From 5c41509ff47c0028c7c025d0d7f726b197bbb384 Mon Sep 17 00:00:00 2001 From: Kevin Krakauer Date: Wed, 15 Nov 2023 20:57:27 -0800 Subject: [PATCH] iptables: account for old kernel being old Our oldkernel test machines use an iptables binary so old that when we scrape the rules, the newer iptables binary running inside gVisor doesn't support the revision anymore. Account for that in the test so that nftables_test doesn't fail every time it's run on oldkernel. Example failure: https://buildkite.com/gvisor/pipeline/builds/25928#018bd63c-4ffe-43ee-bfb0-916766db35f2 PiperOrigin-RevId: 582897811 --- test/iptables/nftables_test.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/iptables/nftables_test.sh b/test/iptables/nftables_test.sh index b50b6ad9e..8b6aedd06 100755 --- a/test/iptables/nftables_test.sh +++ b/test/iptables/nftables_test.sh @@ -27,8 +27,8 @@ expected_regex='-P PREROUTING ACCEPT -N DOCKER_POSTROUTING -A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT -A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING --A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:[0-9]+ --A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:[0-9]+ +-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT (--to-destination 127.0.0.11:[0-9]+|\[unsupported revision\]) +-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT (--to-destination 127.0.0.11:[0-9]+|\[unsupported revision\]) -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport [0-9]+ -j SNAT --to-source :53 -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport [0-9]+ -j SNAT --to-source :53'