Skip to content

Support for ACL (Hnsv2) #705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Nov 5, 2020
Merged

Support for ACL (Hnsv2) #705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
eea59e6
initial changes
ninzavivek Oct 27, 2020
dde0b4a
remove extraneous code
ninzavivek Oct 29, 2020
9494fb6
Add ACL and wireserver ACL
ninzavivek Oct 29, 2020
8c143a8
add ACLs
ninzavivek Oct 29, 2020
de53991
default acls
ninzavivek Oct 29, 2020
83d86cc
Merge remote-tracking branch 'upstream/master' into vivek_acl
ninzavivek Oct 30, 2020
961b0dd
address comments
ninzavivek Nov 3, 2020
24803a3
addressed comment
ninzavivek Nov 3, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions cni/azure-windows.conflist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,46 @@
"DestinationPrefix": "10.0.0.0/8",
"NeedEncap": true
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Action": "Allow",
"Direction": "Out",
"RemoteAddresses": "168.63.129.16/32",
"Protocols": "17",
"RemotePorts": "53",
"Priority": 200
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Action": "Block",
"Direction": "Out",
"RemoteAddresses": "168.63.129.16/32",
"Priority": 65000
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Action": "Allow",
"Direction": "Out",
"Priority": 65500
}
},
{
"Name": "EndpointPolicy",
"Value": {
"Type": "ACL",
"Action": "Allow",
"Direction": "In",
"Priority": 65500
}
}
]
}
Expand Down
1 change: 1 addition & 0 deletions network/policy/policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ const (
OutBoundNatPolicy CNIPolicyType = "OutBoundNAT"
RoutePolicy CNIPolicyType = "ROUTE"
PortMappingPolicy CNIPolicyType = "NAT"
ACLPolicy CNIPolicyType = "ACL"
)

type CNIPolicyType string
Expand Down
29 changes: 29 additions & 0 deletions network/policy/policy_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,11 @@ func GetPolicyType(policy Policy) CNIPolicyType {
}
}

// Check if the type is ACLPolicy
if policy.Type == ACLPolicy {
return ACLPolicy
}

// Return empty string if the policy type is invalid
log.Printf("Returning policyType INVALID")
return ""
Expand Down Expand Up @@ -343,6 +348,28 @@ func GetHcnPortMappingPolicy(policy Policy) (hcn.EndpointPolicy, error) {
return portMappingPolicy, nil
}

// GetHcnACLPolicy returns ACL policy.
func GetHcnACLPolicy(policy Policy) (hcn.EndpointPolicy, error) {
aclEndpolicySetting := hcn.EndpointPolicy{
Type: hcn.ACL,
}

// Check beforehand, the input meets the expected format
// otherwise, endpoint creation will fail later on.
var aclPolicySetting hcn.AclPolicySetting
if err := json.Unmarshal(policy.Data, &aclPolicySetting); err != nil {
return aclEndpolicySetting, err
}

aclPolicySettingBytes, err := json.Marshal(aclPolicySetting)
if err != nil {
return aclEndpolicySetting, err
}

aclEndpolicySetting.Settings = aclPolicySettingBytes
return aclEndpolicySetting, nil
}

// GetHcnEndpointPolicies returns array of all endpoint policies.
func GetHcnEndpointPolicies(policyType CNIPolicyType, policies []Policy, epInfoData map[string]interface{}, enableSnatForDns, enableMultiTenancy bool) ([]hcn.EndpointPolicy, error) {
var (
Expand All @@ -363,6 +390,8 @@ func GetHcnEndpointPolicies(policyType CNIPolicyType, policies []Policy, epInfoD
endpointPolicy, err = GetHcnRoutePolicy(policy)
case PortMappingPolicy:
endpointPolicy, err = GetHcnPortMappingPolicy(policy)
case ACLPolicy:
endpointPolicy, err = GetHcnACLPolicy(policy)
default:
// return error as we should be able to parse all the policies specified
return hcnEndPointPolicies, fmt.Errorf("Failed to set Policy: Type: %s, Data: %s", policy.Type, policy.Data)
Expand Down