Skip to content
Merged
Show file tree
Hide file tree
Changes from 48 commits
Commits
Show all changes
53 commits
Select commit Hold shift + click to select a range
1935495
feat: iptables block using LSM BPF
santhoshmprabhu Jul 29, 2025
9452ce6
feat: makefile changes
santhoshmprabhu Jul 29, 2025
9ac5fa6
chore: cleanup
santhoshmprabhu Jul 29, 2025
1af271c
Update bpf-prog/block-iptables/bpf/src/block_iptables.bpf.c
santhoshmprabhu Jul 29, 2025
cf3038e
chore: fix const
santhoshmprabhu Jul 29, 2025
50dd315
fix: dockerfiles, bug
santhoshmprabhu Jul 29, 2025
6cc55d5
test: add test for bpf attach/detach
santhoshmprabhu Jul 30, 2025
ce9e3e5
Merge remote-tracking branch 'origin/master' into sanprabhu/iptables-…
santhoshmprabhu Jul 30, 2025
0c34970
feat: add event tracking
santhoshmprabhu Jul 30, 2025
27e426a
feat: add event counting
santhoshmprabhu Jul 30, 2025
fd161cc
chore: dockerfiles
santhoshmprabhu Jul 30, 2025
0e369c6
fix: nolint for generated code
santhoshmprabhu Jul 30, 2025
7276e8d
fix: nolint for generated code
santhoshmprabhu Jul 30, 2025
ae83548
fix: golangci skip
santhoshmprabhu Jul 30, 2025
55cd88f
fix:skip directory with generated code
santhoshmprabhu Jul 30, 2025
4169299
chore:skip block iptales generated code
santhoshmprabhu Jul 31, 2025
5e9b829
chore: fix
santhoshmprabhu Jul 31, 2025
722f12b
fix: run go generate first
santhoshmprabhu Jul 31, 2025
2d0928e
fix: use installed go
santhoshmprabhu Jul 31, 2025
e004bec
fix: install bpf libraries
santhoshmprabhu Jul 31, 2025
37dc402
fix: remove file
santhoshmprabhu Jul 31, 2025
9b86fdb
fix: roll back linter changes
santhoshmprabhu Jul 31, 2025
88f4302
fix: add code generation to tests
santhoshmprabhu Aug 1, 2025
37d43ca
chore: switch to dual license
santhoshmprabhu Aug 1, 2025
a9737ba
fix: run generate before lint
santhoshmprabhu Aug 1, 2025
d1df331
fix: install libs
santhoshmprabhu Aug 1, 2025
8a082d1
fix: fix linting, address some comments
santhoshmprabhu Aug 1, 2025
85ec5ba
fix: address comments, fix lint
santhoshmprabhu Aug 2, 2025
91d7063
fix: missed change
santhoshmprabhu Aug 2, 2025
2999342
fix: compile only on linux
santhoshmprabhu Aug 2, 2025
9a436c4
fix: compile only on linux
santhoshmprabhu Aug 2, 2025
17b8ad4
fix: address comments
santhoshmprabhu Aug 5, 2025
ea38462
fix: address comments
santhoshmprabhu Aug 5, 2025
e3efa6d
Merge remote-tracking branch 'origin/master' into sanprabhu/iptables-…
santhoshmprabhu Aug 6, 2025
bddfa2e
chore: dockerfiles
santhoshmprabhu Aug 6, 2025
aa8a4ba
fix: address comments
santhoshmprabhu Aug 6, 2025
c8dca6c
chore:dockerfiles
santhoshmprabhu Aug 6, 2025
60e1272
Merge remote-tracking branch 'origin/master' into sanprabhu/iptables-…
santhoshmprabhu Aug 6, 2025
9dd2f28
fix: address comments
santhoshmprabhu Aug 7, 2025
f54bff7
chore: dockerfiles
santhoshmprabhu Aug 7, 2025
e5490a0
fix: address comments
santhoshmprabhu Aug 7, 2025
abf9d68
fix: add azure- prefix to block-iptables
santhoshmprabhu Aug 8, 2025
7ece36b
fix: rename subdir
santhoshmprabhu Aug 8, 2025
4c6a267
fix: import path
santhoshmprabhu Aug 8, 2025
131b33b
Update .github/workflows/golangci.yaml
santhoshmprabhu Aug 8, 2025
c267570
Update .github/workflows/golangci.yaml
santhoshmprabhu Aug 8, 2025
8e0fc82
Merge remote-tracking branch 'origin/master' into sanprabhu/rename-ip…
santhoshmprabhu Aug 8, 2025
308c97f
fix: remove redundant files
santhoshmprabhu Aug 8, 2025
17e4e18
fix: add code owner
santhoshmprabhu Aug 11, 2025
b933fcd
chore: dockerfiles
santhoshmprabhu Aug 11, 2025
d4dc0e7
chore: add more owners to bpf-prog
santhoshmprabhu Aug 12, 2025
d7eb4aa
chore:dockerfiles
santhoshmprabhu Aug 12, 2025
9339f73
Merge remote-tracking branch 'origin/sanprabhu/bpf-prog-owners' into …
santhoshmprabhu Aug 12, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/golangci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
uses: actions/upload-artifact@v4
with:
name: generated-bpf-program-code
path: ./bpf-prog/block-iptables/pkg/blockservice
path: ./bpf-prog/azure-block-iptables/pkg/blockservice
golangci:
strategy:
fail-fast: false
Expand All @@ -50,7 +50,7 @@ jobs:
uses: actions/download-artifact@v4
with:
name: generated-bpf-program-code
path: ./bpf-prog/block-iptables/pkg/blockservice
path: ./bpf-prog/azure-block-iptables/pkg/blockservice
- name: golangci-lint
uses: golangci/golangci-lint-action@v6
with:
Expand Down
36 changes: 18 additions & 18 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,9 @@ endif
# Interrogate the git repo and set some variables
REPO_ROOT ?= $(shell git rev-parse --show-toplevel)
REVISION ?= $(shell git rev-parse --short HEAD)
ACN_VERSION ?= $(shell git describe --exclude "azure-iptables-monitor*" --exclude "azure-ip-masq-merger*" --exclude "azure-ipam*" --exclude "dropgz*" --exclude "zapai*" --exclude "ipv6-hp-bpf*" --exclude "block-iptables*" --tags --always)
ACN_VERSION ?= $(shell git describe --exclude "azure-iptables-monitor*" --exclude "azure-ip-masq-merger*" --exclude "azure-ipam*" --exclude "dropgz*" --exclude "zapai*" --exclude "ipv6-hp-bpf*" --exclude "azure-block-iptables*" --tags --always)
IPV6_HP_BPF_VERSION ?= $(notdir $(shell git describe --match "ipv6-hp-bpf*" --tags --always))
BLOCK_IPTABLES_VERSION ?= $(notdir $(shell git describe --match "block-iptables*" --tags --always))
AZURE_BLOCK_IPTABLES_VERSION ?= $(notdir $(shell git describe --match "azure-block-iptables*" --tags --always))
AZURE_IPAM_VERSION ?= $(notdir $(shell git describe --match "azure-ipam*" --tags --always))
AZURE_IP_MASQ_MERGER_VERSION ?= $(notdir $(shell git describe --match "azure-ip-masq-merger*" --tags --always))
AZURE_IPTABLES_MONITOR_VERSION ?= $(notdir $(shell git describe --match "azure-iptables-monitor*" --tags --always))
Expand All @@ -49,7 +49,7 @@ AZURE_IPAM_DIR = $(REPO_ROOT)/azure-ipam
AZURE_IP_MASQ_MERGER_DIR = $(REPO_ROOT)/azure-ip-masq-merger
AZURE_IPTABLES_MONITOR_DIR = $(REPO_ROOT)/azure-iptables-monitor
IPV6_HP_BPF_DIR = $(REPO_ROOT)/bpf-prog/ipv6-hp-bpf
BLOCK_IPTABLES_DIR = $(REPO_ROOT)/bpf-prog/block-iptables
AZURE_BLOCK_IPTABLES_DIR = $(REPO_ROOT)/bpf-prog/azure-block-iptables

CNI_NET_DIR = $(REPO_ROOT)/cni/network/plugin
CNI_IPAM_DIR = $(REPO_ROOT)/cni/ipam/plugin
Expand All @@ -65,7 +65,7 @@ AZURE_IPAM_BUILD_DIR = $(BUILD_DIR)/azure-ipam
AZURE_IP_MASQ_MERGER_BUILD_DIR = $(BUILD_DIR)/azure-ip-masq-merger
AZURE_IPTABLES_MONITOR_BUILD_DIR = $(BUILD_DIR)/azure-iptables-monitor
IPV6_HP_BPF_BUILD_DIR = $(BUILD_DIR)/bpf-prog/ipv6-hp-bpf
BLOCK_IPTABLES_BUILD_DIR = $(BUILD_DIR)/bpf-prog/block-iptables
AZURE_BLOCK_IPTABLES_BUILD_DIR = $(BUILD_DIR)/bpf-prog/azure-block-iptables
IMAGE_DIR = $(OUTPUT_DIR)/images

CNI_BUILD_DIR = $(BUILD_DIR)/cni
Expand Down Expand Up @@ -115,7 +115,7 @@ AZURE_IPAM_ARCHIVE_NAME = azure-ipam-$(GOOS)-$(GOARCH)-$(AZURE_IPAM_VERSION).$(A
AZURE_IP_MASQ_MERGER_ARCHIVE_NAME = azure-ip-masq-merger-$(GOOS)-$(GOARCH)-$(AZURE_IP_MASQ_MERGER_VERSION).$(ARCHIVE_EXT)
AZURE_IPTABLES_MONITOR_ARCHIVE_NAME = azure-iptables-monitor-$(GOOS)-$(GOARCH)-$(AZURE_IPTABLES_MONITOR_VERSION).$(ARCHIVE_EXT)
IPV6_HP_BPF_ARCHIVE_NAME = ipv6-hp-bpf-$(GOOS)-$(GOARCH)-$(IPV6_HP_BPF_VERSION).$(ARCHIVE_EXT)
BLOCK_IPTABLES_ARCHIVE_NAME = block-iptables-$(GOOS)-$(GOARCH)-$(BLOCK_IPTABLES_VERSION).$(ARCHIVE_EXT)
AZURE_BLOCK_IPTABLES_ARCHIVE_NAME = azure-block-iptables-$(GOOS)-$(GOARCH)-$(AZURE_BLOCK_IPTABLES_VERSION).$(ARCHIVE_EXT)

# Image info file names.
CNI_IMAGE_INFO_FILE = azure-cni-$(CNI_VERSION).txt
Expand All @@ -132,7 +132,7 @@ all-binaries-platforms: ## Make all platform binaries

# OS specific binaries/images
ifeq ($(GOOS),linux)
all-binaries: acncli azure-cni-plugin azure-cns azure-npm azure-ipam azure-ip-masq-merger azure-iptables-monitor ipv6-hp-bpf block-iptables
all-binaries: acncli azure-cni-plugin azure-cns azure-npm azure-ipam azure-ip-masq-merger azure-iptables-monitor ipv6-hp-bpf azure-block-iptables
all-images: npm-image cns-image cni-manager-image azure-ip-masq-merger-image azure-iptables-monitor-image ipv6-hp-bpf-image
else
all-binaries: azure-cni-plugin azure-cns azure-npm
Expand All @@ -147,7 +147,7 @@ acncli: acncli-binary acncli-archive
azure-npm: azure-npm-binary npm-archive
azure-ipam: azure-ipam-binary azure-ipam-archive
ipv6-hp-bpf: ipv6-hp-bpf-binary ipv6-hp-bpf-archive
block-iptables: block-iptables-binary block-iptables-archive
azure-block-iptables: azure-block-iptables-binary azure-block-iptables-archive
azure-ip-masq-merger: azure-ip-masq-merger-binary azure-ip-masq-merger-archive
azure-iptables-monitor: azure-iptables-monitor-binary azure-iptables-monitor-archive

Expand All @@ -174,8 +174,8 @@ azure-iptables-monitor-version: ## prints the azure-iptables-monitor version
ipv6-hp-bpf-version: ## prints the ipv6-hp-bpf version
@echo $(IPV6_HP_BPF_VERSION)

block-iptables-version: ## prints the block-iptables version
@echo $(BLOCK_IPTABLES_VERSION)
azure-block-iptables-version: ## prints the azure-block-iptables version
@echo $(AZURE_BLOCK_IPTABLES_VERSION)

cni-version: ## prints the cni version
@echo $(CNI_VERSION)
Expand Down Expand Up @@ -210,10 +210,10 @@ else ifeq ($(GOARCH),arm64)
for dir in /usr/include/aarch64-linux-gnu/*; do sudo ln -sfn "$$dir" /usr/include/$$(basename "$$dir"); done
endif

# Build the block-iptables binary.
block-iptables-binary:
cd $(BLOCK_IPTABLES_DIR) && CGO_ENABLED=0 go generate ./...
cd $(BLOCK_IPTABLES_DIR)/cmd/block-iptables && CGO_ENABLED=0 go build -v -o $(BLOCK_IPTABLES_BUILD_DIR)/block-iptables$(EXE_EXT) -ldflags "-X main.version=$(BLOCK_IPTABLES_VERSION)" -gcflags="-dwarflocationlists=true"
# Build the azure-block-iptables binary.
azure-block-iptables-binary:
cd $(AZURE_BLOCK_IPTABLES_DIR) && CGO_ENABLED=0 go generate ./...
cd $(AZURE_BLOCK_IPTABLES_DIR)/cmd/azure-block-iptables && CGO_ENABLED=0 go build -v -o $(AZURE_BLOCK_IPTABLES_BUILD_DIR)/azure-block-iptables$(EXE_EXT) -ldflags "-X main.version=$(AZURE_BLOCK_IPTABLES_VERSION)" -gcflags="-dwarflocationlists=true"

# Build the Azure CNI network binary.
azure-vnet-binary:
Expand Down Expand Up @@ -861,12 +861,12 @@ ifeq ($(GOOS),linux)
cd $(IPV6_HP_BPF_BUILD_DIR) && $(ARCHIVE_CMD) $(IPV6_HP_BPF_ARCHIVE_NAME) ipv6-hp-bpf$(EXE_EXT)
endif

# Create a block-iptables archive for the target platform.
.PHONY: block-iptables-archive
block-iptables-archive: block-iptables-binary
# Create a azure-block-iptables archive for the target platform.
.PHONY: azure-block-iptables-archive
azure-block-iptables-archive: azure-block-iptables-binary
ifeq ($(GOOS),linux)
$(MKDIR) $(BLOCK_IPTABLES_BUILD_DIR)
cd $(BLOCK_IPTABLES_BUILD_DIR) && $(ARCHIVE_CMD) $(BLOCK_IPTABLES_ARCHIVE_NAME) block-iptables$(EXE_EXT)
$(MKDIR) $(AZURE_BLOCK_IPTABLES_BUILD_DIR)
cd $(AZURE_BLOCK_IPTABLES_BUILD_DIR) && $(ARCHIVE_CMD) $(AZURE_BLOCK_IPTABLES_ARCHIVE_NAME) azure-block-iptables$(EXE_EXT)
endif

##@ Utils
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import (
"syscall"
"time"

"github.com/Azure/azure-container-networking/bpf-prog/block-iptables/pkg/bpfprogram"
"github.com/Azure/azure-container-networking/bpf-prog/azure-block-iptables/pkg/bpfprogram"
"github.com/cilium/ebpf/rlimit"
"github.com/fsnotify/fsnotify"
)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import (
"os"
"testing"

"github.com/Azure/azure-container-networking/bpf-prog/block-iptables/pkg/bpfprogram"
"github.com/Azure/azure-container-networking/bpf-prog/azure-block-iptables/pkg/bpfprogram"
"github.com/fsnotify/fsnotify"
"github.com/pkg/errors"
)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ import (
"path/filepath"
"syscall"

blockservice "github.com/Azure/azure-container-networking/bpf-prog/block-iptables/pkg/blockservice"
blockservice "github.com/Azure/azure-container-networking/bpf-prog/azure-block-iptables/pkg/blockservice"
"github.com/cilium/ebpf"
"github.com/cilium/ebpf/link"
"github.com/pkg/errors"
Expand Down
Loading