policy: Track policy rule labels from which map entries are derived from

pkg/endpoint/bpf.go

@@ -30,6 +30,7 @@ import (
 	"github.com/cilium/cilium/pkg/completion"
 	"github.com/cilium/cilium/pkg/controller"
 	"github.com/cilium/cilium/pkg/endpoint/regeneration"
+	"github.com/cilium/cilium/pkg/labels"
 	"github.com/cilium/cilium/pkg/loadinfo"
 	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/maps/ctmap"
@@ -224,7 +225,7 @@ func (e *Endpoint) addNewRedirectsFromDesiredPolicy(ingress bool, desiredRedirec
 				} else {
 					insertedDesiredMapState[keyFromFilter] = struct{}{}
 				}
-				if entry != policy.NoRedirectEntry {
+				if entry.IsRedirectEntry() {
 					entry.ProxyPort = redirectPort
 				}
 				e.desiredPolicy.PolicyMapState[keyFromFilter] = entry
@@ -334,10 +335,15 @@ func (e *Endpoint) addVisibilityRedirects(ingress bool, desiredRedirects map[str
 			TrafficDirection: direction.Uint8(),
 		}
 
-		e.desiredPolicy.PolicyMapState[newKey] = policy.MapStateEntry{
-			ProxyPort: redirectPort,
+		derivedFrom := labels.LabelArrayList{
+			labels.LabelArray{
+				labels.NewLabel(policy.LabelKeyPolicyDerivedFrom, policy.LabelVisibilityAnnotation, labels.LabelSourceReserved),
+			},
 		}
+		entry := policy.NewMapStateEntry(derivedFrom, true)
+		entry.ProxyPort = redirectPort
 
+		e.desiredPolicy.PolicyMapState[newKey] = entry
 		insertedDesiredMapState[newKey] = struct{}{}
 	}
 
@@ -1068,7 +1074,7 @@ func (e *Endpoint) applyPolicyMapChanges() (proxyChanges bool, err error) {
 
 	for keyToAdd, entry := range adds {
 		// Keep the existing proxy port, if any
-		if entry != policy.NoRedirectEntry {
+		if entry.IsRedirectEntry() {
 			entry.ProxyPort = e.realizedRedirects[policy.ProxyIDFromKey(e.ID, keyToAdd)]
 			if entry.ProxyPort != 0 {
 				proxyChanges = true
@@ -1143,7 +1149,7 @@ func (e *Endpoint) addPolicyMapDelta() error {
 	errors := 0
 
 	for keyToAdd, entry := range e.desiredPolicy.PolicyMapState {
-		if oldEntry, ok := e.realizedPolicy.PolicyMapState[keyToAdd]; !ok || oldEntry != entry {
+		if oldEntry, ok := e.realizedPolicy.PolicyMapState[keyToAdd]; !ok || !oldEntry.Equal(&entry) {
 			if !e.addPolicyKey(keyToAdd, entry, false) {
 				errors++
 			}

pkg/endpoint/policy.go

@@ -751,3 +751,23 @@ func (e *Endpoint) UpdateVisibilityPolicy(annoCB AnnotationsResolverCB) {
 	}
 	<-ch
 }
+
+// GetRealizedPolicyRuleLabelsForKey returns the list of policy rule labels
+// which match a given flow key (in host byte-order). The returned
+// LabelArrayList must not be modified. This function is exported to be
+// accessed by code outside of the Cilium code base (e.g. Hubble).
+func (e *Endpoint) GetRealizedPolicyRuleLabelsForKey(key policy.Key) (
+	derivedFrom labels.LabelArrayList,
+	revision uint64,
+	ok bool,
+) {
+	e.mutex.RLock()
+	defer e.mutex.RUnlock()
+
+	entry, ok := e.realizedPolicy.PolicyMapState[key]
+	if !ok {
+		return nil, 0, false
+	}
+
+	return entry.DerivedFromRules, e.policyRevision, true
+}

pkg/labels/array.go

@@ -213,8 +213,8 @@ func (ls LabelArray) StringMap() map[string]string {
 	return o
 }
 
-// Same returns true if the label arrays are the same, i.e., have the same labels in the same order.
-func (ls LabelArray) Same(b LabelArray) bool {
+// Equals returns true if the label arrays are the same, i.e., have the same labels in the same order.
+func (ls LabelArray) Equals(b LabelArray) bool {
 	if len(ls) != len(b) {
 		return false
 	}
@@ -225,3 +225,36 @@ func (ls LabelArray) Same(b LabelArray) bool {
 	}
 	return true
 }
+
+// Less returns true if ls comes before b in the lexicographical order.
+// Assumes both ls and b are already sorted.
+func (ls LabelArray) Less(b LabelArray) bool {
+	lsLen, bLen := len(ls), len(b)
+
+	minLen := lsLen
+	if bLen < minLen {
+		minLen = bLen
+	}
+
+	for i := 0; i < minLen; i++ {
+		switch {
+		// Key
+		case ls[i].Key < b[i].Key:
+			return true
+		case ls[i].Key > b[i].Key:
+			return false
+		// Value
+		case ls[i].Value < b[i].Value:
+			return true
+		case ls[i].Value > b[i].Value:
+			return false
+		// Source
+		case ls[i].Source < b[i].Source:
+			return true
+		case ls[i].Source > b[i].Source:
+			return false
+		}
+	}
+
+	return lsLen < bLen
+}

pkg/labels/array_test.go

@@ -84,7 +84,7 @@ func (s *LabelsSuite) TestHas(c *C) {
 	}
 }
 
-func (s *LabelsSuite) TestSame(c *C) {
+func (s *LabelsSuite) TestEquals(c *C) {
 	lbls1 := LabelArray{
 		NewLabel("env", "devel", LabelSourceAny),
 		NewLabel("user", "bob", LabelSourceContainer),
@@ -105,47 +105,149 @@ func (s *LabelsSuite) TestSame(c *C) {
 	}
 	lbls6 := LabelArray{}
 
-	c.Assert(lbls1.Same(lbls1), Equals, true)
-	c.Assert(lbls1.Same(lbls2), Equals, true)
-	c.Assert(lbls1.Same(lbls3), Equals, false) // inverted order
-	c.Assert(lbls1.Same(lbls4), Equals, false) // different count
-	c.Assert(lbls1.Same(lbls5), Equals, false)
-	c.Assert(lbls1.Same(lbls6), Equals, false)
-
-	c.Assert(lbls2.Same(lbls1), Equals, true)
-	c.Assert(lbls2.Same(lbls2), Equals, true)
-	c.Assert(lbls2.Same(lbls3), Equals, false) // inverted order
-	c.Assert(lbls2.Same(lbls4), Equals, false) // different count
-	c.Assert(lbls2.Same(lbls5), Equals, false)
-	c.Assert(lbls2.Same(lbls6), Equals, false)
-
-	c.Assert(lbls3.Same(lbls1), Equals, false)
-	c.Assert(lbls3.Same(lbls2), Equals, false)
-	c.Assert(lbls3.Same(lbls3), Equals, true)
-	c.Assert(lbls3.Same(lbls4), Equals, false)
-	c.Assert(lbls3.Same(lbls5), Equals, false)
-	c.Assert(lbls3.Same(lbls6), Equals, false)
-
-	c.Assert(lbls4.Same(lbls1), Equals, false)
-	c.Assert(lbls4.Same(lbls2), Equals, false)
-	c.Assert(lbls4.Same(lbls3), Equals, false)
-	c.Assert(lbls4.Same(lbls4), Equals, true)
-	c.Assert(lbls4.Same(lbls5), Equals, false)
-	c.Assert(lbls4.Same(lbls6), Equals, false)
-
-	c.Assert(lbls5.Same(lbls1), Equals, false)
-	c.Assert(lbls5.Same(lbls2), Equals, false)
-	c.Assert(lbls5.Same(lbls3), Equals, false)
-	c.Assert(lbls5.Same(lbls4), Equals, false)
-	c.Assert(lbls5.Same(lbls5), Equals, true)
-	c.Assert(lbls5.Same(lbls6), Equals, false)
-
-	c.Assert(lbls6.Same(lbls1), Equals, false)
-	c.Assert(lbls6.Same(lbls2), Equals, false)
-	c.Assert(lbls6.Same(lbls3), Equals, false)
-	c.Assert(lbls6.Same(lbls4), Equals, false)
-	c.Assert(lbls6.Same(lbls5), Equals, false)
-	c.Assert(lbls6.Same(lbls6), Equals, true)
+	c.Assert(lbls1.Equals(lbls1), Equals, true)
+	c.Assert(lbls1.Equals(lbls2), Equals, true)
+	c.Assert(lbls1.Equals(lbls3), Equals, false) // inverted order
+	c.Assert(lbls1.Equals(lbls4), Equals, false) // different count
+	c.Assert(lbls1.Equals(lbls5), Equals, false)
+	c.Assert(lbls1.Equals(lbls6), Equals, false)
+
+	c.Assert(lbls2.Equals(lbls1), Equals, true)
+	c.Assert(lbls2.Equals(lbls2), Equals, true)
+	c.Assert(lbls2.Equals(lbls3), Equals, false) // inverted order
+	c.Assert(lbls2.Equals(lbls4), Equals, false) // different count
+	c.Assert(lbls2.Equals(lbls5), Equals, false)
+	c.Assert(lbls2.Equals(lbls6), Equals, false)
+
+	c.Assert(lbls3.Equals(lbls1), Equals, false)
+	c.Assert(lbls3.Equals(lbls2), Equals, false)
+	c.Assert(lbls3.Equals(lbls3), Equals, true)
+	c.Assert(lbls3.Equals(lbls4), Equals, false)
+	c.Assert(lbls3.Equals(lbls5), Equals, false)
+	c.Assert(lbls3.Equals(lbls6), Equals, false)
+
+	c.Assert(lbls4.Equals(lbls1), Equals, false)
+	c.Assert(lbls4.Equals(lbls2), Equals, false)
+	c.Assert(lbls4.Equals(lbls3), Equals, false)
+	c.Assert(lbls4.Equals(lbls4), Equals, true)
+	c.Assert(lbls4.Equals(lbls5), Equals, false)
+	c.Assert(lbls4.Equals(lbls6), Equals, false)
+
+	c.Assert(lbls5.Equals(lbls1), Equals, false)
+	c.Assert(lbls5.Equals(lbls2), Equals, false)
+	c.Assert(lbls5.Equals(lbls3), Equals, false)
+	c.Assert(lbls5.Equals(lbls4), Equals, false)
+	c.Assert(lbls5.Equals(lbls5), Equals, true)
+	c.Assert(lbls5.Equals(lbls6), Equals, false)
+
+	c.Assert(lbls6.Equals(lbls1), Equals, false)
+	c.Assert(lbls6.Equals(lbls2), Equals, false)
+	c.Assert(lbls6.Equals(lbls3), Equals, false)
+	c.Assert(lbls6.Equals(lbls4), Equals, false)
+	c.Assert(lbls6.Equals(lbls5), Equals, false)
+	c.Assert(lbls6.Equals(lbls6), Equals, true)
+}
+
+func (s *LabelsSuite) TestLess(c *C) {
+	// lbls1-lbls8 are defined in lexical order
+	lbls1 := LabelArray(nil)
+	lbls2 := LabelArray{
+		NewLabel("env", "devel", LabelSourceAny),
+	}
+	lbls3 := LabelArray{
+		NewLabel("env", "devel", LabelSourceReserved),
+	}
+	lbls4 := LabelArray{
+		NewLabel("env", "prod", LabelSourceAny),
+	}
+	lbls5 := LabelArray{
+		NewLabel("env", "prod", LabelSourceAny),
+		NewLabel("user", "bob", LabelSourceContainer),
+	}
+	lbls6 := LabelArray{
+		NewLabel("env", "prod", LabelSourceAny),
+		NewLabel("user", "bob", LabelSourceContainer),
+	}
+	lbls7 := LabelArray{
+		NewLabel("env", "prod", LabelSourceAny),
+		NewLabel("user", "bob", LabelSourceContainer),
+		NewLabel("xyz", "", LabelSourceAny),
+	}
+	lbls8 := LabelArray{
+		NewLabel("foo", "bar", LabelSourceAny),
+	}
+
+	c.Assert(lbls1.Less(lbls1), Equals, false)
+	c.Assert(lbls1.Less(lbls2), Equals, true)
+	c.Assert(lbls1.Less(lbls3), Equals, true)
+	c.Assert(lbls1.Less(lbls4), Equals, true)
+	c.Assert(lbls1.Less(lbls5), Equals, true)
+	c.Assert(lbls1.Less(lbls6), Equals, true)
+	c.Assert(lbls1.Less(lbls7), Equals, true)
+	c.Assert(lbls1.Less(lbls8), Equals, true)
+
+	c.Assert(lbls2.Less(lbls1), Equals, false)
+	c.Assert(lbls2.Less(lbls2), Equals, false)
+	c.Assert(lbls2.Less(lbls3), Equals, true)
+	c.Assert(lbls2.Less(lbls4), Equals, true)
+	c.Assert(lbls2.Less(lbls5), Equals, true)
+	c.Assert(lbls2.Less(lbls6), Equals, true)
+	c.Assert(lbls2.Less(lbls7), Equals, true)
+	c.Assert(lbls2.Less(lbls8), Equals, true)
+
+	c.Assert(lbls3.Less(lbls1), Equals, false)
+	c.Assert(lbls3.Less(lbls2), Equals, false)
+	c.Assert(lbls3.Less(lbls3), Equals, false)
+	c.Assert(lbls3.Less(lbls4), Equals, true)
+	c.Assert(lbls3.Less(lbls5), Equals, true)
+	c.Assert(lbls3.Less(lbls6), Equals, true)
+	c.Assert(lbls3.Less(lbls7), Equals, true)
+	c.Assert(lbls3.Less(lbls8), Equals, true)
+
+	c.Assert(lbls4.Less(lbls1), Equals, false)
+	c.Assert(lbls4.Less(lbls2), Equals, false)
+	c.Assert(lbls4.Less(lbls3), Equals, false)
+	c.Assert(lbls4.Less(lbls4), Equals, false)
+	c.Assert(lbls4.Less(lbls5), Equals, true)
+	c.Assert(lbls4.Less(lbls6), Equals, true)
+	c.Assert(lbls4.Less(lbls7), Equals, true)
+	c.Assert(lbls4.Less(lbls8), Equals, true)
+
+	c.Assert(lbls5.Less(lbls1), Equals, false)
+	c.Assert(lbls5.Less(lbls2), Equals, false)
+	c.Assert(lbls5.Less(lbls3), Equals, false)
+	c.Assert(lbls5.Less(lbls4), Equals, false)
+	c.Assert(lbls5.Less(lbls5), Equals, false)
+	c.Assert(lbls5.Less(lbls6), Equals, false)
+	c.Assert(lbls5.Less(lbls7), Equals, true)
+	c.Assert(lbls5.Less(lbls8), Equals, true)
+
+	c.Assert(lbls6.Less(lbls1), Equals, false)
+	c.Assert(lbls6.Less(lbls2), Equals, false)
+	c.Assert(lbls6.Less(lbls3), Equals, false)
+	c.Assert(lbls6.Less(lbls4), Equals, false)
+	c.Assert(lbls6.Less(lbls5), Equals, false)
+	c.Assert(lbls6.Less(lbls6), Equals, false)
+	c.Assert(lbls6.Less(lbls7), Equals, true)
+	c.Assert(lbls6.Less(lbls8), Equals, true)
+
+	c.Assert(lbls7.Less(lbls1), Equals, false)
+	c.Assert(lbls7.Less(lbls2), Equals, false)
+	c.Assert(lbls7.Less(lbls3), Equals, false)
+	c.Assert(lbls7.Less(lbls4), Equals, false)
+	c.Assert(lbls7.Less(lbls5), Equals, false)
+	c.Assert(lbls7.Less(lbls6), Equals, false)
+	c.Assert(lbls7.Less(lbls7), Equals, false)
+	c.Assert(lbls7.Less(lbls8), Equals, true)
+
+	c.Assert(lbls8.Less(lbls1), Equals, false)
+	c.Assert(lbls8.Less(lbls2), Equals, false)
+	c.Assert(lbls8.Less(lbls3), Equals, false)
+	c.Assert(lbls8.Less(lbls4), Equals, false)
+	c.Assert(lbls8.Less(lbls5), Equals, false)
+	c.Assert(lbls8.Less(lbls6), Equals, false)
+	c.Assert(lbls8.Less(lbls7), Equals, false)
+	c.Assert(lbls8.Less(lbls8), Equals, false)
 }
 
 // TestOutputConversions tests the various ways a LabelArray can be converted

pkg/labels/arraylist.go

@@ -14,6 +14,8 @@
 
 package labels
 
+import "sort"
+
 // LabelArrayList is an array of LabelArrays. It is primarily intended as a
 // simple collection
 type LabelArrayList []LabelArray
@@ -40,3 +42,27 @@ func (ls LabelArrayList) GetModel() [][]string {
 	}
 	return res
 }
+
+// Equals returns true if the label arrays lists have the same label arrays in the same order.
+func (ls LabelArrayList) Equals(b LabelArrayList) bool {
+	if len(ls) != len(b) {
+		return false
+	}
+	for l := range ls {
+		if !ls[l].Equals(b[l]) {
+			return false
+		}
+	}
+	return true
+}
+
+// Sort sorts the LabelArrayList in-place, but also returns the sorted list
+// for convenience. The LabelArrays themselves must already be sorted. This is
+// true for all constructors of LabelArray.
+func (ls LabelArrayList) Sort() LabelArrayList {
+	sort.Slice(ls, func(i, j int) bool {
+		return ls[i].Less(ls[j])
+	})
+
+	return ls
+}