),
		Entry("with multiple destination networks specified",
			garden.NetOutRule{Networks: []garden.IPRange{
				{Start: net.ParseIP("1.2.3.4")},
				{Start: net.ParseIP("2.2.3.4"), End: net.ParseIP("2.2.3.9")},
			}},
			[]iptables.SingleFilterRule{
				{Networks: &garden.IPRange{Start: net.ParseIP("1.2.3.4")}},
				{Networks: &garden.IPRange{Start: net.ParseIP("2.2.3.4"), End: net.ParseIP("2.2.3.9")}},
			},
		),
		Entry("with a single port specified",
			garden.NetOutRule{
				Protocol: garden.ProtocolTCP,
				Ports: []garden.PortRange{
					garden.PortRangeFromPort(22),
				},
			},
			[]iptables.SingleFilterRule{
				{Protocol: garden.ProtocolTCP, Ports: &garden.PortRange{Start: 22, End: 22}},
			},
		),
		Entry("with multiple ports specified",
			garden.NetOutRule{
				Protocol: garden.ProtocolTCP,
				Ports: []garden.PortRange{
					garden.PortRangeFromPort(22),
					garden.PortRange{Start: 1000, End: 10000},
				},
			},
			[]iptables.SingleFilterRule{
示例#2
0
		})

		JustBeforeEach(func() {
			server.AppendHandlers(
				ghttp.CombineHandlers(
					ghttp.VerifyRequest("POST", fmt.Sprintf("/containers/%s/net/out", handle)),
					verifyRequestBody(&rule, &garden.NetOutRule{}),
					ghttp.RespondWith(200, "{}")))
		})

		Context("when a NetOutRule is passed", func() {
			BeforeEach(func() {
				rule = garden.NetOutRule{
					Protocol: garden.ProtocolICMP,
					Networks: []garden.IPRange{garden.IPRangeFromIP(net.ParseIP("1.2.3.4"))},
					Ports:    []garden.PortRange{garden.PortRangeFromPort(2), garden.PortRangeFromPort(4)},
					ICMPs:    &garden.ICMPControl{Type: 3, Code: garden.ICMPControlCode(3)},
					Log:      true,
				}
			})

			It("should send the rule over the wire", func() {
				Ω(connection.NetOut(handle, rule)).Should(Succeed())
			})
		})
	})

	Describe("Listing containers", func() {
		BeforeEach(func() {
			server.AppendHandlers(
				ghttp.CombineHandlers(
			// Once we have a good baseline...
			//Expect(timed).To(BeNumerically(",", ???))
			//Expect(b.Seconds()).To(BeNumerically(",", ???))
		}, 20)
	})

	Measure("BulkNetOut", func(b Benchmarker) {
		b.Time("3000 rules", func() {
			rules := make([]garden.NetOutRule, 0)

			for i := 0; i < 3000; i++ {
				rules = append(rules, garden.NetOutRule{
					Protocol: garden.ProtocolTCP,
					Networks: []garden.IPRange{garden.IPRangeFromIP(net.ParseIP("8.8.8.8"))},
					Ports:    []garden.PortRange{garden.PortRangeFromPort(uint16(i))},
				})
			}

			container, err := gardenClient.Create(garden.ContainerSpec{})
			Expect(err).ToNot(HaveOccurred())

			Expect(container.BulkNetOut(rules)).To(Succeed())

			Expect(gardenClient.Destroy(container.Handle())).To(Succeed())
		})
	}, 5)
})

func emitMetric(req interface{}) {
	if os.Getenv("DATADOG_API_KEY") == "" {
	})

	Describe("IPRangeFromIPNet", func() {
		It("Creates an IPRange with the Start and End set to the extent of the IPNet", func() {
			ip, cidr, err := net.ParseCIDR("1.2.3.0/24")
			Ω(err).Should(Succeed())

			r := garden.IPRangeFromIPNet(cidr)
			Ω(r.Start.String()).Should(Equal(ip.String()))
			Ω(r.End.String()).Should(Equal("1.2.3.255"))
		})
	})

	Describe("PortRangeFromPort", func() {
		It("Creates an PortRange with the Start and End set to the passed port", func() {
			r := garden.PortRangeFromPort(2)
			Ω(r.Start).Should(Equal(uint16(2)))
			Ω(r.End).Should(Equal(r.Start))
		})
	})

	Describe("ICMPControlCode", func() {
		It("returns an ICMPCode with the passed uint8", func() {
			var icmpVar *garden.ICMPCode
			code := garden.ICMPControlCode(uint8(2))
			Ω(code).Should(BeAssignableToTypeOf(icmpVar))
			Ω(*code).Should(BeNumerically("==", 2))
		})
	})
})
示例#5
0
				Expect(checkConnection(container, "8.8.8.8", 53)).To(MatchError("Request failed. Process exited with code 1"))
				Expect(checkConnection(container, "8.8.4.4", 53)).To(MatchError("Request failed. Process exited with code 1"))
			})
		})
	})

	Describe("NetOut", func() {
		var (
			rule garden.NetOutRule
		)

		BeforeEach(func() {
			rule = garden.NetOutRule{
				Protocol: garden.ProtocolTCP,
				Networks: []garden.IPRange{garden.IPRangeFromIP(net.ParseIP("8.8.8.8"))},
				Ports:    []garden.PortRange{garden.PortRangeFromPort(53)},
			}
		})

		Context("when an IP within the denied network range is permitted", func() {
			BeforeEach(func() {
				args = append(args, "--deny-network", "0.0.0.0/0")
			})

			JustBeforeEach(func() {
				Expect(checkConnection(container, "8.8.8.8", 53)).To(MatchError("Request failed. Process exited with code 1"))
			})

			It("should access internet", func() {
				Expect(container.NetOut(rule)).To(Succeed())
				Expect(checkConnection(container, "8.8.8.8", 53)).To(Succeed())