@@ -86,7 +86,9 @@ Deny,Egress,l4-egress-explicit-deny-any,false,false,6,53
8686Deny,Egress,l4-egress-explicit-deny-any,false,false,17,53
8787Deny,Egress,l4-egress-explicit-deny-any,false,false,132,53
8888Deny,Egress,l4-egress-explicit-deny-tcp,false,false,6,8000
89- Allow,Ingress,cidr:10.100.0.0/16,true,true,0,0
89+ Allow,Ingress,cidr:10.100.0.0/24,true,true,0,0
90+ Allow,Ingress,cidr:10.100.10.0/24,true,true,0,0
91+ Allow,Ingress,cidr:10.120.0.0/16,true,true,0,0
9092Allow,Ingress,reserved:host,true,true,0,0
9193Allow,Egress,cidr:1.1.1.1/32,false,false,6,53
9294Allow,Egress,cidr:1.1.1.1/32,false,false,17,53
@@ -123,14 +125,8 @@ Allow,Egress,cidr:8.8.8.8/32,false,false,17,53
123125Allow,Egress,cidr:8.8.8.8/32,false,false,132,53` ,
124126 },
125127 {
126- Selector : "test=self" ,
127- ExtraArgs : []string {"--with-cidrs=8.8.0.0/16" },
128- Expected : `Deny,Egress,cidr:8.8.4.4/32,false,false,6,53
129- Deny,Egress,cidr:8.8.4.4/32,false,false,17,53
130- Deny,Egress,cidr:8.8.4.4/32,false,false,132,53
131- Allow,Egress,cidr:8.8.8.8/32,false,false,6,53
132- Allow,Egress,cidr:8.8.8.8/32,false,false,17,53
133- Allow,Egress,cidr:8.8.8.8/32,false,false,132,53` ,
128+ Selector : "test=l3-egress-explicit-deny-all" ,
129+ Expected : `Allow,Ingress,reserved:host,true,true,0,0` ,
134130 },
135131 {
136132 Selector : "test=self" ,
@@ -160,6 +156,7 @@ Deny,Egress,cidr:8.8.4.4/32,false,false,132,53`,
160156 Expected : `Deny,Ingress,cidr:192.168.100.0/24,false,false,6,8080
161157Allow,Ingress,cidr:10.100.0.0/16,true,true,0,0` ,
162158 },
159+ // npv inspect should handle --with-public-cidrs
163160 {
164161 Selector : "test=self" ,
165162 ExtraArgs : []string {"--with-public-cidrs" },
@@ -173,6 +170,64 @@ Allow,Egress,cidr:8.8.8.8/32,false,false,6,53
173170Allow,Egress,cidr:8.8.8.8/32,false,false,17,53
174171Allow,Egress,cidr:8.8.8.8/32,false,false,132,53` ,
175172 },
173+ // npv inspect should handle --with-private-cidrs
174+ {
175+ Selector : "test=self" ,
176+ ExtraArgs : []string {"--with-private-cidrs" },
177+ Expected : `Deny,Ingress,cidr:192.168.100.0/24,false,false,6,8080
178+ Allow,Ingress,cidr:10.100.0.0/24,true,true,0,0
179+ Allow,Ingress,cidr:10.100.10.0/24,true,true,0,0
180+ Allow,Ingress,cidr:10.120.0.0/16,true,true,0,0` ,
181+ },
182+ // npv inspect should handle --with-cidrs=/0
183+ {
184+ Selector : "test=self" ,
185+ ExtraArgs : []string {"--with-cidrs=0.0.0.0/0" },
186+ Expected : `Deny,Ingress,cidr:192.168.100.0/24,false,false,6,8080
187+ Deny,Egress,cidr:8.8.4.4/32,false,false,6,53
188+ Deny,Egress,cidr:8.8.4.4/32,false,false,17,53
189+ Deny,Egress,cidr:8.8.4.4/32,false,false,132,53
190+ Allow,Ingress,cidr:10.100.0.0/24,true,true,0,0
191+ Allow,Ingress,cidr:10.100.10.0/24,true,true,0,0
192+ Allow,Ingress,cidr:10.120.0.0/16,true,true,0,0
193+ Allow,Egress,cidr:1.1.1.1/32,false,false,6,53
194+ Allow,Egress,cidr:1.1.1.1/32,false,false,17,53
195+ Allow,Egress,cidr:1.1.1.1/32,false,false,132,53
196+ Allow,Egress,cidr:8.8.8.8/32,false,false,6,53
197+ Allow,Egress,cidr:8.8.8.8/32,false,false,17,53
198+ Allow,Egress,cidr:8.8.8.8/32,false,false,132,53` ,
199+ },
200+ // npv inspect should handle --with-cidrs=/16
201+ {
202+ Selector : "test=self" ,
203+ ExtraArgs : []string {"--with-cidrs=8.8.0.0/16" },
204+ Expected : `Deny,Egress,cidr:8.8.4.4/32,false,false,6,53
205+ Deny,Egress,cidr:8.8.4.4/32,false,false,17,53
206+ Deny,Egress,cidr:8.8.4.4/32,false,false,132,53
207+ Allow,Egress,cidr:8.8.8.8/32,false,false,6,53
208+ Allow,Egress,cidr:8.8.8.8/32,false,false,17,53
209+ Allow,Egress,cidr:8.8.8.8/32,false,false,132,53` ,
210+ },
211+ // npv inspect should handle --with-cidrs=/16,!/32
212+ {
213+ Selector : "test=self" ,
214+ ExtraArgs : []string {"--with-cidrs=8.8.0.0/16,!8.8.8.8/32" },
215+ Expected : `Deny,Egress,cidr:8.8.4.4/32,false,false,6,53
216+ Deny,Egress,cidr:8.8.4.4/32,false,false,17,53
217+ Deny,Egress,cidr:8.8.4.4/32,false,false,132,53` ,
218+ },
219+ // npv inspect should omit /24 --with-cidrs=!/24
220+ {
221+ Selector : "test=self" ,
222+ ExtraArgs : []string {"--with-cidrs=10.100.0.0/24,!10.100.0.0/24" },
223+ Expected : `` ,
224+ },
225+ // npv inspect should include /24 --with-cidrs=!/28
226+ {
227+ Selector : "test=self" ,
228+ ExtraArgs : []string {"--with-cidrs=10.100.0.0/24,!10.100.0.0/28" },
229+ Expected : `Allow,Ingress,cidr:10.100.0.0/24,true,true,0,0` ,
230+ },
176231 // npv inspect should handle reserved:unknown
177232 {
178233 Selector : "test=l4-ingress-all-allow-tcp" ,
@@ -223,7 +278,9 @@ Allow,Egress,l4-ingress-explicit-allow-tcp,false,false,6,8000`,
223278 {
224279 Selector : "test=self" ,
225280 ExtraArgs : []string {"--ingress" , "--allowed" },
226- Expected : `Allow,Ingress,cidr:10.100.0.0/16,true,true,0,0
281+ Expected : `Allow,Ingress,cidr:10.100.0.0/24,true,true,0,0
282+ Allow,Ingress,cidr:10.100.10.0/24,true,true,0,0
283+ Allow,Ingress,cidr:10.120.0.0/16,true,true,0,0
227284Allow,Ingress,reserved:host,true,true,0,0` ,
228285 },
229286 {
0 commit comments