Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd: enhance cilium bpf policy list&get #25389

Merged
merged 3 commits into from May 18, 2023
Merged

cmd: enhance cilium bpf policy list&get #25389

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a778774
cmd: proper JSON/YAML output when listing all policy maps
mhofstetter May 11, 2023
8293b95
cmd: explicitly print Endpoint ID before policy map content
mhofstetter May 11, 2023
858db3c
cmd: add auth type to cilium bpf policy get/list
mhofstetter May 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
92 changes: 62 additions & 30 deletions cilium/cmd/bpf_policy_get.go
View file
Open in desktop
Expand Up @@ -10,6 +10,7 @@ import (
"path/filepath"
"sort"
"strconv"
"strings"
"text/tabwriter"

"github.com/spf13/cobra"
Expand All @@ -20,6 +21,7 @@ import (
"github.com/cilium/cilium/pkg/identity"
identitymodel "github.com/cilium/cilium/pkg/identity/model"
"github.com/cilium/cilium/pkg/maps/policymap"
"github.com/cilium/cilium/pkg/policy"
"github.com/cilium/cilium/pkg/policy/trafficdirection"
)

Expand Down Expand Up @@ -64,13 +66,37 @@ func listAllMaps() {
return
}

maps := []policyMap{}
for _, file := range matchFiles {
fmt.Printf("%s:\n", file)
fmt.Println()
dumpMap(file)
fmt.Println()
fmt.Println()
endpointSplit := strings.Split(file, "_")
endpoint := strings.TrimLeft(endpointSplit[len(endpointSplit)-1], "0")
maps = append(maps, policyMap{
EndpointID: endpoint,
Path: file,
Content: mapContent(file),
})
}

if command.OutputOption() {
if err := command.PrintOutput(maps); err != nil {
os.Exit(1)
}
} else {
for _, m := range maps {
fmt.Printf("Endpoint ID: %s\n", m.EndpointID)
fmt.Printf("Path: %s\n", m.Path)
fmt.Println()
printTable(m.Content)
fmt.Println()
fmt.Println()
}
}
}

type policyMap struct {
EndpointID string
Path string
Content policymap.PolicyEntriesDump
}

func listMap(args []string) {
Expand All @@ -80,10 +106,18 @@ func listMap(args []string) {
if err != nil {
Fatalf("Failed to parse endpointID %q", lbl)
}
dumpMap(mapPath)

contentDump := mapContent(mapPath)
if command.OutputOption() {
if err := command.PrintOutput(contentDump); err != nil {
os.Exit(1)
}
} else {
printTable(contentDump)
}
}

func dumpMap(file string) {
func mapContent(file string) policymap.PolicyEntriesDump {
m, err := policymap.Open(file)
if err != nil {
Fatalf("Failed to open map: %s\n", err)
Expand All @@ -96,19 +130,16 @@ func dumpMap(file string) {
}
sort.Slice(statsMap, statsMap.Less)

if command.OutputOption() {
if err := command.PrintOutput(statsMap); err != nil {
os.Exit(1)
}
} else {
w := tabwriter.NewWriter(os.Stdout, 5, 0, 3, ' ', 0)
formatMap(w, statsMap)
w.Flush()
if len(statsMap) == 0 {
fmt.Printf("Policy stats empty. Perhaps the policy enforcement is disabled?\n")
}
}
return statsMap
}

func printTable(contentDump policymap.PolicyEntriesDump) {
w := tabwriter.NewWriter(os.Stdout, 5, 0, 3, ' ', 0)
formatMap(w, contentDump)
w.Flush()
if len(contentDump) == 0 {
fmt.Printf("Policy stats empty. Perhaps the policy enforcement is disabled?\n")
}
}

func formatMap(w io.Writer, statsMap []policymap.PolicyEntryDump) {
Expand All @@ -119,6 +150,7 @@ func formatMap(w io.Writer, statsMap []policymap.PolicyEntryDump) {
labelsDesTitle = "LABELS (source:key[=value])"
portTitle = "PORT/PROTO"
proxyPortTitle = "PROXY PORT"
authTypeTitle = "AUTH TYPE"
bytesTitle = "BYTES"
packetsTitle = "PACKETS"
prefixTitle = "PREFIX"
Expand All @@ -139,11 +171,11 @@ func formatMap(w io.Writer, statsMap []policymap.PolicyEntryDump) {
}

if printIDs {
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\n",
policyTitle, trafficDirectionTitle, labelsIDTitle, portTitle, proxyPortTitle, bytesTitle, packetsTitle, prefixTitle)
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\n",
policyTitle, trafficDirectionTitle, labelsIDTitle, portTitle, proxyPortTitle, authTypeTitle, bytesTitle, packetsTitle, prefixTitle)
} else {
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\n",
policyTitle, trafficDirectionTitle, labelsDesTitle, portTitle, proxyPortTitle, bytesTitle, packetsTitle, prefixTitle)
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\n",
policyTitle, trafficDirectionTitle, labelsDesTitle, portTitle, proxyPortTitle, authTypeTitle, bytesTitle, packetsTitle, prefixTitle)
}
for _, stat := range statsMap {
prefixLen := stat.Key.Prefixlen - policymap.StaticPrefixBits
Expand All @@ -163,22 +195,22 @@ func formatMap(w io.Writer, statsMap []policymap.PolicyEntryDump) {
policyStr = "Allow"
}
if printIDs {
fmt.Fprintf(w, "%s\t%s\t%d\t%s\t%s\t%d\t%d\t%d\t\n",
policyStr, trafficDirectionString, id, port, proxyPort, stat.Bytes, stat.Packets, prefixLen)
fmt.Fprintf(w, "%s\t%s\t%d\t%s\t%s\t%s\t%d\t%d\t%d\t\n",
policyStr, trafficDirectionString, id, port, proxyPort, policy.AuthType(stat.AuthType), stat.Bytes, stat.Packets, prefixLen)
} else if lbls := labelsID[id]; lbls != nil && len(lbls.Labels) > 0 {
first := true
for _, lbl := range lbls.Labels.GetPrintableModel() {
if first {
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%d\t%d\t%d\t\n",
policyStr, trafficDirectionString, lbl, port, proxyPort, stat.Bytes, stat.Packets, prefixLen)
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%d\t%d\t%d\t\n",
policyStr, trafficDirectionString, lbl, port, proxyPort, policy.AuthType(stat.AuthType), stat.Bytes, stat.Packets, prefixLen)
first = false
} else {
fmt.Fprintf(w, "\t\t%s\t\t\t\t\t\t\n", lbl)
fmt.Fprintf(w, "\t\t%s\t\t\t\t\t\t\t\n", lbl)
}
}
} else {
fmt.Fprintf(w, "%s\t%s\t%d\t%s\t%s\t%d\t%d\t%d\t\n",
policyStr, trafficDirectionString, id, port, proxyPort, stat.Bytes, stat.Packets, prefixLen)
fmt.Fprintf(w, "%s\t%s\t%d\t%s\t%s\t%s\t%d\t%d\t%d\t\n",
policyStr, trafficDirectionString, id, port, proxyPort, policy.AuthType(stat.AuthType), stat.Bytes, stat.Packets, prefixLen)
}
}
}