mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-09 16:31:29 +02:00
778b3b3264
* Unify peer and route ACL filtering with multi-source peer rules * Remove partial userspace firewall mode and open foreign chains via a table-less allower * Snapshot iptables rule maps before persisting state * Scope userspace firewall wildcard source rules per address family * Install nftables peer filter and mangle rules in a single transaction * Share the iptables jump rule spec between install and cleanup * Fix legacy ACL source wildcard and keep rollback tracking on delete failure * Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression * Fall back to per-prefix filter rules when ipset is unavailable * Annotate legacy PeerIP usages in ACL tests and fix import formatting * Keep firewall rule bookkeeping in step with the kernel on replace and teardown * Release the routing reference when the route manager shuts down * Keep set references and rule tracking consistent when a routing rule fails
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package nftables
|
|
|
|
import (
|
|
"net/netip"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestConvertPrefixesToSetWildcard verifies that a /0 prefix produces a
|
|
// usable interval. The last address of a /0 is the broadcast, whose Next()
|
|
// overflows to an invalid Addr with an empty key; the IntervalEnd must wrap
|
|
// to the zero address instead so nftables sees a full-range interval.
|
|
func TestConvertPrefixesToSetWildcard(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
af addrFamily
|
|
prefix string
|
|
}{
|
|
{"IPv4 /0", afIPv4, "0.0.0.0/0"},
|
|
{"IPv6 /0", afIPv6, "::/0"},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &family{af: tt.af}
|
|
elements := r.convertPrefixesToSet([]netip.Prefix{netip.MustParsePrefix(tt.prefix)})
|
|
|
|
require.Len(t, elements, 2, "expected start and interval-end element")
|
|
assert.False(t, elements[0].IntervalEnd, "first element is the interval start")
|
|
assert.True(t, elements[1].IntervalEnd, "second element is the interval end")
|
|
assert.Len(t, elements[1].Key, int(tt.af.addrLen), "interval-end key must be a zero address, not empty")
|
|
})
|
|
}
|
|
}
|