-
Notifications
You must be signed in to change notification settings - Fork 242
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
forwardport: fix: add iptables rules for dns in vnet scale cilium case (
#3421) * cover adding iptables rules for dns in vnet scale cilium case * replace existing iptables rules * modify imds iptables rule * mock iptables in cns and add ut * address linter issues * address linter issue
- Loading branch information
Showing
10 changed files
with
327 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| package fakes | ||
|
|
||
| import ( | ||
| "errors" | ||
| "strings" | ||
|
|
||
| "github.com/Azure/azure-container-networking/iptables" | ||
| ) | ||
|
|
||
| var ( | ||
| errChainExists = errors.New("chain already exists") | ||
| errChainNotFound = errors.New("chain not found") | ||
| errRuleExists = errors.New("rule already exists") | ||
| ) | ||
|
|
||
| type IPTablesMock struct { | ||
| state map[string]map[string][]string | ||
| } | ||
|
|
||
| func NewIPTablesMock() *IPTablesMock { | ||
| return &IPTablesMock{ | ||
| state: make(map[string]map[string][]string), | ||
| } | ||
| } | ||
|
|
||
| func (c *IPTablesMock) ensureTableExists(table string) { | ||
| _, exists := c.state[table] | ||
| if !exists { | ||
| c.state[table] = make(map[string][]string) | ||
| } | ||
| } | ||
|
|
||
| func (c *IPTablesMock) ChainExists(table, chain string) (bool, error) { | ||
| c.ensureTableExists(table) | ||
|
|
||
| builtins := []string{iptables.Input, iptables.Output, iptables.Prerouting, iptables.Postrouting, iptables.Forward} | ||
|
|
||
| _, exists := c.state[table][chain] | ||
|
|
||
| // these chains always exist | ||
| for _, val := range builtins { | ||
| if chain == val && !exists { | ||
| c.state[table][chain] = []string{} | ||
| return true, nil | ||
| } | ||
| } | ||
|
|
||
| return exists, nil | ||
| } | ||
|
|
||
| func (c *IPTablesMock) NewChain(table, chain string) error { | ||
| c.ensureTableExists(table) | ||
|
|
||
| exists, _ := c.ChainExists(table, chain) | ||
|
|
||
| if exists { | ||
| return errChainExists | ||
| } | ||
|
|
||
| c.state[table][chain] = []string{} | ||
| return nil | ||
| } | ||
|
|
||
| func (c *IPTablesMock) Exists(table, chain string, rulespec ...string) (bool, error) { | ||
| c.ensureTableExists(table) | ||
|
|
||
| chainExists, _ := c.ChainExists(table, chain) | ||
| if !chainExists { | ||
| return false, nil | ||
| } | ||
|
|
||
| targetRule := strings.Join(rulespec, " ") | ||
| chainRules := c.state[table][chain] | ||
|
|
||
| for _, chainRule := range chainRules { | ||
| if targetRule == chainRule { | ||
| return true, nil | ||
| } | ||
| } | ||
| return false, nil | ||
| } | ||
|
|
||
| func (c *IPTablesMock) Append(table, chain string, rulespec ...string) error { | ||
| c.ensureTableExists(table) | ||
|
|
||
| chainExists, _ := c.ChainExists(table, chain) | ||
| if !chainExists { | ||
| return errChainNotFound | ||
| } | ||
|
|
||
| ruleExists, _ := c.Exists(table, chain, rulespec...) | ||
| if ruleExists { | ||
| return errRuleExists | ||
| } | ||
|
|
||
| targetRule := strings.Join(rulespec, " ") | ||
| c.state[table][chain] = append(c.state[table][chain], targetRule) | ||
| return nil | ||
| } | ||
|
|
||
| func (c *IPTablesMock) Insert(table, chain string, _ int, rulespec ...string) error { | ||
| return c.Append(table, chain, rulespec...) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,148 @@ | ||
| // Copyright 2020 Microsoft. All rights reserved. | ||
| // MIT License | ||
|
|
||
| package restserver | ||
|
|
||
| import ( | ||
| "strconv" | ||
| "testing" | ||
|
|
||
| "github.com/Azure/azure-container-networking/cns" | ||
| "github.com/Azure/azure-container-networking/cns/fakes" | ||
| "github.com/Azure/azure-container-networking/cns/types" | ||
| "github.com/Azure/azure-container-networking/iptables" | ||
| "github.com/Azure/azure-container-networking/network/networkutils" | ||
| ) | ||
|
|
||
| type FakeIPTablesProvider struct { | ||
| iptables *fakes.IPTablesMock | ||
| } | ||
|
|
||
| func (c *FakeIPTablesProvider) GetIPTables() (iptablesClient, error) { | ||
| // persist iptables in testing | ||
| if c.iptables == nil { | ||
| c.iptables = fakes.NewIPTablesMock() | ||
| } | ||
| return c.iptables, nil | ||
| } | ||
|
|
||
| func TestAddSNATRules(t *testing.T) { | ||
| type expectedScenario struct { | ||
| table string | ||
| chain string | ||
| rule []string | ||
| } | ||
|
|
||
| tests := []struct { | ||
| name string | ||
| input *cns.CreateNetworkContainerRequest | ||
| expected []expectedScenario | ||
| }{ | ||
| { | ||
| // in pod subnet, the primary nic ip is in the same address space as the pod subnet | ||
| name: "podsubnet", | ||
| input: &cns.CreateNetworkContainerRequest{ | ||
| NetworkContainerid: ncID, | ||
| IPConfiguration: cns.IPConfiguration{ | ||
| IPSubnet: cns.IPSubnet{ | ||
| IPAddress: "240.1.2.1", | ||
| PrefixLength: 24, | ||
| }, | ||
| }, | ||
| SecondaryIPConfigs: map[string]cns.SecondaryIPConfig{ | ||
| "abc": { | ||
| IPAddress: "240.1.2.7", | ||
| }, | ||
| }, | ||
| HostPrimaryIP: "10.0.0.4", | ||
| }, | ||
| expected: []expectedScenario{ | ||
| { | ||
| table: iptables.Nat, | ||
| chain: SWIFT, | ||
| rule: []string{ | ||
| "-m", "addrtype", "!", "--dst-type", "local", "-s", "240.1.2.0/24", "-d", | ||
| networkutils.AzureDNS, "-p", iptables.UDP, "--dport", strconv.Itoa(iptables.DNSPort), "-j", iptables.Snat, "--to", "240.1.2.1", | ||
| }, | ||
| }, | ||
| { | ||
| table: iptables.Nat, | ||
| chain: SWIFT, | ||
| rule: []string{ | ||
| "-m", "addrtype", "!", "--dst-type", "local", "-s", "240.1.2.0/24", "-d", | ||
| networkutils.AzureDNS, "-p", iptables.TCP, "--dport", strconv.Itoa(iptables.DNSPort), "-j", iptables.Snat, "--to", "240.1.2.1", | ||
| }, | ||
| }, | ||
| { | ||
| table: iptables.Nat, | ||
| chain: SWIFT, | ||
| rule: []string{ | ||
| "-m", "addrtype", "!", "--dst-type", "local", "-s", "240.1.2.0/24", "-d", | ||
| networkutils.AzureIMDS, "-p", iptables.TCP, "--dport", strconv.Itoa(iptables.HTTPPort), "-j", iptables.Snat, "--to", "10.0.0.4", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| // in vnet scale, the primary nic ip becomes the node ip (diff address space from pod subnet) | ||
| name: "vnet scale", | ||
| input: &cns.CreateNetworkContainerRequest{ | ||
| NetworkContainerid: ncID, | ||
| IPConfiguration: cns.IPConfiguration{ | ||
| IPSubnet: cns.IPSubnet{ | ||
| IPAddress: "10.0.0.4", | ||
| PrefixLength: 28, | ||
| }, | ||
| }, | ||
| SecondaryIPConfigs: map[string]cns.SecondaryIPConfig{ | ||
| "abc": { | ||
| IPAddress: "240.1.2.15", | ||
| }, | ||
| }, | ||
| HostPrimaryIP: "10.0.0.4", | ||
| }, | ||
| expected: []expectedScenario{ | ||
| { | ||
| table: iptables.Nat, | ||
| chain: SWIFT, | ||
| rule: []string{ | ||
| "-m", "addrtype", "!", "--dst-type", "local", "-s", "240.1.2.0/28", "-d", | ||
| networkutils.AzureDNS, "-p", iptables.UDP, "--dport", strconv.Itoa(iptables.DNSPort), "-j", iptables.Snat, "--to", "10.0.0.4", | ||
| }, | ||
| }, | ||
| { | ||
| table: iptables.Nat, | ||
| chain: SWIFT, | ||
| rule: []string{ | ||
| "-m", "addrtype", "!", "--dst-type", "local", "-s", "240.1.2.0/28", "-d", | ||
| networkutils.AzureDNS, "-p", iptables.TCP, "--dport", strconv.Itoa(iptables.DNSPort), "-j", iptables.Snat, "--to", "10.0.0.4", | ||
| }, | ||
| }, | ||
| { | ||
| table: iptables.Nat, | ||
| chain: SWIFT, | ||
| rule: []string{ | ||
| "-m", "addrtype", "!", "--dst-type", "local", "-s", "240.1.2.0/28", "-d", | ||
| networkutils.AzureIMDS, "-p", iptables.TCP, "--dport", strconv.Itoa(iptables.HTTPPort), "-j", iptables.Snat, "--to", "10.0.0.4", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| service := getTestService(cns.KubernetesCRD) | ||
| service.iptables = &FakeIPTablesProvider{} | ||
| resp, msg := service.programSNATRules(tt.input) | ||
| if resp != types.Success { | ||
| t.Fatal("failed to program snat rules", msg, " case: ", tt.name) | ||
| } | ||
| finalState, _ := service.iptables.GetIPTables() | ||
| for _, ex := range tt.expected { | ||
| exists, err := finalState.Exists(ex.table, ex.chain, ex.rule...) | ||
| if err != nil || !exists { | ||
| t.Fatal("rule not found", ex.rule, " case: ", tt.name) | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.