Skip to content

fix: [NPM] [Linux] improve iptables version detection and cleanup #3090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Nov 7, 2024
Merged

fix: [NPM] [Linux] improve iptables version detection and cleanup #3090

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
00b385d
fix: improve iptables version detection
huntergregory Oct 29, 2024
5f3fa4b
fix: redo everything and add tests
huntergregory Oct 31, 2024
334d8c0
fix: address comments
huntergregory Oct 31, 2024
85dc587
fix: avoid segfault by only listing one chain
huntergregory Nov 5, 2024
b399ec0
style: log the kernel version
huntergregory Nov 5, 2024
c149095
style: fix lints
huntergregory Nov 6, 2024
36b3356
fix: don't use stale chains. add comments. minor style change
huntergregory Nov 6, 2024
5acf87e
fix: listing kube chain. get stderr too. also add missing ut
huntergregory Nov 6, 2024
7c7ead6
fix: log messages
huntergregory Nov 6, 2024
10f1f14
fix: stop checking kernel version. default nft, never crash
huntergregory Nov 6, 2024
f7155c6
style: fix lint
huntergregory Nov 6, 2024
7b3e155
style: try fixing gci/gofumpt lint
huntergregory Nov 6, 2024
bebe123
test: fix unit tests referencing iptables legacy
huntergregory Nov 6, 2024
1a3a6d7
Merge branch 'master' into huntergregory/npm-legacy
huntergregory Nov 6, 2024
5934dd5
style: fix lint in iptm_test.go
huntergregory Nov 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions npm/pkg/dataplane/dataplane_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ package dataplane

import (
"github.com/Azure/azure-container-networking/npm/pkg/dataplane/policies"
"github.com/Azure/azure-container-networking/npm/util"
npmerrors "github.com/Azure/azure-container-networking/npm/util/errors"
)

Expand All @@ -21,8 +20,6 @@ func (dp *DataPlane) updatePod(pod *updateNPMPod) error {
}

func (dp *DataPlane) bootupDataPlane() error {
util.DetectIptablesVersion(dp.ioShim)

// It is important to keep order to clean-up ACLs before ipsets. Otherwise we won't be able to delete ipsets referenced by ACLs
if err := dp.policyMgr.Bootup(nil); err != nil {
return npmerrors.ErrorWrapper(npmerrors.BootupDataplane, false, "failed to reset policy dataplane", err)
Expand Down
16 changes: 6 additions & 10 deletions npm/pkg/dataplane/dataplane_linux_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package dataplane

import (
"fmt"
"testing"
"time"

Expand Down Expand Up @@ -74,9 +73,6 @@ func TestNetPolInBackgroundUpdatePolicy(t *testing.T) {
calls := append(getBootupTestCalls(), getAddPolicyTestCallsForDP(&testPolicyobj)...)
calls = append(calls, getRemovePolicyTestCallsForDP(&testPolicyobj)...)
calls = append(calls, getAddPolicyTestCallsForDP(&updatedTestPolicyobj)...)
for _, call := range calls {
fmt.Println(call)
}
ioshim := common.NewMockIOShim(calls)
defer ioshim.VerifyCalls(t, calls)
dp, err := NewDataPlane("testnode", ioshim, netpolInBackgroundCfg, nil)
Expand Down Expand Up @@ -133,31 +129,31 @@ func TestNetPolInBackgroundFailureToAddFirstTime(t *testing.T) {
},
// restore will try twice per pMgr.AddPolicies() call
testutils.TestCmd{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
testutils.TestCmd{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
// first policy succeeds
testutils.TestCmd{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 0,
},
// second policy succeeds
testutils.TestCmd{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 0,
},
// third policy fails
// restore will try twice per pMgr.AddPolicies() call
testutils.TestCmd{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
testutils.TestCmd{
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
ExitCode: 1,
},
)
Expand Down
6 changes: 1 addition & 5 deletions npm/pkg/dataplane/dataplane_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package dataplane

import (
"fmt"
"testing"

"github.com/Azure/azure-container-networking/common"
Expand Down Expand Up @@ -262,9 +261,6 @@ func TestUpdatePolicy(t *testing.T) {
calls := append(getBootupTestCalls(), getAddPolicyTestCallsForDP(&testPolicyobj)...)
calls = append(calls, getRemovePolicyTestCallsForDP(&testPolicyobj)...)
calls = append(calls, getAddPolicyTestCallsForDP(&updatedTestPolicyobj)...)
for _, call := range calls {
fmt.Println(call)
}
ioshim := common.NewMockIOShim(calls)
defer ioshim.VerifyCalls(t, calls)
dp, err := NewDataPlane("testnode", ioshim, dpCfg, nil)
Expand Down Expand Up @@ -420,7 +416,7 @@ func TestUpdatePodCache(t *testing.T) {
}

func getBootupTestCalls() []testutils.TestCmd {
return append(policies.GetBootupTestCalls(true), ipsets.GetResetTestCalls()...)
return append(policies.GetBootupTestCalls(), ipsets.GetResetTestCalls()...)
}

func getAddPolicyTestCallsForDP(networkPolicy *policies.NPMNetworkPolicy) []testutils.TestCmd {
Expand Down
Loading
Loading