Skip to content

Commit 3f1216e

Browse files
ashvindeodharYongli Chen
ashvindeodhar
authored and
Yongli Chen
committed
Fix Endpoint policy regression (#268)
Fix endpoint policy regression
1 parent bfb3eaa commit 3f1216e

File tree

5 files changed

+158
-92
lines changed

5 files changed

+158
-92
lines changed

‎cni/azure-windows-multitenancy.conflist‎

Lines changed: 46 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,48 @@
11
{
2-
"cniVersion":"0.3.0",
3-
"name":"azure",
4-
"plugins":[
5-
{
6-
"type":"azure-vnet",
7-
"mode":"bridge",
8-
"bridge":"azure0",
9-
"multiTenancy":true,
10-
"enableSnatOnHost":true,
11-
"ipam":{
12-
"type":"azure-vnet-ipam"
13-
}
14-
},
15-
{
16-
"type":"portmap",
17-
"capabilities":{
18-
"portMappings":true
19-
},
20-
"snat":true
21-
}
22-
]
2+
"cniVersion": "0.3.0",
3+
"name": "azure",
4+
"plugins": [
5+
{
6+
"type": "azure-vnet",
7+
"mode": "bridge",
8+
"bridge": "azure0",
9+
"multiTenancy":true,
10+
"enableSnatOnHost":true,
11+
"capabilities": {
12+
"portMappings": true
13+
},
14+
"ipam": {
15+
"type": "azure-vnet-ipam"
16+
},
17+
"dns": {
18+
"Nameservers": [
19+
"10.0.0.10",
20+
"168.63.129.16"
21+
],
22+
"Search": [
23+
"svc.cluster.local"
24+
]
25+
},
26+
"AdditionalArgs": [
27+
{
28+
"Name": "EndpointPolicy",
29+
"Value": {
30+
"Type": "OutBoundNAT",
31+
"ExceptionList": [
32+
"10.240.0.0/16",
33+
"10.0.0.0/8"
34+
]
35+
}
36+
},
37+
{
38+
"Name": "EndpointPolicy",
39+
"Value": {
40+
"Type": "ROUTE",
41+
"DestinationPrefix": "10.0.0.0/8",
42+
"NeedEncap": true
43+
}
44+
}
45+
]
46+
}
47+
]
2348
}

‎network/endpoint_windows.go‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -61,35 +61,7 @@ func (nw *network) newEndpointImpl(epInfo *EndpointInfo) (*endpoint, error) {
6161
VirtualNetwork: nw.HnsId,
6262
DNSSuffix: epInfo.DNS.Suffix,
6363
DNSServerList: strings.Join(epInfo.DNS.Servers, ","),
64-
}
65-
66-
// Set outbound NAT policy
67-
outBoundNatPolicy := hcsshim.OutboundNatPolicy{}
68-
outBoundNatPolicy.Policy.Type = hcsshim.OutboundNat
69-
70-
exceptionList, err := policy.GetOutBoundNatExceptionList(epInfo.Policies)
71-
if err != nil {
72-
log.Printf("[net] Failed to parse outbound NAT policy %v", err)
73-
return nil, err
74-
}
75-
76-
if exceptionList != nil {
77-
for _, ipAddress := range exceptionList {
78-
outBoundNatPolicy.Exceptions = append(outBoundNatPolicy.Exceptions, ipAddress)
79-
}
80-
}
81-
82-
if epInfo.Data[CnetAddressSpace] != nil {
83-
if cnetAddressSpace := epInfo.Data[CnetAddressSpace].([]string); cnetAddressSpace != nil {
84-
for _, ipAddress := range cnetAddressSpace {
85-
outBoundNatPolicy.Exceptions = append(outBoundNatPolicy.Exceptions, ipAddress)
86-
}
87-
}
88-
}
89-
90-
if outBoundNatPolicy.Exceptions != nil {
91-
serializedOutboundNatPolicy, _ := json.Marshal(outBoundNatPolicy)
92-
hnsEndpoint.Policies = append(hnsEndpoint.Policies, serializedOutboundNatPolicy)
64+
Policies: policy.SerializePolicies(policy.EndpointPolicy, epInfo.Policies, epInfo.Data),
9365
}
9466

9567
// HNS currently supports only one IP address per endpoint.

‎network/network_windows.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func (nm *networkManager) newNetworkImpl(nwInfo *NetworkInfo, extIf *externalInt
3737
Name: nwInfo.Id,
3838
NetworkAdapterName: networkAdapterName,
3939
DNSServerList: strings.Join(nwInfo.DNS.Servers, ","),
40-
Policies: policy.SerializePolicies(policy.NetworkPolicy, nwInfo.Policies),
40+
Policies: policy.SerializePolicies(policy.NetworkPolicy, nwInfo.Policies, nil),
4141
}
4242

4343
// Set the VLAN and OutboundNAT policies

‎network/policy/policy.go‎

Lines changed: 0 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package policy
22

33
import (
44
"encoding/json"
5-
"log"
65
)
76

87
const (
@@ -17,43 +16,3 @@ type Policy struct {
1716
Type CNIPolicyType
1817
Data json.RawMessage
1918
}
20-
21-
// SerializePolicies serializes policies to json.
22-
func SerializePolicies(policyType CNIPolicyType, policies []Policy) []json.RawMessage {
23-
var jsonPolicies []json.RawMessage
24-
for _, policy := range policies {
25-
if policy.Type == policyType {
26-
jsonPolicies = append(jsonPolicies, policy.Data)
27-
}
28-
}
29-
return jsonPolicies
30-
}
31-
32-
// GetOutBoundNatExceptionList returns exception list for outbound nat policy
33-
func GetOutBoundNatExceptionList(policies []Policy) ([]string, error) {
34-
type KVPair struct {
35-
Type CNIPolicyType `json:"Type"`
36-
ExceptionList json.RawMessage `json:"ExceptionList"`
37-
}
38-
39-
for _, policy := range policies {
40-
if policy.Type == EndpointPolicy {
41-
var data KVPair
42-
if err := json.Unmarshal(policy.Data, &data); err != nil {
43-
return nil, err
44-
}
45-
46-
if data.Type == OutBoundNatPolicy {
47-
var exceptionList []string
48-
if err := json.Unmarshal(data.ExceptionList, &exceptionList); err != nil {
49-
return nil, err
50-
}
51-
52-
return exceptionList, nil
53-
}
54-
}
55-
}
56-
57-
log.Printf("OutBoundNAT policy not set.")
58-
return nil, nil
59-
}

‎network/policy/policy_windows.go‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
package policy
2+
3+
import (
4+
"encoding/json"
5+
"fmt"
6+
"log"
7+
8+
"github.com/Microsoft/hcsshim"
9+
)
10+
11+
// SerializePolicies serializes policies to json.
12+
func SerializePolicies(policyType CNIPolicyType, policies []Policy, epInfoData map[string]interface{}) []json.RawMessage {
13+
var jsonPolicies []json.RawMessage
14+
for _, policy := range policies {
15+
if policy.Type == policyType {
16+
if isPolicyTypeOutBoundNAT := IsPolicyTypeOutBoundNAT(policy); isPolicyTypeOutBoundNAT {
17+
if serializedOutboundNatPolicy, err := SerializeOutBoundNATPolicy(policies, epInfoData); err != nil {
18+
log.Printf("Failed to serialize OutBoundNAT policy")
19+
} else {
20+
jsonPolicies = append(jsonPolicies, serializedOutboundNatPolicy)
21+
}
22+
} else {
23+
jsonPolicies = append(jsonPolicies, policy.Data)
24+
}
25+
}
26+
}
27+
return jsonPolicies
28+
}
29+
30+
// GetOutBoundNatExceptionList returns exception list for outbound nat policy
31+
func GetOutBoundNatExceptionList(policies []Policy) ([]string, error) {
32+
type KVPair struct {
33+
Type CNIPolicyType `json:"Type"`
34+
ExceptionList json.RawMessage `json:"ExceptionList"`
35+
}
36+
37+
for _, policy := range policies {
38+
if policy.Type == EndpointPolicy {
39+
var data KVPair
40+
if err := json.Unmarshal(policy.Data, &data); err != nil {
41+
return nil, err
42+
}
43+
44+
if data.Type == OutBoundNatPolicy {
45+
var exceptionList []string
46+
if err := json.Unmarshal(data.ExceptionList, &exceptionList); err != nil {
47+
return nil, err
48+
}
49+
50+
return exceptionList, nil
51+
}
52+
}
53+
}
54+
55+
log.Printf("OutBoundNAT policy not set")
56+
return nil, nil
57+
}
58+
59+
// IsPolicyTypeOutBoundNAT return true if the policy type is OutBoundNAT
60+
func IsPolicyTypeOutBoundNAT(policy Policy) bool {
61+
if policy.Type == EndpointPolicy {
62+
type KVPair struct {
63+
Type CNIPolicyType `json:"Type"`
64+
ExceptionList json.RawMessage `json:"ExceptionList"`
65+
}
66+
var data KVPair
67+
if err := json.Unmarshal(policy.Data, &data); err != nil {
68+
return false
69+
}
70+
71+
if data.Type == OutBoundNatPolicy {
72+
return true
73+
}
74+
}
75+
76+
return false
77+
}
78+
79+
// SerializeOutBoundNATPolicy formulates OutBoundNAT policy and returns serialized json
80+
func SerializeOutBoundNATPolicy(policies []Policy, epInfoData map[string]interface{}) (json.RawMessage, error) {
81+
outBoundNatPolicy := hcsshim.OutboundNatPolicy{}
82+
outBoundNatPolicy.Policy.Type = hcsshim.OutboundNat
83+
84+
exceptionList, err := GetOutBoundNatExceptionList(policies)
85+
if err != nil {
86+
log.Printf("Failed to parse outbound NAT policy %v", err)
87+
return nil, err
88+
}
89+
90+
if exceptionList != nil {
91+
for _, ipAddress := range exceptionList {
92+
outBoundNatPolicy.Exceptions = append(outBoundNatPolicy.Exceptions, ipAddress)
93+
}
94+
}
95+
96+
if epInfoData["cnetAddressSpace"] != nil {
97+
if cnetAddressSpace := epInfoData["cnetAddressSpace"].([]string); cnetAddressSpace != nil {
98+
for _, ipAddress := range cnetAddressSpace {
99+
outBoundNatPolicy.Exceptions = append(outBoundNatPolicy.Exceptions, ipAddress)
100+
}
101+
}
102+
}
103+
104+
if outBoundNatPolicy.Exceptions != nil {
105+
serializedOutboundNatPolicy, _ := json.Marshal(outBoundNatPolicy)
106+
return serializedOutboundNatPolicy, nil
107+
}
108+
109+
return nil, fmt.Errorf("OutBoundNAT policy not set")
110+
}

0 commit comments

Comments
 (0)