Skip to content

Commit 71d037d

Browse files
zeekezeeke
committed
Give precendence to IPBlock field over PodSelector
As per API description [1]: > IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be." if a policy rule has a from/to rule with an IPBlock field, then the PodSelector and NamespaceSelector fields must be ignored. [1] https://github.com/k8snetworkplumbingwg/multi-networkpolicy/blob/master/scheme.yml#L88 Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
1 parent 845f77f commit 71d037d

File tree

2 files changed

+142
-9
lines changed

2 files changed

+142
-9
lines changed

‎pkg/server/policyrules.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -293,13 +293,13 @@ func (ipt *iptableBuffer) renderIngressFrom(s *Server, podInfo *controllers.PodI
293293

294294
s.podMap.Update(s.podChanges)
295295
for _, peer := range from {
296-
if peer.PodSelector != nil || peer.NamespaceSelector != nil {
297-
ipt.renderIngressFromSelector(s, podInfo, chainName, peer, policyNetworks)
296+
if peer.IPBlock != nil {
297+
ipt.renderIngressFromIPBlock(podInfo, chainName, peer, policyNetworks)
298298
continue
299299
}
300300

301-
if peer.IPBlock != nil {
302-
ipt.renderIngressFromIPBlock(podInfo, chainName, peer, policyNetworks)
301+
if peer.PodSelector != nil || peer.NamespaceSelector != nil {
302+
ipt.renderIngressFromSelector(s, podInfo, chainName, peer, policyNetworks)
303303
continue
304304
}
305305

@@ -537,13 +537,13 @@ func (ipt *iptableBuffer) renderEgressTo(s *Server, podInfo *controllers.PodInfo
537537

538538
s.podMap.Update(s.podChanges)
539539
for _, peer := range to {
540-
if peer.PodSelector != nil || peer.NamespaceSelector != nil {
541-
ipt.renderEgressToSelector(s, podInfo, chainName, peer, policyNetworks)
540+
if peer.IPBlock != nil {
541+
ipt.renderEgressToIPBlock(podInfo, chainName, peer, policyNetworks)
542542
continue
543543
}
544544

545-
if peer.IPBlock != nil {
546-
ipt.renderEgressToIPBlock(podInfo, chainName, peer, policyNetworks)
545+
if peer.PodSelector != nil || peer.NamespaceSelector != nil {
546+
ipt.renderEgressToSelector(s, podInfo, chainName, peer, policyNetworks)
547547
continue
548548
}
549549

‎pkg/server/policyrules_test.go‎

Lines changed: 134 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2041,7 +2041,6 @@ COMMIT
20412041
s.ip4Tables = result
20422042

20432043
s.generatePolicyRulesForPod(pod1, podInfo1)
2044-
fmt.Println(result.Dump.String())
20452044
Expect(result.Dump.String()).To(Equal(`*nat
20462045
:PREROUTING - [0:0]
20472046
:INPUT - [0:0]
@@ -2094,6 +2093,140 @@ COMMIT
20942093

20952094
})
20962095

2096+
It("ignore `podSelector` and `namespaceSelector` when IPBlock field is set", func() {
2097+
policy1 := &multiv1beta1.MultiNetworkPolicy{
2098+
ObjectMeta: metav1.ObjectMeta{
2099+
Name: "ipblock-override-policy",
2100+
Namespace: "testns1",
2101+
Annotations: map[string]string{
2102+
PolicyNetworkAnnotation: "net-attach1",
2103+
},
2104+
},
2105+
Spec: multiv1beta1.MultiNetworkPolicySpec{
2106+
PodSelector: metav1.LabelSelector{
2107+
MatchLabels: map[string]string{
2108+
"role": "targetpod",
2109+
},
2110+
},
2111+
Ingress: []multiv1beta1.MultiNetworkPolicyIngressRule{{
2112+
From: []multiv1beta1.MultiNetworkPolicyPeer{{
2113+
IPBlock: &multiv1beta1.IPBlock{
2114+
CIDR: "1.1.1.0/16",
2115+
Except: []string{"1.1.1.1"},
2116+
},
2117+
PodSelector: &metav1.LabelSelector{
2118+
MatchLabels: map[string]string{"tobe": "ignored"},
2119+
},
2120+
NamespaceSelector: &metav1.LabelSelector{
2121+
MatchLabels: map[string]string{"tobe": "ignored"},
2122+
},
2123+
}},
2124+
}},
2125+
Egress: []multiv1beta1.MultiNetworkPolicyEgressRule{{
2126+
To: []multiv1beta1.MultiNetworkPolicyPeer{{
2127+
IPBlock: &multiv1beta1.IPBlock{
2128+
CIDR: "2.2.2.0/16",
2129+
Except: []string{"2.2.2.2"},
2130+
},
2131+
PodSelector: &metav1.LabelSelector{
2132+
MatchLabels: map[string]string{"tobe": "ignored"},
2133+
},
2134+
NamespaceSelector: &metav1.LabelSelector{
2135+
MatchLabels: map[string]string{"tobe": "ignored"},
2136+
},
2137+
}},
2138+
}},
2139+
},
2140+
}
2141+
2142+
s := NewFakeServer("samplehost")
2143+
Expect(s).NotTo(BeNil())
2144+
2145+
AddNamespace(s, "testns1")
2146+
2147+
Expect(
2148+
s.netdefChanges.Update(nil, NewNetDef("testns1", "net-attach1", NewCNIConfig("testCNI", "multi"))),
2149+
).To(BeTrue())
2150+
2151+
pod1 := NewFakePodWithNetAnnotation(
2152+
"testns1",
2153+
"testpod1",
2154+
"net-attach1",
2155+
NewFakeNetworkStatus("testns1", "net-attach1", "192.168.1.1", "10.1.1.1"),
2156+
map[string]string{
2157+
"role": "targetpod",
2158+
})
2159+
pod1.Spec.NodeName = "samplehost"
2160+
2161+
AddPod(s, pod1)
2162+
podInfo1, err := s.podMap.GetPodInfo(pod1)
2163+
Expect(err).NotTo(HaveOccurred())
2164+
2165+
Expect(
2166+
s.policyChanges.Update(nil, policy1),
2167+
).To(BeTrue())
2168+
s.policyMap.Update(s.policyChanges)
2169+
2170+
result := fakeiptables.NewFake()
2171+
s.ip4Tables = result
2172+
2173+
s.generatePolicyRulesForPod(pod1, podInfo1)
2174+
Expect(result.Dump.String()).To(Equal(`*nat
2175+
:PREROUTING - [0:0]
2176+
:INPUT - [0:0]
2177+
:OUTPUT - [0:0]
2178+
:POSTROUTING - [0:0]
2179+
-A PREROUTING -i net1 -j RETURN
2180+
COMMIT
2181+
*filter
2182+
:INPUT - [0:0]
2183+
:FORWARD - [0:0]
2184+
:OUTPUT - [0:0]
2185+
:MULTI-INGRESS - [0:0]
2186+
:MULTI-EGRESS - [0:0]
2187+
:MULTI-INGRESS-COMMON - [0:0]
2188+
:MULTI-EGRESS-COMMON - [0:0]
2189+
:MULTI-0-INGRESS - [0:0]
2190+
:MULTI-0-INGRESS-0-PORTS - [0:0]
2191+
:MULTI-0-INGRESS-0-FROM - [0:0]
2192+
:MULTI-0-EGRESS - [0:0]
2193+
:MULTI-0-EGRESS-0-PORTS - [0:0]
2194+
:MULTI-0-EGRESS-0-TO - [0:0]
2195+
-A INPUT -i net1 -j MULTI-INGRESS
2196+
-A OUTPUT -o net1 -j MULTI-EGRESS
2197+
-A MULTI-INGRESS -j MULTI-INGRESS-COMMON
2198+
-A MULTI-INGRESS -m comment --comment "policy:ipblock-override-policy net-attach-def:testns1/net-attach1" -i net1 -j MULTI-0-INGRESS
2199+
-A MULTI-INGRESS -m mark --mark 0x30000/0x30000 -j RETURN
2200+
-A MULTI-INGRESS -j DROP
2201+
-A MULTI-EGRESS -j MULTI-EGRESS-COMMON
2202+
-A MULTI-EGRESS -m comment --comment "policy:ipblock-override-policy net-attach-def:testns1/net-attach1" -o net1 -j MULTI-0-EGRESS
2203+
-A MULTI-EGRESS -m mark --mark 0x30000/0x30000 -j RETURN
2204+
-A MULTI-EGRESS -j DROP
2205+
-A MULTI-INGRESS-COMMON -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
2206+
-A MULTI-EGRESS-COMMON -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
2207+
-A MULTI-0-INGRESS -j MARK --set-xmark 0x0/0x30000
2208+
-A MULTI-0-INGRESS -j MULTI-0-INGRESS-0-PORTS
2209+
-A MULTI-0-INGRESS -j MULTI-0-INGRESS-0-FROM
2210+
-A MULTI-0-INGRESS -m mark --mark 0x30000/0x30000 -j RETURN
2211+
-A MULTI-0-INGRESS-0-PORTS -m comment --comment "no ingress ports, skipped" -j MARK --set-xmark 0x10000/0x10000
2212+
-A MULTI-0-INGRESS-0-FROM -i net1 -s 1.1.1.1 -j DROP
2213+
-A MULTI-0-INGRESS-0-FROM -i net1 -s 1.1.1.0/16 -j MARK --set-xmark 0x20000/0x20000
2214+
-A MULTI-0-INGRESS-0-FROM -i net1 -s 10.1.1.1 -j MARK --set-xmark 0x20000/0x20000
2215+
-A MULTI-0-EGRESS -j MARK --set-xmark 0x0/0x30000
2216+
-A MULTI-0-EGRESS -j MULTI-0-EGRESS-0-PORTS
2217+
-A MULTI-0-EGRESS -j MULTI-0-EGRESS-0-TO
2218+
-A MULTI-0-EGRESS -m mark --mark 0x30000/0x30000 -j RETURN
2219+
-A MULTI-0-EGRESS-0-PORTS -m comment --comment "no egress ports, skipped" -j MARK --set-xmark 0x10000/0x10000
2220+
-A MULTI-0-EGRESS-0-TO -o net1 -d 2.2.2.2 -j DROP
2221+
-A MULTI-0-EGRESS-0-TO -o net1 -d 2.2.2.0/16 -j MARK --set-xmark 0x20000/0x20000
2222+
-A MULTI-0-EGRESS-0-TO -o net1 -d 10.1.1.1 -j MARK --set-xmark 0x20000/0x20000
2223+
COMMIT
2224+
*mangle
2225+
COMMIT
2226+
`))
2227+
2228+
})
2229+
20972230
Context("IPv6", func() {
20982231
It("shoud avoid using IPv4 addresses on ip6tables", func() {
20992232

0 commit comments

Comments
 (0)