mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-11 17:29:07 +02:00
Viktor Liu
778b3b3264
* Unify peer and route ACL filtering with multi-source peer rules * Remove partial userspace firewall mode and open foreign chains via a table-less allower * Snapshot iptables rule maps before persisting state * Scope userspace firewall wildcard source rules per address family * Install nftables peer filter and mangle rules in a single transaction * Share the iptables jump rule spec between install and cleanup * Fix legacy ACL source wildcard and keep rollback tracking on delete failure * Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression * Fall back to per-prefix filter rules when ipset is unavailable * Annotate legacy PeerIP usages in ACL tests and fix import formatting * Keep firewall rule bookkeeping in step with the kernel on replace and teardown * Release the routing reference when the route manager shuts down * Keep set references and rule tracking consistent when a routing rule fails
67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"net/netip"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
firewall "github.com/netbirdio/netbird/client/firewall/manager"
|
|
"github.com/netbirdio/netbird/client/internal/peer"
|
|
"github.com/netbirdio/netbird/route"
|
|
)
|
|
|
|
// routingFirewall records the routing lifecycle calls the router makes. The
|
|
// embedded interface covers the methods this test never reaches.
|
|
type routingFirewall struct {
|
|
firewall.Manager
|
|
|
|
removed []firewall.RouterPair
|
|
enabled int
|
|
disabled int
|
|
}
|
|
|
|
func (f *routingFirewall) RemoveNatRule(pair firewall.RouterPair) error {
|
|
f.removed = append(f.removed, pair)
|
|
return nil
|
|
}
|
|
|
|
func (f *routingFirewall) EnableRouting() error {
|
|
f.enabled++
|
|
return nil
|
|
}
|
|
|
|
func (f *routingFirewall) DisableRouting() error {
|
|
f.disabled++
|
|
return nil
|
|
}
|
|
|
|
// TestRouterCleanUpReleasesRouting covers the shutdown path: the router holds a
|
|
// routing reference for as long as it serves routes, and CleanUp has to give it
|
|
// back. Without that the sysctls the reference enabled (IPv6 forwarding and the
|
|
// accept_ra values that keep RA handling working alongside it) stay applied
|
|
// after the client stops, leaving the host configured as a router.
|
|
func TestRouterCleanUpReleasesRouting(t *testing.T) {
|
|
fw := &routingFirewall{}
|
|
r := &Router{
|
|
ctx: context.Background(),
|
|
firewall: fw,
|
|
statusRecorder: peer.NewRecorder("https://mgm"),
|
|
routes: map[route.ID]*route.Route{
|
|
"route-1": {
|
|
ID: "route-1",
|
|
Network: netip.MustParsePrefix("192.168.55.0/24"),
|
|
NetworkType: route.IPv4Network,
|
|
Masquerade: true,
|
|
},
|
|
},
|
|
}
|
|
|
|
r.CleanUp()
|
|
|
|
require.Len(t, fw.removed, 1, "the route's NAT rule must be removed")
|
|
assert.Equal(t, 1, fw.disabled, "CleanUp must release the routing reference")
|
|
}
|