reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move name constants to separate 'chains' package, to reduce dependencies

Browse Source 
We don't want everyone that uses the `net` package to get a transitive
dependency on the Kubernetes APIs required by `npc`.
This commit is contained in:
Bryan Boreham committed 2020-07-29 12:55:46 +00:00
1 parent 9928ddb401
commit a3c76e141b
8 files changed
+50 -42
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

common/chains/npc.go
+12
View File
@@ -0,0 +1,12 @@
package chains
const (
MainChain = "WEAVE-NPC"
DefaultChain = "WEAVE-NPC-DEFAULT"
IngressChain = "WEAVE-NPC-INGRESS"
EgressChain = "WEAVE-NPC-EGRESS"
EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
EgressCustomChain = "WEAVE-NPC-EGRESS-CUSTOM"
EgressMarkChain = "WEAVE-NPC-EGRESS-ACCEPT"
)
net/bridge.go
+5 -5
View File
@@ -14,11 +14,11 @@ import (
"k8s.io/apimachinery/pkg/types"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/common/chains"
"github.com/weaveworks/weave/common/odp"
"github.com/weaveworks/weave/ipam/tracker"
"github.com/weaveworks/weave/net/address"
"github.com/weaveworks/weave/net/ipset"
"github.com/weaveworks/weave/npc"
)
/* This code implements three possible configurations to connect
@@ -513,12 +513,12 @@ func ConfigureIPTables(config *BridgeConfig, ips ipset.Interface) error {
if config.NPC {
// Steer traffic via the NPC.
if err = ensureChains(ipt, "filter", npc.MainChain, npc.EgressChain); err != nil {
if err = ensureChains(ipt, "filter", chains.MainChain, chains.EgressChain); err != nil {
return err
}
// Steer egress traffic destined to local node.
if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", npc.EgressChain); err != nil {
if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", chains.EgressChain); err != nil {
return err
}
fwdRules = append(fwdRules,
@@ -527,11 +527,11 @@ func ConfigureIPTables(config *BridgeConfig, ips ipset.Interface) error {
// ACCEPT in WEAVE-NPC-EGRESS chain
{"-i", config.WeaveBridgeName,
"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
"-j", npc.EgressChain},
"-j", chains.EgressChain},
// The following rules are for ingress NPC processing
{"-o", config.WeaveBridgeName,
"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
"-j", npc.MainChain},
"-j", chains.MainChain},
{"-o", config.WeaveBridgeName, "-m", "state", "--state", "NEW", "-j", "NFLOG", "--nflog-group", "86"},
{"-o", config.WeaveBridgeName, "-j", "DROP"},
}...)
npc/constants.go
-9
View File
@@ -2,15 +2,6 @@ package npc
const (
TableFilter = "filter"
MainChain = "WEAVE-NPC"
DefaultChain = "WEAVE-NPC-DEFAULT"
IngressChain = "WEAVE-NPC-INGRESS"
EgressChain = "WEAVE-NPC-EGRESS"
EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
EgressCustomChain = "WEAVE-NPC-EGRESS-CUSTOM"
EgressMarkChain = "WEAVE-NPC-EGRESS-ACCEPT"
EgressMark = "0x40000/0x40000"
IpsetNamePrefix = "weave-"
npc/controller.go
+2 -1
View File
@@ -12,6 +12,7 @@ import (
"k8s.io/client-go/kubernetes"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/common/chains"
"github.com/weaveworks/weave/net/ipset"
"github.com/weaveworks/weave/npc/iptables"
)
@@ -157,7 +158,7 @@ func (npc *controller) AddNetworkPolicy(obj interface{}) error {
}
if egressNetworkPolicy {
npc.defaultEgressDrop = true
if err := npc.ipt.Append(TableFilter, EgressChain,
if err := npc.ipt.Append(TableFilter, chains.EgressChain,
"-m", "mark", "!", "--mark", EgressMark, "-j", "DROP"); err != nil {
npc.defaultEgressDrop = false
return fmt.Errorf("Failed to add iptable rule to drop egress traffic from the pods by default due to %s", err.Error())
npc/controller_test.go
+5 -4
View File
@@ -8,6 +8,7 @@ import (
"github.com/pkg/errors"
"github.com/stretchr/testify/require"
"github.com/weaveworks/weave/common/chains"
"github.com/weaveworks/weave/net/ipset"
coreapi "k8s.io/api/core/v1"
networkingv1 "k8s.io/api/networking/v1"
@@ -582,8 +583,8 @@ func TestEgressPolicyWithIPBlock(t *testing.T) {
require.True(t, m.entriesExist(exceptIPSetName, "192.168.48.2/32"))
// Each egress rule is represented as two iptables rules (-J MARK and -J RETURN).
require.Equal(t, 2, len(ipt.rules[EgressCustomChain]))
for rule := range ipt.rules[EgressCustomChain] {
require.Equal(t, 2, len(ipt.rules[chains.EgressCustomChain]))
for rule := range ipt.rules[chains.EgressCustomChain] {
require.Contains(t, rule, "-d 192.168.48.0/24 -m set ! --match-set "+exceptIPSetName+" dst")
}
@@ -690,8 +691,8 @@ func TestIngressPolicyWithIPBlockAndPortSpecified(t *testing.T) {
require.Equal(t, 1, len(m.sets[runBarIPSetName].subSets))
require.True(t, m.entriesExist(runBarIPSetName, barPodIP))
require.Equal(t, 1, len(ipt.rules[IngressChain]))
for rule := range ipt.rules[IngressChain] {
require.Equal(t, 1, len(ipt.rules[chains.IngressChain]))
for rule := range ipt.rules[chains.IngressChain] {
require.Contains(t, rule, "-s 192.168.48.4/32 -m set --match-set "+runBarIPSetName+" dst --dport 80")
}
}
npc/namespace.go
+4 -3
View File
@@ -12,6 +12,7 @@ import (
"k8s.io/apimachinery/pkg/util/uuid"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/common/chains"
"github.com/weaveworks/weave/net/ipset"
"github.com/weaveworks/weave/npc/iptables"
)
@@ -455,12 +456,12 @@ func (ns *ns) updateDefaultAllowIPSetEntry(oldObj, newObj *coreapi.Pod, ipsetNam
func bypassRules(namespace string, ingress, egress ipset.Name) map[string][][]string {
return map[string][][]string{
DefaultChain: {
chains.DefaultChain: {
{"-m", "set", "--match-set", string(ingress), "dst", "-j", "ACCEPT",
"-m", "comment", "--comment", "DefaultAllow ingress isolation for namespace: " + namespace},
},
EgressDefaultChain: {
{"-m", "set", "--match-set", string(egress), "src", "-j", EgressMarkChain,
chains.EgressDefaultChain: {
{"-m", "set", "--match-set", string(egress), "src", "-j", chains.EgressMarkChain,
"-m", "comment", "--comment", "DefaultAllow egress isolation for namespace: " + namespace},
{"-m", "set", "--match-set", string(egress), "src", "-j", "RETURN",
"-m", "comment", "--comment", "DefaultAllow egress isolation for namespace: " + namespace},
npc/rule.go
+4 -3
View File
@@ -8,6 +8,7 @@ import (
"k8s.io/apimachinery/pkg/types"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/common/chains"
"github.com/weaveworks/weave/npc/iptables"
)
@@ -55,9 +56,9 @@ func newRuleSpec(policyType policyType, proto *string, srcHost, dstHost ruleHost
func (spec *ruleSpec) iptChain() string {
if spec.policyType == policyTypeEgress {
return EgressCustomChain
return chains.EgressCustomChain
}
return IngressChain
return chains.IngressChain
}
func (spec *ruleSpec) iptRuleSpecs() [][]string {
@@ -71,7 +72,7 @@ func (spec *ruleSpec) iptRuleSpecs() [][]string {
// policyTypeEgress
ruleMark := make([]string, len(spec.args))
copy(ruleMark, spec.args)
ruleMark = append(ruleMark, "-j", EgressMarkChain)
ruleMark = append(ruleMark, "-j", chains.EgressMarkChain)
ruleReturn := make([]string, len(spec.args))
copy(ruleReturn, spec.args)
ruleReturn = append(ruleReturn, "-j", "RETURN")
prog/weave-npc/main.go
+18 -17
View File
@@ -17,6 +17,7 @@ import (
"k8s.io/client-go/tools/cache"
"github.com/weaveworks/weave/common"
"github.com/weaveworks/weave/common/chains"
"github.com/weaveworks/weave/net"
"github.com/weaveworks/weave/net/ipset"
"github.com/weaveworks/weave/npc"
@@ -52,27 +53,27 @@ func makeController(getter cache.Getter, resource string,
func resetIPTables(ipt *iptables.IPTables) error {
// Flush chains first so there are no refs to extant ipsets
if err := ipt.ClearChain(npc.TableFilter, npc.IngressChain); err != nil {
if err := ipt.ClearChain(npc.TableFilter, chains.IngressChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.DefaultChain); err != nil {
if err := ipt.ClearChain(npc.TableFilter, chains.DefaultChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.MainChain); err != nil {
if err := ipt.ClearChain(npc.TableFilter, chains.MainChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.EgressMarkChain); err != nil {
if err := ipt.ClearChain(npc.TableFilter, chains.EgressMarkChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.EgressCustomChain); err != nil {
if err := ipt.ClearChain(npc.TableFilter, chains.EgressCustomChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.EgressDefaultChain); err != nil {
if err := ipt.ClearChain(npc.TableFilter, chains.EgressDefaultChain); err != nil {
return err
}
@@ -121,35 +122,35 @@ func resetIPSets(ips ipset.Interface) error {
func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
// Configure main chain static rules
if err := ipt.Append(npc.TableFilter, npc.MainChain,
if err := ipt.Append(npc.TableFilter, chains.MainChain,
"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil {
return err
}
if allowMcast {
if err := ipt.Append(npc.TableFilter, npc.MainChain,
if err := ipt.Append(npc.TableFilter, chains.MainChain,
"-d", "224.0.0.0/4", "-j", "ACCEPT"); err != nil {
return err
}
}
// If the destination address is not any of the local pods, let it through
if err := ipt.Append(npc.TableFilter, npc.MainChain,
if err := ipt.Append(npc.TableFilter, chains.MainChain,
"-m", "physdev", "--physdev-is-bridged", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "state", "--state", "NEW", "-j", string(npc.DefaultChain)); err != nil {
if err := ipt.Append(npc.TableFilter, chains.MainChain,
"-m", "state", "--state", "NEW", "-j", chains.DefaultChain); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "state", "--state", "NEW", "-j", string(npc.IngressChain)); err != nil {
if err := ipt.Append(npc.TableFilter, chains.MainChain,
"-m", "state", "--state", "NEW", "-j", chains.IngressChain); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
if err := ipt.Append(npc.TableFilter, chains.EgressMarkChain,
"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
return err
}
@@ -187,11 +188,11 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})
}
ruleSpecs = append(ruleSpecs, [][]string{
{"-m", "state", "--state", "NEW", "-j", string(npc.EgressDefaultChain)},
{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", string(npc.EgressCustomChain)},
{"-m", "state", "--state", "NEW", "-j", chains.EgressDefaultChain},
{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", chains.EgressCustomChain},
{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"},
}...)
if err := net.AddChainWithRules(ipt, npc.TableFilter, npc.EgressChain, ruleSpecs); err != nil {
if err := net.AddChainWithRules(ipt, npc.TableFilter, chains.EgressChain, ruleSpecs); err != nil {
return err
}