Skip to content

Commit effc429

Browse files
vakalapamatmerr
vakalapa
and
matmerr
authored
[NPM] Consolidating default chains and rules for easier readability (#796)
* Consolidating default chains and rules for easier readability * Adding tests and checks for allchainsandrules * [build] Update pipeline and enable debug symbols in bins (#793) * add symbols, add gcflags, update timeouts, only show azure core errors Co-authored-by: Mathew Merrick <[email protected]>
1 parent d78002d commit effc429

File tree

3 files changed

+300
-349
lines changed

3 files changed

+300
-349
lines changed

‎npm/iptm/helper.go‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
package iptm
2+
3+
import (
4+
"fmt"
5+
6+
"github.com/Azure/azure-container-networking/npm/util"
7+
)
8+
9+
// GetAllChainsAndRules returns all NPM chains and rules
10+
func getAllChainsAndRules() [][]string {
11+
funcList := []func() [][]string{
12+
getAzureNPMChainRules,
13+
getAzureNPMIngressPortChainRules,
14+
getAzureNPMIngressFromChainRules,
15+
getAzureNPMEgressPortChainRules,
16+
getAzureNPMEgressToChainRules,
17+
}
18+
19+
chainsAndRules := [][]string{}
20+
for _, fn := range funcList {
21+
tempRules := fn()
22+
chainsAndRules = append(chainsAndRules, tempRules...)
23+
}
24+
25+
return chainsAndRules
26+
}
27+
28+
// getAzureNPMChainRules returns all rules for AZURE-NPM chain
29+
func getAzureNPMChainRules() [][]string {
30+
// Note: make sure 0th index is prent chain for logging
31+
return [][]string{
32+
{
33+
util.IptablesAzureChain,
34+
util.IptablesJumpFlag,
35+
util.IptablesAzureIngressPortChain,
36+
},
37+
{
38+
util.IptablesAzureChain,
39+
util.IptablesJumpFlag,
40+
util.IptablesAzureEgressPortChain,
41+
},
42+
{
43+
util.IptablesAzureChain,
44+
util.IptablesJumpFlag,
45+
util.IptablesAccept,
46+
util.IptablesModuleFlag,
47+
util.IptablesMarkVerb,
48+
util.IptablesMarkFlag,
49+
util.IptablesAzureAcceptMarkHex,
50+
util.IptablesModuleFlag,
51+
util.IptablesCommentModuleFlag,
52+
util.IptablesCommentFlag,
53+
fmt.Sprintf("ACCEPT-on-INGRESS-and-EGRESS-mark-%s", util.IptablesAzureAcceptMarkHex),
54+
},
55+
{
56+
util.IptablesAzureChain,
57+
util.IptablesJumpFlag,
58+
util.IptablesAccept,
59+
util.IptablesModuleFlag,
60+
util.IptablesMarkVerb,
61+
util.IptablesMarkFlag,
62+
util.IptablesAzureIngressMarkHex,
63+
util.IptablesModuleFlag,
64+
util.IptablesCommentModuleFlag,
65+
util.IptablesCommentFlag,
66+
fmt.Sprintf("ACCEPT-on-INGRESS-mark-%s", util.IptablesAzureIngressMarkHex),
67+
},
68+
{
69+
util.IptablesAzureChain,
70+
util.IptablesJumpFlag,
71+
util.IptablesAccept,
72+
util.IptablesModuleFlag,
73+
util.IptablesMarkVerb,
74+
util.IptablesMarkFlag,
75+
util.IptablesAzureEgressMarkHex,
76+
util.IptablesModuleFlag,
77+
util.IptablesCommentModuleFlag,
78+
util.IptablesCommentFlag,
79+
fmt.Sprintf("ACCEPT-on-EGRESS-mark-%s", util.IptablesAzureEgressMarkHex),
80+
},
81+
{
82+
util.IptablesAzureChain,
83+
util.IptablesJumpFlag,
84+
util.IptablesAzureTargetSetsChain,
85+
},
86+
{
87+
util.IptablesAzureChain,
88+
util.IptablesModuleFlag,
89+
util.IptablesStateModuleFlag,
90+
util.IptablesStateFlag,
91+
util.IptablesRelatedState + "," + util.IptablesEstablishedState,
92+
util.IptablesJumpFlag,
93+
util.IptablesAccept,
94+
util.IptablesModuleFlag,
95+
util.IptablesCommentModuleFlag,
96+
util.IptablesCommentFlag,
97+
fmt.Sprintf("ACCEPT-on-connection-state"),
98+
},
99+
}
100+
}
101+
102+
// getAzureNPMIngressPortChainRules returns rules for AZURE-NPM-INGRESS-PORT
103+
func getAzureNPMIngressPortChainRules() [][]string {
104+
return [][]string{
105+
{
106+
util.IptablesAzureIngressPortChain,
107+
util.IptablesJumpFlag,
108+
util.IptablesReturn,
109+
util.IptablesModuleFlag,
110+
util.IptablesMarkVerb,
111+
util.IptablesMarkFlag,
112+
util.IptablesAzureIngressMarkHex,
113+
util.IptablesModuleFlag,
114+
util.IptablesCommentModuleFlag,
115+
util.IptablesCommentFlag,
116+
fmt.Sprintf("RETURN-on-INGRESS-mark-%s", util.IptablesAzureIngressMarkHex),
117+
},
118+
}
119+
}
120+
121+
// getAzureNPMIngressFromChainRules returns rules for AZURE-NPM-INGRESS-PORT
122+
func getAzureNPMIngressFromChainRules() [][]string {
123+
return [][]string{
124+
{
125+
util.IptablesAzureIngressFromChain,
126+
util.IptablesJumpFlag,
127+
util.IptablesReturn,
128+
util.IptablesModuleFlag,
129+
util.IptablesMarkVerb,
130+
util.IptablesMarkFlag,
131+
util.IptablesAzureIngressMarkHex,
132+
util.IptablesModuleFlag,
133+
util.IptablesCommentModuleFlag,
134+
util.IptablesCommentFlag,
135+
fmt.Sprintf("RETURN-on-INGRESS-mark-%s", util.IptablesAzureIngressMarkHex),
136+
},
137+
}
138+
}
139+
140+
// getAzureNPMEgressPortChainRules returns rules for AZURE-NPM-INGRESS-PORT
141+
func getAzureNPMEgressPortChainRules() [][]string {
142+
return [][]string{
143+
{
144+
util.IptablesAzureEgressPortChain,
145+
util.IptablesJumpFlag,
146+
util.IptablesReturn,
147+
util.IptablesModuleFlag,
148+
util.IptablesMarkVerb,
149+
util.IptablesMarkFlag,
150+
util.IptablesAzureAcceptMarkHex,
151+
util.IptablesModuleFlag,
152+
util.IptablesCommentModuleFlag,
153+
util.IptablesCommentFlag,
154+
fmt.Sprintf("RETURN-on-EGRESS-and-INGRESS-mark-%s", util.IptablesAzureAcceptMarkHex),
155+
},
156+
{
157+
util.IptablesAzureEgressPortChain,
158+
util.IptablesJumpFlag,
159+
util.IptablesReturn,
160+
util.IptablesModuleFlag,
161+
util.IptablesMarkVerb,
162+
util.IptablesMarkFlag,
163+
util.IptablesAzureEgressMarkHex,
164+
util.IptablesModuleFlag,
165+
util.IptablesCommentModuleFlag,
166+
util.IptablesCommentFlag,
167+
fmt.Sprintf("RETURN-on-EGRESS-mark-%s", util.IptablesAzureEgressMarkHex),
168+
},
169+
}
170+
}
171+
172+
// getAzureNPMEgressToChainRules returns rules for AZURE-NPM-INGRESS-PORT
173+
func getAzureNPMEgressToChainRules() [][]string {
174+
return [][]string{
175+
{
176+
util.IptablesAzureEgressToChain,
177+
util.IptablesJumpFlag,
178+
util.IptablesReturn,
179+
util.IptablesModuleFlag,
180+
util.IptablesMarkVerb,
181+
util.IptablesMarkFlag,
182+
util.IptablesAzureAcceptMarkHex,
183+
util.IptablesModuleFlag,
184+
util.IptablesCommentModuleFlag,
185+
util.IptablesCommentFlag,
186+
fmt.Sprintf("RETURN-on-EGRESS-and-INGRESS-mark-%s", util.IptablesAzureAcceptMarkHex),
187+
},
188+
{
189+
util.IptablesAzureEgressToChain,
190+
util.IptablesJumpFlag,
191+
util.IptablesReturn,
192+
util.IptablesModuleFlag,
193+
util.IptablesMarkVerb,
194+
util.IptablesMarkFlag,
195+
util.IptablesAzureEgressMarkHex,
196+
util.IptablesModuleFlag,
197+
util.IptablesCommentModuleFlag,
198+
util.IptablesCommentFlag,
199+
fmt.Sprintf("RETURN-on-EGRESS-mark-%s", util.IptablesAzureEgressMarkHex),
200+
},
201+
}
202+
}

‎npm/iptm/helper_test.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package iptm
2+
3+
import (
4+
"testing"
5+
6+
"github.com/Azure/azure-container-networking/npm/util"
7+
)
8+
9+
func TestGetAllChainsAndRules(t *testing.T) {
10+
allChainsandRules := getAllChainsAndRules()
11+
12+
parentNpmRulesCount := 7
13+
14+
if len(allChainsandRules[0]) > 3 {
15+
t.Errorf("TestGetAllChainsAndRules failed @ INGRESS target check")
16+
}
17+
18+
if len(allChainsandRules[1]) > 3 {
19+
t.Errorf("TestGetAllChainsAndRules failed @ EGRESS target check")
20+
}
21+
22+
for i, rule := range allChainsandRules {
23+
if i == parentNpmRulesCount {
24+
break
25+
}
26+
// make sure the ordering is correct
27+
// first 7 rules should be parent chain rules
28+
if rule[0] != util.IptablesAzureChain {
29+
t.Errorf("TestGetAllChainsAndRules failed @ AzureNpmChain rule count check")
30+
}
31+
}
32+
}

0 commit comments

Comments
 (0)