npm lite default deny

Author: rejain789

cni/network/network_windows.go

@@ -59,6 +59,7 @@ func setEndpointOptions(cnsNwConfig *cns.GetNetworkContainerResponse, epInfo *ne
 		epInfo.AllowInboundFromHostToNC = cnsNwConfig.AllowHostToNCCommunication
 		epInfo.AllowInboundFromNCToHost = cnsNwConfig.AllowNCToHostCommunication
 		epInfo.NetworkContainerID = cnsNwConfig.NetworkContainerID
+		epInfo.DefaultDenyACL = cnsNwConfig.DefaultDenyACL
 	}
 }
 

cns/NetworkContainerContract.go

@@ -127,6 +127,7 @@ type CreateNetworkContainerRequest struct {
 	EndpointPolicies           []NetworkContainerRequestPolicies
 	NCStatus                   v1alpha.NCStatus
 	NetworkInterfaceInfo       NetworkInterfaceInfo //nolint // introducing new field for backendnic, to be used later by cni code
+	DefaultDenyACL             bool                 // specifies whether a "deny all" policy is applied to l1vh multi-tenant pods
 }
 
 func (req *CreateNetworkContainerRequest) Validate() error {
@@ -487,6 +488,7 @@ type GetNetworkContainerResponse struct {
 	AllowHostToNCCommunication bool
 	AllowNCToHostCommunication bool
 	NetworkInterfaceInfo       NetworkInterfaceInfo
+	DefaultDenyACL             bool // specifies whether a "deny all" policy is applied to l1vh multi-tenant pods
 }
 
 type PodIpInfo struct {

cns/networkcontainers/networkcontainers.go

@@ -134,6 +134,35 @@ func getNetworkConfig(configFilePath string) ([]byte, error) {
 	flatNetConfigMap[versionStr] = configMap[versionStr].(string)
 	flatNetConfigMap[nameStr] = configMap[nameStr].(string)
 
+	// TODO Check if default deny bool is enabled to true
+	// insert default dent policy here
+	defaultDenyOutACL := map[string]interface{}{
+		"Name": "EndpointPolicy",
+		"Value": map[string]interface{}{
+			"Type":      "ACL",
+			"Action":    "Block",
+			"Direction": "Out",
+			"Priority":  300,
+		},
+	}
+
+	defaultDenyInACL := map[string]interface{}{
+		"Name": "EndpointPolicy",
+		"Value": map[string]interface{}{
+			"Type":      "ACL",
+			"Action":    "Block",
+			"Direction": "In",
+			"Priority":  300,
+		},
+	}
+	additionalArgsKey := "AdditionalArgs"
+	if _, exists := flatNetConfigMap[additionalArgsKey]; !exists {
+		flatNetConfigMap[additionalArgsKey] = []interface{}{}
+	}
+
+	flatNetConfigMap[additionalArgsKey] = append(flatNetConfigMap[additionalArgsKey].([]interface{}), defaultDenyOutACL)
+	flatNetConfigMap[additionalArgsKey] = append(flatNetConfigMap[additionalArgsKey].([]interface{}), defaultDenyInACL)
+
 	// convert into bytes format
 	netConfig, err := json.Marshal(flatNetConfigMap)
 	if err != nil {

cns/restserver/util.go

@@ -531,6 +531,7 @@ func (service *HTTPRestService) getAllNetworkContainerResponses(
 			AllowHostToNCCommunication: savedReq.AllowHostToNCCommunication,
 			AllowNCToHostCommunication: savedReq.AllowNCToHostCommunication,
 			NetworkInterfaceInfo:       savedReq.NetworkInterfaceInfo,
+			DefaultDenyACL:             savedReq.DefaultDenyACL,
 		}
 
 		// If the NC version check wasn't skipped, take into account the VFP programming status when returning the response
@@ -933,6 +934,7 @@ func (service *HTTPRestService) handleGetNetworkContainers(w http.ResponseWriter
 			LocalIPConfiguration:       ncDetails.CreateNetworkContainerRequest.LocalIPConfiguration,
 			AllowHostToNCCommunication: ncDetails.CreateNetworkContainerRequest.AllowHostToNCCommunication,
 			AllowNCToHostCommunication: ncDetails.CreateNetworkContainerRequest.AllowNCToHostCommunication,
+			DefaultDenyACL:             ncDetails.CreateNetworkContainerRequest.DefaultDenyACL,
 		}
 		networkContainers[i] = getNcResp
 		i++

crd/multitenancy/api/v1alpha1/podnetworkinstance.go

@@ -56,6 +56,8 @@ type PodNetworkInstanceSpec struct {
 	// optional for now in case orchestrator uses the deprecated fields
 	// +kubebuilder:validation:Optional
 	PodNetworkConfigs []PodNetworkConfig `json:"podNetworkConfigs"`
+	// DefaultDenyACL is a bool that specifies whether a "deny all" policy is applied to l1vh multi-tenant pods
+	DefaultDenyACL bool
 }
 
 // PodNetworkInstanceStatus defines the observed state of PodNetworkInstance

network/endpoint.go

@@ -112,6 +112,7 @@ type EndpointInfo struct {
 	IsIPv6Enabled                 bool
 	HostSubnetPrefix              string // can be used later to add an external interface
 	PnPID                         string
+	DefaultDenyACL                bool
 }
 
 // RouteInfo contains information about an IP route.