Skip to content

fix: [NPM-WIN] validation to prevent cidr except in windows #1513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 9, 2022
Merged

fix: [NPM-WIN] validation to prevent cidr except in windows #1513

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9851e2e
validation to prevent cidr except in windows
huntergregory Aug 8, 2022
8938932
do not requeue on ErrUnsupportedExceptCIDR
huntergregory Aug 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion npm/pkg/controlplane/controllers/v2/networkPolicyController.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -349,5 +349,6 @@ func (c *NetworkPolicyController) cleanUpNetworkPolicy(netPolKey string) error {
func isUnsupportedWindowsTranslationErr(err error) bool {
return errors.Is(err, translation.ErrUnsupportedNamedPort) ||
errors.Is(err, translation.ErrUnsupportedNegativeMatch) ||
errors.Is(err, translation.ErrUnsupportedSCTP)
errors.Is(err, translation.ErrUnsupportedSCTP) ||
errors.Is(err, translation.ErrUnsupportedExceptCIDR)
}
33 changes: 23 additions & 10 deletions npm/pkg/controlplane/translation/translatePolicy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ var (
ErrUnsupportedNamedPort = errors.New("unsupported namedport translation features used on windows")
// ErrUnsupportedNegativeMatch is returned when negative match translation feature is used in windows.
ErrUnsupportedNegativeMatch = errors.New("unsupported NotExist operator translation features used on windows")
// ErrUnsupportedExceptCIDR is returned when Except CIDR block translation feature is used in windows.
ErrUnsupportedExceptCIDR = errors.New("unsupported Except CIDR block translation features used on windows")
// ErrUnsupportedSCTP is returned when SCTP protocol is used in windows.
ErrUnsupportedSCTP = errors.New("unsupported SCTP protocol used on windows")
)
Expand Down Expand Up @@ -156,14 +158,19 @@ func deDuplicateExcept(exceptInIPBlock []string) []string {
}

// ipBlockIPSet return translatedIPSet based based on ipBlockRule.
func ipBlockIPSet(policyName, ns string, direction policies.Direction, ipBlockSetIndex, ipBlockPeerIndex int, ipBlockRule *networkingv1.IPBlock) *ipsets.TranslatedIPSet {
func ipBlockIPSet(policyName, ns string, direction policies.Direction, ipBlockSetIndex, ipBlockPeerIndex int, ipBlockRule *networkingv1.IPBlock) (*ipsets.TranslatedIPSet, error) {
if ipBlockRule == nil || ipBlockRule.CIDR == "" {
return nil
return nil, nil
}

// de-duplicated Except if there are redundance elements.
deDupExcepts := deDuplicateExcept(ipBlockRule.Except)
lenOfDeDupExcepts := len(deDupExcepts)

if util.IsWindowsDP() && lenOfDeDupExcepts > 0 {
return nil, ErrUnsupportedExceptCIDR
}

var members []string
indexOfMembers := 0
// Ipset doesn't allow 0.0.0.0/0 to be added.
Expand Down Expand Up @@ -203,21 +210,23 @@ func ipBlockIPSet(policyName, ns string, direction policies.Direction, ipBlockSe

ipBlockIPSetName := ipBlockSetName(policyName, ns, direction, ipBlockSetIndex, ipBlockPeerIndex)
ipBlockIPSet := ipsets.NewTranslatedIPSet(ipBlockIPSetName, ipsets.CIDRBlocks, members...)
return ipBlockIPSet
return ipBlockIPSet, nil
}

// ipBlockRule translates IPBlock field in networkpolicy object to translatedIPSet and SetInfo.
// ipBlockSetIndex parameter is used to diffentiate ipBlock fields in one networkpolicy object.
func ipBlockRule(policyName, ns string, direction policies.Direction, matchType policies.MatchType, ipBlockSetIndex, ipBlockPeerIndex int,
ipBlockRule *networkingv1.IPBlock) (*ipsets.TranslatedIPSet, policies.SetInfo) {

ipBlockRule *networkingv1.IPBlock) (*ipsets.TranslatedIPSet, policies.SetInfo, error) { //nolint // gofumpt
if ipBlockRule == nil || ipBlockRule.CIDR == "" {
return nil, policies.SetInfo{}
return nil, policies.SetInfo{}, nil
}

ipBlockIPSet := ipBlockIPSet(policyName, ns, direction, ipBlockSetIndex, ipBlockPeerIndex, ipBlockRule)
ipBlockIPSet, err := ipBlockIPSet(policyName, ns, direction, ipBlockSetIndex, ipBlockPeerIndex, ipBlockRule)
if err != nil {
return nil, policies.SetInfo{}, err
}
setInfo := policies.NewSetInfo(ipBlockIPSet.Metadata.Name, ipsets.CIDRBlocks, included, matchType)
return ipBlockIPSet, setInfo
return ipBlockIPSet, setInfo, err
}

// PodSelector translates podSelector of NetworkPolicyPeer field in networkpolicy object to translatedIPSets, children of translated IPSets, and SetInfo.
Expand Down Expand Up @@ -373,9 +382,13 @@ func translateRule(npmNetPol *policies.NPMNetworkPolicy, netPolName string, dire
// #2.1 Handle IPBlock and port if exist
if peer.IPBlock != nil {
if len(peer.IPBlock.CIDR) > 0 {
ipBlockIPSet, ipBlockSetInfo := ipBlockRule(netPolName, npmNetPol.Namespace, direction, matchType, ruleIndex, peerIdx, peer.IPBlock)
ipBlockIPSet, ipBlockSetInfo, err := ipBlockRule(netPolName, npmNetPol.Namespace, direction, matchType, ruleIndex, peerIdx, peer.IPBlock)
if err != nil {
return err
}
npmNetPol.RuleIPSets = append(npmNetPol.RuleIPSets, ipBlockIPSet)
err := peerAndPortRule(npmNetPol, direction, ports, []policies.SetInfo{ipBlockSetInfo})

err = peerAndPortRule(npmNetPol, direction, ports, []policies.SetInfo{ipBlockSetInfo})
if err != nil {
return err
}
Expand Down
10 changes: 4 additions & 6 deletions npm/pkg/controlplane/translation/translatePolicy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ func TestPortType(t *testing.T) {
name string
portRule networkingv1.NetworkPolicyPort
want netpolPortType
wantErr bool
}{
{
name: "empty",
Expand Down Expand Up @@ -179,7 +178,6 @@ func TestNamedPortRuleInfo(t *testing.T) {
name string
portRule *networkingv1.NetworkPolicyPort
want *namedPortOutput
wantErr bool
}{
{
name: "empty",
Expand Down Expand Up @@ -239,7 +237,6 @@ func TestNamedPortRule(t *testing.T) {
name string
portRule *networkingv1.NetworkPolicyPort
want *namedPortRuleOutput
wantErr bool
}{
{
name: "empty",
Expand All @@ -249,7 +246,6 @@ func TestNamedPortRule(t *testing.T) {
setInfo: policies.SetInfo{},
protocol: "",
},
wantErr: false,
},
{
name: "serve-tcp",
Expand Down Expand Up @@ -461,7 +457,8 @@ func TestIPBlockIPSet(t *testing.T) {
tt := tt
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
got := ipBlockIPSet(tt.policyName, tt.namemspace, tt.direction, tt.ipBlockSetIndex, tt.ipBlockPeerIndex, tt.ipBlockRule)
got, err := ipBlockIPSet(tt.policyName, tt.namemspace, tt.direction, tt.ipBlockSetIndex, tt.ipBlockPeerIndex, tt.ipBlockRule)
require.NoError(t, err)
require.Equal(t, tt.translatedIPSet, got)
})
}
Expand Down Expand Up @@ -527,7 +524,8 @@ func TestIPBlockRule(t *testing.T) {
tt := tt
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
translatedIPSet, setInfo := ipBlockRule(tt.policyName, tt.namemspace, tt.direction, tt.matchType, tt.ipBlockSetIndex, tt.ipBlockPeerIndex, tt.ipBlockRule)
translatedIPSet, setInfo, err := ipBlockRule(tt.policyName, tt.namemspace, tt.direction, tt.matchType, tt.ipBlockSetIndex, tt.ipBlockPeerIndex, tt.ipBlockRule)
require.NoError(t, err)
require.Equal(t, tt.translatedIPSet, translatedIPSet)
require.Equal(t, tt.setInfo, setInfo)
})
Expand Down