateNew|StateEstablished, r.State, "unexpected state parse")
}
// An iptables-save line may carry a leading [pkts:bytes] counter prefix; the
// parser must capture it onto the rule and keep parsing the rest of the line.
func TestIPTablesCounterPrefix(t *testing.T) {
fw := new(IPTables)
r, err := fw.UnmarshalRule("[42:3360] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT", IPv4)
require.NoError(t, err)
require.Equal(t, uint64(42), r.Packets, "packet counter not captured")
require.Equal(t, uint64(3360), r.Bytes, "byte counter not captured")
require.True(t, r.EqualBase(&Rule{Family: IPv4, Proto: TCP, Port: 22, Action: Accept}, true),
"counters must not be part of rule identity: %+v", r)
// A line without a counter prefix still parses, with zero counters.
r2, err := fw.UnmarshalRule("-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT", IPv4)
require.NoError(t, err)
require.Zero(t, r2.Packets)
require.Zero(t, r2.Bytes)
}
// A nat rule in the OUTPUT chain (locally-generated DNAT) cannot be represented
// distinctly by the NATRule model, so it must be treated as foreign: skipped on
// read (never surfaced as a PREROUTING DNAT) and preserved verbatim by
// rewriteNATRules (never relocated to PREROUTING or dropped on Restore).
func TestIPTablesNATOutputChainPreserved(t *testing.T) {
// UnmarshalNATRule rejects an OUTPUT-chain rule so natRulesInFile skips it.
f := new(IPTables)
_, err := f.UnmarshalNATRule("-A OUTPUT -p tcp -m tcp --dport 81 -j DNAT --to-destination 10.0.0.6", IPv4)
require.Error(t, err, "an OUTPUT-chain nat rule must not be surfaced as a managed NAT rule")
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
save := "*nat\n" +
":PREROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n" +
"-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.5\n" +
"-A OUTPUT -p tcp -m tcp --dport 81 -j DNAT --to-destination 10.0.0.6\n" +
"COMMIT\n"
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: filepath.Join(dir, "ip6tables")}
// GetNATRules-side read surfaces only the PREROUTING rule; the OUTPUT rule is skipped.
got, err := fw.natRulesInFile(p4)
require.NoError(t, err)
require.Len(t, got, 1, "only the PREROUTING nat rule should be surfaced, not the OUTPUT one")
require.EqualValues(t, 80, got[0].Port)
// Restore-side rewrite replaces the managed (PREROUTING) rules but preserves the
// foreign OUTPUT rule verbatim.
require.NoError(t, fw.rewriteNATRules(p4, []string{"-A PREROUTING -p tcp -m tcp --dport 90 -j DNAT --to-destination 10.0.0.9"}))
data, err := os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(data), "-A OUTPUT -p tcp -m tcp --dport 81 -j DNAT --to-destination 10.0.0.6",
"the OUTPUT nat rule must be preserved verbatim, not relocated or dropped")
require.Contains(t, string(data), "--dport 90", "the rewritten PREROUTING rule must be present")
require.NotContains(t, string(data), "--dport 80", "the old managed PREROUTING rule must be replaced")
}
// TestIPTablesAddRulePreservesUnmodeledRule verifies an additive AddRule keeps a
// pre-existing INPUT/OUTPUT rule the parser cannot model (here an -m recent
// rate-limit rule). GetRules cannot represent such a rule, so a rewrite that
// dropped it would silently delete a foreign rule the read-modify-write add must
// keep.
func TestIPTablesAddRulePreservesUnmodeledRule(t *testing.T) {
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
recent := "-A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 -j DROP"
orphanLog := "-A INPUT -p udp -m udp --dport 53 -j LOG --log-prefix \"dns: \""
save := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n" +
recent + "\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
orphanLog + "\n" +
"-A FORWARD -p tcp -m tcp --dport 8080 -j ACCEPT\n" +
"COMMIT\n"
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte("*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
// The -m recent rule and the orphan LOG are not modeled, so GetRules cannot see
// them; only the two modeled rules surface: the INPUT dport 80 and the FORWARD
// dport 8080, the forward chain being modeled too.
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
require.Len(t, rules, 2, "only the two modeled rules should surface")
// Additively add a new rule.
require.NoError(t, fw.AddRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 443, Action: Accept}))
data, err := os.ReadFile(p4)
require.NoError(t, err)
got := string(data)
require.Contains(t, got, recent, "the foreign -m recent rule must be preserved by an additive add")
require.Contains(t, got, orphanLog, "the standalone LOG rule must be preserved")
require.Contains(t, got, "-A FORWARD -p tcp -m tcp --dport 8080 -j ACCEPT", "the FORWARD rule must be preserved")
require.Contains(t, got, "--dport 443", "the newly added rule must be present")
require.Contains(t, got, "--dport 80", "the pre-existing modeled rule must be preserved")
}
// A comment containing a backslash, an embedded double-quote or a non-ASCII
// rune must round-trip byte-for-byte: strconv.Quote (the previous encoding)
// renders these as Go string-literal escapes that shlex.Split — the parser
// GetRules reads such a line back with — does not interpret, so the comment
// came back mangled (e.g. a literal tab as a two-character "\t") and never
// compared equal to the desired rule, so Sync churned on it forever.
func TestIPTablesCommentSpecialCharsRoundTrip(t *testing.T) {
dir := t.TempDir()
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(scaffold), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
cases := []struct {
port uint16
comment string
}{
{22, `back\slash`},
{23, `quote"inside`},
{24, "tab\ttab"},
{25, "unicode ключ"},
}
for _, c := range cases {
require.NoError(t, fw.AddRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: c.port, Action: Accept, Comment: c.comment}))
}
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
byPort := map[uint16]*Rule{}
for _, r := range rules {
byPort[r.Port] = r
}
for _, c := range cases {
require.Equal(t, c.comment, byPort[c.port].Comment, "comment %q must round-trip unchanged", c.comment)
}
// A literal newline cannot be expressed (it would split the rules file's
// one-line-per-rule format), so it is rejected rather than silently mangled.
err = fw.AddRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 26, Action: Accept, Comment: "line1\nline2"})
require.Error(t, err, "a comment containing a newline must be rejected")
}
// A user comment that itself begins with the configured prefix must survive the
// round-trip intact: GetRules strips the prefix exactly once, so a comment of
// "myapp is great" (stored as "myapp myapp is great") must read back whole and
// not be truncated to "is great".
func TestIPTablesCommentBeginningWithPrefix(t *testing.T) {
dir := t.TempDir()
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(scaffold), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6, rulePrefix: "myapp"}
ctx := context.Background()
require.NoError(t, fw.AddRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 8080, Action: Accept, Comment: "myapp is great"}))
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
require.Len(t, rules, 1)
require.Equal(t, "myapp is great", rules[0].Comment, "prefix must be stripped exactly once")
require.True(t, rules[0].HasPrefix)
}
// A single contiguous port range on a `-m tcp/udp/sctp --dport` — the form
// iptables-save emits and ufw's before.rules use — must parse. The module-match
// handlers must accept the range form, so GetRules reports the rule rather than
// dropping it (and re-adding a duplicate every reconcile).
func TestIPTablesModulePortRangeParse(t *testing.T) {
cases := []struct {
spec string
src bool
}{
{`-A INPUT -p tcp -m tcp --dport 1000:2000 -j ACCEPT`, false},
{`-A INPUT -p tcp -m tcp --sport 1000:2000 -j ACCEPT`, true},
{`-A INPUT -p udp -m udp --dport 1000:2000 -j ACCEPT`, false},
{`-A INPUT -p sctp -m sctp --dport 1000:2000 -j ACCEPT`, false},
}
for _, c := range cases {
r, err := unmarshalIPTablesRule(c.spec, IPv4)
require.NoError(t, err, "range on module match must parse: %s", c.spec)
specs := r.PortSpecs()
if c.src {
specs = r.SourcePortSpecs()
}
require.Equal(t, []PortRange{{Start: 1000, End: 2000}}, specs, "range not captured: %s", c.spec)
}
}
// iptables applies and prints a default --limit-burst 5 on every -m limit match.
// A rule added with Burst 0 must still compare equal to the one iptables-save
// lists back with burst 5 (mirrors the nft burst-5 normalization).
func TestIPTablesRateBurstDefaultNormalized(t *testing.T) {
orig := &Rule{Family: IPv4, Proto: TCP, Port: 22, Action: Accept, RateLimit: &RateLimit{Rate: 10, Unit: PerMinute}}
saved := `-A INPUT -p tcp -m tcp --dport 22 -m limit --limit 10/min --limit-burst 5 -j ACCEPT`
got, err := unmarshalIPTablesRule(saved, IPv4)
require.NoError(t, err)
require.NotNil(t, got.RateLimit)
require.Equal(t, uint(0), got.RateLimit.Burst, "iptables' default burst of 5 must normalize to the unset 0")
require.True(t, got.EqualBase(orig, true), "a burst-5 read-back must equal the burst-0 original")
}
// A DNAT rule on SCTP (which carries ports) must round-trip: the `-m sctp
// --dport` match iptables emits must parse back.
func TestIPTablesSCTPNATRoundTrip(t *testing.T) {
f := &IPTables{rulePrefix: "myapp"}
orig := &NATRule{Kind: DNAT, Family: IPv4, Proto: SCTP, Port: 132, ToAddress: "10.0.0.5", ToPort: 132}
spec, err := f.MarshalNATRule(orig)
require.NoError(t, err)
got, err := f.UnmarshalNATRule(spec, IPv4)
require.NoError(t, err)
require.True(t, orig.EqualBase(got), "sctp nat rule must round-trip; got %+v", got)
}
// iptables labels an ICMPv6 type with an ICMPv6 name, several of which mean a
// different number under ICMPv4 (echo-request is 128 vs 8, destination-unreachable
// is 1 vs 3). The `--icmpv6-type`/`-m icmp6` flags must resolve names through the
// ICMPv6 table, not the ICMPv4 one. Library-written rules emit the number, so the
// round-trip tests never exercised the name path — but ufw's before6.rules do.
func TestIPTablesICMPv6TypeNameParse(t *testing.T) {
// -m icmp6 module form.
r, err := unmarshalIPTablesRule("-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT", IPv6)
require.NoError(t, err)
require.NotNil(t, r.ICMPType)
require.Equal(t, uint8(128), *r.ICMPType, "icmpv6 echo-request is type 128")
// Bare --icmpv6-type form (no -m icmp6).
r2, err := unmarshalIPTablesRule("-A INPUT -p ipv6-icmp --icmpv6-type destination-unreachable -j ACCEPT", IPv6)
require.NoError(t, err)
require.NotNil(t, r2.ICMPType)
require.Equal(t, uint8(1), *r2.ICMPType, "icmpv6 destination-unreachable is type 1")
// The ICMPv4 name path must be unchanged.
r3, err := unmarshalIPTablesRule("-A INPUT -p icmp --icmp-type echo-request -j ACCEPT", IPv4)
require.NoError(t, err)
require.NotNil(t, r3.ICMPType)
require.Equal(t, uint8(8), *r3.ICMPType, "icmp echo-request is type 8")
}
// GetDefaultPolicy reads both family save files: it returns the shared policy
// when they agree and errors when they diverge, rather than silently reporting
// only the IPv4 policy.
func TestIPTablesGetDefaultPolicyBothFamilies(t *testing.T) {
dir := t.TempDir()
write := func(name, in string) string {
p := filepath.Join(dir, name)
body := "*filter\n:INPUT " + in + " [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"
require.NoError(t, os.WriteFile(p, []byte(body), 0644))
return p
}
ctx := context.Background()
// Agreement: both files DROP input -> policy reports DROP.
f := &IPTables{IP4Path: write("iptables", "DROP"), IP6Path: write("ip6tables", "DROP")}
pol, err := f.GetDefaultPolicy(ctx, "")
require.NoError(t, err)
require.Equal(t, Drop, pol.Input)
// Divergence: v4 ACCEPT, v6 DROP -> error, because there is no single policy.
f = &IPTables{IP4Path: write("iptables2", "ACCEPT"), IP6Path: write("ip6tables2", "DROP")}
_, err = f.GetDefaultPolicy(ctx, "")
require.Error(t, err, "a v4/v6 policy mismatch must be surfaced, not hidden")
}
// iptables Backup captures only the INPUT/OUTPUT filter rules and the nat rules,
// so Restore must splice those back into the existing save file and leave
// everything it did not capture untouched: chain default policies, the FORWARD
// chain, user-defined chains, and the *mangle/*raw tables. The old scaffold-based
// Restore silently reset a DROP policy to ACCEPT and deleted all of that.
func TestIPTablesRestorePreservesUnmanaged(t *testing.T) {
dir := t.TempDir()
// A realistic save file: hardened DROP policies, a FORWARD rule, a *mangle
// table, and a *nat table with a managed DNAT plus a foreign DOCKER chain.
save := "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n" +
"-A PREROUTING -j MARK --set-mark 1\nCOMMIT\n" +
"*nat\n:PREROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:DOCKER - [0:0]\n" +
"-A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.5:8080\n-A DOCKER -j RETURN\nCOMMIT\n" +
"*filter\n:INPUT DROP [0:0]\n:OUTPUT DROP [0:0]\n:FORWARD DROP [0:0]\n" +
"-A INPUT -p tcp --dport 22 -j ACCEPT\n-A FORWARD -s 10.0.0.0/8 -j ACCEPT\nCOMMIT\n"
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
// A staging path keeps Backup's address-set read on the file rather than the
// live kernel, which an unprivileged test cannot query.
f := &IPTables{IP4Path: p4, IP6Path: p6, IPSetPath: filepath.Join(dir, "ipsets")}
ctx := context.Background()
backup, err := f.Backup(ctx, "")
require.NoError(t, err)
require.NoError(t, f.Restore(ctx, "", backup))
out, err := os.ReadFile(p4)
require.NoError(t, err)
got := string(out)
// Policies and unmanaged content Backup never captured must survive.
require.Contains(t, got, ":INPUT DROP", "the INPUT DROP policy must not flip to ACCEPT")
require.Contains(t, got, ":FORWARD DROP", "the FORWARD DROP policy must survive")
require.Contains(t, got, "-A FORWARD -s 10.0.0.0/8 -j ACCEPT", "the FORWARD rule must survive")
require.Contains(t, got, "*mangle", "the mangle table must survive")
require.Contains(t, got, "MARK --set-mark 1", "the mangle rule must survive")
require.Contains(t, got, ":DOCKER", "the foreign nat chain must survive")
require.Contains(t, got, "-A DOCKER -j RETURN", "the foreign nat chain's rule must survive")
// The managed rules Backup captured must be re-applied.
require.Contains(t, got, "--dport 22", "the managed INPUT rule must be restored")
require.Contains(t, got, "DNAT", "the managed nat rule must be restored")
// Restore must be idempotent: a second Backup/Restore reproduces the same file.
backup2, err := f.Backup(ctx, "")
require.NoError(t, err)
require.NoError(t, f.Restore(ctx, "", backup2))
out2, err := os.ReadFile(p4)
require.NoError(t, err)
require.Equal(t, got, string(out2), "Restore must be idempotent")
}
// TestIPTablesInsertForeignChainPosition guards the InsertRule position counting
// against a foreign chain whose name merely starts with the target chain name
// (e.g. firewalld's "INPUT_direct"). GetRules numbers only exact INPUT/OUTPUT
// rules, so the insert path must count the same way. With the prefix-match bug
// the foreign line is miscounted and the new rule lands one slot too early.
func TestIPTablesInsertForeignChainPosition(t *testing.T) {
dir := t.TempDir()
// A foreign INPUT_direct chain precedes two managed INPUT rules. GetRules
// reports the INPUT rules as #1 (dport 22) and #2 (dport 80); the
// INPUT_direct line is not an INPUT rule and must not be counted.
save := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n" +
"-A INPUT_direct -j DROP\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"COMMIT\n"
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
// Insert at INPUT position 2, i.e. between dport 22 (#1) and dport 80 (#2).
require.NoError(t, fw.InsertRule(ctx, "", 2, &Rule{Family: IPv4, Proto: TCP, Port: 443, Action: Accept}))
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
var got *Rule
for _, r := range rules {
if r.Port == 443 {
got = r
}
}
require.NotNil(t, got, "the inserted rule should be present after InsertRule")
require.Equal(t, 2, got.Number,
"the rule must land at INPUT position 2, not be miscounted past the foreign INPUT_direct chain")
}
// TestIPTablesMoveForeignChainPosition is the MoveRule analogue: moving a rule to
// a 1-based position must count only exact INPUT rules, ignoring a foreign chain
// whose name starts with INPUT.
func TestIPTablesMoveForeignChainPosition(t *testing.T) {
dir := t.TempDir()
// INPUT rules on read: #1 dport 22, #2 dport 80, #3 dport 443. Move dport 443
// to position 1; it must become #1 with 22 and 80 shifting down.
save := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n" +
"-A INPUT_direct -j DROP\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\n" +
"COMMIT\n"
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
require.NoError(t, fw.MoveRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 443, Action: Accept}, 1))
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
byPort := map[uint16]int{}
for _, r := range rules {
byPort[r.Port] = r.Number
}
require.Equal(t, 1, byPort[443], "moved rule must land at INPUT position 1, ahead of the foreign chain miscount")
require.Equal(t, 2, byPort[22], "the displaced first rule shifts to position 2")
require.Equal(t, 3, byPort[80], "the displaced second rule shifts to position 3")
}
// scanSaveGroups numbers each chain's groups the way GetRules does, and the
// InsertRule/MoveRule position math reads those numbers straight off the same
// scan — so a divergence here breaks Rule.Number's promise to mirror the position
// argument. It pins the four cases that decide a number: a LOG line paired with
// the action line directly under it is one logical rule carrying both lines, an
// orphan LOG line resolves to no rule, a line the parser rejects resolves to no
// rule, and an intervening line of either kind breaks a pair that would otherwise
// have formed. Chains are numbered independently.
func TestIPTablesScanSaveGroupsNumbering(t *testing.T) {
dir := t.TempDir()
path := filepath.Join(dir, "iptables.save")
content := strings.Join([]string{
"*filter",
":INPUT ACCEPT [0:0]",
":OUTPUT ACCEPT [0:0]",
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT",
// A bare LOG line whose match fields agree with nothing below it.
`-A INPUT -j LOG --log-prefix "audit "`,
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT",
// A LOG line and the action line directly under it: one logged rule.
`-A INPUT -p tcp -m tcp --dport 443 -j LOG --log-prefix "https "`,
"-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT",
// A foreign line the model cannot hold, wedged between a LOG line and the
// action it would otherwise have paired with.
`-A INPUT -p tcp -m tcp --dport 8443 -j LOG --log-prefix "alt "`,
"-A INPUT -p tcp -m tcp --tcp-flags SYN,ACK SYN -j DROP",
"-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT",
"-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT",
"COMMIT",
"",
}, "\n")
require.NoError(t, os.WriteFile(path, []byte(content), 0644))
type got struct {
chain string
number int
resolve bool // The group resolved to a rule GetRules would report.
lines int
}
var seen []got
f := &IPTables{}
require.NoError(t, f.scanSaveFile(path, IPv4, func(g iptGroup) error {
if g.chain != "" {
seen = append(seen, got{g.chain, g.number, g.rule != nil, len(g.raw)})
}
return nil
}))
require.Equal(t, []got{
{"INPUT", 1, true, 1}, // dport 22
{"INPUT", 0, false, 1}, // orphan LOG: no rule, no number
{"INPUT", 2, true, 1}, // dport 80
{"INPUT", 3, true, 2}, // the logged pair, both lines in one group
{"INPUT", 0, false, 1}, // LOG line the foreign line below orphaned
{"INPUT", 0, false, 1}, // the unmodeled --tcp-flags line
{"INPUT", 4, true, 1}, // dport 8443, its LOG partnership broken
{"OUTPUT", 1, true, 1}, // OUTPUT numbers from 1 independently
}, seen)
}
// TestIPTablesInsertPastConsecutiveOrphanLogs pins the walker fix: two foreign
// orphan LOG lines (no matching action) that GetRules drops must not shift the
// 1-based insert position. The old stateful walker swallowed the line after each
// LOG line, so with two consecutive orphan LOGs an insert drifted one position.
func TestIPTablesInsertPastConsecutiveOrphanLogs(t *testing.T) {
dir := t.TempDir()
save := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n" +
"-A INPUT -p udp -m udp --dport 53 -j LOG --log-prefix \"dns: \"\n" +
"-A INPUT -p udp -m udp --dport 123 -j LOG --log-prefix \"ntp: \"\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"COMMIT\n"
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
// GetRules reports #1 dport 22, #2 dport 80 (the orphan LOGs are not rules).
// Insert at position 2, i.e. between them.
require.NoError(t, fw.InsertRule(ctx, "", 2, &Rule{Family: IPv4, Proto: TCP, Port: 443, Action: Accept}))
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
byPort := map[uint16]int{}
for _, r := range rules {
byPort[r.Port] = r.Number
}
require.Equal(t, 1, byPort[22], "the first rule stays at position 1")
require.Equal(t, 2, byPort[443], "inserted rule must land at INPUT position 2, past the two orphan LOG lines")
require.Equal(t, 3, byPort[80], "the displaced second rule shifts to position 3")
// The foreign orphan LOG lines must survive the insert.
got, err := os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(got), "dns: ", "orphan LOG line must be preserved")
require.Contains(t, string(got), "ntp: ", "orphan LOG line must be preserved")
}
// TestIPTablesMovePastConsecutiveOrphanLogs is the MoveRule analogue: moving a
// rule to a position after two orphan LOG lines must count only logical rules.
func TestIPTablesMovePastConsecutiveOrphanLogs(t *testing.T) {
dir := t.TempDir()
save := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n" +
"-A INPUT -p udp -m udp --dport 53 -j LOG --log-prefix \"dns: \"\n" +
"-A INPUT -p udp -m udp --dport 123 -j LOG --log-prefix \"ntp: \"\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"COMMIT\n"
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
// Move dport 22 (currently #1) to position 2; it must end up #2 with dport 80
// at #1, not be miscounted onto the orphan LOG lines.
require.NoError(t, fw.MoveRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 22, Action: Accept}, 2))
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
byPort := map[uint16]int{}
for _, r := range rules {
byPort[r.Port] = r.Number
}
require.Equal(t, 1, byPort[80], "the displaced second rule becomes position 1")
require.Equal(t, 2, byPort[22], "the moved rule must land at position 2, past the two orphan LOG lines")
}
// A counter-annotated (iptables-save -c) nat line must parse, matching the
// filter parser. The nat parser must strip the leading [pkts:bytes] prefix, so
// a counter-annotated save file's NAT rules survive in GetNATRules/Backup and
// can be removed.
func TestIPTablesNATCounterPrefix(t *testing.T) {
fw := new(IPTables)
plain := `-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1`
counter := `[0:0] -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1`
rp, err := fw.UnmarshalNATRule(plain, IPv4)
require.NoError(t, err)
rc, err := fw.UnmarshalNATRule(counter, IPv4)
require.NoError(t, err, "counter-prefixed NAT rule should parse")
require.True(t, rp.EqualBase(rc), "counter-prefixed NAT rule should equal the plain one")
}
// A "replace" must remove a pre-existing counter-annotated filter rule. The
// filter parser reads such lines (populating Packets/Bytes), so the file-rewrite
// path must recognise them as rules too — otherwise a Sync-based replace or
// Restore leaves stale foreign rules behind.
func TestIPTablesReplaceStripsCounterRules(t *testing.T) {
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
v4 := strings.Join([]string{
"*filter",
":INPUT ACCEPT [0:0]",
":OUTPUT ACCEPT [0:0]",
":FORWARD ACCEPT [0:0]",
"[7:420] -A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT",
"COMMIT",
"",
}, "\n")
require.NoError(t, os.WriteFile(p4, []byte(v4), 0o644))
require.NoError(t, os.WriteFile(p6, []byte("*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"), 0o644))
f := &IPTables{IP4Path: p4, IP6Path: p6}
_, _, err := Sync(context.Background(), f, "", []*Rule{{Family: IPv4, Proto: TCP, Port: 22, Action: Accept}})
require.NoError(t, err)
got, err := os.ReadFile(p4)
require.NoError(t, err)
require.NotContains(t, string(got), "9999", "stale counter-annotated rule must be removed by replace; file:\n%s", got)
require.Contains(t, string(got), "--dport 22", "desired rule must be present")
}
// A reconcile must preserve rules in chains the library does not model. A rule in
// a user-defined chain (CUSTOM) is never surfaced by GetRules, so the file-rewrite
// add and remove paths must keep it verbatim. The FORWARD chain, by contrast, is a
// modeled direction: GetRules surfaces its rules and a Sync-based reconcile manages
// them like INPUT/OUTPUT.
func TestIPTablesManagesForwardRules(t *testing.T) {
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
v4 := strings.Join([]string{
"*filter",
":INPUT ACCEPT [0:0]",
":OUTPUT ACCEPT [0:0]",
":FORWARD ACCEPT [0:0]",
"-A FORWARD -s 10.0.0.0/8 -j ACCEPT",
"-A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT",
"-A CUSTOM -j ACCEPT",
"COMMIT",
"",
}, "\n")
require.NoError(t, os.WriteFile(p4, []byte(v4), 0o644))
require.NoError(t, os.WriteFile(p6, []byte("*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"), 0o644))
f := &IPTables{IP4Path: p4, IP6Path: p6}
// The FORWARD rule now surfaces as a modeled forward-direction rule.
rules, err := f.GetRules(context.Background(), "")
require.NoError(t, err)
fwd := &Rule{Direction: DirForward, Family: IPv4, Source: "10.0.0.0/8", Action: Accept}
found := false
for _, r := range rules {
if r.Equal(fwd, true) {
found = true
}
}
require.True(t, found, "the FORWARD rule should be modeled; got %+v", rules)
// Additive add: existing rules survive.
require.NoError(t, f.AddRule(context.Background(), "", &Rule{Family: IPv4, Proto: TCP, Port: 22, Action: Accept}))
got, err := os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(got), "-A FORWARD -s 10.0.0.0/8 -j ACCEPT", "an additive add keeps existing FORWARD rules; file:\n%s", got)
require.Contains(t, string(got), "--dport 22", "desired rule must be present")
// Full replace via Sync: every modeled chain — INPUT, OUTPUT and FORWARD — is
// reconciled to exactly the desired set, so the unlisted FORWARD and INPUT rules
// are removed and a desired FORWARD rule is added; a rule in a user-defined chain
// is still preserved verbatim.
desired := []*Rule{
{Family: IPv4, Proto: TCP, Port: 22, Action: Accept},
{Direction: DirForward, Family: IPv4, Source: "192.168.0.0/16", Action: Accept},
}
_, _, err = Sync(context.Background(), f, "", desired)
require.NoError(t, err)
got, err = os.ReadFile(p4)
require.NoError(t, err)
require.NotContains(t, string(got), "10.0.0.0/8", "the replace reconciles away the unwanted FORWARD rule; file:\n%s", got)
require.NotContains(t, string(got), "9999", "the replace reconciles away the unwanted INPUT rule; file:\n%s", got)
require.Contains(t, string(got), "-A FORWARD -s 192.168.0.0/16 -j ACCEPT", "the desired FORWARD rule is added; file:\n%s", got)
require.Contains(t, string(got), "--dport 22", "desired input rule present")
require.Contains(t, string(got), "-A CUSTOM -j ACCEPT", "a user-defined chain rule is preserved; file:\n%s", got)
}
// A negated match in a -m udp/sctp block must not be mis-parsed. Grouping "!"
// with --source-port consumed the following token and parsed the option name as a
// port; the loop must reject the negation like the tcp loop and still parse a
// normal udp source/destination port.
func TestIPTablesUDPNegationParse(t *testing.T) {
fw := new(IPTables)
// A normal udp source-port rule still round-trips.
got, err := fw.UnmarshalRule("-A INPUT -p udp -m udp --sport 53 -j ACCEPT", IPv4)
require.NoError(t, err)
require.Equal(t, uint16(53), got.SourcePort)
// A negated port match cannot be represented and must be rejected cleanly.
_, err = fw.UnmarshalRule("-A INPUT -p udp -m udp ! --dport 80 -j ACCEPT", IPv4)
require.Error(t, err, "a negated udp port match must be rejected, not mis-parsed")
}
// An additive add must preserve a standalone LOG rule (no terminal action). Such a
// rule cannot be modeled as a Rule, so GetRules drops it; if the file-rewrite path
// also drops it, an AddRule silently deletes a foreign audit-log rule.
func TestIPTablesAddPreservesOrphanLog(t *testing.T) {
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
v4 := strings.Join([]string{
"*filter",
":INPUT ACCEPT [0:0]",
":OUTPUT ACCEPT [0:0]",
":FORWARD ACCEPT [0:0]",
`-A INPUT -j LOG --log-prefix "audit "`,
"-A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT",
"COMMIT",
"",
}, "\n")
require.NoError(t, os.WriteFile(p4, []byte(v4), 0o644))
require.NoError(t, os.WriteFile(p6, []byte("*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"), 0o644))
f := &IPTables{IP4Path: p4, IP6Path: p6}
require.NoError(t, f.AddRule(context.Background(), "", &Rule{Family: IPv4, Proto: TCP, Port: 22, Action: Accept}))
got, err := os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(got), "-j LOG", "an additive add must not delete a standalone LOG rule; file:\n%s", got)
require.Contains(t, string(got), "--dport 9999", "existing INPUT rule must survive an additive add")
require.Contains(t, string(got), "--dport 22", "desired rule must be present")
}
// iptables-save always appends the connlimit counting key (--connlimit-saddr by
// default, or --connlimit-daddr) after a connlimit match. The parser did not
// consume that trailing flag, so it errored ("unsupported option") and
// parseFilterFile silently dropped the whole rule: a per-source connection-limit
// rule vanished from GetRules/Backup and could never be reconciled or removed.
func TestIPTablesConnlimitSaddrRoundTrip(t *testing.T) {
fw := new(IPTables)
// The exact form iptables-save emits for a per-source connlimit rule.
saved := "-A INPUT -p tcp -m tcp --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable"
got, err := fw.UnmarshalRule(saved, IPv4)
require.NoError(t, err, "connlimit rule with --connlimit-saddr must parse")
want := &Rule{Family: IPv4, Proto: TCP, Port: 80, ConnLimit: &ConnLimit{Count: 20, PerSource: true}, Action: Reject}
require.True(t, want.Equal(got, false), "per-source connlimit must round-trip: got %+v", got.ConnLimit)
// --connlimit-daddr must also be consumed rather than dropping the rule.
daddr := "-A INPUT -p tcp -m tcp --dport 80 -m connlimit --connlimit-above 5 --connlimit-mask 24 --connlimit-daddr -j DROP"
got, err = fw.UnmarshalRule(daddr, IPv4)
require.NoError(t, err, "connlimit rule with --connlimit-daddr must parse")
require.NotNil(t, got.ConnLimit)
// A global (mask 0) connlimit still parses and counts globally.
global := "-A INPUT -p tcp -m tcp --dport 80 -m connlimit --connlimit-above 100 --connlimit-mask 0 --connlimit-saddr -j DROP"
got, err = fw.UnmarshalRule(global, IPv4)
require.NoError(t, err)
require.False(t, got.ConnLimit.PerSource, "mask 0 must count globally")
}
// iptables-save spells an ICMP type carrying a code as `type/code` (e.g. `3/1`).
// The parser rejected the token as an invalid type and dropped the whole rule;
// the Rule model has no code field, so the type is taken and the code ignored.
func TestIPTablesICMPTypeCode(t *testing.T) {
fw := new(IPTables)
got, err := fw.UnmarshalRule("-A INPUT -p icmp -m icmp --icmp-type 3/1 -j DROP", IPv4)
require.NoError(t, err, "icmp type/code rule must parse")
require.NotNil(t, got.ICMPType)
require.Equal(t, uint8(3), *got.ICMPType)
require.Equal(t, Drop, got.Action)
}
// MoveRule must operate only on the *filter table. A full iptables-save dump also
// carries INPUT/OUTPUT chains in *nat/*mangle; the move must not pull a
// foreign rule out of one of those tables and splice it into *filter (which both
// corrupts the source table and installs a foreign rule as a filter rule).
func TestIPTablesMoveRuleFilterScope(t *testing.T) {
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
save := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"COMMIT\n" +
"*mangle\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n" +
"-A INPUT -p tcp -m tcp --dport 25 -j DROP\n" +
"COMMIT\n"
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
fw := &IPTables{IP4Path: p4}
// The dport-25 rule lives only in *mangle. Moving it must be a no-op on *filter
// and leave the file untouched.
require.NoError(t, fw.MoveRule(context.Background(), "", &Rule{Proto: TCP, Port: 25, Action: Drop}, 1))
data, err := os.ReadFile(p4)
require.NoError(t, err)
require.Equal(t, save, string(data), "a rule living only in *mangle must not be moved as a filter rule")
}
// ipsetParseType decodes the family and set type from an `ipset save` create
// line's fields, defaulting to IPv4 hash:ip.
func TestIPSetParseType(t *testing.T) {
f := new(IPTables)
fam, typ := f.ipsetParseType([]string{"create", "s", "hash:ip"})
require.Equal(t, IPv4, fam)
require.Equal(t, SetHashIP, typ)
fam, typ = f.ipsetParseType([]string{"create", "s", "hash:net", "family", "inet6", "hashsize", "1024"})
require.Equal(t, IPv6, fam, "family inet6 must decode to IPv6")
require.Equal(t, SetHashNet, typ)
fam, typ = f.ipsetParseType([]string{"create", "s", "hash:ip", "family", "inet"})
require.Equal(t, IPv4, fam, "family inet stays IPv4")
require.Equal(t, SetHashIP, typ)
}
// A foreign, standalone `-j LOG` audit line that does not belong to the rule
// being removed must be preserved. The remove path holds a LOG line back as
// "pending" and only folds it into the following action line when their match
// fields agree (iptSameMatch). When they do not agree, removing the action line
// must not also drop the unrelated LOG line.
func TestRemoveRulePreservesUnrelatedLogLine(t *testing.T) {
dir := t.TempDir()
path := filepath.Join(dir, "iptables.save")
content := strings.Join([]string{
"*filter",
":INPUT ACCEPT [0:0]",
":OUTPUT ACCEPT [0:0]",
`-A INPUT -j LOG --log-prefix "audit "`,
"-A INPUT -p tcp --dport 22 -j ACCEPT",
"COMMIT",
"",
}, "\n")
require.NoError(t, os.WriteFile(path, []byte(content), 0644))
f := &IPTables{IP4Path: path}
// Remove the unlogged tcp/22 rule; the standalone audit LOG line is unrelated.
target := &Rule{Proto: TCP, Port: 22, Action: Accept}
require.NoError(t, f.RemoveRule(context.Background(), "", target))
got, err := os.ReadFile(path)
require.NoError(t, err)
out := string(got)
require.NotContains(t, out, "--dport 22", "the targeted rule must be removed")
require.Contains(t, out, `LOG --log-prefix "audit "`,
"an unrelated standalone LOG line must not be removed with the rule")
}
// The MoveRule path has the mirror defect: a standalone `-j LOG` line that does
// not coalesce with the moved rule must not be lifted and dragged to the new
// position. Moving dport 80 to position 1 must reorder it ahead of dport 22 while
// the audit line stays exactly where it was — it begins no logical rule, so it
// neither takes a position nor travels with one.
func TestMoveRuleDoesNotDragUnrelatedLogLine(t *testing.T) {
dir := t.TempDir()
path := filepath.Join(dir, "iptables.save")
content := strings.Join([]string{
"*filter",
":INPUT ACCEPT [0:0]",
`-A INPUT -j LOG --log-prefix "audit "`,
"-A INPUT -p tcp --dport 22 -j ACCEPT",
"-A INPUT -p tcp --dport 80 -j ACCEPT",
"COMMIT",
"",
}, "\n")
require.NoError(t, os.WriteFile(path, []byte(content), 0644))
f := &IPTables{IP4Path: path}
require.NoError(t, f.MoveRule(context.Background(), "", &Rule{Proto: TCP, Port: 80, Action: Accept}, 1))
data, err := os.ReadFile(path)
require.NoError(t, err)
require.Equal(t, []string{
"*filter",
":INPUT ACCEPT [0:0]",
`-A INPUT -j LOG --log-prefix "audit "`,
"-A INPUT -p tcp --dport 80 -j ACCEPT",
"-A INPUT -p tcp --dport 22 -j ACCEPT",
"COMMIT",
}, strings.Split(strings.TrimRight(string(data), "\n"), "\n"))
}
func TestIPTablesLogLimitRoundTrip(t *testing.T) {
f := &IPTables{}
// A logged rule is two lines that coalesce back to one logical rule.
logged := &Rule{Port: 22, Proto: TCP, Action: Accept, Log: true, LogPrefix: "ssh"}
lines, err := f.marshalRuleLines(logged)
require.NoError(t, err)
require.Len(t, lines, 2, "a logged rule should be a LOG line plus an action line")
var parsed []*Rule
for _, l := range lines {
r, perr := f.UnmarshalRule(l, IPv4)
require.NoError(t, perr, "line %q", l)
parsed = append(parsed, r)
}
coalesced := coalesceLoggedRules(parsed)
require.Len(t, coalesced, 1)
require.True(t, coalesced[0].EqualBase(logged, true), "want %+v got %+v", logged, coalesced[0])
// Rate and connection limits round-trip on a single line.
for _, orig := range []*Rule{
// A non-default burst round-trips; the default of 5 is normalized to 0 (it
// is indistinguishable from iptables' applied default), covered separately
// by TestIPTablesRateBurstDefaultNormalized.
{Port: 22, Proto: TCP, Action: Accept, RateLimit: &RateLimit{Rate: 10, Unit: PerMinute, Burst: 3}},
{Proto: TCP, Port: 80, Action: Reject, ConnLimit: &ConnLimit{Count: 20, PerSource: true}},
{Proto: TCP, Port: 80, Action: Reject, ConnLimit: &ConnLimit{Count: 20, PerSource: false}},
{Proto: TCP, Port: 80, SourcePort: 1234, Action: Accept},
{Proto: TCP, Port: 80, SourcePorts: []PortRange{{Start: 1000, End: 2000}}, Action: Accept},
} {
spec, err := f.MarshalRule(orig)
require.NoError(t, err)
got, err := f.UnmarshalRule(spec, IPv4)
require.NoError(t, err, "spec %q", spec)
require.True(t, got.EqualBase(orig, true), "spec %q: want %+v got %+v", spec, orig, got)
}
}
// Address sets are staged in the ipset file and reach the kernel only on Reload,
// so every mutation is a file edit and every read comes back off the file. None
// of this shells out to ipset, which is what lets the test run anywhere.
func TestIPTablesAddressSetStaging(t *testing.T) {
ctx := context.Background()
path := filepath.Join(t.TempDir(), "ipsets")
f := &IPTables{IPSetPath: path}
set := &AddressSet{Name: "block", Family: IPv6, Type: SetHashNet, Entries: []string{"2001:db8::/64"}}
require.NoError(t, f.AddAddressSet(ctx, set))
data, err := os.ReadFile(path)
require.NoError(t, err)
require.Equal(t, "create block hash:net family inet6\nadd block 2001:db8::/64\n", string(data),
"the staging file holds ipset save format, not a dump of live state")
// Entries are staged into the file, and adding one already there is a no-op.
require.NoError(t, f.AddAddressSetEntry(ctx, "block", "2001:db8:1::/64"))
require.NoError(t, f.AddAddressSetEntry(ctx, "block", "2001:db8:1::/64"))
got, err := f.GetAddressSet(ctx, "block")
require.NoError(t, err)
require.Equal(t, []string{"2001:db8::/64", "2001:db8:1::/64"}, got.Entries)
require.Equal(t, IPv6, got.Family)
require.Equal(t, SetHashNet, got.Type)
require.NoError(t, f.RemoveAddressSetEntry(ctx, "block", "2001:db8::/64"))
// A missing entry, and an entry on a set that is not staged, are both no-ops.
require.NoError(t, f.RemoveAddressSetEntry(ctx, "block", "192.0.2.1"))
require.NoError(t, f.RemoveAddressSetEntry(ctx, "ghost", "192.0.2.1"))
got, err = f.GetAddressSet(ctx, "block")
require.NoError(t, err)
require.Equal(t, []string{"2001:db8:1::/64"}, got.Entries)
// Re-declaring a staged set merges entries; re-declaring it with a different
// family or type is a conflict rather than a silent rewrite.
require.NoError(t, f.AddAddressSet(ctx, &AddressSet{
Name: "block", Family: IPv6, Type: SetHashNet, Entries: []string{"2001:db8:2::/64"}}))
got, err = f.GetAddressSet(ctx, "block")
require.NoError(t, err)
require.Equal(t, []string{"2001:db8:1::/64", "2001:db8:2::/64"}, got.Entries)
require.ErrorContains(t,
f.AddAddressSet(ctx, &AddressSet{Name: "block", Family: IPv4, Type: SetHashNet}),
"already staged")
// An entry on a set that was never staged reports what ipset itself would.
require.ErrorContains(t, f.AddAddressSetEntry(ctx, "ghost", "192.0.2.1"), "does not exist")
// Removal drops the set from the file and queues the kernel-side destroy for
// Reload; removing an unstaged set is a no-op that queues nothing.
require.NoError(t, f.RemoveAddressSet(ctx, "block"))
require.Equal(t, []string{"block"}, f.pendingSetRemovals)
require.NoError(t, f.RemoveAddressSet(ctx, "ghost"))
require.Equal(t, []string{"block"}, f.pendingSetRemovals)
sets, err := f.GetAddressSets(ctx)
require.NoError(t, err)
require.Empty(t, sets)
// Staging the set again before that Reload cancels the queued destroy, which
// would otherwise delete the set the caller just asked for.
require.NoError(t, f.AddAddressSet(ctx, set))
require.Empty(t, f.pendingSetRemovals)
}
// A FamilyAny set is staged as IPv4: a set is family-typed, so the file always
// names a concrete family for `ipset restore` to create it with.
func TestIPTablesAddressSetFamilyAnyStagedAsIPv4(t *testing.T) {
ctx := context.Background()
path := filepath.Join(t.TempDir(), "ipsets")
f := &IPTables{IPSetPath: path}
require.NoError(t, f.AddAddressSet(ctx, &AddressSet{Name: "any", Type: SetHashIP}))
got, err := f.GetAddressSet(ctx, "any")
require.NoError(t, err)
require.Equal(t, IPv4, got.Family)
data, err := os.ReadFile(path)
require.NoError(t, err)
require.Contains(t, string(data), "family inet")
}
// The save-format decode is single-pass and must survive the oddities a real
// staging file carries, since a misread here silently changes what Reload loads.
func TestIPTablesIPSetSaveDecode(t *testing.T) {
f := &IPTables{}
lines := []string{
"create v4 hash:ip family inet hashsize 1024 maxelem 65536",
"add v4 192.0.2.1 timeout 600",
`add v4 192.0.2.2 comment "note"`,
"create v6 hash:net family inet6",
"add v6 2001:db8::/64",
// A second create for a name already decoded, and an add naming a set this
// file never declares, are both dropped rather than corrupting the decode.
"create v4 hash:net family inet6",
"add ghost 198.51.100.1",
"",
"# a comment",
}
want := []*AddressSet{
{Name: "v4", Family: IPv4, Type: SetHashIP, Entries: []string{"192.0.2.1", "192.0.2.2"}},
{Name: "v6", Family: IPv6, Type: SetHashNet, Entries: []string{"2001:db8::/64"}},
}
path := filepath.Join(t.TempDir(), "ipsets")
require.NoError(t, os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0600))
scanned, err := f.scanIPSetSave(path)
require.NoError(t, err)
require.Equal(t, want, scanned)
// What the backend renders round-trips through the decode unchanged.
rendered := filepath.Join(t.TempDir(), "rendered")
require.NoError(t, os.WriteFile(rendered, f.marshalIPSetSave(want), 0600))
round, err := f.scanIPSetSave(rendered)
require.NoError(t, err)
require.Equal(t, want, round)
// A staging file that was never written decodes as no sets, not an error.
missing, err := f.scanIPSetSave(filepath.Join(t.TempDir(), "absent"))
require.NoError(t, err)
require.Empty(t, missing)
}
// Encoding entries for the kernel is work the `ipset` binary used to do for us,
// so the address/CIDR forms a set can hold are pinned here. Decoding must land
// back on the exact string the save-format decode produces for the same entry,
// or a set read live and the same set read from a staging file would not compare
// equal.
func TestIPSetEntryEncoding(t *testing.T) {
for _, tc := range []struct {
entry string
ip string
cidr uint8
// decoded is the entry as it reads back, which differs from entry only
// where host bits were supplied and the kernel masks them off.
decoded string
}{
{entry: "192.0.2.10", ip: "192.0.2.10", cidr: 0, decoded: "192.0.2.10"},
{entry: "10.0.0.0/8", ip: "10.0.0.0", cidr: 8, decoded: "10.0.0.0/8"},
{entry: "192.0.2.5/24", ip: "192.0.2.0", cidr: 24, decoded: "192.0.2.0/24"},
{entry: "2001:db8::1", ip: "2001:db8::1", cidr: 0, decoded: "2001:db8::1"},
{entry: "2001:db8::/64", ip: "2001:db8::", cidr: 64, decoded: "2001:db8::/64"},
} {
got, err := ipsetEncodeEntry(tc.entry)
require.NoError(t, err, "entry %q", tc.entry)
require.Equal(t, tc.ip, got.IP.String(), "entry %q", tc.entry)
require.Equal(t, tc.cidr, got.CIDR, "entry %q", tc.entry)
require.True(t, got.Replace, "entry %q must carry the kernel's exist flag", tc.entry)
require.Equal(t, tc.decoded, ipsetDecodeEntry(*got), "entry %q", tc.entry)
}
// A prefix covering the whole address is dropped, which is how `ipset save`
// writes a single host held in a hash:net set.
require.Equal(t, "192.0.2.1", ipsetDecodeEntry(netlink.IPSetEntry{IP: net.ParseIP("192.0.2.1"), CIDR: 32}))
require.Equal(t, "2001:db8::1", ipsetDecodeEntry(netlink.IPSetEntry{IP: net.ParseIP("2001:db8::1"), CIDR: 128}))
// An entry the kernel sent without an address has no representation.
require.Empty(t, ipsetDecodeEntry(netlink.IPSetEntry{}))
for _, bad := range []string{"", "not-an-ip", "192.0.2.0/33", "example.com", "192.0.2.1-192.0.2.9"} {
_, err := ipsetEncodeEntry(bad)
require.Error(t, err, "entry %q must be rejected rather than sent to the kernel", bad)
}
}
// setRefFamily consults the staged sets first and falls back to the live kernel
// for a set that exists only there, and a rule that already carries a family
// bypasses resolution entirely.
func TestIPTablesSetRefFamilyFallbackChain(t *testing.T) {
dir := t.TempDir()
scaffold := "*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\nCOMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(scaffold), 0644))
require.NoError(t, os.WriteFile(p6, []byte(scaffold), 0644))
ipsets := filepath.Join(dir, "ipsets")
require.NoError(t, os.WriteFile(ipsets, []byte(
"create bootset hash:ip family inet6\nadd bootset 2001:db8::1\n"), 0644))
f := &IPTables{IP4Path: p4, IP6Path: p6, IPSetPath: ipsets}
ctx := context.Background()
// The live query knows no sets; "errored" additionally exercises the
// netlink-failure path, which falls through to the declared sets.
prev := ipsetLiveFamily
t.Cleanup(func() { ipsetLiveFamily = prev })
ipsetLiveFamily = func(name string) (Family, bool, error) {
if name == "errored" {
return FamilyAny, false, fmt.Errorf("netlink unavailable")
}
return FamilyAny, false, nil
}
// Declared only in the persistence file: pinned to its inet6 family.
require.NoError(t, f.AddRule(ctx, "", &Rule{Proto: TCP, Port: 4220, Source: "bootset", Action: Accept}))
d4, err := os.ReadFile(p4)
require.NoError(t, err)
d6, err := os.ReadFile(p6)
require.NoError(t, err)
require.Contains(t, string(d6), "--match-set bootset src")
require.NotContains(t, string(d4), "bootset",
"a set declared inet6 in boot config must not produce an iptables line")
// A netlink failure still falls through to the declared file; the set is
// not there either, so the add fails as unknown rather than writing a
// blind line.
err = f.AddRule(ctx, "", &Rule{Proto: TCP, Port: 4221, Source: "errored", Action: Accept})
require.ErrorContains(t, err, `"errored"`)
// A rule that already carries a family is written as declared: no source
// knows "errored", so success proves resolution was never consulted.
require.NoError(t, f.AddRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 4222, Source: "errored", Action: Accept}))
d4, err = os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(d4), "--match-set errored src")
}
func TestIPTablesNATRoundTrip(t *testing.T) {
f := &IPTables{}
cases := []*NATRule{
{Kind: DNAT, Family: IPv4, Proto: TCP, Port: 80, ToAddress: "10.0.0.5", ToPort: 8080, Interface: "eth0"},
{Kind: Redirect, Family: IPv4, Proto: TCP, Port: 80, ToPort: 8080},
{Kind: SNAT, Family: IPv4, Source: "10.0.0.0/24", ToAddress: "1.2.3.4", Interface: "eth1"},
// SNAT with a source-port translation is now accepted: iptables emits it
// as --to-source addr:port (pf/nft reject it in their own MarshalNATRule).
{Kind: SNAT, Family: IPv4, Proto: TCP, Source: "10.0.0.0/24", ToAddress: "1.2.3.4", ToPort: 8443, Interface: "eth1"},
{Kind: Masquerade, Family: IPv4, Interface: "eth1"},
}
for _, orig := range cases {
spec, err := f.MarshalNATRule(orig)
require.NoError(t, err)
got, err := f.UnmarshalNATRule(spec, IPv4)
require.NoError(t, err, "spec %q", spec)
require.True(t, got.EqualBase(orig), "spec %q: want %+v got %+v", spec, orig, got)
}
}
func TestIPTablesProtocolAndComment(t *testing.T) {
f := &IPTables{}
cases := []*Rule{
{Proto: SCTP, Port: 9000, Action: Accept},
{Proto: GRE, Action: Accept},
{Proto: ESP, Action: Accept},
{Proto: AH, Action: Drop},
{Proto: TCP, Port: 22, Action: Accept, Comment: "ssh access"},
}
for _, orig := range cases {
spec, err := f.MarshalRule(orig)
require.NoError(t, err)
got, err := f.UnmarshalRule(spec, IPv4)
require.NoError(t, err, "spec %q", spec)
require.True(t, got.EqualBase(orig, true), "spec %q: want %+v got %+v", spec, orig, got)
require.Equal(t, orig.Comment, got.Comment, "spec %q comment", spec)
}
}
// TestIPTablesNATParserRejectsUnmodeledMatches pins the shapes UnmarshalNATRule
// must leave foreign: a negated interface/protocol/port match (reading
// `! -o docker0` as a plain match would invert Docker's stock masquerade rule),
// an unknown protocol token, and a source-or-destination multiport option.
func TestIPTablesNATParserRejectsUnmodeledMatches(t *testing.T) {
fw := new(IPTables)
foreign := []string{
"-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE",
"-A PREROUTING ! -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080",
"-A PREROUTING ! -p tcp -j REDIRECT --to-ports 8080",
"-A PREROUTING -p tcp -m tcp ! --dport 80 -j REDIRECT --to-ports 8080",
"-A PREROUTING -p udplite -j REDIRECT --to-ports 8080",
"-A PREROUTING -p 47 -j REDIRECT --to-ports 8080",
"-A PREROUTING -p udp -m multiport --ports 5060 -j REDIRECT --to-ports 5061",
}
for _, spec := range foreign {
_, err := fw.UnmarshalNATRule(spec, IPv4)
require.Error(t, err, "line must stay foreign: %s", spec)
}
// A negated address still models, and the plain forms still parse.
r, err := fw.UnmarshalNATRule("-A POSTROUTING ! -s 172.17.0.0/16 -o eth0 -j MASQUERADE", IPv4)
require.NoError(t, err)
require.Equal(t, "!172.17.0.0/16", r.Source)
require.Equal(t, "eth0", r.Interface)
r, err = fw.UnmarshalNATRule("-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.0.0.5:80", IPv4)
require.NoError(t, err)
require.Equal(t, DNAT, r.Kind)
require.EqualValues(t, 8080, r.Port)
}
// TestIPTablesRewriteNATPreservesUnmodeled pins that a Restore-style nat rewrite
// keeps managed-chain lines the model cannot hold — Docker's addrtype jump — while
// still replacing the modeled rules.
func TestIPTablesRewriteNATPreservesUnmodeled(t *testing.T) {
dir := t.TempDir()
save := "*nat\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n" +
"-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER\n" +
"-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.0.0.5:80\n" +
"-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE\n" +
"COMMIT\n*filter\n:INPUT ACCEPT [0:0]\nCOMMIT\n"
p := filepath.Join(dir, "iptables")
require.NoError(t, os.WriteFile(p, []byte(save), 0644))
fw := &IPTables{IP4Path: p, IP6Path: filepath.Join(dir, "ip6tables")}
require.NoError(t, fw.rewriteNATRules(p, []string{"-A PREROUTING -p tcp -m tcp --dport 9090 -j DNAT --to-destination 10.0.0.6:90"}))
got, err := os.ReadFile(p)
require.NoError(t, err)
body := string(got)
require.Contains(t, body, "-j DOCKER", "Docker's unmodeled prerouting jump must survive the rewrite")
require.Contains(t, body, "! -o docker0", "Docker's negated masquerade must survive the rewrite")
require.Contains(t, body, "--dport 9090", "the desired rule must be written")
require.NotContains(t, body, "--dport 8080", "the replaced modeled rule must be gone")
}
// TestIPTablesLogPairSplitByForeignLine pins that a LOG line and an action line
// separated by an unmodeled foreign line are not coalesced into one logged rule:
// the pair reads apart everywhere (GetRules, positions, removal), so reporting a
// merged rule would surface one no removal could ever find.
func TestIPTablesLogPairSplitByForeignLine(t *testing.T) {
dir := t.TempDir()
save := "*filter\n:INPUT ACCEPT [0:0]\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j LOG --log-prefix \"web: \"\n" +
"-A INPUT -m recent --name probe --set -j DROP\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"COMMIT\n"
p := filepath.Join(dir, "iptables")
require.NoError(t, os.WriteFile(p, []byte(save), 0644))
fw := &IPTables{IP4Path: p, IP6Path: filepath.Join(dir, "ip6tables")}
rules, err := fw.parseFilterFile(p, IPv4)
require.NoError(t, err)
require.Len(t, rules, 1, "only the plain accept is a modeled rule")
require.False(t, rules[0].Log, "the accept must not inherit the separated LOG line")
// Removing the reported rule must find its line even with the split pair.
ctx := context.Background()
require.NoError(t, os.WriteFile(filepath.Join(dir, "ip6tables"), []byte("*filter\nCOMMIT\n"), 0644))
require.NoError(t, fw.RemoveRule(ctx, "", &Rule{Family: IPv4, Proto: TCP, Port: 80, Action: Accept}))
got, err := os.ReadFile(p)
require.NoError(t, err)
require.NotContains(t, string(got), "-j ACCEPT", "the reported rule must be removable")
require.Contains(t, string(got), "-j LOG", "the orphaned LOG line is unmodeled and preserved")
require.Contains(t, string(got), "-m recent", "the foreign line is preserved")
}
// TestIPTablesInsertPositionSkipsForeignLine pins that Insert positions count
// only the rules GetRules reports: an unmodeled foreign line holds no position,
// so Rule.Number and the InsertRule position argument cannot diverge.
func TestIPTablesInsertPositionSkipsForeignLine(t *testing.T) {
dir := t.TempDir()
save := "*filter\n:INPUT ACCEPT [0:0]\n" +
"-A INPUT -m recent --name probe --set -j DROP\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\n" +
"COMMIT\n"
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(save), 0644))
require.NoError(t, os.WriteFile(p6, []byte("*filter\nCOMMIT\n"), 0644))
fw := &IPTables{IP4Path: p4, IP6Path: p6}
ctx := context.Background()
// GetRules reports #1 dport 22, #2 dport 80. Insert at 2 = between them.
require.NoError(t, fw.InsertRule(ctx, "", 2, &Rule{Family: IPv4, Proto: TCP, Port: 443, Action: Accept}))
rules, err := fw.GetRules(ctx, "")
require.NoError(t, err)
byPort := map[uint16]int{}
for _, r := range rules {
byPort[r.Port] = r.Number
}
require.Equal(t, 1, byPort[22])
require.Equal(t, 2, byPort[443], "position 2 must land between the two modeled rules, not before dport 22")
require.Equal(t, 3, byPort[80])
got, err := os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(got), "-m recent", "the foreign line survives the insert")
}
// dockerSaveFile is a realistic iptables-save dump of a host running Docker: the
// classic DOCKER-* chain layout plus an operator's own INPUT and FORWARD rules
// and a hand-named br-lan bridge, which must stay managed. Only three of Docker's
// lines parse as modeled rules — the two FORWARD accepts and the per-published-
// port hairpin masquerade — and those are the ones the library must not touch.
const dockerSaveFile = "*nat\n:PREROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:DOCKER - [0:0]\n" +
"-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER\n" +
"-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE\n" +
"-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE\n" +
"-A POSTROUTING -o eth0 -j MASQUERADE\n" +
"-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80\n" +
"COMMIT\n" +
"*filter\n:INPUT DROP [0:0]\n:FORWARD DROP [0:0]\n:OUTPUT ACCEPT [0:0]\n" +
":DOCKER - [0:0]\n:DOCKER-USER - [0:0]\n:DOCKER-ISOLATION-STAGE-1 - [0:0]\n" +
"-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n" +
"-A FORWARD -j DOCKER-USER\n" +
"-A FORWARD -j DOCKER-ISOLATION-STAGE-1\n" +
"-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n" +
"-A FORWARD -o docker0 -j DOCKER\n" +
"-A FORWARD -i docker0 ! -o docker0 -j ACCEPT\n" +
"-A FORWARD -i docker0 -o docker0 -j ACCEPT\n" +
"-A FORWARD -i br-1a2b3c4d5e6f -o br-1a2b3c4d5e6f -j ACCEPT\n" +
"-A FORWARD -i br-lan -o eth0 -j ACCEPT\n" +
"-A DOCKER-USER -j RETURN\n" +
"COMMIT\n"
// dockerTestFirewall stages the Docker save file and returns the backend plus the
// IPv4 file path.
func dockerTestFirewall(t *testing.T) (*IPTables, string) {
t.Helper()
dir := t.TempDir()
p4 := filepath.Join(dir, "iptables")
p6 := filepath.Join(dir, "ip6tables")
require.NoError(t, os.WriteFile(p4, []byte(dockerSaveFile), 0644))
require.NoError(t, os.WriteFile(p6, []byte("*filter\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\nCOMMIT\n"), 0644))
// A staging path keeps Backup's address-set read on the file rather than the
// live kernel, which an unprivileged test cannot query.
return &IPTables{IP4Path: p4, IP6Path: p6, IPSetPath: filepath.Join(dir, "ipsets")}, p4
}
// Docker owns and continuously reconciles its rules, so GetRules must not report
// them: a reported rule enters no desired set, and Sync would delete it and sever
// container networking. The operator's own rules — including one on a hand-named
// br-lan bridge — must still be reported and keep correct Numbers, since a
// container rule consumes no logical position, exactly like an unmodeled line.
func TestIPTablesGetRulesHidesContainerRuntime(t *testing.T) {
f, _ := dockerTestFirewall(t)
rules, err := f.GetRules(context.Background(), "")
require.NoError(t, err)
for _, r := range rules {
require.False(t, isContainerRuntimeIface(r.InInterface),
"a rule on container interface %q must not be reported", r.InInterface)
require.False(t, isContainerRuntimeIface(r.OutInterface),
"a rule on container interface %q must not be reported", r.OutInterface)
}
require.Len(t, rules, 2, "only the operator's two rules are in scope")
require.Equal(t, DirInput, rules[0].Direction)
require.EqualValues(t, 22, rules[0].Port)
require.Equal(t, 1, rules[0].Number)
// The operator's FORWARD rule is the only reported forward rule, so it is
// number 1 in that chain — Docker's rules consume no logical position.
require.Equal(t, DirForward, rules[1].Direction)
require.Equal(t, "br-lan", rules[1].InInterface, "a hand-named bridge stays managed")
require.Equal(t, "eth0", rules[1].OutInterface)
require.Equal(t, 1, rules[1].Number)
}
// The nat counterpart: Docker's hairpin masquerade is the only nat line that
// parses, and it must be hidden, while the operator's egress masquerade is
// reported and numbered as the first POSTROUTING rule.
func TestIPTablesGetNATRulesHidesContainerRuntime(t *testing.T) {
f, _ := dockerTestFirewall(t)
nats, err := f.GetNATRules(context.Background(), "")
require.NoError(t, err)
require.Len(t, nats, 1, "only the operator's masquerade is in scope")
require.Equal(t, "eth0", nats[0].Interface)
require.Equal(t, 1, nats[0].Number)
}
// A Backup/Restore round trip is the sharpest test: Backup captures only what
// GetRules reports, and Restore rewrites the managed chains from that set. Every
// Docker line must survive verbatim, or restoring a backup would tear down
// container networking on a host that was running fine.
func TestIPTablesRestorePreservesContainerRuntime(t *testing.T) {
f, p4 := dockerTestFirewall(t)
ctx := context.Background()
backup, err := f.Backup(ctx, "")
require.NoError(t, err)
for _, r := range backup.Rules {
require.False(t, r.isContainerRuntime(), "a container rule must never reach a backup")
}
require.NoError(t, f.Restore(ctx, "", backup))
out, err := os.ReadFile(p4)
require.NoError(t, err)
got := string(out)
for _, line := range []string{
"-A FORWARD -j DOCKER-USER",
"-A FORWARD -j DOCKER-ISOLATION-STAGE-1",
"-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
"-A FORWARD -o docker0 -j DOCKER",
"-A FORWARD -i docker0 ! -o docker0 -j ACCEPT",
"-A FORWARD -i docker0 -o docker0 -j ACCEPT",
"-A FORWARD -i br-1a2b3c4d5e6f -o br-1a2b3c4d5e6f -j ACCEPT",
"-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE",
"-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE",
"-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER",
"-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80",
} {
require.Contains(t, got, line, "Docker's rule must survive a Backup/Restore round trip")
}
// The operator's own rules are still restored, and the round trip is stable.
require.Contains(t, got, "--dport 22")
require.Contains(t, got, "-A FORWARD -i br-lan -o eth0 -j ACCEPT")
backup2, err := f.Backup(ctx, "")
require.NoError(t, err)
require.NoError(t, f.Restore(ctx, "", backup2))
out2, err := os.ReadFile(p4)
require.NoError(t, err)
require.Equal(t, got, string(out2), "Restore must be idempotent with container rules present")
}
// Sync is the path that would actually do the damage: it removes every reported
// rule the desired set does not cover. With Docker's rules hidden, a caller
// syncing only its own INPUT rule must leave every Docker line intact.
func TestIPTablesSyncLeavesContainerRuntimeIntact(t *testing.T) {
f, p4 := dockerTestFirewall(t)
ctx := context.Background()
desired := []*Rule{{Direction: DirInput, Proto: TCP, Port: 443, Action: Accept}}
_, removed, err := Sync(ctx, f, "", desired)
require.NoError(t, err)
require.Equal(t, 2, removed, "only the operator's two rules are reconciled")
out, err := os.ReadFile(p4)
require.NoError(t, err)
got := string(out)
require.Contains(t, got, "-A FORWARD -i docker0 -o docker0 -j ACCEPT", "Sync must not delete Docker's rule")
require.Contains(t, got, "-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT")
require.Contains(t, got, "-A FORWARD -i br-1a2b3c4d5e6f -o br-1a2b3c4d5e6f -j ACCEPT")
require.Contains(t, got, "--dport 443", "the desired rule is applied")
require.NotContains(t, got, "--dport 22", "the operator's stale rule is reconciled away")
}
// Even a caller that hand-builds a rule matching a Docker line exactly must not
// be able to remove it through RemoveRule.
func TestIPTablesRemoveRuleRefusesContainerRuntime(t *testing.T) {
f, p4 := dockerTestFirewall(t)
target := &Rule{Direction: DirForward, InInterface: "docker0", OutInterface: "docker0", Action: Accept}
require.NoError(t, f.RemoveRule(context.Background(), "", target))
out, err := os.ReadFile(p4)
require.NoError(t, err)
require.Contains(t, string(out), "-A FORWARD -i docker0 -o docker0 -j ACCEPT",
"Docker's rule must survive an exact-match removal attempt")
}
Reference in a new issue View git blame Copy permalink