enable network policies strict mode #268
+711
−46
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: allow-all-ingress | ||
| spec: | ||
| podSelector: {} | ||
| ingress: | ||
| - {} | ||
| policyTypes: | ||
| - Ingress |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: default-deny-all | ||
| spec: | ||
| podSelector: {} | ||
| policyTypes: | ||
| - Ingress | ||
| - Egress |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| package dataplane | ||
|
|
||
| import ( | ||
| "encoding/binary" | ||
|
|
||
| "github.com/vishvananda/netlink" | ||
| "golang.org/x/sys/unix" | ||
| v1 "k8s.io/api/core/v1" | ||
| "k8s.io/klog/v2" | ||
| "sigs.k8s.io/kube-network-policies/pkg/network" | ||
| ) | ||
|
|
||
| var ( | ||
| mapIPFamilyToString = map[uint8]v1.IPFamily{ | ||
| unix.AF_INET: v1.IPv4Protocol, | ||
| unix.AF_INET6: v1.IPv6Protocol, | ||
| } | ||
| mapProtocolToString = map[uint8]v1.Protocol{ | ||
| unix.IPPROTO_TCP: v1.ProtocolTCP, | ||
| unix.IPPROTO_UDP: v1.ProtocolUDP, | ||
| unix.IPPROTO_SCTP: v1.ProtocolSCTP, | ||
| } | ||
| ) | ||
|
|
||
| func PacketFromFlow(flow *netlink.ConntrackFlow) *network.Packet { | ||
| if flow == nil { | ||
| return nil | ||
| } | ||
| packet := network.Packet{ | ||
| SrcIP: flow.Forward.SrcIP, | ||
| DstIP: flow.Reverse.SrcIP, | ||
| SrcPort: int(flow.Forward.SrcPort), | ||
| DstPort: int(flow.Reverse.SrcPort), | ||
| } | ||
|
|
||
| if family, ok := mapIPFamilyToString[flow.FamilyType]; ok { | ||
| packet.Family = family | ||
| } else { | ||
| klog.InfoS("Unknown IP family", "family", flow.FamilyType, "flow", flow) | ||
| return nil | ||
| } | ||
|
|
||
| if protocol, ok := mapProtocolToString[flow.Forward.Protocol]; ok { | ||
| packet.Proto = protocol | ||
| } else { | ||
| klog.InfoS("Unknown protocol", "protocol", flow.Forward.Protocol, "flow", flow) | ||
| return nil | ||
| } | ||
|
|
||
| return &packet | ||
| } | ||
|
|
||
| // generateLabelMask converts an integer (bit index 0-127) into a 16-byte | ||
| // slice ([]byte) representing the 128-bit mask. If the bit index is out of range, | ||
| // it returns a 16-byte slice of all zeros. It expects bit index to be in the range 0-127. | ||
| func generateLabelMask(bitIndex int) []byte { | ||
| if bitIndex < 0 || bitIndex > 127 { | ||
| return make([]byte, 16) | ||
| } | ||
| // word64Index 0: Bits 0-63 (LSW 64 bits) | ||
| // word64Index 1: Bits 64-127 (MSW 64 bits) | ||
| word64Index := bitIndex / 64 | ||
| bitPos := uint(bitIndex % 64) | ||
| mask := uint64(1) << bitPos | ||
|
|
||
| result := make([]byte, 16) | ||
|
There was a problem hiding this comment. could do this at the top and then you'd be able to |
||
| if word64Index == 1 { | ||
| // Bit is in the MSW (96-127), serialize the mask into the first 8 bytes. | ||
| binary.BigEndian.PutUint64(result[0:], mask) | ||
| } else { | ||
| // Bit is in the LSW (0-63), serialize the mask into the last 8 bytes. | ||
| binary.BigEndian.PutUint64(result[8:], mask) | ||
| } | ||
|
There was a problem hiding this comment. You don't need to use byteIndex := bitIndex / 8
bitPos := uint(bitIndex % 8)
mask := uint8(1) << bitPos
result[byteIndex] = maskThere was a problem hiding this comment. that gives me the returned value in the reverse order, I think is the oppsite "endianess" |
||
|
|
||
| return result | ||
| } | ||
|
|
||
| // clearLabelBit clears a specific bit in a 16-byte label array and returns a new array. | ||
| func clearLabelBit(currentLabel []byte, bitIndex int) []byte { | ||
| newLabel := make([]byte, 16) | ||
| if len(currentLabel) != 16 { | ||
| return newLabel | ||
| } | ||
|
|
||
| copy(newLabel, currentLabel) | ||
|
|
||
| if bitIndex < 0 || bitIndex > 127 { | ||
| return newLabel | ||
| } | ||
|
|
||
| // Determine which 64-bit word the bit falls into. | ||
| // word64Index 0: Bits 0-63 (LSW) | ||
| // word64Index 1: Bits 64-127 (MSW) | ||
| word64Index := bitIndex / 64 | ||
|
|
||
| // Determine the bit position within that 64-bit word (0-63). | ||
| bitPos := uint(bitIndex % 64) | ||
|
|
||
| // Create the 64-bit mask for clearing. | ||
| // ^(1 << bitPos) results in a mask that is all 1s except for a single 0 at the target bitPos. | ||
| zeroMask := ^(uint64(1) << bitPos) | ||
|
|
||
| // The 16-byte array is Big-Endian: MSW (first 8 bytes), LSW (last 8 bytes). | ||
| var targetStartIndex int | ||
|
|
||
| if word64Index == 1 { | ||
| // Bit is in the MSW (Bits 64-127), located in the first 8 bytes. | ||
| targetStartIndex = 0 | ||
| } else { | ||
| // Bit is in the LSW (Bits 0-63), located in the last 8 bytes. | ||
| targetStartIndex = 8 | ||
| } | ||
|
|
||
| // 3. Extract the target 64-bit word from the new array. | ||
| currentWord := binary.BigEndian.Uint64(newLabel[targetStartIndex:]) | ||
|
|
||
| // 4. Apply the AND operation: currentWord &= zeroMask. | ||
| // This clears the single bit while preserving all others in the word. | ||
| newWord := currentWord & zeroMask | ||
|
|
||
| // 5. Write the modified 64-bit word back into the new array. | ||
| binary.BigEndian.PutUint64(newLabel[targetStartIndex:], newWord) | ||
|
There was a problem hiding this comment. byteIndex := bitIndex / 8
bitPos := uint(bitIndex % 8)
mask := uint8(1) << bitPos
newLabel[byteIndex] ^&= mask |
||
|
|
||
| return newLabel | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.