Skip to content

Commit 467c9ea

Browse files
DakEnviyDakEnviy
committed
test: add tests for source
1 parent c54c9b9 commit 467c9ea

1 file changed

Lines changed: 202 additions & 18 deletions

File tree

‎test/ufw-docker.test.sh‎

Lines changed: 202 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,42 @@ test-allow-command-for-instance-with-port-and-udp-protocol-assert() {
251251
}
252252

253253

254+
test-allow-command-for-instance-with-source-ip() {
255+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
256+
ufw-docker allow httpd 192.168.1.10 80/tcp
257+
}
258+
test-allow-command-for-instance-with-source-ip-assert() {
259+
ufw-docker--allow httpd-container-name 192.168.1.10 80 tcp ""
260+
}
261+
262+
263+
test-allow-command-for-instance-with-source-subnet() {
264+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
265+
ufw-docker allow httpd 192.168.1.0/24 80/tcp
266+
}
267+
test-allow-command-for-instance-with-source-subnet-assert() {
268+
ufw-docker--allow httpd-container-name 192.168.1.0/24 80 tcp ""
269+
}
270+
271+
272+
test-allow-command-for-instance-with-source-any() {
273+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
274+
ufw-docker allow httpd any 80/tcp
275+
}
276+
test-allow-command-for-instance-with-source-any-assert() {
277+
ufw-docker--allow httpd-container-name any 80 tcp ""
278+
}
279+
280+
281+
test-allow-command-for-instance-with-source-and-network() {
282+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
283+
ufw-docker allow httpd 192.168.1.10 80/tcp default
284+
}
285+
test-allow-command-for-instance-with-source-and-network-assert() {
286+
ufw-docker--allow httpd-container-name 192.168.1.10 80 tcp default
287+
}
288+
289+
254290
test-ASSERT-FAIL-allow-httpd-INVALID-port() {
255291
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
256292
@mock die 'invalid port syntax: "invalid".' === exit 1
@@ -259,6 +295,14 @@ test-ASSERT-FAIL-allow-httpd-INVALID-port() {
259295
}
260296

261297

298+
test-ASSERT-FAIL-allow-httpd-INVALID-source() {
299+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
300+
@mock die 'invalid source syntax: "invalid-source".' === exit 1
301+
302+
ufw-docker allow httpd invalid-source
303+
}
304+
305+
262306
test-delete-allow-command-for-instance() {
263307
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
264308
ufw-docker delete allow httpd
@@ -268,6 +312,24 @@ test-delete-allow-command-for-instance-assert() {
268312
}
269313

270314

315+
test-delete-allow-command-for-instance-with-source() {
316+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
317+
ufw-docker delete allow httpd 192.168.1.10 80/tcp
318+
}
319+
test-delete-allow-command-for-instance-with-source-assert() {
320+
ufw-docker--delete httpd-container-name 192.168.1.10 80 tcp ""
321+
}
322+
323+
324+
test-delete-allow-command-for-instance-with-source-and-network() {
325+
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
326+
ufw-docker delete allow httpd 192.168.1.10 80/tcp default
327+
}
328+
test-delete-allow-command-for-instance-with-source-and-network-assert() {
329+
ufw-docker--delete httpd-container-name 192.168.1.10 80 tcp default
330+
}
331+
332+
271333
test-ASSERT-FAIL-delete-only-supports-allowed-rules() {
272334
@mock ufw-docker--instance-name httpd === @stdout httpd-container-name
273335
ufw-docker delete non-allow
@@ -568,6 +630,54 @@ test-add-rule-modifies-existing-rule-without-port-assert() {
568630
}
569631

570632

633+
test-add-rule-for-source-ip() {
634+
@mockfalse ufw-docker--list webapp 192.168.1.10 5000 tcp ""
635+
@ignore echo
636+
637+
load-ufw-docker-function ufw-docker--add-rule
638+
ufw-docker--add-rule webapp 172.18.0.4 192.168.1.10 5000 tcp
639+
}
640+
test-add-rule-for-source-ip-assert() {
641+
ufw route allow proto tcp from 192.168.1.10 to 172.18.0.4 port 5000 comment "allow webapp 192.168.1.10 5000/tcp"
642+
}
643+
644+
645+
test-add-rule-for-source-subnet() {
646+
@mockfalse ufw-docker--list webapp 192.168.1.0/24 5000 tcp ""
647+
@ignore echo
648+
649+
load-ufw-docker-function ufw-docker--add-rule
650+
ufw-docker--add-rule webapp 172.18.0.4 192.168.1.0/24 5000 tcp
651+
}
652+
test-add-rule-for-source-subnet-assert() {
653+
ufw route allow proto tcp from 192.168.1.0/24 to 172.18.0.4 port 5000 comment "allow webapp 192.168.1.0/24 5000/tcp"
654+
}
655+
656+
657+
test-ipv6-add-rule-for-source-ip() {
658+
@mockfalse ufw-docker--list webapp fd00:cf::42 5000 tcp ""
659+
@ignore echo
660+
661+
load-ufw-docker-function ufw-docker--add-rule
662+
ufw-docker--add-rule webapp 172.18.0.4 fd00:cf::42 5000 tcp
663+
}
664+
test-ipv6-add-rule-for-source-ip-assert() {
665+
ufw route allow proto tcp from fd00:cf::42 to 172.18.0.4 port 5000 comment "allow webapp fd00:cf::42 5000/tcp"
666+
}
667+
668+
669+
test-ipv6-add-rule-for-source-subnet() {
670+
@mockfalse ufw-docker--list webapp fd00:cf::/8 5000 tcp ""
671+
@ignore echo
672+
673+
load-ufw-docker-function ufw-docker--add-rule
674+
ufw-docker--add-rule webapp 172.18.0.4 fd00:cf::/8 5000 tcp
675+
}
676+
test-ipv6-add-rule-for-source-subnet-assert() {
677+
ufw route allow proto tcp from fd00:cf::/8 to 172.18.0.4 port 5000 comment "allow webapp fd00:cf::/8 5000/tcp"
678+
}
679+
680+
571681
test-instance-name-resolves-from-name() {
572682
@mock docker inspect --format="{{.Name}}" foo
573683
@mock sed -e 's,^/,,'
@@ -598,7 +708,6 @@ test-instance-name-resolves-from-id-assert() {
598708
@dryrun echo -n fooid
599709
}
600710

601-
# TODO(DakEnviy): Add mock for custom sources
602711
function mock-ufw-status-numbered-foo() {
603712
@mock ufw status numbered === @echo "Status: active
604713
@@ -613,12 +722,19 @@ function mock-ufw-status-numbered-foo() {
613722
[ 7] 172.18.0.2 29090/tcp ALLOW FWD Anywhere # allow id111111 any 29090/tcp
614723
[ 8] 172.18.0.2 48080/tcp ALLOW FWD Anywhere # allow id222222 any 48080/tcp
615724
[ 9] 172.18.0.2 40080/tcp ALLOW FWD Anywhere # allow id333333 any 40080/tcp
616-
[10] OpenSSH (v6) ALLOW IN Anywhere (v6)
617-
[11] Anywhere (v6) ALLOW IN fd00:a:b:0:cafe::/80
618-
[12] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge
619-
[13] fd05:8f23:c937:2::3 80/tcp ALLOW FWD Anywhere (v6) # allow bar/v6 any 80/tcp bar-external
620-
[14] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal
621-
[15] fd00:a:b:deaf::3 53/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/tcp
725+
[10] 172.18.0.4 8080/tcp ALLOW FWD 192.168.1.10 # allow baz 192.168.1.10 8080/tcp
726+
[11] 172.18.0.4 8082/udp ALLOW FWD 192.168.1.10 # allow baz 192.168.1.10 8082/udp
727+
[12] 172.18.0.4 8080/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8080/tcp
728+
[13] 172.18.0.4 8081/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8081/tcp bridge
729+
[14] OpenSSH (v6) ALLOW IN Anywhere (v6)
730+
[15] Anywhere (v6) ALLOW IN fd00:a:b:0:cafe::/80
731+
[16] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge
732+
[17] fd05:8f23:c937:2::3 80/tcp ALLOW FWD Anywhere (v6) # allow bar/v6 any 80/tcp bar-external
733+
[18] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal
734+
[19] fd00:a:b:deaf::3 53/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/tcp
735+
[20] fd00:a:b:deaf::4 8080/tcp ALLOW FWD fd00:a:b:0:cafe::1 # allow baz/v6 fd00:a:b:0:cafe::1 8080/tcp
736+
[21] fd00:a:b:deaf::4 8080/tcp ALLOW FWD fd00:a:b:0:cafe::/80 # allow baz/v6 fd00:a:b:0:cafe::/80 8080/tcp
737+
[22] fd00:a:b:deaf::4 8081/tcp ALLOW FWD fd00:a:b:0:cafe::/80 # allow baz/v6 fd00:a:b:0:cafe::/80 8081/tcp bridge
622738
"
623739

624740
}
@@ -650,10 +766,17 @@ test-list-internal-all-rules-assert() {
650766
@stdout "[ 7] 172.18.0.2 29090/tcp ALLOW FWD Anywhere # allow id111111 any 29090/tcp"
651767
@stdout "[ 8] 172.18.0.2 48080/tcp ALLOW FWD Anywhere # allow id222222 any 48080/tcp"
652768
@stdout "[ 9] 172.18.0.2 40080/tcp ALLOW FWD Anywhere # allow id333333 any 40080/tcp"
653-
@stdout "[12] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
654-
@stdout "[13] fd05:8f23:c937:2::3 80/tcp ALLOW FWD Anywhere (v6) # allow bar/v6 any 80/tcp bar-external"
655-
@stdout "[14] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
656-
@stdout "[15] fd00:a:b:deaf::3 53/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/tcp"
769+
@stdout "[10] 172.18.0.4 8080/tcp ALLOW FWD 192.168.1.10 # allow baz 192.168.1.10 8080/tcp"
770+
@stdout "[11] 172.18.0.4 8082/udp ALLOW FWD 192.168.1.10 # allow baz 192.168.1.10 8082/udp"
771+
@stdout "[12] 172.18.0.4 8080/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8080/tcp"
772+
@stdout "[13] 172.18.0.4 8081/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8081/tcp bridge"
773+
@stdout "[16] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
774+
@stdout "[17] fd05:8f23:c937:2::3 80/tcp ALLOW FWD Anywhere (v6) # allow bar/v6 any 80/tcp bar-external"
775+
@stdout "[18] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
776+
@stdout "[19] fd00:a:b:deaf::3 53/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/tcp"
777+
@stdout "[20] fd00:a:b:deaf::4 8080/tcp ALLOW FWD fd00:a:b:0:cafe::1 # allow baz/v6 fd00:a:b:0:cafe::1 8080/tcp"
778+
@stdout "[21] fd00:a:b:deaf::4 8080/tcp ALLOW FWD fd00:a:b:0:cafe::/80 # allow baz/v6 fd00:a:b:0:cafe::/80 8080/tcp"
779+
@stdout "[22] fd00:a:b:deaf::4 8081/tcp ALLOW FWD fd00:a:b:0:cafe::/80 # allow baz/v6 fd00:a:b:0:cafe::/80 8081/tcp bridge"
657780
}
658781

659782
test-list-internal-rules-by-name() {
@@ -667,9 +790,9 @@ test-list-internal-rules-by-name-assert() {
667790
@stdout "[ 3] 172.17.0.3 80/tcp ALLOW FWD Anywhere # allow foo any 80/tcp bridge"
668791
@stdout "[ 5] 172.17.0.3 53/udp ALLOW FWD Anywhere # allow foo any 53/udp foo-internal"
669792
@stdout "[ 6] 172.17.0.3 53/tcp ALLOW FWD Anywhere # allow foo any 53/tcp"
670-
@stdout "[12] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
671-
@stdout "[14] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
672-
@stdout "[15] fd00:a:b:deaf::3 53/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/tcp"
793+
@stdout "[16] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
794+
@stdout "[18] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
795+
@stdout "[19] fd00:a:b:deaf::3 53/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/tcp"
673796
}
674797

675798
test-list-internal-rules-by-name-and-udp-protocol() {
@@ -681,7 +804,7 @@ test-list-internal-rules-by-name-and-udp-protocol() {
681804
}
682805
test-list-internal-rules-by-name-and-udp-protocol-assert() {
683806
@stdout "[ 5] 172.17.0.3 53/udp ALLOW FWD Anywhere # allow foo any 53/udp foo-internal"
684-
@stdout "[14] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
807+
@stdout "[18] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
685808
}
686809

687810

@@ -694,7 +817,7 @@ test-list-internal-rules-by-name-port-and-bridge-network() {
694817
}
695818
test-list-internal-rules-by-name-port-and-bridge-network-assert() {
696819
@stdout "[ 3] 172.17.0.3 80/tcp ALLOW FWD Anywhere # allow foo any 80/tcp bridge"
697-
@stdout "[12] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
820+
@stdout "[16] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
698821
}
699822

700823

@@ -707,7 +830,7 @@ test-list-internal-rules-by-name-port-and-udp-protocol() {
707830
}
708831
test-list-internal-rules-by-name-port-and-udp-protocol-assert() {
709832
@stdout "[ 5] 172.17.0.3 53/udp ALLOW FWD Anywhere # allow foo any 53/udp foo-internal"
710-
@stdout "[14] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
833+
@stdout "[18] fd00:a:b:deaf::3 53/udp ALLOW FWD Anywhere (v6) # allow foo/v6 any 53/udp foo-internal"
711834
}
712835

713836

@@ -723,6 +846,67 @@ test-list-internal-fails-with-incorrect-network-assert() {
723846
}
724847

725848

849+
test-list-internal-rules-by-name-and-source-ip() {
850+
mock-ufw-status-numbered-foo
851+
@allow-real grep '# allow baz\(/v6\)\? 192.168.1.10 [[:digit:]]\+/tcp\( [-_.[:alnum:]]\+\)\?$'
852+
853+
load-ufw-docker-function ufw-docker--list
854+
ufw-docker--list baz 192.168.1.10
855+
}
856+
test-list-internal-rules-by-name-and-source-ip-assert() {
857+
@stdout "[10] 172.18.0.4 8080/tcp ALLOW FWD 192.168.1.10 # allow baz 192.168.1.10 8080/tcp"
858+
}
859+
860+
861+
test-list-internal-rules-by-name-and-source-subnet() {
862+
mock-ufw-status-numbered-foo
863+
@allow-real grep '# allow baz\(/v6\)\? 192.168.2.10/24 [[:digit:]]\+/tcp\( [-_.[:alnum:]]\+\)\?$'
864+
865+
load-ufw-docker-function ufw-docker--list
866+
ufw-docker--list baz 192.168.2.10/24
867+
}
868+
test-list-internal-rules-by-name-and-source-subnet-assert() {
869+
@stdout "[12] 172.18.0.4 8080/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8080/tcp"
870+
@stdout "[13] 172.18.0.4 8081/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8081/tcp bridge"
871+
}
872+
873+
874+
test-list-internal-rules-by-name-source-and-port() {
875+
mock-ufw-status-numbered-foo
876+
@allow-real grep '# allow baz\(/v6\)\? 192.168.2.10/24 8081/tcp\( [-_.[:alnum:]]\+\)\?$'
877+
878+
load-ufw-docker-function ufw-docker--list
879+
ufw-docker--list baz 192.168.2.10/24 8081
880+
}
881+
test-list-internal-rules-by-name-source-and-port-assert() {
882+
@stdout "[13] 172.18.0.4 8081/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8081/tcp bridge"
883+
}
884+
885+
886+
test-list-internal-rules-by-name-source-port-and-udp-protocol() {
887+
mock-ufw-status-numbered-foo
888+
@allow-real grep '# allow baz\(/v6\)\? 192.168.1.10 8082/udp\( [-_.[:alnum:]]\+\)\?$'
889+
890+
load-ufw-docker-function ufw-docker--list
891+
ufw-docker--list baz 192.168.1.10 8082 udp
892+
}
893+
test-list-internal-rules-by-name-source-port-and-udp-protocol-assert() {
894+
@stdout "[11] 172.18.0.4 8082/udp ALLOW FWD 192.168.1.10 # allow baz 192.168.1.10 8082/udp"
895+
}
896+
897+
898+
test-list-internal-rules-by-name-source-port-protocol-and-network() {
899+
mock-ufw-status-numbered-foo
900+
@allow-real grep '# allow baz\(/v6\)\? 192.168.2.10/24 8081/tcp bridge$'
901+
902+
load-ufw-docker-function ufw-docker--list
903+
ufw-docker--list baz 192.168.2.10/24 8081 tcp bridge
904+
}
905+
test-list-internal-rules-by-name-source-port-protocol-and-network-assert() {
906+
@stdout "[13] 172.18.0.4 8081/tcp ALLOW FWD 192.168.2.10/24 # allow baz 192.168.2.10/24 8081/tcp bridge"
907+
}
908+
909+
726910
test-list-internal-rules-by-name-and-port() {
727911
mock-ufw-status-numbered-foo
728912
@allow-real grep '# allow foo\(/v6\)\? \([.:/[:xdigit:]]\+\|any\) 80/tcp\( [-_.[:alnum:]]\+\)\?$'
@@ -732,7 +916,7 @@ test-list-internal-rules-by-name-and-port() {
732916
}
733917
test-list-internal-rules-by-name-and-port-assert() {
734918
@stdout "[ 3] 172.17.0.3 80/tcp ALLOW FWD Anywhere # allow foo any 80/tcp bridge"
735-
@stdout "[12] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
919+
@stdout "[16] fd00:a:b:deaf::3 80/tcp ALLOW FWD Anywhere (v6) # allow foo/v6 any 80/tcp bridge"
736920
}
737921

738922

0 commit comments

Comments
 (0)