Skip to content

Commit 0c8f78a

Browse files
QxBytesQxBytes
authored
refactor: add receiver to iptables and create interface (#2421)
* Move network utils functions with iptables to new file * Add receiver to iptables and create interface * Resolve conflicts from rebasing * Add changes for building on windows * Address linter issues * Address windows linter issues * Invert if condition for linter nesting * Scope iptables interfaces to package * Rename iptables client to avoid stuttering * Move EnableIPForwarding to snat linux * Rename ipTablesClientInterface to ipTablesClient * Address linter issues from moving enable ip forwarding function * Rename after rebase
1 parent 8798f10 commit 0c8f78a

20 files changed

+195
-133
lines changed

‎cni/network/invoker_cns.go

+11-10
Original file line numberDiff line numberDiff line change
@@ -227,25 +227,26 @@ func setHostOptions(ncSubnetPrefix *net.IPNet, options map[string]interface{}, i
227227
// we need to snat IMDS traffic to node IP, this sets up snat '--to'
228228
snatHostIPJump := fmt.Sprintf("%s --to %s", iptables.Snat, info.hostPrimaryIP)
229229

230+
iptablesClient := iptables.NewClient()
230231
var iptableCmds []iptables.IPTableEntry
231-
if !iptables.ChainExists(iptables.V4, iptables.Nat, iptables.Swift) {
232-
iptableCmds = append(iptableCmds, iptables.GetCreateChainCmd(iptables.V4, iptables.Nat, iptables.Swift))
232+
if !iptablesClient.ChainExists(iptables.V4, iptables.Nat, iptables.Swift) {
233+
iptableCmds = append(iptableCmds, iptablesClient.GetCreateChainCmd(iptables.V4, iptables.Nat, iptables.Swift))
233234
}
234235

235-
if !iptables.RuleExists(iptables.V4, iptables.Nat, iptables.Postrouting, "", iptables.Swift) {
236-
iptableCmds = append(iptableCmds, iptables.GetAppendIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Postrouting, "", iptables.Swift))
236+
if !iptablesClient.RuleExists(iptables.V4, iptables.Nat, iptables.Postrouting, "", iptables.Swift) {
237+
iptableCmds = append(iptableCmds, iptablesClient.GetAppendIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Postrouting, "", iptables.Swift))
237238
}
238239

239-
if !iptables.RuleExists(iptables.V4, iptables.Nat, iptables.Swift, azureDNSUDPMatch, snatPrimaryIPJump) {
240-
iptableCmds = append(iptableCmds, iptables.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureDNSUDPMatch, snatPrimaryIPJump))
240+
if !iptablesClient.RuleExists(iptables.V4, iptables.Nat, iptables.Swift, azureDNSUDPMatch, snatPrimaryIPJump) {
241+
iptableCmds = append(iptableCmds, iptablesClient.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureDNSUDPMatch, snatPrimaryIPJump))
241242
}
242243

243-
if !iptables.RuleExists(iptables.V4, iptables.Nat, iptables.Swift, azureDNSTCPMatch, snatPrimaryIPJump) {
244-
iptableCmds = append(iptableCmds, iptables.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureDNSTCPMatch, snatPrimaryIPJump))
244+
if !iptablesClient.RuleExists(iptables.V4, iptables.Nat, iptables.Swift, azureDNSTCPMatch, snatPrimaryIPJump) {
245+
iptableCmds = append(iptableCmds, iptablesClient.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureDNSTCPMatch, snatPrimaryIPJump))
245246
}
246247

247-
if !iptables.RuleExists(iptables.V4, iptables.Nat, iptables.Swift, azureIMDSMatch, snatHostIPJump) {
248-
iptableCmds = append(iptableCmds, iptables.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureIMDSMatch, snatHostIPJump))
248+
if !iptablesClient.RuleExists(iptables.V4, iptables.Nat, iptables.Swift, azureIMDSMatch, snatHostIPJump) {
249+
iptableCmds = append(iptableCmds, iptablesClient.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureIMDSMatch, snatHostIPJump))
249250
}
250251

251252
options[network.IPTablesKey] = iptableCmds

‎cni/network/network.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ func NewPlugin(name string,
117117

118118
nl := netlink.NewNetlink()
119119
// Setup network manager.
120-
nm, err := network.NewNetworkManager(nl, platform.NewExecClient(logger), &netio.NetIO{}, network.NewNamespaceClient())
120+
nm, err := network.NewNetworkManager(nl, platform.NewExecClient(logger), &netio.NetIO{}, network.NewNamespaceClient(), iptables.NewClient())
121121
if err != nil {
122122
return nil, err
123123
}

‎cnm/network/network.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/Azure/azure-container-networking/cnm"
1212
cnsclient "github.com/Azure/azure-container-networking/cns/client"
1313
"github.com/Azure/azure-container-networking/common"
14+
"github.com/Azure/azure-container-networking/iptables"
1415
"github.com/Azure/azure-container-networking/log"
1516
"github.com/Azure/azure-container-networking/netio"
1617
"github.com/Azure/azure-container-networking/netlink"
@@ -53,7 +54,7 @@ func NewPlugin(config *common.PluginConfig) (NetPlugin, error) {
5354

5455
nl := netlink.NewNetlink()
5556
// Setup network manager.
56-
nm, err := network.NewNetworkManager(nl, platform.NewExecClient(nil), &netio.NetIO{}, network.NewNamespaceClient())
57+
nm, err := network.NewNetworkManager(nl, platform.NewExecClient(nil), &netio.NetIO{}, network.NewNamespaceClient(), iptables.NewClient())
5758
if err != nil {
5859
return nil, err
5960
}

‎cnms/service/networkmonitor.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
cnms "github.com/Azure/azure-container-networking/cnms/cnmspackage"
1212
acn "github.com/Azure/azure-container-networking/common"
13+
"github.com/Azure/azure-container-networking/iptables"
1314
"github.com/Azure/azure-container-networking/log"
1415
"github.com/Azure/azure-container-networking/netio"
1516
"github.com/Azure/azure-container-networking/netlink"
@@ -157,7 +158,7 @@ func main() {
157158
}
158159

159160
nl := netlink.NewNetlink()
160-
nm, err := network.NewNetworkManager(nl, platform.NewExecClient(nil), &netio.NetIO{}, network.NewNamespaceClient())
161+
nm, err := network.NewNetworkManager(nl, platform.NewExecClient(nil), &netio.NetIO{}, network.NewNamespaceClient(), iptables.NewClient())
161162
if err != nil {
162163
log.Printf("[monitor] Failed while creating network manager")
163164
return

‎iptables/iptables.go

+28-22
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,14 @@ type IPTableEntry struct {
8787
Params string
8888
}
8989

90+
type Client struct{}
91+
92+
func NewClient() *Client {
93+
return &Client{}
94+
}
95+
9096
// Run iptables command
91-
func RunCmd(version, params string) error {
97+
func (c *Client) RunCmd(version, params string) error {
9298
var cmd string
9399

94100
p := platform.NewExecClient(logger)
@@ -111,29 +117,29 @@ func RunCmd(version, params string) error {
111117
}
112118

113119
// check if iptable chain alreay exists
114-
func ChainExists(version, tableName, chainName string) bool {
120+
func (c *Client) ChainExists(version, tableName, chainName string) bool {
115121
params := fmt.Sprintf("-t %s -L %s", tableName, chainName)
116-
if err := RunCmd(version, params); err != nil {
122+
if err := c.RunCmd(version, params); err != nil {
117123
return false
118124
}
119125

120126
return true
121127
}
122128

123-
func GetCreateChainCmd(version, tableName, chainName string) IPTableEntry {
129+
func (c *Client) GetCreateChainCmd(version, tableName, chainName string) IPTableEntry {
124130
return IPTableEntry{
125131
Version: version,
126132
Params: fmt.Sprintf("-t %s -N %s", tableName, chainName),
127133
}
128134
}
129135

130136
// create new iptable chain under specified table name
131-
func CreateChain(version, tableName, chainName string) error {
137+
func (c *Client) CreateChain(version, tableName, chainName string) error {
132138
var err error
133139

134-
if !ChainExists(version, tableName, chainName) {
135-
cmd := GetCreateChainCmd(version, tableName, chainName)
136-
err = RunCmd(version, cmd.Params)
140+
if !c.ChainExists(version, tableName, chainName) {
141+
cmd := c.GetCreateChainCmd(version, tableName, chainName)
142+
err = c.RunCmd(version, cmd.Params)
137143
} else {
138144
logger.Info("Chain exists in table", zap.String("chainName", chainName), zap.String("tableName", tableName))
139145
}
@@ -142,52 +148,52 @@ func CreateChain(version, tableName, chainName string) error {
142148
}
143149

144150
// check if iptable rule alreay exists
145-
func RuleExists(version, tableName, chainName, match, target string) bool {
151+
func (c *Client) RuleExists(version, tableName, chainName, match, target string) bool {
146152
params := fmt.Sprintf("-t %s -C %s %s -j %s", tableName, chainName, match, target)
147-
if err := RunCmd(version, params); err != nil {
153+
if err := c.RunCmd(version, params); err != nil {
148154
return false
149155
}
150156
return true
151157
}
152158

153-
func GetInsertIptableRuleCmd(version, tableName, chainName, match, target string) IPTableEntry {
159+
func (c *Client) GetInsertIptableRuleCmd(version, tableName, chainName, match, target string) IPTableEntry {
154160
return IPTableEntry{
155161
Version: version,
156162
Params: fmt.Sprintf("-t %s -I %s 1 %s -j %s", tableName, chainName, match, target),
157163
}
158164
}
159165

160166
// Insert iptable rule at beginning of iptable chain
161-
func InsertIptableRule(version, tableName, chainName, match, target string) error {
162-
if RuleExists(version, tableName, chainName, match, target) {
167+
func (c *Client) InsertIptableRule(version, tableName, chainName, match, target string) error {
168+
if c.RuleExists(version, tableName, chainName, match, target) {
163169
logger.Info("Rule already exists")
164170
return nil
165171
}
166172

167-
cmd := GetInsertIptableRuleCmd(version, tableName, chainName, match, target)
168-
return RunCmd(version, cmd.Params)
173+
cmd := c.GetInsertIptableRuleCmd(version, tableName, chainName, match, target)
174+
return c.RunCmd(version, cmd.Params)
169175
}
170176

171-
func GetAppendIptableRuleCmd(version, tableName, chainName, match, target string) IPTableEntry {
177+
func (c *Client) GetAppendIptableRuleCmd(version, tableName, chainName, match, target string) IPTableEntry {
172178
return IPTableEntry{
173179
Version: version,
174180
Params: fmt.Sprintf("-t %s -A %s %s -j %s", tableName, chainName, match, target),
175181
}
176182
}
177183

178184
// Append iptable rule at end of iptable chain
179-
func AppendIptableRule(version, tableName, chainName, match, target string) error {
180-
if RuleExists(version, tableName, chainName, match, target) {
185+
func (c *Client) AppendIptableRule(version, tableName, chainName, match, target string) error {
186+
if c.RuleExists(version, tableName, chainName, match, target) {
181187
logger.Info("Rule already exists")
182188
return nil
183189
}
184190

185-
cmd := GetAppendIptableRuleCmd(version, tableName, chainName, match, target)
186-
return RunCmd(version, cmd.Params)
191+
cmd := c.GetAppendIptableRuleCmd(version, tableName, chainName, match, target)
192+
return c.RunCmd(version, cmd.Params)
187193
}
188194

189195
// Delete matched iptable rule
190-
func DeleteIptableRule(version, tableName, chainName, match, target string) error {
196+
func (c *Client) DeleteIptableRule(version, tableName, chainName, match, target string) error {
191197
params := fmt.Sprintf("-t %s -D %s %s -j %s", tableName, chainName, match, target)
192-
return RunCmd(version, params)
198+
return c.RunCmd(version, params)
193199
}

‎network/endpoint.go

+6-3
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,7 @@ func (nw *network) newEndpoint(
140140
plc platform.ExecClient,
141141
netioCli netio.NetIOInterface,
142142
nsc NamespaceClientInterface,
143+
iptc ipTablesClient,
143144
epInfo []*EndpointInfo,
144145
) (*endpoint, error) {
145146
var ep *endpoint
@@ -153,7 +154,7 @@ func (nw *network) newEndpoint(
153154

154155
// Call the platform implementation.
155156
// Pass nil for epClient and will be initialized in newendpointImpl
156-
ep, err = nw.newEndpointImpl(apipaCli, nl, plc, netioCli, nil, nsc, epInfo)
157+
ep, err = nw.newEndpointImpl(apipaCli, nl, plc, netioCli, nil, nsc, iptc, epInfo)
157158
if err != nil {
158159
return nil, err
159160
}
@@ -164,7 +165,9 @@ func (nw *network) newEndpoint(
164165
}
165166

166167
// DeleteEndpoint deletes an existing endpoint from the network.
167-
func (nw *network) deleteEndpoint(nl netlink.NetlinkInterface, plc platform.ExecClient, nioc netio.NetIOInterface, nsc NamespaceClientInterface, endpointID string) error {
168+
func (nw *network) deleteEndpoint(nl netlink.NetlinkInterface, plc platform.ExecClient, nioc netio.NetIOInterface, nsc NamespaceClientInterface,
169+
iptc ipTablesClient, endpointID string,
170+
) error {
168171
var err error
169172

170173
logger.Info("Deleting endpoint from network", zap.String("endpointID", endpointID), zap.String("id", nw.Id))
@@ -183,7 +186,7 @@ func (nw *network) deleteEndpoint(nl netlink.NetlinkInterface, plc platform.Exec
183186

184187
// Call the platform implementation.
185188
// Pass nil for epClient and will be initialized in deleteEndpointImpl
186-
err = nw.deleteEndpointImpl(nl, plc, nil, nioc, nsc, ep)
189+
err = nw.deleteEndpointImpl(nl, plc, nil, nioc, nsc, iptc, ep)
187190
if err != nil {
188191
return err
189192
}

‎network/endpoint_linux.go

+9-5
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func (nw *network) newEndpointImpl(
5656
netioCli netio.NetIOInterface,
5757
testEpClient EndpointClient,
5858
nsc NamespaceClientInterface,
59+
iptc ipTablesClient,
5960
epInfo []*EndpointInfo,
6061
) (*endpoint, error) {
6162
var (
@@ -134,7 +135,7 @@ func (nw *network) newEndpointImpl(
134135
if _, ok := epInfo.Data[SnatBridgeIPKey]; ok {
135136
nw.SnatBridgeIP = epInfo.Data[SnatBridgeIPKey].(string)
136137
}
137-
epClient = NewTransparentVlanEndpointClient(nw, epInfo, hostIfName, contIfName, vlanid, localIP, nl, plc, nsc)
138+
epClient = NewTransparentVlanEndpointClient(nw, epInfo, hostIfName, contIfName, vlanid, localIP, nl, plc, nsc, iptc)
138139
} else {
139140
logger.Info("OVS client")
140141
if _, ok := epInfo.Data[SnatBridgeIPKey]; ok {
@@ -150,7 +151,8 @@ func (nw *network) newEndpointImpl(
150151
localIP,
151152
nl,
152153
ovsctl.NewOvsctl(),
153-
plc)
154+
plc,
155+
iptc)
154156
}
155157
} else if nw.Mode != opModeTransparent {
156158
logger.Info("Bridge client")
@@ -255,7 +257,9 @@ func (nw *network) newEndpointImpl(
255257
}
256258

257259
// deleteEndpointImpl deletes an existing endpoint from the network.
258-
func (nw *network) deleteEndpointImpl(nl netlink.NetlinkInterface, plc platform.ExecClient, epClient EndpointClient, nioc netio.NetIOInterface, nsc NamespaceClientInterface, ep *endpoint) error {
260+
func (nw *network) deleteEndpointImpl(nl netlink.NetlinkInterface, plc platform.ExecClient, epClient EndpointClient, nioc netio.NetIOInterface, nsc NamespaceClientInterface,
261+
iptc ipTablesClient, ep *endpoint,
262+
) error {
259263
// Delete the veth pair by deleting one of the peer interfaces.
260264
// Deleting the host interface is more convenient since it does not require
261265
// entering the container netns and hence works both for CNI and CNM.
@@ -267,10 +271,10 @@ func (nw *network) deleteEndpointImpl(nl netlink.NetlinkInterface, plc platform.
267271
epInfo := ep.getInfo()
268272
if nw.Mode == opModeTransparentVlan {
269273
logger.Info("Transparent vlan client")
270-
epClient = NewTransparentVlanEndpointClient(nw, epInfo, ep.HostIfName, "", ep.VlanID, ep.LocalIP, nl, plc, nsc)
274+
epClient = NewTransparentVlanEndpointClient(nw, epInfo, ep.HostIfName, "", ep.VlanID, ep.LocalIP, nl, plc, nsc, iptc)
271275

272276
} else {
273-
epClient = NewOVSEndpointClient(nw, epInfo, ep.HostIfName, "", ep.VlanID, ep.LocalIP, nl, ovsctl.NewOvsctl(), plc)
277+
epClient = NewOVSEndpointClient(nw, epInfo, ep.HostIfName, "", ep.VlanID, ep.LocalIP, nl, ovsctl.NewOvsctl(), plc, iptc)
274278
}
275279
} else if nw.Mode != opModeTransparent {
276280
epClient = NewLinuxBridgeEndpointClient(nw.extIf, ep.HostIfName, "", nw.Mode, nl, plc)

‎network/endpoint_snatroute_linux.go

+1-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"fmt"
55

66
"github.com/Azure/azure-container-networking/netlink"
7-
"github.com/Azure/azure-container-networking/network/networkutils"
87
"github.com/Azure/azure-container-networking/network/snat"
98
"github.com/Azure/azure-container-networking/platform"
109
"github.com/pkg/errors"
@@ -36,8 +35,7 @@ func AddSnatEndpointRules(snatClient *snat.Client, hostToNC, ncToHost bool, nl n
3635
if err := snatClient.BlockIPAddressesOnSnatBridge(); err != nil {
3736
return errors.Wrap(err, "failed to block ip addresses on snat bridge")
3837
}
39-
nuc := networkutils.NewNetworkUtils(nl, plc)
40-
if err := nuc.EnableIPForwarding(); err != nil {
38+
if err := snatClient.EnableIPForwarding(); err != nil {
4139
return errors.Wrap(err, "failed to enable ip forwarding")
4240
}
4341

0 commit comments

Comments
 (0)