Skip to content

Commit 42bf16c

Browse files
zeekezeeke
authored
Merge pull request #75 from zeeke/us/end-port
Support `EndPort` field
2 parents 810df27 + 890ce6f commit 42bf16c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+1711
-1831
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.19
55
require (
66
github.com/containernetworking/cni v0.8.1
77
github.com/containernetworking/plugins v0.8.6
8-
github.com/k8snetworkplumbingwg/multi-networkpolicy v0.0.0-20200903074708-7b3ce95ae804
8+
github.com/k8snetworkplumbingwg/multi-networkpolicy v1.0.1
99
github.com/k8snetworkplumbingwg/network-attachment-definition-client v0.0.0-20200528071255-22c819bc6e7e
1010
github.com/onsi/ginkgo v1.16.4
1111
github.com/onsi/gomega v1.27.6

‎go.sum‎

Lines changed: 15 additions & 1790 deletions
Large diffs are not rendered by default.

‎pkg/server/policyrules.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,12 +262,16 @@ func (ipt *iptableBuffer) renderIngressPorts(_ *Server, podInfo *controllers.Pod
262262
dport := ""
263263
if port.Port != nil {
264264
dport = "--dport " + port.Port.String()
265+
if port.EndPort != nil {
266+
dport = fmt.Sprintf("--dport %s:%d", port.Port.String(), *port.EndPort)
267+
}
265268
}
266269

267270
writeLine(ipt.ingressPorts, "-A", chainName,
268271
"-i", podIntf.InterfaceName,
269272
"-m", proto, "-p", proto, dport,
270273
"-j", "MARK", "--set-xmark", "0x10000/0x10000")
274+
271275
validPorts++
272276
}
273277
}
@@ -493,6 +497,9 @@ func (ipt *iptableBuffer) renderEgressPorts(_ *Server, podInfo *controllers.PodI
493497
dport := ""
494498
if port.Port != nil {
495499
dport = "--dport " + port.Port.String()
500+
if port.EndPort != nil {
501+
dport = fmt.Sprintf("--dport %s:%d", port.Port.String(), *port.EndPort)
502+
}
496503
}
497504

498505
writeLine(ipt.egressPorts, "-A", chainName,

‎pkg/server/policyrules_test.go‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1064,6 +1064,93 @@ COMMIT
10641064
Expect(buf.filterRules.String()).To(Equal(finalizedRules))
10651065
})
10661066

1067+
It("ingress rules endport", func() {
1068+
port0 := intstr.FromInt(8888)
1069+
port1 := intstr.FromInt(9999)
1070+
endport := int32(11111)
1071+
protoTCP := v1.ProtocolTCP
1072+
ingressPolicies1 := &multiv1beta1.MultiNetworkPolicy{
1073+
ObjectMeta: metav1.ObjectMeta{
1074+
Name: "ingressPolicies1",
1075+
Namespace: "testns1",
1076+
},
1077+
Spec: multiv1beta1.MultiNetworkPolicySpec{
1078+
Ingress: []multiv1beta1.MultiNetworkPolicyIngressRule{
1079+
{
1080+
Ports: []multiv1beta1.MultiNetworkPolicyPort{
1081+
{
1082+
Protocol: &protoTCP,
1083+
Port: &port0,
1084+
},
1085+
{
1086+
Protocol: &protoTCP,
1087+
Port: &port1,
1088+
EndPort: &endport,
1089+
},
1090+
},
1091+
},
1092+
},
1093+
},
1094+
}
1095+
1096+
ipt := fakeiptables.NewFake()
1097+
Expect(ipt).NotTo(BeNil())
1098+
buf := newIptableBuffer()
1099+
Expect(buf).NotTo(BeNil())
1100+
1101+
// verify buf initialized at init
1102+
buf.Init(ipt)
1103+
s := NewFakeServer("samplehost")
1104+
Expect(s).NotTo(BeNil())
1105+
1106+
Expect(s.netdefChanges.Update(
1107+
nil,
1108+
NewNetDef("testns1", "net-attach1", NewCNIConfig("testCNI", "multi")))).To(BeTrue())
1109+
Expect(s.netdefChanges.GetPluginType(types.NamespacedName{Namespace: "testns1", Name: "net-attach1"})).To(Equal("multi"))
1110+
1111+
pod1 := NewFakePodWithNetAnnotation(
1112+
"testns1",
1113+
"testpod1",
1114+
"net-attach1",
1115+
NewFakeNetworkStatus("testns1", "net-attach1", "192.168.1.1", "10.1.1.1"),
1116+
nil)
1117+
AddPod(s, pod1)
1118+
podInfo1, err := s.podMap.GetPodInfo(pod1)
1119+
Expect(err).NotTo(HaveOccurred())
1120+
1121+
buf.renderIngress(s, podInfo1, 0, ingressPolicies1, []string{"testns1/net-attach1"})
1122+
1123+
portRules :=
1124+
`-A MULTI-0-INGRESS-0-PORTS -i net1 -m tcp -p tcp --dport 8888 -j MARK --set-xmark 0x10000/0x10000
1125+
-A MULTI-0-INGRESS-0-PORTS -i net1 -m tcp -p tcp --dport 9999:11111 -j MARK --set-xmark 0x10000/0x10000
1126+
`
1127+
1128+
Expect(buf.ingressPorts.String()).To(Equal(portRules))
1129+
1130+
buf.FinalizeRules()
1131+
finalizedRules :=
1132+
`*filter
1133+
:MULTI-INGRESS - [0:0]
1134+
:MULTI-INGRESS-COMMON - [0:0]
1135+
:MULTI-EGRESS - [0:0]
1136+
:MULTI-EGRESS-COMMON - [0:0]
1137+
:MULTI-0-INGRESS - [0:0]
1138+
:MULTI-0-INGRESS-0-PORTS - [0:0]
1139+
:MULTI-0-INGRESS-0-FROM - [0:0]
1140+
-A MULTI-INGRESS -m comment --comment "policy:ingressPolicies1 net-attach-def:testns1/net-attach1" -i net1 -j MULTI-0-INGRESS
1141+
-A MULTI-INGRESS -m mark --mark 0x30000/0x30000 -j RETURN
1142+
-A MULTI-0-INGRESS -j MARK --set-xmark 0x0/0x30000
1143+
-A MULTI-0-INGRESS -j MULTI-0-INGRESS-0-PORTS
1144+
-A MULTI-0-INGRESS -j MULTI-0-INGRESS-0-FROM
1145+
-A MULTI-0-INGRESS -m mark --mark 0x30000/0x30000 -j RETURN
1146+
-A MULTI-0-INGRESS-0-PORTS -i net1 -m tcp -p tcp --dport 8888 -j MARK --set-xmark 0x10000/0x10000
1147+
-A MULTI-0-INGRESS-0-PORTS -i net1 -m tcp -p tcp --dport 9999:11111 -j MARK --set-xmark 0x10000/0x10000
1148+
-A MULTI-0-INGRESS-0-FROM -m comment --comment "no ingress from, skipped" -j MARK --set-xmark 0x20000/0x20000
1149+
COMMIT
1150+
`
1151+
Expect(buf.filterRules.String()).To(Equal(finalizedRules))
1152+
})
1153+
10671154
It("ingress rules podselector/matchlabels", func() {
10681155
port := intstr.FromInt(8888)
10691156
protoTCP := v1.ProtocolTCP
@@ -1521,6 +1608,92 @@ COMMIT
15211608
Expect(buf.filterRules.String()).To(Equal(finalizedRules))
15221609
})
15231610

1611+
It("egress rules endport", func() {
1612+
port0 := intstr.FromInt(8888)
1613+
port1 := intstr.FromInt(9999)
1614+
endport := int32(11111)
1615+
protoTCP := v1.ProtocolTCP
1616+
egressPolicies1 := &multiv1beta1.MultiNetworkPolicy{
1617+
ObjectMeta: metav1.ObjectMeta{
1618+
Name: "EgressPolicies1",
1619+
Namespace: "testns1",
1620+
},
1621+
Spec: multiv1beta1.MultiNetworkPolicySpec{
1622+
Egress: []multiv1beta1.MultiNetworkPolicyEgressRule{
1623+
{
1624+
Ports: []multiv1beta1.MultiNetworkPolicyPort{
1625+
{
1626+
Protocol: &protoTCP,
1627+
Port: &port0,
1628+
},
1629+
{
1630+
Protocol: &protoTCP,
1631+
Port: &port1,
1632+
EndPort: &endport,
1633+
},
1634+
},
1635+
},
1636+
},
1637+
},
1638+
}
1639+
1640+
ipt := fakeiptables.NewFake()
1641+
Expect(ipt).NotTo(BeNil())
1642+
buf := newIptableBuffer()
1643+
Expect(buf).NotTo(BeNil())
1644+
1645+
// verify buf initialized at init
1646+
buf.Init(ipt)
1647+
s := NewFakeServer("samplehost")
1648+
Expect(s).NotTo(BeNil())
1649+
1650+
Expect(s.netdefChanges.Update(
1651+
nil,
1652+
NewNetDef("testns1", "net-attach1", NewCNIConfig("testCNI", "multi")))).To(BeTrue())
1653+
Expect(s.netdefChanges.GetPluginType(types.NamespacedName{Namespace: "testns1", Name: "net-attach1"})).To(Equal("multi"))
1654+
1655+
pod1 := NewFakePodWithNetAnnotation(
1656+
"testns1",
1657+
"testpod1",
1658+
"net-attach1",
1659+
NewFakeNetworkStatus("testns1", "net-attach1", "192.168.1.1", "10.1.1.1"),
1660+
nil)
1661+
AddPod(s, pod1)
1662+
podInfo1, err := s.podMap.GetPodInfo(pod1)
1663+
Expect(err).NotTo(HaveOccurred())
1664+
1665+
buf.renderEgress(s, podInfo1, 0, egressPolicies1, []string{"testns1/net-attach1"})
1666+
1667+
portRules :=
1668+
`-A MULTI-0-EGRESS-0-PORTS -o net1 -m tcp -p tcp --dport 8888 -j MARK --set-xmark 0x10000/0x10000
1669+
-A MULTI-0-EGRESS-0-PORTS -o net1 -m tcp -p tcp --dport 9999:11111 -j MARK --set-xmark 0x10000/0x10000
1670+
`
1671+
Expect(buf.egressPorts.String()).To(Equal(portRules))
1672+
1673+
buf.FinalizeRules()
1674+
finalizedRules :=
1675+
`*filter
1676+
:MULTI-INGRESS - [0:0]
1677+
:MULTI-INGRESS-COMMON - [0:0]
1678+
:MULTI-EGRESS - [0:0]
1679+
:MULTI-EGRESS-COMMON - [0:0]
1680+
:MULTI-0-EGRESS - [0:0]
1681+
:MULTI-0-EGRESS-0-PORTS - [0:0]
1682+
:MULTI-0-EGRESS-0-TO - [0:0]
1683+
-A MULTI-EGRESS -m comment --comment "policy:EgressPolicies1 net-attach-def:testns1/net-attach1" -o net1 -j MULTI-0-EGRESS
1684+
-A MULTI-EGRESS -m mark --mark 0x30000/0x30000 -j RETURN
1685+
-A MULTI-0-EGRESS -j MARK --set-xmark 0x0/0x30000
1686+
-A MULTI-0-EGRESS -j MULTI-0-EGRESS-0-PORTS
1687+
-A MULTI-0-EGRESS -j MULTI-0-EGRESS-0-TO
1688+
-A MULTI-0-EGRESS -m mark --mark 0x30000/0x30000 -j RETURN
1689+
-A MULTI-0-EGRESS-0-PORTS -o net1 -m tcp -p tcp --dport 8888 -j MARK --set-xmark 0x10000/0x10000
1690+
-A MULTI-0-EGRESS-0-PORTS -o net1 -m tcp -p tcp --dport 9999:11111 -j MARK --set-xmark 0x10000/0x10000
1691+
-A MULTI-0-EGRESS-0-TO -m comment --comment "no egress to, skipped" -j MARK --set-xmark 0x20000/0x20000
1692+
COMMIT
1693+
`
1694+
Expect(buf.filterRules.String()).To(Equal(finalizedRules))
1695+
})
1696+
15241697
It("egress rules podselector/matchlabels", func() {
15251698
port := intstr.FromInt(8888)
15261699
protoTCP := v1.ProtocolTCP

0 commit comments

Comments
 (0)