octavia 14.0.0.0rc1__py3-none-any.whl → 15.0.0.0rc1__py3-none-any.whl

octavia/tests/unit/amphorae/backends/utils/test_interface.py

@@ -37,7 +37,7 @@ class TestInterface(base.TestCase):
 
         ifaces = ('eth0', 'eth7', 'eth8')
         mock_listdir.return_value = [
-            "{}.json".format(iface)
+            f"{iface}.json"
             for iface in ifaces
         ]
         mock_listdir.return_value.extend(["invalidfile"])
@@ -48,7 +48,7 @@ class TestInterface(base.TestCase):
 
         for iface in ifaces:
             f = os.path.join(consts.AMP_NET_DIR_TEMPLATE,
-                             "{}.json".format(iface))
+                             f"{iface}.json")
             self.assertIn(f, config_file_list)
 
         # unsupported file
@@ -274,11 +274,10 @@ class TestInterface(base.TestCase):
         mock_check_output.assert_called_once_with(
             ["/sbin/dhclient",
              "-lf",
-             "/var/lib/dhclient/dhclient-{}.leases".format(
-                 iface),
+             f"/var/lib/dhclient/dhclient-{iface}.leases",
              "-pf",
-             "/run/dhclient-{}.pid".format(iface),
-             iface], stderr=-2)
+             f"/run/dhclient-{iface}.pid",
+             iface], stderr=subprocess.STDOUT)
 
     @mock.patch('subprocess.check_output')
     def test__dhclient_down(self, mock_check_output):
@@ -291,11 +290,10 @@ class TestInterface(base.TestCase):
             ["/sbin/dhclient",
              "-r",
              "-lf",
-             "/var/lib/dhclient/dhclient-{}.leases".format(
-                 iface),
+             f"/var/lib/dhclient/dhclient-{iface}.leases",
              "-pf",
-             "/run/dhclient-{}.pid".format(iface),
-             iface], stderr=-2)
+             f"/run/dhclient-{iface}.pid",
+             iface], stderr=subprocess.STDOUT)
 
     @mock.patch('subprocess.check_output')
     def test__ipv6auto_up(self, mock_check_output):
@@ -306,9 +304,11 @@ class TestInterface(base.TestCase):
 
         mock_check_output.assert_has_calls([
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.iface2.accept_ra=2"], stderr=-2),
+                       "net.ipv6.conf.iface2.accept_ra=2"],
+                      stderr=subprocess.STDOUT),
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.iface2.autoconf=1"], stderr=-2)])
+                       "net.ipv6.conf.iface2.autoconf=1"],
+                      stderr=subprocess.STDOUT)])
 
     @mock.patch('subprocess.check_output')
     def test__ipv6auto_down(self, mock_check_output):
@@ -319,9 +319,11 @@ class TestInterface(base.TestCase):
 
         mock_check_output.assert_has_calls([
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.iface2.accept_ra=0"], stderr=-2),
+                       "net.ipv6.conf.iface2.accept_ra=0"],
+                      stderr=subprocess.STDOUT),
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.iface2.autoconf=0"], stderr=-2)])
+                       "net.ipv6.conf.iface2.autoconf=0"],
+                      stderr=subprocess.STDOUT)])
 
     @mock.patch('pyroute2.IPRoute.rule')
     @mock.patch('pyroute2.IPRoute.route')
@@ -452,7 +454,7 @@ class TestInterface(base.TestCase):
     @mock.patch('octavia.amphorae.backends.utils.network_namespace.'
                 'NetworkNamespace')
     @mock.patch('octavia.amphorae.backends.utils.nftable_utils.'
-                'write_nftable_vip_rules_file')
+                'write_nftable_rules_file')
     @mock.patch('pyroute2.IPRoute.rule')
     @mock.patch('pyroute2.IPRoute.route')
     @mock.patch('pyroute2.IPRoute.addr')
@@ -578,16 +580,8 @@ class TestInterface(base.TestCase):
                       family=socket.AF_INET6)])
 
         mock_check_output.assert_has_calls([
-            mock.call([consts.NFT_CMD, consts.NFT_ADD, 'table',
-                       consts.NFT_FAMILY, consts.NFT_VIP_TABLE], stderr=-2),
-            mock.call([consts.NFT_CMD, consts.NFT_ADD, 'chain',
-                       consts.NFT_FAMILY, consts.NFT_VIP_TABLE,
-                       consts.NFT_VIP_CHAIN, '{', 'type', 'filter', 'hook',
-                       'ingress', 'device', 'fake-eth1', 'priority',
-                       consts.NFT_SRIOV_PRIORITY, ';', 'policy', 'drop', ';',
-                       '}'], stderr=-2),
-            mock.call([consts.NFT_CMD, '-o', '-f', consts.NFT_VIP_RULES_FILE],
-                      stderr=-2),
+            mock.call([consts.NFT_CMD, '-o', '-f', consts.NFT_RULES_FILE],
+                      stderr=subprocess.STDOUT),
             mock.call(["post-up", "fake-eth1"])
         ])
 
@@ -921,17 +915,16 @@ class TestInterface(base.TestCase):
         mock_check_output.assert_has_calls([
             mock.call(["/sbin/dhclient",
                        "-lf",
-                       "/var/lib/dhclient/dhclient-{}.leases".format(
-                           iface.name),
+                       f"/var/lib/dhclient/dhclient-{iface.name}.leases",
                        "-pf",
-                       "/run/dhclient-{}.pid".format(iface.name),
-                       iface.name], stderr=-2),
+                       f"/run/dhclient-{iface.name}.pid",
+                       iface.name], stderr=subprocess.STDOUT),
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.{}.accept_ra=2".format(iface.name)],
-                      stderr=-2),
+                       f"net.ipv6.conf.{iface.name}.accept_ra=2"],
+                      stderr=subprocess.STDOUT),
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.{}.autoconf=1".format(iface.name)],
-                      stderr=-2),
+                       f"net.ipv6.conf.{iface.name}.autoconf=1"],
+                      stderr=subprocess.STDOUT),
             mock.call(["post-up", iface.name])
         ])
 
@@ -1338,17 +1331,16 @@ class TestInterface(base.TestCase):
             mock.call(["/sbin/dhclient",
                        "-r",
                        "-lf",
-                       "/var/lib/dhclient/dhclient-{}.leases".format(
-                           iface.name),
+                       f"/var/lib/dhclient/dhclient-{iface.name}.leases",
                        "-pf",
-                       "/run/dhclient-{}.pid".format(iface.name),
-                       iface.name], stderr=-2),
+                       f"/run/dhclient-{iface.name}.pid",
+                       iface.name], stderr=subprocess.STDOUT),
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.{}.accept_ra=0".format(iface.name)],
-                      stderr=-2),
+                       f"net.ipv6.conf.{iface.name}.accept_ra=0"],
+                      stderr=subprocess.STDOUT),
             mock.call(["/sbin/sysctl", "-w",
-                       "net.ipv6.conf.{}.autoconf=0".format(iface.name)],
-                      stderr=-2),
+                       f"net.ipv6.conf.{iface.name}.autoconf=0"],
+                      stderr=subprocess.STDOUT),
             mock.call(["post-down", iface.name])
         ])
 
@@ -1444,56 +1436,3 @@ class TestInterface(base.TestCase):
 
         addr = controller._normalize_ip_network(None)
         self.assertIsNone(addr)
-
-    @mock.patch('octavia.amphorae.backends.utils.nftable_utils.'
-                'load_nftables_file')
-    @mock.patch('octavia.amphorae.backends.utils.nftable_utils.'
-                'write_nftable_vip_rules_file')
-    @mock.patch('subprocess.check_output')
-    def test__setup_nftables_chain(self, mock_check_output, mock_write_rules,
-                                   mock_load_rules):
-
-        controller = interface.InterfaceController()
-
-        mock_check_output.side_effect = [
-            mock.DEFAULT, mock.DEFAULT,
-            subprocess.CalledProcessError(cmd=consts.NFT_CMD, returncode=-1),
-            mock.DEFAULT,
-            subprocess.CalledProcessError(cmd=consts.NFT_CMD, returncode=-1)]
-
-        interface_mock = mock.MagicMock()
-        interface_mock.name = 'fake2'
-
-        # Test succeessful path
-        controller._setup_nftables_chain(interface_mock)
-
-        mock_write_rules.assert_called_once_with('fake2', [])
-        mock_load_rules.assert_called_once_with()
-        mock_check_output.assert_has_calls([
-            mock.call([consts.NFT_CMD, 'add', 'table', consts.NFT_FAMILY,
-                       consts.NFT_VIP_TABLE], stderr=subprocess.STDOUT),
-            mock.call([consts.NFT_CMD, 'add', 'chain', consts.NFT_FAMILY,
-                       consts.NFT_VIP_TABLE, consts.NFT_VIP_CHAIN, '{',
-                       'type', 'filter', 'hook', 'ingress', 'device',
-                       'fake2', 'priority', consts.NFT_SRIOV_PRIORITY, ';',
-                       'policy', 'drop', ';', '}'], stderr=subprocess.STDOUT)])
-
-        # Test first nft call fails
-        mock_write_rules.reset_mock()
-        mock_load_rules.reset_mock()
-        mock_check_output.reset_mock()
-
-        self.assertRaises(subprocess.CalledProcessError,
-                          controller._setup_nftables_chain, interface_mock)
-        mock_check_output.assert_called_once()
-        mock_write_rules.assert_not_called()
-
-        # Test second nft call fails
-        mock_write_rules.reset_mock()
-        mock_load_rules.reset_mock()
-        mock_check_output.reset_mock()
-
-        self.assertRaises(subprocess.CalledProcessError,
-                          controller._setup_nftables_chain, interface_mock)
-        self.assertEqual(2, mock_check_output.call_count)
-        mock_write_rules.assert_not_called()

octavia/tests/unit/amphorae/backends/utils/test_interface_file.py

@@ -112,13 +112,13 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv4 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
                         "/usr/local/bin/lvs-masquerade.sh delete ipv4 "
-                        "{}".format(netns_interface))
+                        f"{netns_interface}")
                 }]
             }
         }
@@ -244,13 +244,13 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv4 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
                         "/usr/local/bin/lvs-masquerade.sh delete ipv4 "
-                        "{}".format(netns_interface))
+                        f"{netns_interface}")
                 }]
             }
         }
@@ -323,13 +323,13 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv4 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh delete ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh delete ipv4 "
+                        f"{netns_interface}")
                 }]
             }
         }
@@ -404,13 +404,13 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv4 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh delete ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh delete ipv4 "
+                        f"{netns_interface}")
                 }]
             }
         }
@@ -516,13 +516,13 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv6 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv6 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh delete ipv6 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh delete ipv6 "
+                        f"{netns_interface}")
                 }]
             }
         }
@@ -603,21 +603,21 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv4 "
+                        f"{netns_interface}")
                 }, {
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv6 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv6 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh delete ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh delete ipv4 "
+                        f"{netns_interface}")
                 }, {
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh delete ipv6 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh delete ipv6 "
+                        f"{netns_interface}")
                 }]
             }
         }
@@ -654,21 +654,21 @@ class TestInterfaceFile(base.TestCase):
             consts.SCRIPTS: {
                 consts.IFACE_UP: [{
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv4 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv4 "
+                        f"{netns_interface}")
                 }, {
                     consts.COMMAND: (
-                        "/usr/local/bin/lvs-masquerade.sh add ipv6 "
-                        "{}".format(netns_interface))
+                        f"/usr/local/bin/lvs-masquerade.sh add ipv6 "
+                        f"{netns_interface}")
                 }],
                 consts.IFACE_DOWN: [{
                     consts.COMMAND: (
                         "/usr/local/bin/lvs-masquerade.sh delete ipv4 "
-                        "{}".format(netns_interface))
+                        f"{netns_interface}")
                 }, {
                     consts.COMMAND: (
                         "/usr/local/bin/lvs-masquerade.sh delete ipv6 "
-                        "{}".format(netns_interface))
+                        f"{netns_interface}")
                 }]
             }
         }

octavia/tests/unit/amphorae/backends/utils/test_network_namespace.py

@@ -50,9 +50,8 @@ class TestNetworkNamespace(base.TestCase):
         mock_cdll_obj = mock.MagicMock()
         mock_cdll.return_value = mock_cdll_obj
         mock_getpid.return_value = FAKE_PID
-        expected_current_netns = '/proc/{pid}/ns/net'.format(pid=FAKE_PID)
-        expected_target_netns = '/var/run/netns/{netns}'.format(
-            netns=FAKE_NETNS)
+        expected_current_netns = f'/proc/{FAKE_PID}/ns/net'
+        expected_target_netns = f'/var/run/netns/{FAKE_NETNS}'
 
         netns = network_namespace.NetworkNamespace(FAKE_NETNS)
 
@@ -72,9 +71,8 @@ class TestNetworkNamespace(base.TestCase):
         mock_getpid.return_value = FAKE_PID
         mock_cdll_obj = mock.MagicMock()
         mock_cdll.return_value = mock_cdll_obj
-        expected_current_netns = '/proc/{pid}/ns/net'.format(pid=FAKE_PID)
-        expected_target_netns = '/var/run/netns/{netns}'.format(
-            netns=FAKE_NETNS)
+        expected_current_netns = f'/proc/{FAKE_PID}/ns/net'
+        expected_target_netns = f'/var/run/netns/{FAKE_NETNS}'
 
         netns = network_namespace.NetworkNamespace(FAKE_NETNS)
 

octavia/tests/unit/amphorae/backends/utils/test_nftable_utils.py

@@ -28,23 +28,22 @@ import octavia.tests.unit.base as base
 class TestNFTableUtils(base.TestCase):
     @mock.patch('os.open')
     @mock.patch('os.path.isfile')
-    def test_write_nftable_vip_rules_file_exists(self, mock_isfile, mock_open):
+    def test_write_nftable_rules_file_exists(self, mock_isfile, mock_open):
         """Test when a rules file exists and no new rules
 
         When an existing rules file is present and we call
-        write_nftable_vip_rules_file with no rules, the method should not
+        write_nftable_rules_file with no rules, the method should not
         overwrite the existing rules.
         """
         mock_isfile.return_value = True
 
-        nftable_utils.write_nftable_vip_rules_file('fake-eth2', [])
+        nftable_utils.write_nftable_rules_file('fake-eth2', [])
 
         mock_open.assert_not_called()
 
     @mock.patch('os.open')
     @mock.patch('os.path.isfile')
-    def test_write_nftable_vip_rules_file_rules(self, mock_isfile,
-                                                mock_open):
+    def test_write_nftable_rules_file_rules(self, mock_isfile, mock_open):
         """Test when a rules file exists and rules are passed in
 
         This should create a simple rules file with the base chain and rules.
@@ -61,32 +60,40 @@ class TestNFTableUtils(base.TestCase):
 
         mocked_open = mock.mock_open()
         with mock.patch.object(os, 'fdopen', mocked_open):
-            nftable_utils.write_nftable_vip_rules_file(
+            nftable_utils.write_nftable_rules_file(
                 'fake-eth2', [test_rule_1, test_rule_2])
 
         mocked_open.assert_called_once_with('fake-fd', 'w')
         mock_open.assert_called_once_with(
-            consts.NFT_VIP_RULES_FILE,
+            consts.NFT_RULES_FILE,
             (os.O_WRONLY | os.O_CREAT | os.O_TRUNC),
             (stat.S_IRUSR | stat.S_IWUSR))
 
         handle = mocked_open()
         handle.write.assert_has_calls([
-            mock.call(f'table {consts.NFT_FAMILY} {consts.NFT_VIP_TABLE} '
+            mock.call(f'table {consts.NFT_FAMILY} {consts.NFT_TABLE} '
                       '{}\n'),
             mock.call(f'delete table {consts.NFT_FAMILY} '
-                      f'{consts.NFT_VIP_TABLE}\n'),
-            mock.call(f'table {consts.NFT_FAMILY} {consts.NFT_VIP_TABLE} '
+                      f'{consts.NFT_TABLE}\n'),
+            mock.call(f'table {consts.NFT_FAMILY} {consts.NFT_TABLE} '
                       '{\n'),
-            mock.call(f'  chain {consts.NFT_VIP_CHAIN} {{\n'),
-            mock.call('    type filter hook ingress device fake-eth2 '
-                      f'priority {consts.NFT_SRIOV_PRIORITY}; policy drop;\n'),
+            mock.call(f'  chain {consts.NFT_CHAIN} {{\n'),
+            mock.call('    type filter hook input priority filter; '
+                      'policy drop;\n'),
+            mock.call('      ct state vmap { established : accept, related : '
+                      'accept, invalid : drop }\n'),
+            mock.call('      iif lo accept\n'),
+            mock.call('      ip saddr 127.0.0.0/8 drop\n'),
+            mock.call('      ip6 saddr ::1 drop\n'),
             mock.call('      icmp type destination-unreachable accept\n'),
             mock.call('      icmpv6 type { nd-neighbor-solicit, '
                       'nd-router-advert, nd-neighbor-advert, packet-too-big, '
                       'destination-unreachable } accept\n'),
             mock.call('      udp sport 67 udp dport 68 accept\n'),
             mock.call('      udp sport 547 udp dport 546 accept\n'),
+            mock.call('      iifname eth1 goto amphora_vip_chain\n'),
+            mock.call('  }\n'),
+            mock.call('  chain amphora_vip_chain {\n'),
             mock.call('      tcp dport 1234 accept\n'),
             mock.call('      ip saddr 192.0.2.0/24 ip protocol 112 accept\n'),
             mock.call('  }\n'),
@@ -95,8 +102,7 @@ class TestNFTableUtils(base.TestCase):
 
     @mock.patch('os.open')
     @mock.patch('os.path.isfile')
-    def test_write_nftable_vip_rules_file_missing(self, mock_isfile,
-                                                  mock_open):
+    def test_write_nftable_rules_file_missing(self, mock_isfile, mock_open):
         """Test when a rules file does not exist and no new rules
 
         This should create a simple rules file with the base chain.
@@ -106,21 +112,21 @@ class TestNFTableUtils(base.TestCase):
 
         mocked_open = mock.mock_open()
         with mock.patch.object(os, 'fdopen', mocked_open):
-            nftable_utils.write_nftable_vip_rules_file('fake-eth2', [])
+            nftable_utils.write_nftable_rules_file('fake-eth2', [])
 
         mocked_open.assert_called_once_with('fake-fd', 'w')
         mock_open.assert_called_once_with(
-            consts.NFT_VIP_RULES_FILE,
+            consts.NFT_RULES_FILE,
             (os.O_WRONLY | os.O_CREAT | os.O_TRUNC),
             (stat.S_IRUSR | stat.S_IWUSR))
 
         handle = mocked_open()
         handle.write.assert_has_calls([
-            mock.call(f'table {consts.NFT_FAMILY} {consts.NFT_VIP_TABLE} '
+            mock.call(f'table {consts.NFT_FAMILY} {consts.NFT_TABLE} '
                       '{\n'),
-            mock.call(f'  chain {consts.NFT_VIP_CHAIN} {{\n'),
-            mock.call('    type filter hook ingress device fake-eth2 '
-                      f'priority {consts.NFT_SRIOV_PRIORITY}; policy drop;\n'),
+            mock.call(f'  chain {consts.NFT_CHAIN} {{\n'),
+            mock.call('    type filter hook input priority filter; '
+                      'policy drop;\n'),
             mock.call('      icmp type destination-unreachable accept\n'),
             mock.call('      icmpv6 type { nd-neighbor-solicit, '
                       'nd-router-advert, nd-neighbor-advert, packet-too-big, '
@@ -184,7 +190,7 @@ class TestNFTableUtils(base.TestCase):
 
         mock_netns.assert_called_once_with(consts.AMPHORA_NAMESPACE)
         mock_check_output.assert_called_once_with([
-            consts.NFT_CMD, '-o', '-f', consts.NFT_VIP_RULES_FILE],
+            consts.NFT_CMD, '-o', '-f', consts.NFT_RULES_FILE],
             stderr=subprocess.STDOUT)
 
         self.assertRaises(subprocess.CalledProcessError,