mirror of
https://github.com/k3s-io/kubernetes.git
synced 2026-01-05 15:37:24 +00:00
Refactor handling of local traffic detection.
This commit is contained in:
Satyadeep Musuvathy
@@ -50,6 +50,7 @@ filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [
|
||||
":package-srcs",
|
||||
"//pkg/proxy/util/iptables:all-srcs",
|
||||
"//pkg/proxy/util/testing:all-srcs",
|
||||
],
|
||||
tags = ["automanaged"],
|
||||
|
||||
37
pkg/proxy/util/iptables/BUILD
Normal file
37
pkg/proxy/util/iptables/BUILD
Normal file
@@ -0,0 +1,37 @@
|
||||
load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
|
||||
|
||||
go_library(
|
||||
name = "go_default_library",
|
||||
srcs = ["traffic.go"],
|
||||
importpath = "k8s.io/kubernetes/pkg/proxy/util/iptables",
|
||||
visibility = ["//visibility:public"],
|
||||
deps = [
|
||||
"//pkg/util/iptables:go_default_library",
|
||||
"//vendor/k8s.io/klog:go_default_library",
|
||||
"//vendor/k8s.io/utils/net:go_default_library",
|
||||
],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
go_test(
|
||||
name = "go_default_test",
|
||||
srcs = ["traffic_test.go"],
|
||||
embed = [":go_default_library"],
|
||||
deps = [
|
||||
"//pkg/util/iptables:go_default_library",
|
||||
"//pkg/util/iptables/testing:go_default_library",
|
||||
],
|
||||
)
|
||||
93
pkg/proxy/util/iptables/traffic.go
Normal file
93
pkg/proxy/util/iptables/traffic.go
Normal file
@@ -0,0 +1,93 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package iptables
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
|
||||
"k8s.io/klog"
|
||||
utiliptables "k8s.io/kubernetes/pkg/util/iptables"
|
||||
utilnet "k8s.io/utils/net"
|
||||
)
|
||||
|
||||
// LocalTrafficDetector in a interface to take action (jump) based on whether traffic originated locally
|
||||
// at the node or not
|
||||
type LocalTrafficDetector interface {
|
||||
// IsImplemented returns true if the implementation does something, false otherwise
|
||||
IsImplemented() bool
|
||||
|
||||
// JumpIfLocal appends conditions to jump to a target chain if traffic detected to be
|
||||
// of local origin
|
||||
JumpIfLocal(args []string, toChain string) []string
|
||||
|
||||
// JumpINotfLocal appends conditions to jump to a target chain if traffic detected not to be
|
||||
// of local origin
|
||||
JumpIfNotLocal(args []string, toChain string) []string
|
||||
}
|
||||
|
||||
type noOpLocalDetector struct{}
|
||||
|
||||
// NewNoOpLocalDetector is a no-op implementation of LocalTrafficDetector
|
||||
func NewNoOpLocalDetector() LocalTrafficDetector {
|
||||
return &noOpLocalDetector{}
|
||||
}
|
||||
|
||||
func (n *noOpLocalDetector) IsImplemented() bool {
|
||||
return false
|
||||
}
|
||||
|
||||
func (n *noOpLocalDetector) JumpIfLocal(args []string, toChain string) []string {
|
||||
return args // no-op
|
||||
}
|
||||
|
||||
func (n *noOpLocalDetector) JumpIfNotLocal(args []string, toChain string) []string {
|
||||
return args // no-op
|
||||
}
|
||||
|
||||
type detectLocalByCIDR struct {
|
||||
cidr string
|
||||
}
|
||||
|
||||
// NewDetectLocalByCIDR implements the LocalTrafficDetector interface using a CIDR. This can be used when a single CIDR
|
||||
// range can be used to capture the notion of local traffic.
|
||||
func NewDetectLocalByCIDR(cidr string, ipt utiliptables.Interface) (LocalTrafficDetector, error) {
|
||||
if utilnet.IsIPv6CIDRString(cidr) != ipt.IsIpv6() {
|
||||
return nil, fmt.Errorf("CIDR %s has incorrect IP version: expect isIPv6=%t", cidr, ipt.IsIpv6())
|
||||
}
|
||||
_, _, err := net.ParseCIDR(cidr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &detectLocalByCIDR{cidr: cidr}, nil
|
||||
}
|
||||
|
||||
func (d *detectLocalByCIDR) IsImplemented() bool {
|
||||
return true
|
||||
}
|
||||
|
||||
func (d *detectLocalByCIDR) JumpIfLocal(args []string, toChain string) []string {
|
||||
line := append(args, "-s", d.cidr, "-j", toChain)
|
||||
klog.V(4).Info("[DetectLocalByCIDR (", d.cidr, ")", " Jump Local: ", line)
|
||||
return line
|
||||
}
|
||||
|
||||
func (d *detectLocalByCIDR) JumpIfNotLocal(args []string, toChain string) []string {
|
||||
line := append(args, "!", "-s", d.cidr, "-j", toChain)
|
||||
klog.V(4).Info("[DetectLocalByCIDR (", d.cidr, ")]", " Jump Not Local: ", line)
|
||||
return line
|
||||
}
|
||||
168
pkg/proxy/util/iptables/traffic_test.go
Normal file
168
pkg/proxy/util/iptables/traffic_test.go
Normal file
@@ -0,0 +1,168 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package iptables
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
utiliptables "k8s.io/kubernetes/pkg/util/iptables"
|
||||
iptablestest "k8s.io/kubernetes/pkg/util/iptables/testing"
|
||||
)
|
||||
|
||||
func TestNoOpLocalDetector(t *testing.T) {
|
||||
cases := []struct {
|
||||
chain string
|
||||
args []string
|
||||
expectedJumpIfOutput []string
|
||||
expectedJumpIfNotOutput []string
|
||||
}{
|
||||
{
|
||||
chain: "TEST",
|
||||
args: []string{"arg1", "arg2"},
|
||||
expectedJumpIfOutput: []string{"arg1", "arg2"},
|
||||
expectedJumpIfNotOutput: []string{"arg1", "arg2"},
|
||||
},
|
||||
}
|
||||
for _, c := range cases {
|
||||
localDetector := NewNoOpLocalDetector()
|
||||
if localDetector.IsImplemented() {
|
||||
t.Error("DetectLocalByCIDR returns true for IsImplemented")
|
||||
}
|
||||
|
||||
jumpIf := localDetector.JumpIfLocal(c.args, c.chain)
|
||||
jumpIfNot := localDetector.JumpIfNotLocal(c.args, c.chain)
|
||||
|
||||
if !reflect.DeepEqual(jumpIf, c.expectedJumpIfOutput) {
|
||||
t.Errorf("JumpIf, expected: '%v', but got: '%v'", c.expectedJumpIfOutput, jumpIf)
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(jumpIfNot, c.expectedJumpIfNotOutput) {
|
||||
t.Errorf("JumpIfNot, expected: '%v', but got: '%v'", c.expectedJumpIfNotOutput, jumpIfNot)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewDetectLocalByCIDR(t *testing.T) {
|
||||
cases := []struct {
|
||||
cidr string
|
||||
ipt utiliptables.Interface
|
||||
errExpected bool
|
||||
}{
|
||||
{
|
||||
cidr: "10.0.0.0/14",
|
||||
ipt: iptablestest.NewFake(),
|
||||
errExpected: false,
|
||||
},
|
||||
{
|
||||
cidr: "2002::1234:abcd:ffff:c0a8:101/64",
|
||||
ipt: iptablestest.NewIpv6Fake(),
|
||||
errExpected: false,
|
||||
},
|
||||
{
|
||||
cidr: "10.0.0.0/14",
|
||||
ipt: iptablestest.NewIpv6Fake(),
|
||||
errExpected: true,
|
||||
},
|
||||
{
|
||||
cidr: "2002::1234:abcd:ffff:c0a8:101/64",
|
||||
ipt: iptablestest.NewFake(),
|
||||
errExpected: true,
|
||||
},
|
||||
{
|
||||
cidr: "10.0.0.0",
|
||||
ipt: iptablestest.NewFake(),
|
||||
errExpected: true,
|
||||
},
|
||||
{
|
||||
cidr: "2002::1234:abcd:ffff:c0a8:101",
|
||||
ipt: iptablestest.NewIpv6Fake(),
|
||||
errExpected: true,
|
||||
},
|
||||
{
|
||||
cidr: "",
|
||||
ipt: iptablestest.NewFake(),
|
||||
errExpected: true,
|
||||
},
|
||||
{
|
||||
cidr: "",
|
||||
ipt: iptablestest.NewIpv6Fake(),
|
||||
errExpected: true,
|
||||
},
|
||||
}
|
||||
for i, c := range cases {
|
||||
r, err := NewDetectLocalByCIDR(c.cidr, c.ipt)
|
||||
if c.errExpected {
|
||||
if err == nil {
|
||||
t.Errorf("Case[%d] expected error, but succeeded with: %q", i, r)
|
||||
}
|
||||
continue
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("Case[%d] failed with error: %v", i, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDetectLocalByCIDR(t *testing.T) {
|
||||
cases := []struct {
|
||||
cidr string
|
||||
ipt utiliptables.Interface
|
||||
chain string
|
||||
args []string
|
||||
expectedJumpIfOutput []string
|
||||
expectedJumpIfNotOutput []string
|
||||
}{
|
||||
{
|
||||
cidr: "10.0.0.0/14",
|
||||
ipt: iptablestest.NewFake(),
|
||||
chain: "TEST",
|
||||
args: []string{"arg1", "arg2"},
|
||||
expectedJumpIfOutput: []string{"arg1", "arg2", "-s", "10.0.0.0/14", "-j", "TEST"},
|
||||
expectedJumpIfNotOutput: []string{"arg1", "arg2", "!", "-s", "10.0.0.0/14", "-j", "TEST"},
|
||||
},
|
||||
{
|
||||
cidr: "2002::1234:abcd:ffff:c0a8:101/64",
|
||||
ipt: iptablestest.NewIpv6Fake(),
|
||||
chain: "TEST",
|
||||
args: []string{"arg1", "arg2"},
|
||||
expectedJumpIfOutput: []string{"arg1", "arg2", "-s", "2002::1234:abcd:ffff:c0a8:101/64", "-j", "TEST"},
|
||||
expectedJumpIfNotOutput: []string{"arg1", "arg2", "!", "-s", "2002::1234:abcd:ffff:c0a8:101/64", "-j", "TEST"},
|
||||
},
|
||||
}
|
||||
for _, c := range cases {
|
||||
localDetector, err := NewDetectLocalByCIDR(c.cidr, c.ipt)
|
||||
if err != nil {
|
||||
t.Errorf("Error initializing localDetector: %v", err)
|
||||
continue
|
||||
}
|
||||
if !localDetector.IsImplemented() {
|
||||
t.Error("DetectLocalByCIDR returns false for IsImplemented")
|
||||
}
|
||||
|
||||
jumpIf := localDetector.JumpIfLocal(c.args, c.chain)
|
||||
jumpIfNot := localDetector.JumpIfNotLocal(c.args, c.chain)
|
||||
|
||||
if !reflect.DeepEqual(jumpIf, c.expectedJumpIfOutput) {
|
||||
t.Errorf("JumpIf, expected: '%v', but got: '%v'", c.expectedJumpIfOutput, jumpIf)
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(jumpIfNot, c.expectedJumpIfNotOutput) {
|
||||
t.Errorf("JumpIfNot, expected: '%v', but got: '%v'", c.expectedJumpIfNotOutput, jumpIfNot)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user