From cabc05b06c8b89b9b7406d53936b74780fa0111c Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Tue, 15 May 2018 21:45:09 +0200 Subject: [PATCH] npc: Add rule type (ingress, egress) --- npc/analyser.go | 16 ++++++++-------- npc/rule.go | 32 ++++++++++++++++++++++++-------- npc/rule_test.go | 2 +- 3 files changed, 33 insertions(+), 17 deletions(-) diff --git a/npc/analyser.go b/npc/analyser.go index 01cdf5ee..50246a38 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -45,13 +45,13 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) ( // From is not provided, this rule matches all sources (traffic not restricted by source). if ingressRule.Ports == nil { // Ports is not provided, this rule matches all ports (traffic not restricted by port). - rule := newRuleSpec(nil, nil, dstSelector, nil) + rule := newRuleSpec(ingress, nil, nil, dstSelector, nil) rules[rule.key] = rule } else { // Ports is present and contains at least one item, then this rule allows traffic // only if the traffic matches at least one port in the ports list. withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) { - rule := newRuleSpec(&proto, nil, dstSelector, &port) + rule := newRuleSpec(ingress, &proto, nil, dstSelector, &port) rules[rule.key] = rule }) } @@ -77,13 +77,13 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) ( if ingressRule.Ports == nil { // Ports is not provided, this rule matches all ports (traffic not restricted by port). - rule := newRuleSpec(nil, srcSelector, dstSelector, nil) + rule := newRuleSpec(ingress, nil, srcSelector, dstSelector, nil) rules[rule.key] = rule } else { // Ports is present and contains at least one item, then this rule allows traffic // only if the traffic matches at least one port in the ports list. withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) { - rule := newRuleSpec(&proto, srcSelector, dstSelector, &port) + rule := newRuleSpec(ingress, &proto, srcSelector, dstSelector, &port) rules[rule.key] = rule }) } @@ -128,11 +128,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( if allSources { if allPorts { - rule := newRuleSpec(nil, nil, dstSelector, nil) + rule := newRuleSpec(ingress, nil, nil, dstSelector, nil) rules[rule.key] = rule } else { withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) { - rule := newRuleSpec(&proto, nil, dstSelector, &port) + rule := newRuleSpec(ingress, &proto, nil, dstSelector, &port) rules[rule.key] = rule }) } @@ -158,11 +158,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( } if allPorts { - rule := newRuleSpec(nil, srcSelector, dstSelector, nil) + rule := newRuleSpec(ingress, nil, srcSelector, dstSelector, nil) rules[rule.key] = rule } else { withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) { - rule := newRuleSpec(&proto, srcSelector, dstSelector, &port) + rule := newRuleSpec(ingress, &proto, srcSelector, dstSelector, &port) rules[rule.key] = rule }) } diff --git a/npc/rule.go b/npc/rule.go index c0a334c0..f84884da 100644 --- a/npc/rule.go +++ b/npc/rule.go @@ -10,12 +10,20 @@ import ( "github.com/weaveworks/weave/npc/iptables" ) +type ruleType byte + +const ( + ingress ruleType = iota + egress +) + type ruleSpec struct { - key string - args []string + key string + args []string + ruleType ruleType } -func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, dstPort *string) *ruleSpec { +func newRuleSpec(ruleType ruleType, proto *string, srcHost *selectorSpec, dstHost *selectorSpec, dstPort *string) *ruleSpec { args := []string{} if proto != nil { args = append(args, "-p", *proto) @@ -41,7 +49,7 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment)) key := strings.Join(args, " ") - return &ruleSpec{key, args} + return &ruleSpec{key, args, ruleType} } type ruleSet struct { @@ -58,8 +66,12 @@ func (rs *ruleSet) deprovision(user types.UID, current, desired map[string]*rule if _, found := desired[key]; !found { delete(rs.users[key], user) if len(rs.users[key]) == 0 { - common.Log.Infof("deleting rule: %v", spec.args) - if err := rs.ipt.Delete(TableFilter, IngressChain, spec.args...); err != nil { + chain := IngressChain + if spec.ruleType == egress { + chain = EgressCustomChain + } + common.Log.Infof("deleting rule %v from %q chain", spec.args, chain) + if err := rs.ipt.Delete(TableFilter, chain, spec.args...); err != nil { return err } delete(rs.users, key) @@ -74,8 +86,12 @@ func (rs *ruleSet) provision(user types.UID, current, desired map[string]*ruleSp for key, spec := range desired { if _, found := current[key]; !found { if _, found := rs.users[key]; !found { - common.Log.Infof("adding rule: %v", spec.args) - if err := rs.ipt.Append(TableFilter, IngressChain, spec.args...); err != nil { + chain := IngressChain + if spec.ruleType == egress { + chain = EgressCustomChain + } + common.Log.Infof("adding rule %v to %q chain", spec.args, chain) + if err := rs.ipt.Append(TableFilter, chain, spec.args...); err != nil { return err } rs.users[key] = make(map[types.UID]struct{}) diff --git a/npc/rule_test.go b/npc/rule_test.go index dee1802f..ab5850de 100644 --- a/npc/rule_test.go +++ b/npc/rule_test.go @@ -9,7 +9,7 @@ func TestRegressionHandleNil3095(t *testing.T) { // Test for handling nil values // https://github.com/weaveworks/weave/issues/3095 - rs := newRuleSpec(nil, nil, nil, nil) + rs := newRuleSpec(ingress, nil, nil, nil, nil) require.NotEqual(t, rs.key, "")