ceamac/slocker-lite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add intern-network outside-isolation tests (veth + tap+relay variants)

Browse Source 
A container joined only to an intern network gets no default route
(network_join.cpp), so pinging a real outside address (8.8.8.8) must
fail outright, not merely succeed slower than an extern join would.
Verified end-to-end as root: both variants correctly report
"Network unreachable" and the tests assert a RESULT= line was seen
(the command actually ran) that isn't RESULT=0.
This commit is contained in:
Viorel Munteanu
2026-09-05 11:39:01 +00:00
parent f9e68d48d9
commit b42073c48e
1 changed files with 61 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/test_network_join_scenarios.cpp
+61
View File
@@ -300,6 +300,67 @@ TEST_CASE("network join: two intern peers can ping each other by IP (veth)", "[i
CHECK(found_success);
}
TEST_CASE("network join: intern network has no route to the outside (veth)", "[integration][root][net]") {
if (geteuid() != 0) {
SKIP("requires root");
}
auto image = find_busybox_fixture();
if (!image) {
SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
}
ScratchXdgDirs scratch;
TestNetwork network("selftest-intern-isolation-veth", NetworkKind::intern, /*veth=*/true);
REQUIRE(network.created());
// 8.8.8.8 is real, well-known and reachable outside this project's own
// sandbox (already confirmed by direct testing elsewhere this session,
// and by network_bridge.h's own extern-uplink verification) -- an
// intern network gets no default route at all (network_join.cpp), so
// this must fail, not merely time out slower than an extern join would.
auto output = run_networked(*image, {network.name()},
{"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
auto lines = extract_marked_lines(output);
bool found_result = false;
bool found_success = false;
for (const auto& line : lines) {
if (line.rfind("RESULT=", 0) == 0) {
found_result = true;
found_success = (line == "RESULT=0");
}
}
CHECK(found_result);
CHECK_FALSE(found_success);
}
TEST_CASE("network join: intern network has no route to the outside (tap+relay)", "[integration][root][net]") {
if (geteuid() != 0) {
SKIP("requires root");
}
auto image = find_busybox_fixture();
if (!image) {
SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
}
ScratchXdgDirs scratch;
TestNetwork network("selftest-intern-isolation-tap", NetworkKind::intern, /*veth=*/false);
REQUIRE(network.created());
auto output = run_networked(*image, {network.name()},
{"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
auto lines = extract_marked_lines(output);
bool found_result = false;
bool found_success = false;
for (const auto& line : lines) {
if (line.rfind("RESULT=", 0) == 0) {
found_result = true;
found_success = (line == "RESULT=0");
}
}
CHECK(found_result);
CHECK_FALSE(found_success);
}
TEST_CASE("network join: two intern peers can ping each other by IP (tap+relay)", "[integration][root][net]") {
if (geteuid() != 0) {
SKIP("requires root");