Skip to content

Commit 1190864

Browse files
tanyavekslertanyaveksler
authored
Sanity query optimized (#560)
* Optimized implementation of EquivalenceQuery. Signed-off-by: Tanya <[email protected]> * Added VacuityQuery and RedundancyQuery optimized implementation. Keeping optimized properties separated per rule (instead of the union of all policy rules) Fixed handling HostEPs in optimized implementation. Signed-off-by: Tanya <[email protected]> * Added VacuityQuery and RedundancyQuery optimized implementation. Keeping optimized properties separated per rule (instead of the union of all policy rules) Fixed handling HostEPs in optimized implementation. Signed-off-by: Tanya <[email protected]> * Ignoring 'complex function' lint error. Returning 'passed' code for skipped queries. Signed-off-by: Tanya <[email protected]> * Added VacuityQuery and RedundancyQuery optimized implementation. Keeping optimized properties separated per rule (instead of the union of all policy rules) Fixed handling HostEPs in optimized implementation. Signed-off-by: Tanya <[email protected]> * Removed redundant method. Signed-off-by: Tanya <[email protected]> * Added VacuityQuery and RedundancyQuery optimized implementation. Keeping optimized properties separated per rule (instead of the union of all policy rules) Fixed handling HostEPs in optimized implementation. Signed-off-by: Tanya <[email protected]> * Fixed domain updating mechanism per rule (to avoid activating multiple times for the same rule, for example when a rule appears twice in a config). Signed-off-by: Tanya <[email protected]> * Fixed lint errors Signed-off-by: Tanya <[email protected]> * Enabled strongEquivalence optimized implementation. Signed-off-by: Tanya <[email protected]> * Implemented optimized ContainmentQuery. Commented out containment fullExplanation result comparison in tests, since optimized solution gives more accurate result that differs from the original expected result, and thus the test fails. Signed-off-by: Tanya <[email protected]> * Enabled optimized TwoContainmentQuery and PermitsQuery. Commented out twoWayContainment fullExplanation result comparison in tests, since optimized solution gives more accurate result that differs from the original expected result, and thus the tests fail. Signed-off-by: Tanya <[email protected]> * Fixed small inaccuracy in handling host endpoints in optimized solution. Adding docs Signed-off-by: Tanya <[email protected]> * Implemented optimized InterferesQuery Signed-off-by: Tanya <[email protected]> * Small improvement in print differences for two config queries Commenting out detailed difference result for some tests, since optimized implementation results are sometimes more detailed than the original ones. Signed-off-by: Tanya <[email protected]> * Optimized implementation of intersects and forbids queries. Signed-off-by: Tanya <[email protected]> * Fixed bug in creation of optimized istio policy properties. Signed-off-by: Tanya <[email protected]> * Opened for optimized run those queries that do not call allowed_connections. Signed-off-by: Tanya <[email protected]> * Implemented sanity query optimized. Signed-off-by: Tanya <[email protected]> * Fixing lint error. Signed-off-by: Tanya <[email protected]> * Fixing lint error. Signed-off-by: Tanya <[email protected]> --------- Signed-off-by: Tanya <[email protected]>
1 parent ae0abbd commit 1190864

File tree

3 files changed

+34
-21
lines changed

3 files changed

+34
-21
lines changed

‎nca/NetworkConfig/NetworkConfigQuery.py

Lines changed: 32 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -458,7 +458,7 @@ def other_policy_containing_deny(self, self_policy, config_with_self_policy, lay
458458
:param NetworkPolicy self_policy: The policy to check
459459
:param NetworkConfig config_with_self_policy: A network config with self_policy as its single policy
460460
:param NetworkLayerName layer_name: The layer name of the policy
461-
:return: A policy containing self_policy's denied connections if exist, None otherwise
461+
:return: A policy containing self_policy's denied connections if exists, None otherwise
462462
:rtype: NetworkPolicy
463463
"""
464464
policies_list = self.config.policies_container.layers[layer_name].policies_list
@@ -471,26 +471,39 @@ def other_policy_containing_deny(self, self_policy, config_with_self_policy, lay
471471
if not other_policy.has_deny_rules():
472472
continue
473473
config_with_other_policy = self.config.clone_with_just_one_policy(other_policy.full_name())
474-
# calling get_all_peers_group does not require getting dnsEntry peers, since they are not relevant when computing
475-
# deny connections
476-
pods_to_compare = self.config.peer_container.get_all_peers_group()
477-
pods_to_compare |= TwoNetworkConfigsQuery(self.config,
478-
config_with_other_policy).disjoint_referenced_ip_blocks()
479-
for pod1 in pods_to_compare:
480-
for pod2 in pods_to_compare:
481-
if isinstance(pod1, IpBlock) and isinstance(pod2, IpBlock):
482-
continue
483-
if pod1 == pod2:
484-
continue # no way to prevent a pod from communicating with itself
485-
_, _, _, self_deny_conns = config_with_self_policy.allowed_connections(pod1, pod2, layer_name)
486-
_, _, _, other_deny_conns = config_with_other_policy.allowed_connections(pod1, pod2, layer_name)
487-
if not self_deny_conns:
488-
continue
489-
if not self_deny_conns.contained_in(other_deny_conns):
490-
return None
491-
return other_policy
474+
if self.config.optimized_run == 'false':
475+
res = self.check_deny_containment_original(config_with_self_policy, config_with_other_policy, layer_name)
476+
else:
477+
res = self.check_deny_containment_optimized(config_with_self_policy, config_with_other_policy, layer_name)
478+
if res:
479+
return other_policy
492480
return None
493481

482+
def check_deny_containment_original(self, config_with_self_policy, config_with_other_policy, layer_name):
483+
# calling get_all_peers_group does not require getting dnsEntry peers, since they are not relevant when computing
484+
# deny connections
485+
pods_to_compare = self.config.peer_container.get_all_peers_group()
486+
pods_to_compare |= TwoNetworkConfigsQuery(self.config, config_with_other_policy).disjoint_referenced_ip_blocks()
487+
for pod1 in pods_to_compare:
488+
for pod2 in pods_to_compare:
489+
if isinstance(pod1, IpBlock) and isinstance(pod2, IpBlock):
490+
continue
491+
if pod1 == pod2:
492+
continue # no way to prevent a pod from communicating with itself
493+
_, _, _, self_deny_conns = config_with_self_policy.allowed_connections(pod1, pod2, layer_name)
494+
_, _, _, other_deny_conns = config_with_other_policy.allowed_connections(pod1, pod2, layer_name)
495+
if not self_deny_conns:
496+
continue
497+
if not self_deny_conns.contained_in(other_deny_conns):
498+
return False
499+
return True
500+
501+
@staticmethod
502+
def check_deny_containment_optimized(config_with_self_policy, config_with_other_policy, layer_name):
503+
self_props = config_with_self_policy.allowed_connections_optimized(layer_name)
504+
other_props = config_with_other_policy.allowed_connections_optimized(layer_name)
505+
return self_props.denied_conns.contained_in(other_props.denied_conns)
506+
494507
def other_rule_containing(self, self_policy, self_rule_index, is_ingress, layer_name):
495508
"""
496509
Search whether a given policy rule is contained in another policy rule

‎nca/SchemeRunner.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ class SchemeRunner(GenericYamlParser):
2020

2121
implemented_opt_queries = {'connectivityMap', 'equivalence', 'vacuity', 'redundancy', 'strongEquivalence',
2222
'containment', 'twoWayContainment', 'permits', 'interferes', 'pairwiseInterferes',
23-
'forbids', 'emptiness', 'disjointness', 'allCaptured'}
23+
'forbids', 'emptiness', 'disjointness', 'allCaptured', 'sanity'}
2424

2525
def __init__(self, scheme_file_name, output_format=None, output_path=None, optimized_run='false'):
2626
GenericYamlParser.__init__(self, scheme_file_name)

‎tests/run_all_tests.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ def run_all_test_flow(self, all_results):
112112
tmp_opt = [i for i in self.test_queries_obj.args_obj.args if '-opt=' in i]
113113
opt = tmp_opt[0].split('=')[1] if tmp_opt else 'false'
114114
if isinstance(self.test_queries_obj, CliQuery) and (opt == 'debug' or opt == 'true'):
115-
implemented_opt_queries = {'--connectivity', '--equiv', '--permits', '--interferes', '--forbids'}
115+
implemented_opt_queries = {'--connectivity', '--equiv', '--permits', '--interferes', '--forbids', '--sanity'}
116116
# TODO - update/remove the optimization below when all queries are supported in optimized implementation
117117
if not implemented_opt_queries.intersection(set(self.test_queries_obj.args_obj.args)):
118118
print(f'Skipping {self.test_queries_obj.test_name} since it does not have optimized implementation yet')

0 commit comments

Comments
 (0)