mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 06:56:52 +01:00
118 lines
3.6 KiB
Go
118 lines
3.6 KiB
Go
package nicfinder
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"net/netip"
|
|
"regexp"
|
|
"testing"
|
|
|
|
"github.com/slackhq/nebula/test"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
type allowAll struct{}
|
|
|
|
func (allowAll) Allow(netip.Addr) bool { return true }
|
|
func (allowAll) AllowName(string) bool { return true }
|
|
|
|
type testAllowList struct {
|
|
bannedName *regexp.Regexp
|
|
bannedAddr netip.Addr
|
|
}
|
|
|
|
func (l *testAllowList) Allow(addr netip.Addr) bool {
|
|
return addr != l.bannedAddr
|
|
}
|
|
|
|
func (l *testAllowList) AllowName(n string) bool {
|
|
return !l.bannedName.MatchString(n)
|
|
}
|
|
|
|
func newTestAllowList(bannedName string) *testAllowList {
|
|
return &testAllowList{
|
|
bannedName: regexp.MustCompile(bannedName),
|
|
}
|
|
}
|
|
|
|
func TestAllowedAddr(t *testing.T) {
|
|
ctx, l := context.Background(), test.NewLogger()
|
|
allowed := func(filter Filter, addrs []net.Addr) []netip.Addr {
|
|
var out []netip.Addr
|
|
for _, rawAddr := range addrs {
|
|
if addr, ok := allowedAddr(ctx, l, filter, rawAddr); ok {
|
|
out = append(out, addr)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
addrs := []net.Addr{
|
|
&net.IPNet{IP: net.ParseIP("127.0.0.1"), Mask: net.CIDRMask(8, 32)},
|
|
&net.IPNet{IP: net.ParseIP("::1"), Mask: net.CIDRMask(128, 128)},
|
|
&net.IPNet{IP: net.ParseIP("10.0.0.5"), Mask: net.CIDRMask(24, 32)},
|
|
&net.IPNet{IP: net.ParseIP("169.254.10.10"), Mask: net.CIDRMask(16, 32)},
|
|
&net.IPNet{IP: net.ParseIP("fe80::1"), Mask: net.CIDRMask(64, 128)},
|
|
&net.IPAddr{IP: net.ParseIP("fd00::5")},
|
|
&net.IPNet{},
|
|
otherAddr{},
|
|
nil,
|
|
}
|
|
|
|
// Loopback, link local and anything without an IP are dropped, and IPv4 comes back unmapped
|
|
// even though net.ParseIP hands over a 16 byte slice.
|
|
assert.Equal(t, []netip.Addr{
|
|
netip.MustParseAddr("10.0.0.5"),
|
|
netip.MustParseAddr("fd00::5"),
|
|
}, allowed(allowAll{}, addrs))
|
|
|
|
// The filter sees the unmapped form and can drop a single address.
|
|
al := newTestAllowList("none")
|
|
al.bannedAddr = netip.MustParseAddr("10.0.0.5")
|
|
assert.Equal(t, []netip.Addr{netip.MustParseAddr("fd00::5")}, allowed(al, addrs))
|
|
}
|
|
|
|
// otherAddr is a net.Addr that is neither *net.IPNet nor *net.IPAddr. netlink.Addr is one such
|
|
// type: it satisfies net.Addr through an embedded *net.IPNet, and passing it directly once
|
|
// silently produced no addresses.
|
|
type otherAddr struct{}
|
|
|
|
func (otherAddr) Network() string { return "other" }
|
|
func (otherAddr) String() string { return "other" }
|
|
|
|
// hostFilter counts AllowName calls and can reject every name or every address.
|
|
type hostFilter struct {
|
|
rejectNames bool
|
|
rejectAddrs bool
|
|
asked map[string]int
|
|
}
|
|
|
|
func (f *hostFilter) Allow(netip.Addr) bool { return !f.rejectAddrs }
|
|
func (f *hostFilter) AllowName(name string) bool {
|
|
f.asked[name]++
|
|
return !f.rejectNames
|
|
}
|
|
|
|
// Runs this platform's localAddrs against the host and checks it honors the whole filter.
|
|
func TestLocalAddrsAppliesFilter(t *testing.T) {
|
|
ctx, l := context.Background(), test.NewLogger()
|
|
|
|
f := &hostFilter{asked: map[string]int{}}
|
|
all, err := localAddrs(ctx, l, f)
|
|
if len(f.asked) == 0 {
|
|
t.Skipf("no interfaces to enumerate here: %v", err)
|
|
}
|
|
for name, n := range f.asked {
|
|
assert.Equal(t, 1, n, "AllowName asked %d times for %s", n, name)
|
|
}
|
|
// Loopback and link-local never come back, whatever the filter says.
|
|
for _, addr := range all {
|
|
assert.False(t, addr.IsLoopback() || addr.IsLinkLocalUnicast(), "%s", addr)
|
|
}
|
|
|
|
none, _ := localAddrs(ctx, l, &hostFilter{rejectNames: true, asked: map[string]int{}})
|
|
assert.Empty(t, none, "addresses got past a filter that rejects every interface name")
|
|
|
|
none, _ = localAddrs(ctx, l, &hostFilter{rejectAddrs: true, asked: map[string]int{}})
|
|
assert.Empty(t, none, "addresses got past a filter that rejects every address")
|
|
}
|