ceamac/slocker-lite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add extern-network outside-reachability tests (veth + tap+relay variants)

Browse Source 
The positive counterpart to the intern-network isolation tests: a
container joined to an extern network gets a default route through its
uplink and can reach a real outside address. Verified end-to-end as
root, both variants.
This commit is contained in:
Viorel Munteanu
2026-09-05 11:40:16 +00:00
parent 441ccf1419
commit 4b264d3df3
1 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/test_network_join_scenarios.cpp
+54
View File
@@ -370,6 +370,60 @@ TEST_CASE("network join: two extern peers can ping each other by IP (tap+relay)"
CHECK(found_success);
}
TEST_CASE("network join: extern network can reach the outside (veth)", "[integration][root][net]") {
if (geteuid() != 0) {
SKIP("requires root");
}
auto image = find_busybox_fixture();
if (!image) {
SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
}
ScratchXdgDirs scratch;
TestNetwork network("selftest-extern-outside-veth", NetworkKind::extern_, /*veth=*/true);
REQUIRE(network.created());
// 8.8.8.8 -- real internet access confirmed available in this sandbox
// elsewhere this session, and network_bridge.h's own extern-uplink
// verification already proved outside reachability at the host-side
// level; this confirms it end-to-end through a real container join.
auto output = run_networked(*image, {network.name()},
{"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
auto lines = extract_marked_lines(output);
bool found_success = false;
for (const auto& line : lines) {
if (line == "RESULT=0") {
found_success = true;
}
}
CHECK(found_success);
}
TEST_CASE("network join: extern network can reach the outside (tap+relay)", "[integration][root][net]") {
if (geteuid() != 0) {
SKIP("requires root");
}
auto image = find_busybox_fixture();
if (!image) {
SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
}
ScratchXdgDirs scratch;
TestNetwork network("selftest-extern-outside-tap", NetworkKind::extern_, /*veth=*/false);
REQUIRE(network.created());
auto output = run_networked(*image, {network.name()},
{"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
auto lines = extract_marked_lines(output);
bool found_success = false;
for (const auto& line : lines) {
if (line == "RESULT=0") {
found_success = true;
}
}
CHECK(found_success);
}
TEST_CASE("network join: intern network has no route to the outside (veth)", "[integration][root][net]") {
if (geteuid() != 0) {
SKIP("requires root");