Skip to content

Update action to block and increase priority for allow #547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 16, 2020
Merged

Update action to block and increase priority for allow #547

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
80f00e4
need to update action to block, update priority
aegal Apr 15, 2020
459f2db
need to update action to block, update priority
aegal Apr 15, 2020
dd305ce
address comments
aegal Apr 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions cns/NetworkContainerContract.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,13 @@ type ValidAclPolicySetting struct {
Priority uint16 `json:","`
}

const (
ActionTypeAllow string = "Allow"
ActionTypeBlock string = "Block"
DirectionTypeIn string = "In"
DirectionTypeOut string = "Out"
)

// Validate - Validates network container request policies
func (networkContainerRequestPolicy *NetworkContainerRequestPolicies) Validate() error {
// validate ACL policy
Expand All @@ -258,15 +265,15 @@ func (networkContainerRequestPolicy *NetworkContainerRequestPolicies) Validate()
return fmt.Errorf("Action field cannot be empty in ACL Policy")
}
//Deny request if ACL Action is not Allow or Deny
if !strings.EqualFold(requestedAclPolicy.Action, "Allow") && !strings.EqualFold(requestedAclPolicy.Action, "Deny") {
return fmt.Errorf("Only Allow or Deny is supported in Action field")
if !strings.EqualFold(requestedAclPolicy.Action, ActionTypeAllow) && !strings.EqualFold(requestedAclPolicy.Action, ActionTypeBlock) {
return fmt.Errorf("Only Allow or Block is supported in Action field")
}
//Deny request if ACL Direction is empty
if len(strings.TrimSpace(string(requestedAclPolicy.Direction))) == 0 {
return fmt.Errorf("Direction field cannot be empty in ACL Policy")
}
//Deny request if ACL direction is not In or Out
if !strings.EqualFold(requestedAclPolicy.Direction, "In") && !strings.EqualFold(requestedAclPolicy.Direction, "Out") {
if !strings.EqualFold(requestedAclPolicy.Direction, DirectionTypeIn) && !strings.EqualFold(requestedAclPolicy.Direction, DirectionTypeOut) {
return fmt.Errorf("Only In or Out is supported in Direction field")
}
if requestedAclPolicy.Priority == 0 {
Expand Down
9 changes: 6 additions & 3 deletions cns/hnsclient/hnsclient_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,9 @@ const (
// aclPriority200 indicates the ACL priority of 200
aclPriority200 = 200

// aclPriority1000 indicates the ACL priority of 1000
aclPriority1000 = 1000

// aclPolicyType indicates a ACL policy
aclPolicyType = "ACLPolicy"

Expand Down Expand Up @@ -394,7 +397,7 @@ func configureAclSettingHostNCApipaEndpoint(
LocalAddresses: networkContainerApipaIP,
RemoteAddresses: hostApipaIP,
RuleType: hcn.RuleTypeSwitch,
Priority: aclPriority200,
Priority: aclPriority1000,
}

if err = addAclToEndpointPolicy(outAllowToHostOnly, &endpointPolicies); err != nil {
Expand Down Expand Up @@ -426,7 +429,7 @@ func configureAclSettingHostNCApipaEndpoint(
LocalAddresses: networkContainerApipaIP,
RemoteAddresses: hostApipaIP,
RuleType: hcn.RuleTypeSwitch,
Priority: aclPriority200,
Priority: aclPriority1000,
}

if err = addAclToEndpointPolicy(inAllowFromHostOnly, &endpointPolicies); err != nil {
Expand All @@ -443,7 +446,7 @@ func configureAclSettingHostNCApipaEndpoint(
if strings.EqualFold(requestedPolicy.Type, aclPolicyType) && strings.EqualFold(requestedPolicy.EndpointType, apipaEndpointType) {
var requestedAclPolicy hcn.AclPolicySetting
if err = json.Unmarshal(requestedPolicy.Settings, &requestedAclPolicy); err != nil {
return nil, fmt.Errorf("Failed to Unmarshal requested ACL policy: %+v with error: %S", requestedPolicy.Settings, err)
return nil, fmt.Errorf("Failed to Unmarshal requested ACL policy: %+v with error: %+v", requestedPolicy.Settings, err)
}
//Using {NetworkContainerIP} as a placeholder to signal using Network Container IP
if strings.EqualFold(requestedAclPolicy.LocalAddresses, "{NetworkContainerIP}") {
Expand Down