From d5e864736bf480c6507fdba6f80b99aa69a7eb2a Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Fri, 10 Aug 2018 18:37:08 +0530 Subject: [PATCH 1/3] weave-npc doesn't handle named ports Support for names ports in enhancement, but with this PR just adding more graceful failure. Fixes #3032 --- npc/analyser.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/npc/analyser.go b/npc/analyser.go index a19bb711..7e62e5b8 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -1,7 +1,9 @@ package npc import ( + "errors" "fmt" + "strconv" apiv1 "k8s.io/api/core/v1" networkingv1 "k8s.io/api/networking/v1" @@ -50,6 +52,13 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( // If From is empty or missing, this rule matches all sources allSources := ingressRule.From == nil || len(ingressRule.From) == 0 + if !allPorts { + for _, npProtocolPort := range ingressRule.Ports { + if _, err := strconv.Atoi(port(npProtocolPort.Port)); err != nil { + return nil, nil, nil, nil, errors.New("named ports in network policies in not support yet. Rejecting network policy from further processing") + } + } + } if allSources { if allPorts { rule := newRuleSpec(policyTypeIngress, nil, nil, targetSelector, nil) @@ -103,6 +112,13 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( // If To is empty or missing, this rule matches all destinations allDestinations := egressRule.To == nil || len(egressRule.To) == 0 + if !allPorts { + for _, npProtocolPort := range egressRule.Ports { + if _, err := strconv.Atoi(port(npProtocolPort.Port)); err != nil { + return nil, nil, nil, nil, errors.New("named ports in network policies in not support yet. Rejecting network policy from further processing") + } + } + } if allDestinations { if allPorts { rule := newRuleSpec(policyTypeEgress, nil, targetSelector, nil, nil) From 6625e29071ec6e0163f196f348aca92dd4a832fd Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Fri, 10 Aug 2018 19:36:18 +0530 Subject: [PATCH 2/3] addressing review comments --- npc/analyser.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/npc/analyser.go b/npc/analyser.go index 7e62e5b8..7ee462e9 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -1,7 +1,6 @@ package npc import ( - "errors" "fmt" "strconv" @@ -55,7 +54,8 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( if !allPorts { for _, npProtocolPort := range ingressRule.Ports { if _, err := strconv.Atoi(port(npProtocolPort.Port)); err != nil { - return nil, nil, nil, nil, errors.New("named ports in network policies in not support yet. Rejecting network policy from further processing") + return nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+ + "Rejecting network policy: %s with named port: %s from further processing ", policy.Name, port(npProtocolPort.Port)) } } } @@ -115,7 +115,8 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( if !allPorts { for _, npProtocolPort := range egressRule.Ports { if _, err := strconv.Atoi(port(npProtocolPort.Port)); err != nil { - return nil, nil, nil, nil, errors.New("named ports in network policies in not support yet. Rejecting network policy from further processing") + return nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+ + "Rejecting network policy: %s with named port: %s from further processing ", policy.Name, port(npProtocolPort.Port)) } } } From a19d0256775bf99bdf6282c2e1c2eb947a10232b Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Tue, 14 Aug 2018 20:16:04 +0530 Subject: [PATCH 3/3] addressing review comment --- npc/analyser.go | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/npc/analyser.go b/npc/analyser.go index 7ee462e9..a44b1bd2 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -2,7 +2,6 @@ package npc import ( "fmt" - "strconv" apiv1 "k8s.io/api/core/v1" networkingv1 "k8s.io/api/networking/v1" @@ -52,11 +51,9 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( allSources := ingressRule.From == nil || len(ingressRule.From) == 0 if !allPorts { - for _, npProtocolPort := range ingressRule.Ports { - if _, err := strconv.Atoi(port(npProtocolPort.Port)); err != nil { - return nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+ - "Rejecting network policy: %s with named port: %s from further processing ", policy.Name, port(npProtocolPort.Port)) - } + if err = checkForNamedPorts(ingressRule.Ports); err != nil { + return nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+ + "Rejecting network policy: %s from further processing. "+err.Error(), policy.Name) } } if allSources { @@ -113,11 +110,9 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( allDestinations := egressRule.To == nil || len(egressRule.To) == 0 if !allPorts { - for _, npProtocolPort := range egressRule.Ports { - if _, err := strconv.Atoi(port(npProtocolPort.Port)); err != nil { - return nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+ - "Rejecting network policy: %s with named port: %s from further processing ", policy.Name, port(npProtocolPort.Port)) - } + if err = checkForNamedPorts(egressRule.Ports); err != nil { + return nil, nil, nil, nil, fmt.Errorf("named ports in network policies is not supported yet. "+ + "Rejecting network policy: %s from further processing. "+err.Error(), policy.Name) } } if allDestinations { @@ -212,3 +207,12 @@ func port(p *intstr.IntOrString) string { return port } + +func checkForNamedPorts(ports []networkingv1.NetworkPolicyPort) error { + for _, npProtocolPort := range ports { + if npProtocolPort.Port != nil && npProtocolPort.Port.Type == intstr.String { + return fmt.Errorf("named port %s in network policy", port(npProtocolPort.Port)) + } + } + return nil +}