Add a Nets field, deprecate the Net field. #470
Conversation
fasaxc
force-pushed
the
multi-nets-2
branch
3 times, most recently
from
89c84fd
to
d22bc15
Compare
|
@robbrockbank think I prefer this. WDYT? |
| @@ -128,3 +139,28 @@ type EntityRule struct { | |||
| // Protocol match in the Rule to be set to "tcp" or "udp". | |||
| NotPorts []numorstring.Port `json:"notPorts,omitempty" validate:"omitempty,dive"` | |||
| } | |||
|
|
|||
| func combineNets(n *net.IPNet, nets []*net.IPNet) []*net.IPNet { | |||
There was a problem hiding this comment.
Is there a requirement to support both nets and net on the same object?
Maybe we could simplify this by just validating that only one of net and nets is provided - might also be useful as a way to get users to drop using the deprecated field (they need to stop using it in order to use the new feature) so that there's less pain when that field is dropped some day in the future.
There was a problem hiding this comment.
Yup I agree - I think I'd suggested similar on the other PR :-)
There was a problem hiding this comment.
@robbrockbank That was the approach I took, the validation function for the front-end does do that so a normal user shouldn't be able to hit this. I thought it was better to have felix tolerate having both in the backend though; no point dropping a policy on the floor if it has a fairly sensible interpretation.
lib/api/rule.go
Outdated
| } | ||
|
|
||
| // GetNets returns either r.Nets or a slice containing r.Net. It is useful for unifying the | ||
| // two representations. If both values are specified, it joins them together. |
There was a problem hiding this comment.
I don't think the "If both values are specified" sentence should be there since it shouldn't be possible to have that and it sounds like we are encouraging the use of both.
lib/backend/model/rule.go
Outdated
| toParts = append(toParts, "cidr", joinNets(dstNets)) | ||
| } | ||
| if len(r.NotDstPorts) > 0 { | ||
| NotDstPorts := make([]string, len(r.NotDstPorts)) |
There was a problem hiding this comment.
NotDstPorts -> notDstPorts
| structLevel.ReportError(reflect.ValueOf(rule.Source.Net), "Source.Net", | ||
| "", reason("rule contains an IP version that does not match src CIDR version")) | ||
| } | ||
| // Check that only one of the net or nets fields is specified. |
There was a problem hiding this comment.
Given our desire to ween people off the singular, I wonder if we should be a little more strict and reject if there is a mix of any of the Net and Nets fields (e.g. Source.Net && Dest.NotNets)
WDYT?
|
A couple of minor comments, and branch needs updating. Otherwise LGTM. |
| // NotNet is the negated version of the Net field. | ||
| // NotNet is an optional field that restricts the rule to only apply to traffic that | ||
| // does not originate from (or terminate at) an IP address in the given subnet. | ||
| // Deprecated: superseded by NotNets. |
There was a problem hiding this comment.
Spurred by the conversation in slack - is there a good place to add a warning log when users use Nets, so we can indicate that it's deprecated?
|
@caseydavenport How about this: 0886ade |
|
@fasaxc that LGTM - sorry for the last minute comment :p |
…ctcalico#470) Co-authored-by: Alina Militaru <asincu@users.noreply.github.com>
projectcalico#470)" (#477) This reverts commit e0e826f.
Description
Alternative approach to allowing multiple nets in a rule.
Todos
Release Note