Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Configure rp_filter based on env variable #902

Merged
merged 2 commits into from
Apr 8, 2020
Merged

Configure rp_filter based on env variable #902

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c5f2de
Revert "Update rp_filter only when /proc is accessible"
SaranBalaji90 Apr 7, 2020
634f0c8
Configure rp_filter for primary interface based on env variable.
SaranBalaji90 Apr 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 23 additions & 15 deletions pkg/networkutils/network.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,10 @@ const (
// sent over the main ENI.
envConnmark = "AWS_VPC_K8S_CNI_CONNMARK"

// This environment variable indicates if ipamd should configure rp filter for primary interface. Default value is
// true. If set to false, then rp filter should be configured through init container.
envConfigureRpfilter = "AWS_VPC_K8S_CNI_CONFIGURE_RPFILTER"

// defaultConnmark is the default value for the connmark described above. Note: the mark space is a little crowded,
// - kube-proxy uses 0x0000c000
// - Calico uses 0xffff0000.
Expand Down Expand Up @@ -125,12 +129,13 @@ type NetworkAPIs interface {
}

type linuxNetwork struct {
useExternalSNAT bool
excludeSNATCIDRs []string
typeOfSNAT snatType
nodePortSupportEnabled bool
connmark uint32
mtu int
useExternalSNAT bool
excludeSNATCIDRs []string
typeOfSNAT snatType
nodePortSupportEnabled bool
shouldConfigureRpFilter bool
connmark uint32
mtu int

netLink netlinkwrapper.NetLink
ns nswrapper.NS
Expand Down Expand Up @@ -163,12 +168,13 @@ const (
// New creates a linuxNetwork object
func New() NetworkAPIs {
return &linuxNetwork{
useExternalSNAT: useExternalSNAT(),
excludeSNATCIDRs: getExcludeSNATCIDRs(),
typeOfSNAT: typeOfSNAT(),
nodePortSupportEnabled: nodePortSupportEnabled(),
mainENIMark: getConnmark(),
mtu: GetEthernetMTU(""),
useExternalSNAT: useExternalSNAT(),
excludeSNATCIDRs: getExcludeSNATCIDRs(),
typeOfSNAT: typeOfSNAT(),
nodePortSupportEnabled: nodePortSupportEnabled(),
shouldConfigureRpFilter: shouldConfigureRpFilter(),
mainENIMark: getConnmark(),
mtu: GetEthernetMTU(""),

netLink: netlinkwrapper.NewNetLink(),
ns: nswrapper.NewNS(),
Expand Down Expand Up @@ -243,15 +249,13 @@ func (n *linuxNetwork) SetupHostNetwork(vpcCIDR *net.IPNet, vpcCIDRs []*string,
primaryIntfRPFilter := "net/ipv4/conf/" + primaryIntf + "/rp_filter"
const rpFilterLoose = "2"

if n.procSys.IsPathWriteAccessible(primaryIntfRPFilter) {
// Setting RPF will be removed from aws-node when we bump our minor version.
if n.shouldConfigureRpFilter {
log.Debugf("Setting RPF for primary interface: %s", primaryIntfRPFilter)
err = n.procSys.Set(primaryIntfRPFilter, rpFilterLoose)
if err != nil {
return errors.Wrapf(err, "failed to configure %s RPF check", primaryIntf)
}
} else {
// when aws-node run as an un-privileged pod, /proc will be mounted as read only
log.Infof("Skip updating RPF for primary interface: %s", primaryIntfRPFilter)
}
}
Expand Down Expand Up @@ -602,6 +606,10 @@ func nodePortSupportEnabled() bool {
return getBoolEnvVar(envNodePortSupport, true)
}

func shouldConfigureRpFilter() bool {
return getBoolEnvVar(envConfigureRpfilter, true)
}

func getBoolEnvVar(name string, defaultValue bool) bool {
if strValue := os.Getenv(name); strValue != "" {
parsedValue, err := strconv.ParseBool(strValue)
Expand Down
89 changes: 45 additions & 44 deletions pkg/networkutils/network_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,10 +272,11 @@ func TestSetupHostNetworkNodePortEnabled(t *testing.T) {
defer ctrl.Finish()

ln := &linuxNetwork{
useExternalSNAT: true,
nodePortSupportEnabled: true,
mainENIMark: defaultConnmark,
mtu: testMTU,
useExternalSNAT: true,
nodePortSupportEnabled: true,
shouldConfigureRpFilter: true,
mainENIMark: defaultConnmark,
mtu: testMTU,

netLink: mockNetLink,
ns: mockNS,
Expand All @@ -286,7 +287,8 @@ func TestSetupHostNetworkNodePortEnabled(t *testing.T) {
}

setupNetLinkMocks(ctrl, mockNetLink)
setupProcSysMocks(mockProcSys, true)

mockProcSys.EXPECT().Set("net/ipv4/conf/lo/rp_filter", "2").Return(nil)

var vpcCIDRs []*string

Expand Down Expand Up @@ -339,11 +341,12 @@ func TestSetupHostNetworkWithExcludeSNATCIDRs(t *testing.T) {
defer ctrl.Finish()

ln := &linuxNetwork{
useExternalSNAT: false,
excludeSNATCIDRs: []string{"10.12.0.0/16", "10.13.0.0/16"},
nodePortSupportEnabled: true,
mainENIMark: defaultConnmark,
mtu: testMTU,
useExternalSNAT: false,
excludeSNATCIDRs: []string{"10.12.0.0/16", "10.13.0.0/16"},
nodePortSupportEnabled: true,
shouldConfigureRpFilter: true,
mainENIMark: defaultConnmark,
mtu: testMTU,

netLink: mockNetLink,
ns: mockNS,
Expand All @@ -354,7 +357,8 @@ func TestSetupHostNetworkWithExcludeSNATCIDRs(t *testing.T) {
}

setupNetLinkMocks(ctrl, mockNetLink)
setupProcSysMocks(mockProcSys, true)

mockProcSys.EXPECT().Set("net/ipv4/conf/lo/rp_filter", "2").Return(nil)

var vpcCIDRs []*string
vpcCIDRs = []*string{aws.String("10.10.0.0/16"), aws.String("10.11.0.0/16")}
Expand Down Expand Up @@ -383,11 +387,12 @@ func TestSetupHostNetworkCleansUpStaleSNATRules(t *testing.T) {
defer ctrl.Finish()

ln := &linuxNetwork{
useExternalSNAT: false,
excludeSNATCIDRs: nil,
nodePortSupportEnabled: true,
mainENIMark: defaultConnmark,
mtu: testMTU,
useExternalSNAT: false,
excludeSNATCIDRs: nil,
nodePortSupportEnabled: true,
shouldConfigureRpFilter: true,
mainENIMark: defaultConnmark,
mtu: testMTU,

netLink: mockNetLink,
ns: mockNS,
Expand All @@ -397,7 +402,8 @@ func TestSetupHostNetworkCleansUpStaleSNATRules(t *testing.T) {
procSys: mockProcSys,
}
setupNetLinkMocks(ctrl, mockNetLink)
setupProcSysMocks(mockProcSys, true)

mockProcSys.EXPECT().Set("net/ipv4/conf/lo/rp_filter", "2").Return(nil)

vpcCIDRs := []*string{aws.String("10.10.0.0/16"), aws.String("10.11.0.0/16")}
_ = mockIptables.Append("nat", "AWS-SNAT-CHAIN-0", "!", "-d", "10.10.0.0/16", "-m", "comment", "--comment", "AWS SNAT CHAN", "-j", "AWS-SNAT-CHAIN-1") //AWS SNAT CHAN proves backwards compatibility
Expand Down Expand Up @@ -434,11 +440,12 @@ func TestSetupHostNetworkExcludedSNATCIDRsIdempotent(t *testing.T) {
defer ctrl.Finish()

ln := &linuxNetwork{
useExternalSNAT: false,
excludeSNATCIDRs: []string{"10.12.0.0/16", "10.13.0.0/16"},
nodePortSupportEnabled: true,
mainENIMark: defaultConnmark,
mtu: testMTU,
useExternalSNAT: false,
excludeSNATCIDRs: []string{"10.12.0.0/16", "10.13.0.0/16"},
nodePortSupportEnabled: true,
shouldConfigureRpFilter: true,
mainENIMark: defaultConnmark,
mtu: testMTU,

netLink: mockNetLink,
ns: mockNS,
Expand All @@ -448,7 +455,8 @@ func TestSetupHostNetworkExcludedSNATCIDRsIdempotent(t *testing.T) {
procSys: mockProcSys,
}
setupNetLinkMocks(ctrl, mockNetLink)
setupProcSysMocks(mockProcSys, true)

mockProcSys.EXPECT().Set("net/ipv4/conf/lo/rp_filter", "2").Return(nil)

_ = mockIptables.Append("nat", "AWS-SNAT-CHAIN-0", "!", "-d", "10.10.0.0/16", "-m", "comment", "--comment", "AWS SNAT CHAIN", "-j", "AWS-SNAT-CHAIN-1")
_ = mockIptables.Append("nat", "AWS-SNAT-CHAIN-1", "!", "-d", "10.11.0.0/16", "-m", "comment", "--comment", "AWS SNAT CHAIN", "-j", "AWS-SNAT-CHAIN-2")
Expand Down Expand Up @@ -485,10 +493,11 @@ func TestSetupHostNetworkMultipleCIDRs(t *testing.T) {
defer ctrl.Finish()

ln := &linuxNetwork{
useExternalSNAT: true,
nodePortSupportEnabled: true,
mainENIMark: defaultConnmark,
mtu: testMTU,
useExternalSNAT: true,
nodePortSupportEnabled: true,
shouldConfigureRpFilter: true,
mainENIMark: defaultConnmark,
mtu: testMTU,

netLink: mockNetLink,
ns: mockNS,
Expand All @@ -498,7 +507,8 @@ func TestSetupHostNetworkMultipleCIDRs(t *testing.T) {
procSys: mockProcSys,
}
setupNetLinkMocks(ctrl, mockNetLink)
setupProcSysMocks(mockProcSys, true)

mockProcSys.EXPECT().Set("net/ipv4/conf/lo/rp_filter", "2").Return(nil)

var vpcCIDRs []*string
vpcCIDRs = []*string{aws.String("10.10.0.0/16"), aws.String("10.11.0.0/16")}
Expand Down Expand Up @@ -532,15 +542,16 @@ func TestIncrementIPv4Addr(t *testing.T) {
}
}

func TestSetupHostNetworkForUnprivilegedPod(t *testing.T) {
func TestSetupHostNetworkIgnoringRpFilterUpdate(t *testing.T) {
ctrl, mockNetLink, _, mockNS, mockIptables, mockProcSys := setup(t)
defer ctrl.Finish()

ln := &linuxNetwork{
useExternalSNAT: true,
nodePortSupportEnabled: true,
mainENIMark: defaultConnmark,
mtu: testMTU,
useExternalSNAT: true,
nodePortSupportEnabled: true,
shouldConfigureRpFilter: false,
mainENIMark: defaultConnmark,
mtu: testMTU,

netLink: mockNetLink,
ns: mockNS,
Expand All @@ -549,23 +560,13 @@ func TestSetupHostNetworkForUnprivilegedPod(t *testing.T) {
},
procSys: mockProcSys,
}
var vpcCIDRs []*string
setupNetLinkMocks(ctrl, mockNetLink)
setupProcSysMocks(mockProcSys, false)

var vpcCIDRs []*string
err := ln.SetupHostNetwork(testENINetIPNet, vpcCIDRs, loopback, &testENINetIP)
assert.NoError(t, err)
}

func setupProcSysMocks(mockProcSys *mock_procsyswrapper.MockProcSys, shouldHaveWriteAccess bool) {
rpFilterPath := "net/ipv4/conf/lo/rp_filter"

mockProcSys.EXPECT().IsPathWriteAccessible(rpFilterPath).Return(shouldHaveWriteAccess)
if shouldHaveWriteAccess {
mockProcSys.EXPECT().Set(rpFilterPath, "2").Return(nil)
}
}

func setupNetLinkMocks(ctrl *gomock.Controller, mockNetLink *mock_netlinkwrapper.MockNetLink) {
mockPrimaryInterfaceLookup(ctrl, mockNetLink)
mockNetLink.EXPECT().LinkSetMTU(gomock.Any(), testMTU).Return(nil)
Expand Down
14 changes: 0 additions & 14 deletions pkg/procsyswrapper/mocks/procsys_mocks.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 0 additions & 8 deletions pkg/procsyswrapper/procsys.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,11 @@ package procsyswrapper

import (
"io/ioutil"

"golang.org/x/sys/unix"
)

type ProcSys interface {
Get(key string) (string, error)
Set(key, value string) error
IsPathWriteAccessible(key string) bool
}

type procSys struct {
Expand All @@ -45,8 +42,3 @@ func (p *procSys) Get(key string) (string, error) {
func (p *procSys) Set(key, value string) error {
return ioutil.WriteFile(p.path(key), []byte(value), 0644)
}

// IsPathWriteAccessible verifies if aws-node pod can write to the specified path
func (p *procSys) IsPathWriteAccessible(key string) bool {
return unix.Access(p.path(key), unix.W_OK) != nil
}