Skip to content

Commit 5e26843

Browse files
jaer-tsunjaer-tsun
authored
Named Ports Support (#553)
* Initial changes to support named ports. * add support for named ports via ipset ip+port hash * fixing a couple of operational bugs * adding simple test to validate named port parsing
1 parent d5c3386 commit 5e26843

File tree

12 files changed

+850
-352
lines changed

12 files changed

+850
-352
lines changed

‎npm/azure-npm.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@ spec:
9595
mountPath: /run/xtables.lock
9696
- name: log
9797
mountPath: /var/log
98+
- name: protocols
99+
mountPath: /etc/protocols
98100
hostNetwork: true
99101
volumes:
100102
- name: log
@@ -105,4 +107,8 @@ spec:
105107
hostPath:
106108
path: /run/xtables.lock
107109
type: File
110+
- name: protocols
111+
hostPath:
112+
path: /etc/protocols
113+
type: File
108114
serviceAccountName: azure-npm

‎npm/ipsm/ipsm.go‎

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ func (ipsMgr *IpsetManager) CreateList(listName string) error {
8484
spec: util.IpsetSetListFlag,
8585
}
8686
log.Printf("Creating List: %+v", entry)
87-
if _, err := ipsMgr.Run(entry); err != nil {
87+
if errCode, err := ipsMgr.Run(entry); err != nil && errCode != 1 {
8888
log.Errorf("Error: failed to create ipset list %s.", listName)
8989
return err
9090
}
@@ -101,10 +101,8 @@ func (ipsMgr *IpsetManager) DeleteList(listName string) error {
101101
set: util.GetHashedName(listName),
102102
}
103103

104-
errCode, err := ipsMgr.Run(entry)
105-
if err != nil {
104+
if errCode, err := ipsMgr.Run(entry); err != nil {
106105
if errCode == 1 {
107-
log.Printf("Error: Cannot delete list %s as it's being referred or doesn't exist.", listName)
108106
return nil
109107
}
110108

@@ -137,7 +135,7 @@ func (ipsMgr *IpsetManager) AddToList(listName string, setName string) error {
137135
spec: util.GetHashedName(setName),
138136
}
139137

140-
if _, err := ipsMgr.Run(entry); err != nil {
138+
if errCode, err := ipsMgr.Run(entry); err != nil && errCode != 1 {
141139
log.Errorf("Error: failed to create ipset rules. rule: %+v", entry)
142140
return err
143141
}
@@ -166,8 +164,8 @@ func (ipsMgr *IpsetManager) DeleteFromList(listName string, setName string) erro
166164
set: hashedListName,
167165
spec: hashedSetName,
168166
}
169-
errCode, err := ipsMgr.Run(entry)
170-
if errCode > 1 && err != nil {
167+
168+
if _, err := ipsMgr.Run(entry); err != nil {
171169
log.Errorf("Error: failed to delete ipset entry. %+v", entry)
172170
return err
173171
}
@@ -183,7 +181,7 @@ func (ipsMgr *IpsetManager) DeleteFromList(listName string, setName string) erro
183181
}
184182

185183
// CreateSet creates an ipset.
186-
func (ipsMgr *IpsetManager) CreateSet(setName string) error {
184+
func (ipsMgr *IpsetManager) CreateSet(setName, spec string) error {
187185
if _, exists := ipsMgr.setMap[setName]; exists {
188186
return nil
189187
}
@@ -193,10 +191,10 @@ func (ipsMgr *IpsetManager) CreateSet(setName string) error {
193191
operationFlag: util.IpsetCreationFlag,
194192
// Use hashed string for set name to avoid string length limit of ipset.
195193
set: util.GetHashedName(setName),
196-
spec: util.IpsetNetHashFlag,
194+
spec: spec,
197195
}
198196
log.Printf("Creating Set: %+v", entry)
199-
if _, err := ipsMgr.Run(entry); err != nil {
197+
if errCode, err := ipsMgr.Run(entry); err != nil && errCode != 1 {
200198
log.Errorf("Error: failed to create ipset.")
201199
return err
202200
}
@@ -221,10 +219,9 @@ func (ipsMgr *IpsetManager) DeleteSet(setName string) error {
221219
operationFlag: util.IpsetDestroyFlag,
222220
set: util.GetHashedName(setName),
223221
}
224-
errCode, err := ipsMgr.Run(entry)
225-
if err != nil {
222+
223+
if errCode, err := ipsMgr.Run(entry); err != nil {
226224
if errCode == 1 {
227-
log.Printf("Cannot delete set %s as it's being referred.", setName)
228225
return nil
229226
}
230227

@@ -238,12 +235,12 @@ func (ipsMgr *IpsetManager) DeleteSet(setName string) error {
238235
}
239236

240237
// AddToSet inserts an ip to an entry in setMap, and creates/updates the corresponding ipset.
241-
func (ipsMgr *IpsetManager) AddToSet(setName string, ip string) error {
242-
if ipsMgr.Exists(setName, ip, util.IpsetNetHashFlag) {
238+
func (ipsMgr *IpsetManager) AddToSet(setName, ip, spec string) error {
239+
if ipsMgr.Exists(setName, ip, spec) {
243240
return nil
244241
}
245242

246-
if err := ipsMgr.CreateSet(setName); err != nil {
243+
if err := ipsMgr.CreateSet(setName, spec); err != nil {
247244
return err
248245
}
249246

@@ -253,7 +250,7 @@ func (ipsMgr *IpsetManager) AddToSet(setName string, ip string) error {
253250
spec: ip,
254251
}
255252

256-
if _, err := ipsMgr.Run(entry); err != nil {
253+
if errCode, err := ipsMgr.Run(entry); err != nil && errCode != 1 {
257254
log.Printf("Error: failed to create ipset rules. %+v", entry)
258255
return err
259256
}
@@ -264,7 +261,7 @@ func (ipsMgr *IpsetManager) AddToSet(setName string, ip string) error {
264261
}
265262

266263
// DeleteFromSet removes an ip from an entry in setMap, and delete/update the corresponding ipset.
267-
func (ipsMgr *IpsetManager) DeleteFromSet(setName string, ip string) error {
264+
func (ipsMgr *IpsetManager) DeleteFromSet(setName, ip string) error {
268265
if _, exists := ipsMgr.setMap[setName]; !exists {
269266
log.Printf("ipset with name %s not found", setName)
270267
return nil
@@ -281,11 +278,18 @@ func (ipsMgr *IpsetManager) DeleteFromSet(setName string, ip string) error {
281278
set: util.GetHashedName(setName),
282279
spec: ip,
283280
}
284-
if _, err := ipsMgr.Run(entry); err != nil {
281+
282+
if errCode, err := ipsMgr.Run(entry); err != nil {
283+
if errCode == 1 {
284+
return nil
285+
}
286+
285287
log.Errorf("Error: failed to delete ipset entry. Entry: %+v", entry)
286288
return err
287289
}
288290

291+
ipsMgr.DeleteSet(setName)
292+
289293
return nil
290294
}
291295

‎npm/ipsm/ipsm_test.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
package ipsm
44

55
import (
6-
"testing"
76
"os"
7+
"testing"
88

99
"github.com/Azure/azure-container-networking/npm/util"
1010
)
@@ -77,7 +77,7 @@ func TestAddToList(t *testing.T) {
7777
}
7878
}()
7979

80-
if err := ipsMgr.CreateSet("test-set"); err != nil {
80+
if err := ipsMgr.CreateSet("test-set", util.IpsetNetHashFlag); err != nil {
8181
t.Errorf("TestAddToList failed @ ipsMgr.CreateSet")
8282
}
8383

@@ -98,7 +98,7 @@ func TestDeleteFromList(t *testing.T) {
9898
}
9999
}()
100100

101-
if err := ipsMgr.CreateSet("test-set"); err != nil {
101+
if err := ipsMgr.CreateSet("test-set", util.IpsetNetHashFlag); err != nil {
102102
t.Errorf("TestDeleteFromList failed @ ipsMgr.CreateSet")
103103
}
104104

@@ -127,7 +127,7 @@ func TestCreateSet(t *testing.T) {
127127
}
128128
}()
129129

130-
if err := ipsMgr.CreateSet("test-set"); err != nil {
130+
if err := ipsMgr.CreateSet("test-set", util.IpsetNetHashFlag); err != nil {
131131
t.Errorf("TestCreateSet failed @ ipsMgr.CreateSet")
132132
}
133133
}
@@ -144,7 +144,7 @@ func TestDeleteSet(t *testing.T) {
144144
}
145145
}()
146146

147-
if err := ipsMgr.CreateSet("test-set"); err != nil {
147+
if err := ipsMgr.CreateSet("test-set", util.IpsetNetHashFlag); err != nil {
148148
t.Errorf("TestDeleteSet failed @ ipsMgr.CreateSet")
149149
}
150150

@@ -165,7 +165,7 @@ func TestAddToSet(t *testing.T) {
165165
}
166166
}()
167167

168-
if err := ipsMgr.AddToSet("test-set", "1.2.3.4"); err != nil {
168+
if err := ipsMgr.AddToSet("test-set", "1.2.3.4", util.IpsetNetHashFlag); err != nil {
169169
t.Errorf("TestAddToSet failed @ ipsMgr.AddToSet")
170170
}
171171
}
@@ -182,7 +182,7 @@ func TestDeleteFromSet(t *testing.T) {
182182
}
183183
}()
184184

185-
if err := ipsMgr.AddToSet("test-set", "1.2.3.4"); err != nil {
185+
if err := ipsMgr.AddToSet("test-set", "1.2.3.4", util.IpsetNetHashFlag); err != nil {
186186
t.Errorf("TestDeleteFromSet failed @ ipsMgr.AddToSet")
187187
}
188188

@@ -203,7 +203,7 @@ func TestClean(t *testing.T) {
203203
}
204204
}()
205205

206-
if err := ipsMgr.CreateSet("test-set"); err != nil {
206+
if err := ipsMgr.CreateSet("test-set", util.IpsetNetHashFlag); err != nil {
207207
t.Errorf("TestClean failed @ ipsMgr.CreateSet")
208208
}
209209

@@ -224,7 +224,7 @@ func TestDestroy(t *testing.T) {
224224
}
225225
}()
226226

227-
if err := ipsMgr.AddToSet("test-set", "1.2.3.4"); err != nil {
227+
if err := ipsMgr.AddToSet("test-set", "1.2.3.4", util.IpsetNetHashFlag); err != nil {
228228
t.Errorf("TestDestroy failed @ ipsMgr.AddToSet")
229229
}
230230

@@ -262,6 +262,6 @@ func TestMain(m *testing.M) {
262262
exitCode := m.Run()
263263

264264
ipsMgr.Restore(util.IpsetConfigFile)
265-
265+
266266
os.Exit(exitCode)
267267
}

‎npm/namespace.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func (npMgr *NetworkPolicyManager) AddNamespace(nsObj *corev1.Namespace) error {
9595

9696
ipsMgr := npMgr.nsMap[util.KubeAllNamespacesFlag].ipsMgr
9797
// Create ipset for the namespace.
98-
if err = ipsMgr.CreateSet(nsName); err != nil {
98+
if err = ipsMgr.CreateSet(nsName, util.IpsetNetHashFlag); err != nil {
9999
log.Errorf("Error: failed to create ipset for namespace %s.", nsName)
100100
return err
101101
}

‎npm/npm.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ func NewNetworkPolicyManager(clientset *kubernetes.Clientset, informerFactory in
250250

251251
// Create ipset for the namespace.
252252
kubeSystemNs := "ns-" + util.KubeSystemFlag
253-
if err := allNs.ipsMgr.CreateSet(kubeSystemNs); err != nil {
253+
if err := allNs.ipsMgr.CreateSet(kubeSystemNs, util.IpsetNetHashFlag); err != nil {
254254
log.Logf("Error: failed to create ipset for namespace %s.", kubeSystemNs)
255255
}
256256

‎npm/nwpolicy.go‎

Lines changed: 29 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func (npMgr *NetworkPolicyManager) AddNetworkPolicy(npObj *networkingv1.NetworkP
4949
}
5050

5151
if !npMgr.isAzureNpmChainCreated {
52-
if err = allNs.ipsMgr.CreateSet(util.KubeSystemFlag); err != nil {
52+
if err = allNs.ipsMgr.CreateSet(util.KubeSystemFlag, util.IpsetNetHashFlag); err != nil {
5353
log.Errorf("Error: failed to initialize kube-system ipset.")
5454
return err
5555
}
@@ -63,10 +63,11 @@ func (npMgr *NetworkPolicyManager) AddNetworkPolicy(npObj *networkingv1.NetworkP
6363
}
6464

6565
var (
66-
hashedSelector = HashSelector(&npObj.Spec.PodSelector)
67-
addedPolicy *networkingv1.NetworkPolicy
68-
sets, lists []string
69-
iptEntries []*iptm.IptEntry
66+
hashedSelector = HashSelector(&npObj.Spec.PodSelector)
67+
addedPolicy *networkingv1.NetworkPolicy
68+
sets, namedPorts, lists []string
69+
iptEntries []*iptm.IptEntry
70+
ipsMgr = allNs.ipsMgr
7071
)
7172

7273
// Remove the existing policy from processed (merged) network policy map
@@ -92,30 +93,31 @@ func (npMgr *NetworkPolicyManager) AddNetworkPolicy(npObj *networkingv1.NetworkP
9293

9394
ns.rawNpMap[npObj.ObjectMeta.Name] = npObj
9495

95-
sets, lists, iptEntries = translatePolicy(npObj)
96-
ipsMgr := allNs.ipsMgr
96+
sets, namedPorts, lists, iptEntries = translatePolicy(npObj)
9797
for _, set := range sets {
9898
log.Printf("Creating set: %v, hashedSet: %v", set, util.GetHashedName(set))
99-
if err = ipsMgr.CreateSet(set); err != nil {
99+
if err = ipsMgr.CreateSet(set, util.IpsetNetHashFlag); err != nil {
100100
log.Printf("Error creating ipset %s", set)
101-
return err
101+
}
102+
}
103+
for _, set := range namedPorts {
104+
log.Printf("Creating set: %v, hashedSet: %v", set, util.GetHashedName(set))
105+
if err = ipsMgr.CreateSet(set, util.IpsetIPPortHashFlag); err != nil {
106+
log.Printf("Error creating ipset named port %s", set)
102107
}
103108
}
104109
for _, list := range lists {
105110
if err = ipsMgr.CreateList(list); err != nil {
106111
log.Printf("Error creating ipset list %s", list)
107-
return err
108112
}
109113
}
110114
if err = npMgr.InitAllNsList(); err != nil {
111115
log.Printf("Error initializing all-namespace ipset list.")
112-
return err
113116
}
114117
iptMgr := allNs.iptMgr
115118
for _, iptEntry := range iptEntries {
116119
if err = iptMgr.Add(iptEntry); err != nil {
117120
log.Errorf("Error: failed to apply iptables rule. Rule: %+v", iptEntry)
118-
return err
119121
}
120122
}
121123

@@ -135,8 +137,10 @@ func (npMgr *NetworkPolicyManager) UpdateNetworkPolicy(oldNpObj *networkingv1.Ne
135137
// DeleteNetworkPolicy handles deleting network policy from iptables.
136138
func (npMgr *NetworkPolicyManager) DeleteNetworkPolicy(npObj *networkingv1.NetworkPolicy) error {
137139
var (
138-
err error
139-
ns *namespace
140+
err error
141+
ns *namespace
142+
allNs = npMgr.nsMap[util.KubeAllNamespacesFlag]
143+
ipsMgr = allNs.ipsMgr
140144
)
141145

142146
npNs, npName := "ns-"+npObj.ObjectMeta.Namespace, npObj.ObjectMeta.Name
@@ -151,20 +155,27 @@ func (npMgr *NetworkPolicyManager) DeleteNetworkPolicy(npObj *networkingv1.Netwo
151155
npMgr.nsMap[npNs] = ns
152156
}
153157

154-
allNs := npMgr.nsMap[util.KubeAllNamespacesFlag]
155-
156-
_, _, iptEntries := translatePolicy(npObj)
158+
sets, namedPorts, lists, iptEntries := translatePolicy(npObj)
157159

158160
iptMgr := allNs.iptMgr
159161
for _, iptEntry := range iptEntries {
160162
if err = iptMgr.Delete(iptEntry); err != nil {
161163
log.Errorf("Error: failed to apply iptables rule. Rule: %+v", iptEntry)
162-
return err
163164
}
164165
}
165166

166167
delete(ns.rawNpMap, npObj.ObjectMeta.Name)
167168

169+
for _, set := range sets {
170+
ipsMgr.DeleteSet(set)
171+
}
172+
for _, set := range namedPorts {
173+
ipsMgr.DeleteSet(set)
174+
}
175+
for _, list := range lists {
176+
ipsMgr.DeleteList(list)
177+
}
178+
168179
hashedSelector := HashSelector(&npObj.Spec.PodSelector)
169180
if oldPolicy, oldPolicyExists := ns.processedNpMap[hashedSelector]; oldPolicyExists {
170181
deductedPolicy, err := deductPolicy(oldPolicy, npObj)

‎npm/nwpolicy_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func TestAddNetworkPolicy(t *testing.T) {
3838
}
3939

4040
// Create ns-kube-system set
41-
if err := ipsMgr.CreateSet("ns-" + util.KubeSystemFlag); err != nil {
41+
if err := ipsMgr.CreateSet("ns-"+util.KubeSystemFlag, util.IpsetNetHashFlag); err != nil {
4242
t.Errorf("TestAddNetworkPolicy failed @ ipsMgr.CreateSet, adding kube-system set%+v", err)
4343
}
4444

@@ -161,7 +161,7 @@ func TestUpdateNetworkPolicy(t *testing.T) {
161161
}()
162162

163163
// Create ns-kube-system set
164-
if err := ipsMgr.CreateSet("ns-" + util.KubeSystemFlag); err != nil {
164+
if err := ipsMgr.CreateSet("ns-"+util.KubeSystemFlag, util.IpsetNetHashFlag); err != nil {
165165
t.Errorf("TestUpdateNetworkPolicy failed @ ipsMgr.CreateSet, adding kube-system set%+v", err)
166166
}
167167

@@ -273,7 +273,7 @@ func TestDeleteNetworkPolicy(t *testing.T) {
273273
}()
274274

275275
// Create ns-kube-system set
276-
if err := ipsMgr.CreateSet("ns-" + util.KubeSystemFlag); err != nil {
276+
if err := ipsMgr.CreateSet("ns-"+util.KubeSystemFlag, util.IpsetNetHashFlag); err != nil {
277277
t.Errorf("TestDeleteNetworkPolicy failed @ ipsMgr.CreateSet, adding kube-system set%+v", err)
278278
}
279279

0 commit comments

Comments
 (0)