reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

npc: Rename policy{Ingress,Egress} to policyType{Ingress,Egress}

Browse Source
This commit is contained in:
Martynas Pumputis authored and Martynas Pumputis committed 2018-07-24 10:06:23 +02:00
1 parent dee24aec65
commit 49224ec9f7
6 files changed
+27 -27
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

npc/analyser.go
+15 -15
View File
@@ -24,7 +24,7 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
podSelectors = make(map[string]*selectorSpec)
rules = make(map[string]*ruleSpec)
policyTypes := []policyType{ingressPolicy}
policyTypes := []policyType{policyTypeIngress}
targetSelector, err := newSelectorSpec(&policy.Spec.PodSelector, policyTypes, ns.name, ipset.HashIP)
if err != nil {
return nil, nil, nil, err
@@ -46,13 +46,13 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
// From is not provided, this rule matches all sources (traffic not restricted by source).
if ingressRule.Ports == nil {
// Ports is not provided, this rule matches all ports (traffic not restricted by port).
rule := newRuleSpec(ingressPolicy, nil, nil, targetSelector, nil)
rule := newRuleSpec(policyTypeIngress, nil, nil, targetSelector, nil)
rules[rule.key] = rule
} else {
// Ports is present and contains at least one item, then this rule allows traffic
// only if the traffic matches at least one port in the ports list.
withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
rule := newRuleSpec(ingressPolicy, &proto, nil, targetSelector, &port)
rule := newRuleSpec(policyTypeIngress, &proto, nil, targetSelector, &port)
rules[rule.key] = rule
})
}
@@ -78,13 +78,13 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
if ingressRule.Ports == nil {
// Ports is not provided, this rule matches all ports (traffic not restricted by port).
rule := newRuleSpec(ingressPolicy, nil, srcSelector, targetSelector, nil)
rule := newRuleSpec(policyTypeIngress, nil, srcSelector, targetSelector, nil)
rules[rule.key] = rule
} else {
// Ports is present and contains at least one item, then this rule allows traffic
// only if the traffic matches at least one port in the ports list.
withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
rule := newRuleSpec(ingressPolicy, &proto, srcSelector, targetSelector, &port)
rule := newRuleSpec(policyTypeIngress, &proto, srcSelector, targetSelector, &port)
rules[rule.key] = rule
})
}
@@ -109,10 +109,10 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
for _, pt := range policy.Spec.PolicyTypes {
if pt == networkingv1.PolicyTypeIngress {
policyTypes = append(policyTypes, ingressPolicy)
policyTypes = append(policyTypes, policyTypeIngress)
}
if pt == networkingv1.PolicyTypeEgress {
policyTypes = append(policyTypes, egressPolicy)
policyTypes = append(policyTypes, policyTypeEgress)
}
}
// If empty, matches all pods in a namespace
@@ -137,11 +137,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
if allSources {
if allPorts {
rule := newRuleSpec(ingressPolicy, nil, nil, targetSelector, nil)
rule := newRuleSpec(policyTypeIngress, nil, nil, targetSelector, nil)
rules[rule.key] = rule
} else {
withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
rule := newRuleSpec(ingressPolicy, &proto, nil, targetSelector, &port)
rule := newRuleSpec(policyTypeIngress, &proto, nil, targetSelector, &port)
rules[rule.key] = rule
})
}
@@ -167,11 +167,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
}
if allPorts {
rule := newRuleSpec(ingressPolicy, nil, srcSelector, targetSelector, nil)
rule := newRuleSpec(policyTypeIngress, nil, srcSelector, targetSelector, nil)
rules[rule.key] = rule
} else {
withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
rule := newRuleSpec(ingressPolicy, &proto, srcSelector, targetSelector, &port)
rule := newRuleSpec(policyTypeIngress, &proto, srcSelector, targetSelector, &port)
rules[rule.key] = rule
})
}
@@ -190,11 +190,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
if allDestinations {
if allPorts {
rule := newRuleSpec(egressPolicy, nil, targetSelector, nil, nil)
rule := newRuleSpec(policyTypeEgress, nil, targetSelector, nil, nil)
rules[rule.key] = rule
} else {
withNormalisedProtoAndPort(egressRule.Ports, func(proto, port string) {
rule := newRuleSpec(egressPolicy, &proto, targetSelector, nil, &port)
rule := newRuleSpec(policyTypeEgress, &proto, targetSelector, nil, &port)
rules[rule.key] = rule
})
}
@@ -227,11 +227,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
}
if allPorts {
rule := newRuleSpec(egressPolicy, nil, targetSelector, dstRuleHost, nil)
rule := newRuleSpec(policyTypeEgress, nil, targetSelector, dstRuleHost, nil)
rules[rule.key] = rule
} else {
withNormalisedProtoAndPort(egressRule.Ports, func(proto, port string) {
rule := newRuleSpec(egressPolicy, &proto, targetSelector, dstRuleHost, &port)
rule := newRuleSpec(policyTypeEgress, &proto, targetSelector, dstRuleHost, &port)
rules[rule.key] = rule
})
}
npc/namespace.go
+3 -3
View File
@@ -288,10 +288,10 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
}
if !ns.legacy {
if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, ingressPolicy); err != nil {
if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeIngress); err != nil {
return err
}
if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, egressPolicy); err != nil {
if err := ns.addOrRemoveToDefaultAllowIPSet(ps, oldObj, newObj, oldMatch, newMatch, policyTypeEgress); err != nil {
return err
}
}
@@ -645,7 +645,7 @@ func podComment(pod *coreapi.Pod) string {
func (ns *ns) defaultAllowIPSetName(pt policyType) ipset.Name {
ipset := ns.ingressDefaultAllowIPSet
if pt == egressPolicy {
if pt == policyTypeEgress {
ipset = ns.egressDefaultAllowIPSet
}
return ipset
npc/rule.go
+3 -3
View File
@@ -55,21 +55,21 @@ func newRuleSpec(policyType policyType, proto *string, srcHost, dstHost ruleHost
}
func (spec *ruleSpec) iptChain() string {
if spec.policyType == egressPolicy {
if spec.policyType == policyTypeEgress {
return EgressCustomChain
}
return IngressChain
}
func (spec *ruleSpec) iptRuleSpecs() [][]string {
if spec.policyType == ingressPolicy {
if spec.policyType == policyTypeIngress {
rule := make([]string, len(spec.args))
copy(rule, spec.args)
rule = append(rule, "-j", "ACCEPT")
return [][]string{rule}
}
// egressPolicy
// policyTypeEgress
ruleMark := make([]string, len(spec.args))
copy(ruleMark, spec.args)
ruleMark = append(ruleMark, "-j", EgressMarkChain)
npc/rule_test.go
+1 -1
View File
@@ -9,7 +9,7 @@ func TestRegressionHandleNil3095(t *testing.T) {
// Test for handling nil values
// https://github.com/weaveworks/weave/issues/3095
rs := newRuleSpec(ingressPolicy, nil, nil, nil, nil)
rs := newRuleSpec(policyTypeIngress, nil, nil, nil, nil)
require.NotEqual(t, rs.key, "")
npc/selector.go
+2 -2
View File
@@ -114,10 +114,10 @@ func (ss *selectorSet) addToMatching(user types.UID, labelMap map[string]string,
foundEgress := false
for _, s := range ss.entries {
if s.matches(labelMap) {
if ss.targetSelectorExist(s, ingressPolicy) {
if ss.targetSelectorExist(s, policyTypeIngress) {
foundIngress = true
}
if ss.targetSelectorExist(s, egressPolicy) {
if ss.targetSelectorExist(s, policyTypeEgress) {
foundEgress = true
}
if err := s.addEntry(user, entry, comment); err != nil {
npc/types.go
+3 -3
View File
@@ -3,12 +3,12 @@ package npc
type policyType byte
const (
ingressPolicy policyType = iota
egressPolicy
policyTypeIngress policyType = iota
policyTypeEgress
)
func policyTypeStr(policyType policyType) string {
if policyType == egressPolicy {
if policyType == policyTypeEgress {
return "egress"
}
return "ingress"