reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3423 from weaveworks/issue-3344

Browse Source 
Replace weave-local-pods ipset with physdev iptables rule
This commit is contained in:
Bryan Boreham authored and GitHub committed 2018-10-17 18:03:26 +01:00
2 parents 727fe46b2a 408e5f7bdd
commit bf9985b0c8
2 files changed
+27 -38
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

npc/namespace.go
-15
View File
@@ -169,10 +169,6 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
return nil
}
if ns.checkLocalPod(obj) {
ns.ips.AddEntry(obj.ObjectMeta.UID, LocalIpset, obj.Status.PodIP, podComment(obj))
}
foundIngress, foundEgress, err := ns.podSelectors.addToMatching(obj.ObjectMeta.UID, obj.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
if err != nil {
return err
@@ -201,10 +197,6 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
}
if hasIP(oldObj) && !hasIP(newObj) {
if ns.checkLocalPod(oldObj) {
ns.ips.DelEntry(oldObj.ObjectMeta.UID, LocalIpset, oldObj.Status.PodIP)
}
if err := ns.ips.DelEntry(oldObj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
return err
}
@@ -216,9 +208,6 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
}
if !hasIP(oldObj) && hasIP(newObj) {
if ns.checkLocalPod(newObj) {
ns.ips.AddEntry(newObj.ObjectMeta.UID, LocalIpset, newObj.Status.PodIP, podComment(newObj))
}
foundIngress, foundEgress, err := ns.podSelectors.addToMatching(newObj.ObjectMeta.UID, newObj.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
if err != nil {
return err
@@ -303,10 +292,6 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
return nil
}
if ns.checkLocalPod(obj) {
ns.ips.DelEntry(obj.ObjectMeta.UID, LocalIpset, obj.Status.PodIP)
}
if err := ns.ips.DelEntry(obj.ObjectMeta.UID, ns.ingressDefaultAllowIPSet, obj.Status.PodIP); err != nil {
return err
}
prog/weave-npc/main.go
+27 -23
View File
@@ -25,12 +25,13 @@ import (
)
var (
version = "unreleased"
metricsAddr string
logLevel string
allowMcast bool
nodeName string
maxList int
version = "unreleased"
metricsAddr string
logLevel string
allowMcast bool
nodeName string
maxList int
bridgePortName string
)
func handleError(err error) { common.CheckFatal(err) }
@@ -125,6 +126,12 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
}
}
// If the destination address is not any of the local pods, let it through
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "physdev", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "state", "--state", "NEW", "-j", string(npc.DefaultChain)); err != nil {
return err
@@ -135,21 +142,6 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
return err
}
// If the destination address is not any of the local pods, let it through
found, err := ipsetExist(ips, npc.LocalIpset)
if err != nil {
return err
}
if !found {
if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
return err
}
}
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
return err
@@ -158,7 +150,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
// Egress rules:
//
// -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j ACCEPT
// -A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
// -A WEAVE-NPC-EGRESS -m physdev --physdev-in=vethwe-bridge -j RETURN
// -A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
// -A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
// -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
@@ -179,7 +171,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
ruleSpecs := [][]string{
{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
{"-m", "state", "--state", "NEW", "-m", "set", "!", "--match-set", npc.LocalIpset, "src", "-j", "RETURN"},
{"-m", "physdev", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
}
if allowMcast {
ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})
@@ -194,6 +186,17 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
return err
}
// delete `weave-local-pods` ipset which is no longer used by weave-npc
weaveLocalPodExist, err := ipsetExist(ips, npc.LocalIpset)
if err != nil {
common.Log.Errorf("Failed to look if ipset '%s' exists", npc.LocalIpset)
} else if weaveLocalPodExist {
common.Log.Debugf("Destroying ipset '%s'", npc.LocalIpset)
if err := ips.Destroy(npc.LocalIpset); err != nil {
common.Log.Errorf("Failed to destroy ipset '%s'", npc.LocalIpset)
}
}
return nil
}
@@ -332,6 +335,7 @@ func main() {
rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node")
rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)")
rootCmd.PersistentFlags().StringVar(&bridgePortName, "bridge-port-name", "vethwe-bridge", "name of the brige port on which packets are received and sent")
handleError(rootCmd.Execute())
}