Skip to content

Commit 46a2236

Browse files
matthewmcneelymatthewmcneely
authored
chore(tests): Future-proof whitelist against Docker network changes (#9500)
This PR changes the security/whitelist superflag definition in docker compose files and other places where docker cmds are issued. The change is to the "all ipv4 addresses" CIDR definition (0.0.0.0/0). Background: after updating Docker on my Mac, clients presented a new 175.x ip address that was not covered by the old set of CIDR definitions.
1 parent 0f2dc32 commit 46a2236

53 files changed

Lines changed: 163 additions & 208 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎compose/compose.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ func getAlpha(idx int, raft string) service {
307307
svc.Command += fmt.Sprintf(" --vmodule=%s", opts.Vmodule)
308308
}
309309
if opts.WhiteList {
310-
svc.Command += ` --security "whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;"`
310+
svc.Command += ` --security "whitelist=0.0.0.0/0;"`
311311
}
312312
if opts.Acl {
313313
svc.Command += ` --acl "secret-file=/secret/hmac;"`

‎dgraph/cmd/alpha/mutations_mode/docker-compose.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ services:
1818
read_only: true
1919
command:
2020
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --my=alpha1:7080
21-
--zero=zero1:5080,zero2:5080,zero3:5080 --logtostderr -v=2 --security
22-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --limit "mutations=disallow;"
21+
--zero=zero1:5080,zero2:5080,zero3:5080 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;"
22+
--limit "mutations=disallow;"
2323
alpha2:
2424
image: dgraph/dgraph:local
2525
working_dir: /data/alpha2
@@ -35,8 +35,8 @@ services:
3535
read_only: true
3636
command:
3737
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --my=alpha2:7080
38-
--zero=zero1:5080,zero2:5080,zero3:5080 --logtostderr -v=2 --security
39-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --limit "mutations=strict;"
38+
--zero=zero1:5080,zero2:5080,zero3:5080 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;"
39+
--limit "mutations=strict;"
4040
alpha3:
4141
image: dgraph/dgraph:local
4242
working_dir: /data/alpha3
@@ -52,8 +52,8 @@ services:
5252
read_only: true
5353
command:
5454
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --my=alpha3:7080
55-
--zero=zero1:5080,zero2:5080,zero3:5080 --logtostderr -v=2 --security
56-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --limit "mutations=strict;"
55+
--zero=zero1:5080,zero2:5080,zero3:5080 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;"
56+
--limit "mutations=strict;"
5757
zero1:
5858
image: dgraph/dgraph:local
5959
working_dir: /data/zero1

‎dgraph/docker-compose.yml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,7 @@ services:
8585
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --telemetry "reports=false;" --encryption
8686
"key-file=/dgraph-enc/enc-key;" --my=alpha1:7080 --zero=zero1:5080,zero2:5080,zero3:5080
8787
--expose_trace --profile_mode block --block_rate 10 --logtostderr -v=2 --security
88-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --acl
89-
"secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
88+
"whitelist=0.0.0.0/0;" --acl "secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
9089

9190
alpha2:
9291
image: dgraph/dgraph:local
@@ -115,8 +114,7 @@ services:
115114
command:
116115
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --encryption "key-file=/dgraph-enc/enc-key;"
117116
--my=alpha2:7080 --zero=zero1:5080,zero2:5080,zero3:5080 --expose_trace --profile_mode block
118-
--block_rate 10 --logtostderr -v=2 --security
119-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --acl
117+
--block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;" --acl
120118
"secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
121119

122120
alpha3:
@@ -146,8 +144,7 @@ services:
146144
command:
147145
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --encryption "key-file=/dgraph-enc/enc-key;"
148146
--my=alpha3:7080 --zero=zero1:5080,zero2:5080,zero3:5080 --expose_trace --profile_mode block
149-
--block_rate 10 --logtostderr -v=2 --security
150-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --acl
147+
--block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;" --acl
151148
"secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
152149

153150
alpha4:
@@ -177,8 +174,7 @@ services:
177174
command:
178175
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --encryption "key-file=/dgraph-enc/enc-key;"
179176
--my=alpha4:7080 --zero=zero1:5080,zero2:5080,zero3:5080 --expose_trace --profile_mode block
180-
--block_rate 10 --logtostderr -v=2 --security
181-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --acl
177+
--block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;" --acl
182178
"secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
183179

184180
alpha5:
@@ -208,8 +204,7 @@ services:
208204
command:
209205
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --encryption "key-file=/dgraph-enc/enc-key;"
210206
--my=alpha5:7080 --zero=zero1:5080,zero2:5080,zero3:5080 --expose_trace --profile_mode block
211-
--block_rate 10 --logtostderr -v=2 --security
212-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --acl
207+
--block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;" --acl
213208
"secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
214209

215210
alpha6:
@@ -239,8 +234,7 @@ services:
239234
command:
240235
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --encryption "key-file=/dgraph-enc/enc-key;"
241236
--my=alpha6:7080 --zero=zero1:5080,zero2:5080,zero3:5080 --expose_trace --profile_mode block
242-
--block_rate 10 --logtostderr -v=2 --security
243-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --acl
237+
--block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;" --acl
244238
"secret-file=/dgraph-acl/hmac-secret; access-ttl=20s;"
245239

246240
minio:

‎dgraphtest/dgraph.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -235,10 +235,9 @@ func (a *alpha) cmd(c *LocalCluster) []string {
235235
"--bindall", "--logtostderr", fmt.Sprintf("-v=%d", c.conf.verbosity)}
236236

237237
if c.lowerThanV21 {
238-
acmd = append(acmd, `--whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`, "--telemetry=false")
238+
acmd = append(acmd, `--whitelist=0.0.0.0/0`, "--telemetry=false")
239239
} else {
240-
acmd = append(acmd, `--security=whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`,
241-
"--telemetry=reports=false;")
240+
acmd = append(acmd, `--security=whitelist=0.0.0.0/0`, "--telemetry=reports=false;")
242241
}
243242

244243
if c.conf.lambdaURL != "" {

‎graphql/e2e/admin_auth/poorman_auth/docker-compose.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,5 @@ services:
3434
service: alpha1
3535
command:
3636
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --my=alpha1:7080 --zero=zero1:5080 --expose_trace
37-
--profile_mode block --block_rate 10 --logtostderr -v=2 --security
38-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16; token=itIsSecret;" --trace "ratio=1.0;"
37+
--profile_mode block --block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;
38+
token=itIsSecret;" --trace "ratio=1.0;"

‎graphql/e2e/admin_auth/poorman_auth_with_acl/docker-compose.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,6 @@ services:
3838
service: alpha1
3939
command:
4040
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --my=alpha1:7080 --zero=zero1:5080 --expose_trace
41-
--profile_mode block --block_rate 10 --logtostderr -v=2 --security
42-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16; token=itIsSecret;" --acl
43-
"secret-file=/dgraph-acl/hmac-secret; access-ttl=3s;" --trace "ratio=1.0;"
41+
--profile_mode block --block_rate 10 --logtostderr -v=2 --security "whitelist=0.0.0.0/0;
42+
token=itIsSecret;" --acl "secret-file=/dgraph-acl/hmac-secret; access-ttl=3s;" --trace
43+
"ratio=1.0;"

‎graphql/e2e/auth/debug_off/docker-compose.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,5 @@ services:
3434
service: alpha1
3535
command:
3636
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --zero=zero1:5080 --expose_trace --profile_mode block
37-
--block_rate 10 --logtostderr -v=3 --my=alpha1:7080 --security
38-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --trace "ratio=1.0;"
37+
--block_rate 10 --logtostderr -v=3 --my=alpha1:7080 --security "whitelist=0.0.0.0/0;" --trace
38+
"ratio=1.0;"

‎graphql/e2e/auth/docker-compose.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,5 @@ services:
3434
service: alpha1
3535
command:
3636
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --zero=zero1:5080 --expose_trace --profile_mode block
37-
--block_rate 10 --logtostderr -v=3 --my=alpha1:7080 --security
38-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --graphql "debug=true;" --trace
39-
"ratio=1.0;"
37+
--block_rate 10 --logtostderr -v=3 --my=alpha1:7080 --security "whitelist=0.0.0.0/0;"
38+
--graphql "debug=true;" --trace "ratio=1.0;"

‎graphql/e2e/auth_closed_by_default/docker-compose.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,5 @@ services:
3434
service: alpha1
3535
command:
3636
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --zero=zero1:5080 --expose_trace --profile_mode block
37-
--block_rate 10 --logtostderr -v=3 --my=alpha1:7080 --security
38-
"whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;" --graphql "debug=true;" --trace
39-
"ratio=1.0;"
37+
--block_rate 10 --logtostderr -v=3 --my=alpha1:7080 --security "whitelist=0.0.0.0/0;"
38+
--graphql "debug=true;" --trace "ratio=1.0;"

‎graphql/e2e/custom_logic/docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ services:
1717
read_only: true
1818
command:
1919
/gobin/dgraph ${COVERAGE_OUTPUT} alpha --my=alpha1:7080 --zero=zero1:5080 --logtostderr -v=2
20-
--raft="idx=1;" --security "whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;"
20+
--raft="idx=1;" --security "whitelist=0.0.0.0/0;"
2121
zero1:
2222
image: dgraph/dgraph:local
2323
working_dir: /data/zero1

0 commit comments

Comments
 (0)