Skip to content

fix: [NPM] reposition iptables jump to AZURE-NPM chain #1086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Nov 16, 2021
Merged

fix: [NPM] reposition iptables jump to AZURE-NPM chain #1086

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
fad4111
put jump from forward to azure-npm chain above the one to kube-services
huntergregory Nov 4, 2021
6ba442a
update unit test
huntergregory Nov 5, 2021
a3fc86f
add toggle for chain position
huntergregory Nov 5, 2021
4913cbf
incorporate toggle in iptm and update UTs. v1 controller tests seem b…
huntergregory Nov 9, 2021
aee147f
rename toggle name
huntergregory Nov 9, 2021
89af13e
jump to azure chain on new ct state and update default toggle (UTs wi…
huntergregory Nov 9, 2021
ef6f3e6
make util constant for UTs and fix UT errors (besides ones I get for …
huntergregory Nov 9, 2021
c2895ea
added missing module args for ctstate NEW
huntergregory Nov 9, 2021
125d151
reconcile jump to azure chain at top
huntergregory Nov 9, 2021
a33fda7
delete deprecated jump to azure chain on uninit, and fix go lint
huntergregory Nov 9, 2021
28eb4f4
assign correct default toggle value
huntergregory Nov 10, 2021
d0ddd5c
addressed comments
huntergregory Nov 11, 2021
a9cb8b7
fix UTs after removing index 1 for placing chain first. Also make all…
huntergregory Nov 12, 2021
bf8e766
set PlaceAzureChainFirst: true
huntergregory Nov 12, 2021
af9453e
switch to correct default for PlaceAzureChainFirst
huntergregory Nov 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions npm/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ var DefaultConfig = Config{
EnablePprof: true,
EnableHTTPDebugAPI: true,
EnableV2Controllers: false,
PlaceAzureChainFirst: false,
},
}

Expand All @@ -33,4 +34,5 @@ type Toggles struct {
EnablePprof bool
EnableHTTPDebugAPI bool
EnableV2Controllers bool
PlaceAzureChainFirst bool
}
84 changes: 59 additions & 25 deletions npm/iptm/iptm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,14 @@ var IptablesAzureChainList = []string{
util.IptablesAzureEgressDropsChain,
}

var deprecatedJumpToAzureEntry = &IptEntry{
Chain: util.IptablesForwardChain,
Specs: []string{
util.IptablesJumpFlag,
util.IptablesAzureChain,
},
}

// IptEntry represents an iptables rule.
type IptEntry struct {
Command string
Expand All @@ -48,9 +56,10 @@ type IptEntry struct {

// IptablesManager stores iptables entries.
type IptablesManager struct {
exec utilexec.Interface
io ioshim
OperationFlag string
exec utilexec.Interface
io ioshim
OperationFlag string
placeAzureChainFirst bool
}

func isDropsChain(chainName string) bool {
Expand All @@ -63,11 +72,12 @@ func isDropsChain(chainName string) bool {
}

// NewIptablesManager creates a new instance for IptablesManager object.
func NewIptablesManager(exec utilexec.Interface, io ioshim) *IptablesManager {
func NewIptablesManager(exec utilexec.Interface, io ioshim, placeAzureChainFirst bool) *IptablesManager {
iptMgr := &IptablesManager{
exec: exec,
io: io,
OperationFlag: "",
exec: exec,
io: io,
OperationFlag: "",
placeAzureChainFirst: placeAzureChainFirst,
}

return iptMgr
Expand All @@ -93,15 +103,25 @@ func (iptMgr *IptablesManager) InitNpmChains() error {
// UninitNpmChains uninitializes Azure NPM chains in iptables.
func (iptMgr *IptablesManager) UninitNpmChains() error {
// Remove AZURE-NPM chain from FORWARD chain.
iptMgr.OperationFlag = util.IptablesDeletionFlag
errCode, err := iptMgr.run(deprecatedJumpToAzureEntry)
if errCode != iptablesErrDoesNotExist && err != nil {
metrics.SendErrorLogAndMetric(util.IptmID, "Error: failed to delete deprecated jump from FORWARD chain to AZURE-NPM")
return err
}

entry := &IptEntry{
Chain: util.IptablesForwardChain,
Specs: []string{
util.IptablesJumpFlag,
util.IptablesAzureChain,
util.IptablesModuleFlag,
util.IptablesCtstateModuleFlag,
util.IptablesCtstateFlag,
util.IptablesNewState,
},
}
iptMgr.OperationFlag = util.IptablesDeletionFlag
errCode, err := iptMgr.run(entry)
errCode, err = iptMgr.run(entry)
if errCode != iptablesErrDoesNotExist && err != nil {
metrics.SendErrorLogAndMetric(util.IptmID, "Error: failed to delete AZURE-NPM from Forward chain")
return err
Expand Down Expand Up @@ -201,18 +221,26 @@ func (iptMgr *IptablesManager) checkAndAddForwardChain() error {
Specs: []string{
util.IptablesJumpFlag,
util.IptablesAzureChain,
util.IptablesModuleFlag,
util.IptablesCtstateModuleFlag,
util.IptablesCtstateFlag,
util.IptablesNewState,
},
}

// retrieve KUBE-SERVICES index
kubeServicesLine, err := iptMgr.getChainLineNumber(util.IptablesKubeServicesChain, util.IptablesForwardChain)
if err != nil {
metrics.SendErrorLogAndMetric(util.IptmID, "Error: failed to get index of KUBE-SERVICES in FORWARD chain with error: %s", err.Error())
return err
var index int
var kubeServicesLine int
if !iptMgr.placeAzureChainFirst {
// retrieve KUBE-SERVICES index
var err error
kubeServicesLine, err = iptMgr.getChainLineNumber(util.IptablesKubeServicesChain, util.IptablesForwardChain)
if err != nil {
metrics.SendErrorLogAndMetric(util.IptmID, "Error: failed to get index of KUBE-SERVICES in FORWARD chain with error: %s", err.Error())
return err
}
index = kubeServicesLine + 1 // insert the jump to AZURE-NPM after the jump to KUBE-SERVICES
}

index := kubeServicesLine + 1

exists, err := iptMgr.exists(entry)
if err != nil {
return err
Expand All @@ -221,7 +249,9 @@ func (iptMgr *IptablesManager) checkAndAddForwardChain() error {
if !exists {
// position Azure-NPM chain after Kube-Forward and Kube-Service chains if it exists
iptMgr.OperationFlag = util.IptablesInsertionFlag
entry.Specs = append([]string{strconv.Itoa(index)}, entry.Specs...)
if !iptMgr.placeAzureChainFirst {
entry.Specs = append([]string{strconv.Itoa(index)}, entry.Specs...)
}
if _, err = iptMgr.run(entry); err != nil {
metrics.SendErrorLogAndMetric(util.IptmID, "Error: failed to add AZURE-NPM chain to FORWARD chain.")
return err
Expand All @@ -236,11 +266,15 @@ func (iptMgr *IptablesManager) checkAndAddForwardChain() error {
return err
}

// Kube-services line number is less than npm chain line number then all good
if kubeServicesLine < npmChainLine {
return nil
} else if kubeServicesLine <= 0 {
return nil
if iptMgr.placeAzureChainFirst {
if npmChainLine == 1 {
return nil
}
} else {
// Kube-services line number is less than npm chain line number then all good
if kubeServicesLine < npmChainLine || kubeServicesLine <= 0 {
return nil
}
}

errCode := 0
Expand All @@ -253,11 +287,11 @@ func (iptMgr *IptablesManager) checkAndAddForwardChain() error {
return err
}
iptMgr.OperationFlag = util.IptablesInsertionFlag
// Reduce index for deleted AZURE-NPM chain
if index > 1 {
if !iptMgr.placeAzureChainFirst {
// Reduce index for deleted AZURE-NPM chain
index--
entry.Specs = append([]string{strconv.Itoa(index)}, entry.Specs...)
}
entry.Specs = append([]string{strconv.Itoa(index)}, entry.Specs...)
if errCode, err = iptMgr.run(entry); err != nil {
metrics.SendErrorLogAndMetric(util.IptmID, "Error: failed to add AZURE-NPM chain to FORWARD chain with error code %d.", errCode)
return err
Expand Down
Loading