Skip to content

fix: [NPM] updating NPM marks with a mask to not clash with kube-proxy #1313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Apr 11, 2022
Merged

fix: [NPM] updating NPM marks with a mask to not clash with kube-proxy #1313

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3161272
fix: [NPM] updating NPM marks with a mask to not clash with kube-proxy
vakalapa Mar 31, 2022
7c383f8
updating mark to single bit instead of 2 bits for 500
vakalapa Apr 5, 2022
3565558
not touching v1 and adjusting UTs for V2
vakalapa Apr 6, 2022
b8f0852
correcting an UT
vakalapa Apr 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions npm/pkg/dataplane/policies/chain-management_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,10 +321,6 @@ func (pMgr *PolicyManager) creatorForBootup(currentChains map[string]struct{}) *
creator.AddLine("", nil, jumpOnIngressMatchSpecs...)

// add AZURE-NPM-ACCEPT chain rules
clearSpecs := []string{util.IptablesAppendFlag, util.IptablesAzureAcceptChain}
clearSpecs = append(clearSpecs, setMarkSpecs(util.IptablesAzureClearMarkHex)...)
clearSpecs = append(clearSpecs, commentSpecs("CLEAR-AZURE-NPM-MARKS")...)
creator.AddLine("", nil, clearSpecs...)
creator.AddLine("", nil, util.IptablesAppendFlag, util.IptablesAzureAcceptChain, util.IptablesJumpFlag, util.IptablesAccept)
creator.AddLine("", nil, util.IptablesRestoreCommit)
return creator
Expand Down
36 changes: 16 additions & 20 deletions npm/pkg/dataplane/policies/chain-management_linux_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,12 +213,11 @@ func TestCreatorForBootup(t *testing.T) {
":AZURE-NPM-INGRESS-ALLOW-MARK - -",
":AZURE-NPM-EGRESS - -",
":AZURE-NPM-ACCEPT - -",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x4000 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x4000",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x2000 -m comment --comment SET-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x400/0x400 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x400/0x400",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x200/0x200 -m comment --comment SET-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j AZURE-NPM-EGRESS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x5000 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x5000",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x2000 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-ACCEPT -j MARK --set-mark 0x0 -m comment --comment CLEAR-AZURE-NPM-MARKS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x800/0x800 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x800/0x800",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x200/0x200 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-ACCEPT -j ACCEPT",
"COMMIT",
"",
Expand Down Expand Up @@ -246,12 +245,11 @@ func TestCreatorForBootup(t *testing.T) {
"-F AZURE-NPM-ACCEPT",
"-F AZURE-NPM-INGRESS-123456",
"-F AZURE-NPM-EGRESS-123456",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x4000 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x4000",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x2000 -m comment --comment SET-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x400/0x400 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x400/0x400",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x200/0x200 -m comment --comment SET-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j AZURE-NPM-EGRESS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x5000 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x5000",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x2000 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-ACCEPT -j MARK --set-mark 0x0 -m comment --comment CLEAR-AZURE-NPM-MARKS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x800/0x800 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x800/0x800",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x200/0x200 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-ACCEPT -j ACCEPT",
"COMMIT",
"",
Expand All @@ -276,12 +274,11 @@ func TestCreatorForBootup(t *testing.T) {
"-F AZURE-NPM-ACCEPT",
"-F AZURE-NPM-INGRESS",
"-F AZURE-NPM-INGRESS-ALLOW-MARK",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x4000 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x4000",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x2000 -m comment --comment SET-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x400/0x400 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x400/0x400",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x200/0x200 -m comment --comment SET-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j AZURE-NPM-EGRESS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x5000 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x5000",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x2000 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-ACCEPT -j MARK --set-mark 0x0 -m comment --comment CLEAR-AZURE-NPM-MARKS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x800/0x800 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x800/0x800",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x200/0x200 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-ACCEPT -j ACCEPT",
"COMMIT",
"",
Expand All @@ -305,12 +302,11 @@ func TestCreatorForBootup(t *testing.T) {
"-F AZURE-NPM-EGRESS-DROPS",
"-F AZURE-NPM-EGRESS-FROM",
"-F AZURE-NPM-EGRESS-PORTS",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x4000 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x4000",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x2000 -m comment --comment SET-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-INGRESS -j DROP -m mark --mark 0x400/0x400 -m comment --comment DROP-ON-INGRESS-DROP-MARK-0x400/0x400",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j MARK --set-mark 0x200/0x200 -m comment --comment SET-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-INGRESS-ALLOW-MARK -j AZURE-NPM-EGRESS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x5000 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x5000",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x2000 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x2000",
"-A AZURE-NPM-ACCEPT -j MARK --set-mark 0x0 -m comment --comment CLEAR-AZURE-NPM-MARKS",
"-A AZURE-NPM-EGRESS -j DROP -m mark --mark 0x800/0x800 -m comment --comment DROP-ON-EGRESS-DROP-MARK-0x800/0x800",
"-A AZURE-NPM-EGRESS -j AZURE-NPM-ACCEPT -m mark --mark 0x200/0x200 -m comment --comment ACCEPT-ON-INGRESS-ALLOW-MARK-0x200/0x200",
"-A AZURE-NPM-ACCEPT -j ACCEPT",
"COMMIT",
"",
Expand Down
11 changes: 8 additions & 3 deletions npm/pkg/dataplane/policies/policymanager_linux_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,14 +89,19 @@ const (
// iptables rule variables for ACLs
var (
ingressDropRule = fmt.Sprintf(
"-j MARK --set-mark 0x4000 -p TCP --dport 222:333 -m set --match-set %s src -m set ! --match-set %s dst -m comment --comment %s",
"-j MARK --set-mark %s -p TCP --dport 222:333 -m set --match-set %s src -m set ! --match-set %s dst -m comment --comment %s",
util.IptablesAzureIngressDropMarkHex,
ipsets.TestCIDRSet.HashedName,
ipsets.TestKeyPodSet.HashedName,
ingressDropComment,
)
ingressAllowRule = fmt.Sprintf("-j AZURE-NPM-INGRESS-ALLOW-MARK -m set --match-set %s src -m comment --comment %s", ipsets.TestCIDRSet.HashedName, ingressAllowComment)
egressDropRule = fmt.Sprintf("-j MARK --set-mark 0x5000 -p UDP --dport 144 -m set --match-set %s dst -m comment --comment %s", ipsets.TestCIDRSet.HashedName, egressDropComment)
egressAllowRule = fmt.Sprintf("-j AZURE-NPM-ACCEPT -m set --match-set %s dst -m comment --comment %s", ipsets.TestNamedportSet.HashedName, egressAllowComment)
egressDropRule = fmt.Sprintf("-j MARK --set-mark %s -p UDP --dport 144 -m set --match-set %s dst -m comment --comment %s",
util.IptablesAzureEgressDropMarkHex,
ipsets.TestCIDRSet.HashedName,
egressDropComment,
)
egressAllowRule = fmt.Sprintf("-j AZURE-NPM-ACCEPT -m set --match-set %s dst -m comment --comment %s", ipsets.TestNamedportSet.HashedName, egressAllowComment)
)

// NetworkPolicies
Expand Down
12 changes: 9 additions & 3 deletions npm/util/const.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,12 +116,18 @@ const (
IptablesAzureEgressToPodChain string = "AZURE-NPM-EGRESS-TO-POD"

// Below are the skb->mark NPM will use for different criteria
// for V1
IptablesAzureClearMarkHex string = "0x0"
// for v2, deprecated
IptablesAzureClearMarkHexV2 string = "0x0/0xE00"

// marks in NPM v2
IptablesAzureIngressAllowMarkHex string = "0x2000" // same as old IptablesAzureIngressMarkHex
IptablesAzureIngressDropMarkHex string = "0x4000"
IptablesAzureEgressDropMarkHex string = "0x5000"
// NPM uses the 3rd word of the 32-bit mark for the purpose of
// identifying the traffic direction and decision making.
// NPM uses 9th, 10th and 11th bit for marking
IptablesAzureIngressAllowMarkHex string = "0x200/0x200"
IptablesAzureIngressDropMarkHex string = "0x400/0x400"
IptablesAzureEgressDropMarkHex string = "0x800/0x800"

// marks in NPM v1
IptablesAzureIngressMarkHex string = "0x2000"
Expand Down