1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
summary: Ensure network errors are handled gracefully
details: |
Check that snapd handles and logs network errors correctly. The test does
this by rejecting DNS queries with iptables, flushing the DNS cache and
then forcing snapd to trigger a query.
# no iptables on core18+
systems: [-ubuntu-core-18-*, -ubuntu-core-2*]
restore: |
if [ "${SNAPD_USE_PROXY:-}" != true ]; then
echo "Restoring iptables rules"
iptables -D OUTPUT -p udp --dport 53 -j REJECT --reject-with icmp-port-unreachable || true
iptables -D OUTPUT -p tcp --dport 53 -j REJECT --reject-with icmp-port-unreachable || true
ip6tables -D OUTPUT -p udp --dport 53 -j REJECT --reject-with icmp6-port-unreachable || true
ip6tables -D OUTPUT -p tcp --dport 53 -j REJECT --reject-with icmp6-port-unreachable || true
fi
debug: |
echo "iptables rules:"
iptables -L -n -v || true
execute: |
# Do a store op to avoid an unexpected device auth refresh on snap find
# below, which would produce different kind of error.
snap refresh
systemctl stop snapd.{socket,service}
if [ "${SNAPD_USE_PROXY:-}" != true ]; then
echo "Disabling DNS queries"
# DNS queries generally use port 53 through UDP protocol, but TCP could be used as well
iptables -I OUTPUT -p udp --dport 53 -j REJECT --reject-with icmp-port-unreachable
iptables -I OUTPUT -p tcp --dport 53 -j REJECT --reject-with icmp-port-unreachable
ip6tables -I OUTPUT -p udp --dport 53 -j REJECT --reject-with icmp6-port-unreachable
ip6tables -I OUTPUT -p tcp --dport 53 -j REJECT --reject-with icmp6-port-unreachable
else
# The proxy is unset to produce a network error when snapd tries to contact the store
mv /etc/systemd/system/snapd.service.d/proxy.conf proxy.conf
cp /etc/environment environment
cp "$SNAPD_WORK_DIR"/environment.bak /etc/environment
systemctl daemon-reload
tests.cleanup defer mv proxy.conf /etc/systemd/system/snapd.service.d/proxy.conf
tests.cleanup defer mv environment /etc/environment
tests.cleanup defer systemctl daemon-reload
fi
if systemctl is-active systemd-resolved; then
# before systemd 239, the tool was named systemd-resolve some systems do not support
if command -v resolvectl; then
resolvectl flush-caches
elif systemd-resolve -h | MATCH flush-caches; then
# centos 7: doesn't support caching dns, so no flushing required
# ubuntu-core 16: systemd-resolve doesn't support flush-caches
systemd-resolve --flush-caches
fi
fi
systemctl start snapd.{socket,service}
OUT=$(snap find test 2>&1 || true)
echo "$OUT" | MATCH "error: unable to contact snap store"
|
