()
| 22 | |
| 23 | |
| 24 | def main(): |
| 25 | portForwards = getHealthChecksData("portForwarding") |
| 26 | if portForwards is None or len(portForwards) == 0: |
| 27 | print("No portforwarding rules provided to check, skipping") |
| 28 | exit(0) |
| 29 | |
| 30 | failedCheck = False |
| 31 | failureMessage = "Missing port forwarding rules in Iptables-\n " |
| 32 | for portForward in portForwards: |
| 33 | entriesExpected = [] |
| 34 | destIp = portForward["destIp"] |
| 35 | srcIpText = "-d " + portForward["sourceIp"] |
| 36 | srcPortText = "--dport " + formatPort(portForward["sourcePortStart"], portForward["sourcePortEnd"], ":") |
| 37 | dstText = destIp + ":" + formatPort(portForward["destPortStart"], portForward["destPortEnd"], "-") |
| 38 | for algo in [["PREROUTING", "--to-destination"], |
| 39 | ["OUTPUT", "--to-destination"]]: |
| 40 | entriesExpected.append([algo[0], srcIpText, srcPortText, algo[1] + " " + dstText]) |
| 41 | |
| 42 | fetchIpTableEntriesCmd = "iptables-save | grep " + destIp |
| 43 | pout = Popen(fetchIpTableEntriesCmd, shell=True, stdout=PIPE) |
| 44 | if pout.wait() != 0: |
| 45 | failedCheck = True |
| 46 | failureMessage = failureMessage + "Unable to execute iptables-save command " \ |
| 47 | "for fetching rules by " + fetchIpTableEntriesCmd + "\n" |
| 48 | continue |
| 49 | |
| 50 | ipTablesMatchingEntries = pout.communicate()[0].decode().strip().split('\n') |
| 51 | for pfEntryListExpected in entriesExpected: |
| 52 | foundPfEntryList = False |
| 53 | for ipTableEntry in ipTablesMatchingEntries: |
| 54 | # Check if all expected parts of pfEntryList |
| 55 | # is present in this ipTableEntry |
| 56 | foundAll = True |
| 57 | for expectedEntry in pfEntryListExpected: |
| 58 | if ipTableEntry.find(expectedEntry) == -1: |
| 59 | foundAll = False |
| 60 | break |
| 61 | |
| 62 | if foundAll: |
| 63 | foundPfEntryList = True |
| 64 | break |
| 65 | |
| 66 | if not foundPfEntryList: |
| 67 | failedCheck = True |
| 68 | failureMessage = failureMessage + str(pfEntryListExpected) + "\n" |
| 69 | |
| 70 | if failedCheck: |
| 71 | print(failureMessage) |
| 72 | exit(1) |
| 73 | else: |
| 74 | print("Found all entries (count " + str(len(portForwards)) + ") in iptables") |
| 75 | exit(0) |
| 76 | |
| 77 | |
| 78 | if __name__ == "__main__": |
no test coverage detected