K8s Net pol -- UDP handling

src/conf/local-file.yaml

@@ -2,10 +2,10 @@ application:
   name: knoxautopolicy
   network:
     operation-mode: 1                             # 1: cronjob | 2: one-time-job
-    operation-trigger: 5
+    operation-trigger: 100
     cron-job-time-interval: "0h0m10s"             # format: XhYmZs 
     network-log-limit: 10000
-    network-log-from: "kubearmor"                 # db|hubble|feed-consumer|kubearmor
+    network-log-from: "hubble"                    # db|hubble|feed-consumer|kubearmor
     #network-log-file: "/home/rahul/feeds.json"   # file path
     network-policy-to: "db"                       # db, file
     network-policy-dir: "./"

src/networkpolicy/deduplicator.go

@@ -974,13 +974,15 @@ func UpdateDuplicatedPolicy(existingPolicies []types.KnoxNetworkPolicy, discover
 
 	for _, policy := range existIngressPolicies {
 		if policy.Metadata["status"] == "updated" {
-			delete(policy.Metadata, "status")
+			policy.Metadata["status"] = "latest"
+			//delete(policy.Metadata, "status")
 			updatedPolicies = append(updatedPolicies, policy)
 		}
 	}
 	for _, policy := range existEgressPolicies {
 		if policy.Metadata["status"] == "updated" {
-			delete(policy.Metadata, "status")
+			policy.Metadata["status"] = "latest"
+			//delete(policy.Metadata, "status")
 			updatedPolicies = append(updatedPolicies, policy)
 		}
 	}

src/networkpolicy/helperFunctions.go

@@ -13,6 +13,7 @@ import (
 	"github.com/clarketm/json"
 
 	"github.com/accuknox/auto-policy-discovery/src/cluster"
+	"github.com/accuknox/auto-policy-discovery/src/config"
 	"github.com/accuknox/auto-policy-discovery/src/libs"
 	"github.com/accuknox/auto-policy-discovery/src/plugin"
 	wpb "github.com/accuknox/auto-policy-discovery/src/protobuf/v1/worker"
@@ -797,7 +798,8 @@ func GetNetPolicy(cluster, namespace, policyType string) *wpb.WorkerResponse {
 		}
 		response.K8SNetworkpolicy = nil
 	} else if strings.Contains(policyType, "generic") {
-		policies := plugin.ConvertKnoxNetPolicyToK8sNetworkPolicy(cluster, namespace)
+		knoxNetPolicies := libs.GetNetworkPolicies(config.CurrentCfg.ConfigDB, cluster, namespace, "latest", "", "")
+		policies := plugin.ConvertKnoxNetPolicyToK8sNetworkPolicy(cluster, namespace, knoxNetPolicies)
 
 		for i := range policies {
 			genericNetPol := wpb.Policy{}

src/networkpolicy/networkPolicy.go

@@ -1598,13 +1598,31 @@ func mergeIngressPolicies(existPolicy types.KnoxNetworkPolicy, policies []types.
 						}
 					}
 				}
+			} else if len(newIngress.FromCIDRs) > 0 && len(newIngress.ToPorts) > 0 {
+				newCIDR := newIngress.FromCIDRs[0].CIDRs[0]
+				newToPort := newIngress.ToPorts[0]
+
+				for _, existIngress := range mergedPolicy.Spec.Ingress {
+					if len(existIngress.FromCIDRs) == 0 || len(existIngress.ToPorts) == 0 {
+						continue
+					}
+					existCIDR := existIngress.FromCIDRs[0].CIDRs[0]
+					existToPort := existIngress.ToPorts[0]
+
+					if existCIDR == newCIDR && existToPort == newToPort {
+						ingressMatched = true
+						break
+					}
+				}
 			}
+
 			if !ingressMatched {
 				mergedPolicy.Spec.Ingress = append(mergedPolicy.Spec.Ingress, newIngress)
 				updated = true
 			}
 		}
 	}
+
 	return mergedPolicy, updated
 }
 
@@ -1668,7 +1686,24 @@ func mergeEgressPolicies(existPolicy types.KnoxNetworkPolicy, policies []types.K
 						}
 					}
 				}
+			} else if len(newEgress.ToCIDRs) > 0 && len(newEgress.ToPorts) > 0 {
+				newCIDR := newEgress.ToCIDRs[0].CIDRs[0]
+				newToPort := newEgress.ToPorts[0]
+
+				for _, existEgress := range mergedPolicy.Spec.Egress {
+					if len(existEgress.ToCIDRs) == 0 || len(existEgress.ToPorts) == 0 {
+						continue
+					}
+					existCIDR := existEgress.ToCIDRs[0].CIDRs[0]
+					existToPort := existEgress.ToPorts[0]
+
+					if existCIDR == newCIDR && existToPort == newToPort {
+						egressMatched = true
+						break
+					}
+				}
 			}
+
 			if !egressMatched {
 				mergedPolicy.Spec.Egress = append(mergedPolicy.Spec.Egress, newEgress)
 				updated = true
@@ -1858,6 +1893,49 @@ func convertKnoxNetworkLogToKnoxNetworkPolicy(log *types.KnoxNetworkLog, pods []
 			ePolicy.Metadata["namespace"] = log.SrcNamespace
 			egressPolicy = &ePolicy
 		}
+	} else if log.DstPodName == "" && len(log.DstReservedLabels) == 0 && log.Direction == "EGRESS" {
+		// Egress Policy
+		ePolicy := buildNewKnoxEgressPolicy()
+		egress := types.Egress{}
+
+		ePolicy.Spec.Selector.MatchLabels = getEndpointMatchLabels(log.SrcPodName, pods)
+
+		var cidrs []string
+		cidrs = append(cidrs, "0.0.0.0/32")
+
+		egress.ToCIDRs = append(egress.ToCIDRs, types.SpecCIDR{
+			CIDRs: cidrs,
+		})
+
+		egress.ToPorts = append(egress.ToPorts, types.SpecPort{
+			Port:     strconv.Itoa(log.DstPort),
+			Protocol: libs.GetProtocol(log.Protocol),
+		})
+
+		ePolicy.Spec.Egress = append(ePolicy.Spec.Egress, egress)
+		ePolicy.Metadata["namespace"] = log.SrcNamespace
+		egressPolicy = &ePolicy
+	} else if log.DstPodName == "" && len(log.DstReservedLabels) == 0 && log.Direction == "INGRESS" {
+		iPolicy := buildNewKnoxIngressPolicy()
+		ingress := types.Ingress{}
+
+		iPolicy.Spec.Selector.MatchLabels = getEndpointMatchLabels(log.SrcPodName, pods)
+
+		var cidrs []string
+		cidrs = append(cidrs, "0.0.0.0/32")
+
+		ingress.FromCIDRs = append(ingress.FromCIDRs, types.SpecCIDR{
+			CIDRs: cidrs,
+		})
+
+		ingress.ToPorts = append(ingress.ToPorts, types.SpecPort{
+			Port:     strconv.Itoa(log.DstPort),
+			Protocol: libs.GetProtocol(log.Protocol),
+		})
+
+		iPolicy.Spec.Ingress = append(iPolicy.Spec.Ingress, ingress)
+		iPolicy.Metadata["namespace"] = log.SrcNamespace
+		ingressPolicy = &iPolicy
 	}
 
 	if !isValidPolicy(ingressPolicy) {
@@ -2134,47 +2212,79 @@ func PopulateNetworkPoliciesFromNetworkLogs(networkLogs []types.KnoxNetworkLog)
 
 func writeNetworkPoliciesYamlToDB(policies []types.KnoxNetworkPolicy) {
 	clusters := []string{}
+	res := []types.PolicyYaml{}
 
 	for _, pol := range policies {
 		clusters = append(clusters, pol.Metadata["cluster_name"])
 	}
 
-	// convert knoxPolicy to CiliumPolicy
-	ciliumPolicies := plugin.ConvertKnoxPoliciesToCiliumPolicies(policies)
+	if cfg.CurrentCfg.ConfigNetPolicy.NetworkLogFrom == "kubearmor" {
+		k8sNetPolicies := plugin.ConvertKnoxNetPolicyToK8sNetworkPolicy("", "", policies)
 
-	res := []types.PolicyYaml{}
+		for i, np := range k8sNetPolicies {
+			np.ClusterName = ""
+			jsonBytes, err := json.Marshal(np)
+			if err != nil {
+				log.Error().Msg(err.Error())
+				continue
+			}
+			yamlBytes, err := yaml.JSONToYAML(jsonBytes)
+			if err != nil {
+				log.Error().Msg(err.Error())
+				continue
+			}
 
-	for i, ciliumPolicy := range ciliumPolicies {
-		jsonBytes, err := json.Marshal(ciliumPolicy)
-		if err != nil {
-			log.Error().Msg(err.Error())
-			continue
-		}
-		yamlBytes, err := yaml.JSONToYAML(jsonBytes)
-		if err != nil {
-			log.Error().Msg(err.Error())
-			continue
-		}
+			policyYaml := types.PolicyYaml{
+				Type:      types.PolicyTypeNetwork,
+				Kind:      np.Kind,
+				Name:      np.Name,
+				Namespace: np.Namespace,
+				Cluster:   clusters[i],
+				Labels:    np.Labels,
+				Yaml:      yamlBytes,
+			}
+			res = append(res, policyYaml)
 
-		var labels types.LabelMap
-		if ciliumPolicy.Kind == cu.ResourceTypeCiliumNetworkPolicy {
-			labels = ciliumPolicy.Spec.EndpointSelector.MatchLabels
-		} else {
-			labels = ciliumPolicy.Spec.NodeSelector.MatchLabels
+			PolicyStore.Publish(&policyYaml)
 		}
 
-		policyYaml := types.PolicyYaml{
-			Type:      types.PolicyTypeNetwork,
-			Kind:      ciliumPolicy.Kind,
-			Name:      ciliumPolicy.Metadata["name"],
-			Namespace: ciliumPolicy.Metadata["namespace"],
-			Cluster:   clusters[i],
-			Labels:    labels,
-			Yaml:      yamlBytes,
-		}
-		res = append(res, policyYaml)
+	} else {
 
-		PolicyStore.Publish(&policyYaml)
+		// convert knoxPolicy to CiliumPolicy
+		ciliumPolicies := plugin.ConvertKnoxPoliciesToCiliumPolicies(policies)
+
+		for i, ciliumPolicy := range ciliumPolicies {
+			jsonBytes, err := json.Marshal(ciliumPolicy)
+			if err != nil {
+				log.Error().Msg(err.Error())
+				continue
+			}
+			yamlBytes, err := yaml.JSONToYAML(jsonBytes)
+			if err != nil {
+				log.Error().Msg(err.Error())
+				continue
+			}
+
+			var labels types.LabelMap
+			if ciliumPolicy.Kind == cu.ResourceTypeCiliumNetworkPolicy {
+				labels = ciliumPolicy.Spec.EndpointSelector.MatchLabels
+			} else {
+				labels = ciliumPolicy.Spec.NodeSelector.MatchLabels
+			}
+
+			policyYaml := types.PolicyYaml{
+				Type:      types.PolicyTypeNetwork,
+				Kind:      ciliumPolicy.Kind,
+				Name:      ciliumPolicy.Metadata["name"],
+				Namespace: ciliumPolicy.Metadata["namespace"],
+				Cluster:   clusters[i],
+				Labels:    labels,
+				Yaml:      yamlBytes,
+			}
+			res = append(res, policyYaml)
+
+			PolicyStore.Publish(&policyYaml)
+		}
 	}
 
 	if err := libs.UpdateOrInsertPolicyYamls(CfgDB, res); err != nil {