diff --git a/controllers/policyendpoints_controller.go b/controllers/policyendpoints_controller.go index 3bd8433..37daaad 100644 --- a/controllers/policyendpoints_controller.go +++ b/controllers/policyendpoints_controller.go @@ -20,8 +20,6 @@ import ( "context" "errors" "net" - "os" - "strconv" "sync" "time" @@ -41,7 +39,6 @@ import ( ) const ( - envLocalConntrackCacheCleanupPeriod = "CONNTRACK_CACHE_CLEANUP_PERIOD" defaultLocalConntrackCacheCleanupPeriodInSeconds = 300 ) @@ -77,7 +74,7 @@ func prometheusRegister() { // NewPolicyEndpointsReconciler constructs new PolicyEndpointReconciler func NewPolicyEndpointsReconciler(k8sClient client.Client, log logr.Logger, - enablePolicyEventLogs, enableCloudWatchLogs bool, enableIPv6 bool, enableNetworkPolicy bool) (*PolicyEndpointsReconciler, error) { + enablePolicyEventLogs, enableCloudWatchLogs bool, enableIPv6 bool, enableNetworkPolicy bool, conntrackTTL int) (*PolicyEndpointsReconciler, error) { r := &PolicyEndpointsReconciler{ k8sClient: k8sClient, log: log, @@ -88,7 +85,7 @@ func NewPolicyEndpointsReconciler(k8sClient client.Client, log logr.Logger, } else { r.nodeIP, _ = imds.GetMetaData("ipv6") } - conntrackTTL := r.getLocalConntrackCacheCleanupPeriod() + r.log.Info("ConntrackTTL", "cleanupPeriod", conntrackTTL) var err error if enableNetworkPolicy { r.ebpfClient, err = ebpf.NewBpfClient(&r.policyEndpointeBPFContext, r.nodeIP, @@ -155,7 +152,6 @@ func (r *PolicyEndpointsReconciler) cleanUpPolicyEndpoint(ctx context.Context, r req.NamespacedName.Namespace) start := time.Now() - if targetPods, ok := r.policyEndpointSelectorMap.Load(policyEndpointIdentifier); ok { err := r.updatePolicyEnforcementStatusForPods(ctx, req.NamespacedName.Name, targetPods.([]types.NamespacedName)) if err != nil { @@ -210,7 +206,7 @@ func (r *PolicyEndpointsReconciler) reconcilePolicyEndpoint(ctx context.Context, for podIdentifier, _ := range podIdentifiers { // Derive Ingress IPs from the PolicyEndpoint ingressRules, egressRules, isIngressIsolated, isEgressIsolated, err := r.deriveIngressAndEgressFirewallRules(ctx, podIdentifier, - policyEndpoint.Namespace) + policyEndpoint.Namespace, policyEndpoint.Name, false) if err != nil { r.log.Error(err, "Error Parsing policy Endpoint resource", "name:", policyEndpoint.Name) return err @@ -287,7 +283,8 @@ func (r *PolicyEndpointsReconciler) cleanupeBPFProbes(ctx context.Context, targe // Detach eBPF probes attached to the local pods (if required). We should detach eBPF probes if this // is the only PolicyEndpoint resource that applies to this pod. If not, just update the Ingress/Egress Map contents if _, ok := r.podIdentifierToPolicyEndpointMap.Load(podIdentifier); ok { - ingressRules, egressRules, isIngressIsolated, isEgressIsolated, err = r.deriveIngressAndEgressFirewallRules(ctx, podIdentifier, targetPod.Namespace) + ingressRules, egressRules, isIngressIsolated, isEgressIsolated, err = r.deriveIngressAndEgressFirewallRules(ctx, podIdentifier, targetPod.Namespace, + policyEndpoint, true) if err != nil { r.log.Error(err, "Error Parsing policy Endpoint resource", "name ", policyEndpoint) return err @@ -337,7 +334,7 @@ func (r *PolicyEndpointsReconciler) cleanupeBPFProbes(ctx context.Context, targe } func (r *PolicyEndpointsReconciler) deriveIngressAndEgressFirewallRules(ctx context.Context, - podIdentifier string, resourceNamespace string) ([]ebpf.EbpfFirewallRules, []ebpf.EbpfFirewallRules, bool, bool, error) { + podIdentifier string, resourceNamespace string, resourceName string, isDeleteFlow bool) ([]ebpf.EbpfFirewallRules, []ebpf.EbpfFirewallRules, bool, bool, error) { var ingressRules, egressRules []ebpf.EbpfFirewallRules isIngressIsolated, isEgressIsolated := false, false currentPE := &policyk8sawsv1.PolicyEndpoint{} @@ -349,6 +346,17 @@ func (r *PolicyEndpointsReconciler) deriveIngressAndEgressFirewallRules(ctx cont Name: policyEndpointResource, Namespace: resourceNamespace, } + + if isDeleteFlow { + deletedPEParentNPName := utils.GetParentNPNameFromPEName(resourceName) + currentPEParentNPName := utils.GetParentNPNameFromPEName(policyEndpointResource) + if deletedPEParentNPName == currentPEParentNPName { + r.log.Info("PE belongs to same NP. Ignore and move on since it's a delete flow", + "deletedPE", resourceName, "currentPE", policyEndpointResource) + continue + } + } + if err := r.k8sClient.Get(ctx, peNamespacedName, currentPE); err != nil { if apierrors.IsNotFound(err) { continue @@ -514,7 +522,7 @@ func (r *PolicyEndpointsReconciler) updatePodIdentifierToPEMap(ctx context.Conte defer r.podIdentifierToPolicyEndpointMapMutex.Unlock() var policyEndpoints []string - r.log.Info("Total PEs for Parent NP:", "Count: ", len(parentPEList)) + r.log.Info("Current PE Count for Parent NP:", "Count: ", len(parentPEList)) if currentPESet, ok := r.podIdentifierToPolicyEndpointMap.Load(podIdentifier); ok { policyEndpoints = currentPESet.([]string) for _, policyEndpointResourceName := range parentPEList { @@ -577,22 +585,6 @@ func (r *PolicyEndpointsReconciler) SetupWithManager(ctx context.Context, mgr ct Complete(r) } -func (r *PolicyEndpointsReconciler) getLocalConntrackCacheCleanupPeriod() time.Duration { - periodStr, found := os.LookupEnv(envLocalConntrackCacheCleanupPeriod) - if !found { - return defaultLocalConntrackCacheCleanupPeriodInSeconds - } - if cleanupPeriod, err := strconv.Atoi(periodStr); err == nil { - if cleanupPeriod < 1 { - r.log.Info("conntrack cache cleanup is set to less than 1s. Reverting to default value") - return defaultLocalConntrackCacheCleanupPeriodInSeconds - } - r.log.Info("Setting CONNTRACK_CACHE_CLEANUP_PERIOD %v", cleanupPeriod) - return time.Duration(cleanupPeriod) * time.Second - } - return defaultLocalConntrackCacheCleanupPeriodInSeconds -} - func (r *PolicyEndpointsReconciler) derivePolicyEndpointsOfParentNP(ctx context.Context, parentNP, resourceNamespace string) []string { var parentPolicyEndpointList []string diff --git a/controllers/policyendpoints_controller_test.go b/controllers/policyendpoints_controller_test.go index 9d4693b..7a39d6b 100644 --- a/controllers/policyendpoints_controller_test.go +++ b/controllers/policyendpoints_controller_test.go @@ -329,7 +329,7 @@ func TestDeriveIngressAndEgressFirewallRules(t *testing.T) { mockClient := mock_client.NewMockClient(ctrl) policyEndpointReconciler, _ := NewPolicyEndpointsReconciler(mockClient, logr.New(&log.NullLogSink{}), - false, false, false, false) + false, false, false, false, 300) var policyEndpointsList []string policyEndpointsList = append(policyEndpointsList, tt.policyEndpointName) policyEndpointReconciler.podIdentifierToPolicyEndpointMap.Store(tt.podIdentifier, policyEndpointsList) @@ -347,7 +347,7 @@ func TestDeriveIngressAndEgressFirewallRules(t *testing.T) { t.Run(tt.name, func(t *testing.T) { gotIngressRules, gotEgressRules, gotIsIngressIsolated, gotIsEgressIsolated, gotError := policyEndpointReconciler.deriveIngressAndEgressFirewallRules(context.Background(), - tt.podIdentifier, tt.resourceNamespace) + tt.podIdentifier, tt.resourceNamespace, tt.policyEndpointName, false) assert.Equal(t, tt.want.ingressRules, gotIngressRules) assert.Equal(t, tt.want.egressRules, gotEgressRules) assert.Equal(t, tt.want.isIngressIsolated, gotIsIngressIsolated) diff --git a/go.mod b/go.mod index 4c012f1..e71fad2 100644 --- a/go.mod +++ b/go.mod @@ -4,25 +4,25 @@ go 1.21 require ( github.com/aws/amazon-vpc-cni-k8s v1.15.1 - github.com/aws/aws-ebpf-sdk-go v1.0.4 + github.com/aws/aws-ebpf-sdk-go v1.0.6 github.com/aws/aws-sdk-go v1.47.5 github.com/go-logr/logr v1.3.0 github.com/go-logr/zapr v1.2.4 github.com/golang/mock v1.6.0 - github.com/google/go-cmp v0.5.9 - github.com/google/uuid v1.3.1 + github.com/google/go-cmp v0.6.0 + github.com/google/uuid v1.4.0 github.com/pkg/errors v0.9.1 - github.com/prometheus/client_golang v1.16.0 - github.com/spf13/cobra v1.7.0 + github.com/prometheus/client_golang v1.17.0 + github.com/spf13/cobra v1.8.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.4 github.com/vishvananda/netlink v1.2.1-beta.2 go.uber.org/zap v1.26.0 - golang.org/x/sys v0.14.0 + golang.org/x/sys v0.15.0 gopkg.in/natefinch/lumberjack.v2 v2.2.1 - k8s.io/api v0.28.3 - k8s.io/apimachinery v0.28.3 - k8s.io/client-go v0.28.3 + k8s.io/api v0.28.4 + k8s.io/apimachinery v0.28.4 + k8s.io/client-go v0.28.4 sigs.k8s.io/controller-runtime v0.16.3 ) @@ -52,17 +52,18 @@ require ( github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - github.com/prometheus/client_model v0.4.0 // indirect + github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect github.com/prometheus/common v0.44.0 // indirect - github.com/prometheus/procfs v0.10.1 // indirect + github.com/prometheus/procfs v0.11.1 // indirect github.com/vishvananda/netns v0.0.4 // indirect go.uber.org/multierr v1.11.0 // indirect golang.org/x/exp v0.0.0-20230315142452-642cacee5cc0 // indirect - golang.org/x/net v0.17.0 // indirect + golang.org/x/net v0.19.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/term v0.13.0 // indirect - golang.org/x/text v0.13.0 // indirect + golang.org/x/term v0.15.0 // indirect + golang.org/x/text v0.14.0 // indirect golang.org/x/time v0.3.0 // indirect + golang.org/x/tools v0.16.0 // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.31.0 // indirect diff --git a/go.sum b/go.sum index 12e9a51..3112e94 100644 --- a/go.sum +++ b/go.sum @@ -1,11 +1,7 @@ github.com/aws/amazon-vpc-cni-k8s v1.15.1 h1:zKhJ58AoFj+QaZfo768mSVFpLr3qeSVV0Qn0aeV2fhE= github.com/aws/amazon-vpc-cni-k8s v1.15.1/go.mod h1:VjgdEc3U5d05RY5Jnovqt6pLbHmnIkzsgX6sDC6I4II= -github.com/aws/aws-ebpf-sdk-go v1.0.4-rc1 h1:X1JOboraocdX6aOT2POU4rJSyD2X2mKy4I2DHnpY1Hg= -github.com/aws/aws-ebpf-sdk-go v1.0.4-rc1/go.mod h1:08LzhuZ2vJNshF6cZaJNzN8vC59Rrq43jFJdbST5Oi0= -github.com/aws/aws-ebpf-sdk-go v1.0.4-rc2 h1:DZOKWMO/iCQekTkugs9A3h4o9hYwOvTdNSxIMOB8og4= -github.com/aws/aws-ebpf-sdk-go v1.0.4-rc2/go.mod h1:CCXK40H7FN2eN1FLt/O2vT9eNIDH0uXZxZGxQEdJaIM= -github.com/aws/aws-ebpf-sdk-go v1.0.4 h1:WJeuAYd8ThiC22kKJHpGZCJ63wotsJ04rY3JsHhdwVM= -github.com/aws/aws-ebpf-sdk-go v1.0.4/go.mod h1:CCXK40H7FN2eN1FLt/O2vT9eNIDH0uXZxZGxQEdJaIM= +github.com/aws/aws-ebpf-sdk-go v1.0.6 h1:f4f2HKmDEA2hQLd4Sz5jA0YYAFLmgLVnopZIycKcxnA= +github.com/aws/aws-ebpf-sdk-go v1.0.6/go.mod h1:sZz5xaENDQ1Y/FXjGIMJfVCSmHMB4LG9Bc+8+V1MLTo= github.com/aws/aws-sdk-go v1.47.5 h1:U2JlfPmrUoz5p+2X/XwKxmaJFo2oV+LbJqx8jyEvyAY= github.com/aws/aws-sdk-go v1.47.5/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= @@ -13,7 +9,7 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= +github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= @@ -26,7 +22,6 @@ github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJ github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= -github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY= @@ -55,15 +50,15 @@ github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 h1:0VpGH+cDhbDtdcweoyCVsF3fhN8kejK6rFe/2FFX2nU= github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49/go.mod h1:BkkQ4L1KS1xMt2aWSPStnn55ChGC0DPOn2FQYj+f25M= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= -github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4= -github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4= +github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= @@ -98,7 +93,6 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU= github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= @@ -108,19 +102,19 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8= -github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc= -github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY= -github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= +github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q= +github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY= +github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM= +github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY= github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY= -github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg= -github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM= +github.com/prometheus/procfs v0.11.1 h1:xRC8Iq1yyca5ypa9n1EZnWZkt7dwcoRPQwX/5gwaUuI= +github.com/prometheus/procfs v0.11.1/go.mod h1:eesXgaPo1q7lBpVMoMy0ZOFTth9hBn4W/y0/p/ScXhY= github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I= -github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0= +github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0= +github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -167,8 +161,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= -golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= -golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= +golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c= +golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U= golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8= golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -185,18 +179,16 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= -golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q= -golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc= +golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= -golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= +golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4= +golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= -golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -206,8 +198,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM= -golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= +golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM= +golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= @@ -235,14 +227,14 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/api v0.28.3 h1:Gj1HtbSdB4P08C8rs9AR94MfSGpRhJgsS+GF9V26xMM= -k8s.io/api v0.28.3/go.mod h1:MRCV/jr1dW87/qJnZ57U5Pak65LGmQVkKTzf3AtKFHc= +k8s.io/api v0.28.4 h1:8ZBrLjwosLl/NYgv1P7EQLqoO8MGQApnbgH8tu3BMzY= +k8s.io/api v0.28.4/go.mod h1:axWTGrY88s/5YE+JSt4uUi6NMM+gur1en2REMR7IRj0= k8s.io/apiextensions-apiserver v0.28.3 h1:Od7DEnhXHnHPZG+W9I97/fSQkVpVPQx2diy+2EtmY08= k8s.io/apiextensions-apiserver v0.28.3/go.mod h1:NE1XJZ4On0hS11aWWJUTNkmVB03j9LM7gJSisbRt8Lc= -k8s.io/apimachinery v0.28.3 h1:B1wYx8txOaCQG0HmYF6nbpU8dg6HvA06x5tEffvOe7A= -k8s.io/apimachinery v0.28.3/go.mod h1:uQTKmIqs+rAYaq+DFaoD2X7pcjLOqbQX2AOiO0nIpb8= -k8s.io/client-go v0.28.3 h1:2OqNb72ZuTZPKCl+4gTKvqao0AMOl9f3o2ijbAj3LI4= -k8s.io/client-go v0.28.3/go.mod h1:LTykbBp9gsA7SwqirlCXBWtK0guzfhpoW4qSm7i9dxo= +k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8= +k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg= +k8s.io/client-go v0.28.4 h1:Np5ocjlZcTrkyRJ3+T3PkXDpe4UpatQxj85+xjaD2wY= +k8s.io/client-go v0.28.4/go.mod h1:0VDZFpgoZfelyP5Wqu0/r/TRYcLYuJ2U1KEeoaPa1N4= k8s.io/component-base v0.28.3 h1:rDy68eHKxq/80RiMb2Ld/tbH8uAE75JdCqJyi6lXMzI= k8s.io/component-base v0.28.3/go.mod h1:fDJ6vpVNSk6cRo5wmDa6eKIG7UlIQkaFmZN2fYgIUD8= k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= diff --git a/main.go b/main.go index 9c8591c..c5f3827 100644 --- a/main.go +++ b/main.go @@ -90,7 +90,7 @@ func main() { ctx := ctrl.SetupSignalHandler() policyEndpointController, err := controllers.NewPolicyEndpointsReconciler(mgr.GetClient(), ctrl.Log.WithName("controllers").WithName("policyEndpoints"), ctrlConfig.EnablePolicyEventLogs, ctrlConfig.EnableCloudWatchLogs, - ctrlConfig.EnableIPv6, ctrlConfig.EnableNetworkPolicy) + ctrlConfig.EnableIPv6, ctrlConfig.EnableNetworkPolicy, ctrlConfig.ConntrackCacheCleanupPeriod) if err != nil { setupLog.Error(err, "unable to setup controller", "controller", "PolicyEndpoints init failed") os.Exit(1) diff --git a/pkg/clihelper/show.go b/pkg/clihelper/show.go index 81b0c01..3216565 100644 --- a/pkg/clihelper/show.go +++ b/pkg/clihelper/show.go @@ -19,7 +19,7 @@ import ( func Show() error { bpfSDKclient := goelf.New() - bpfState, err := bpfSDKclient.RecoverAllBpfProgramsAndMaps() + bpfState, err := bpfSDKclient.GetAllBpfProgramsAndMaps() if err != nil { return err } @@ -30,7 +30,7 @@ func Show() error { line := fmt.Sprintf("Pod Identifier : %s Direction : %s \n", podIdentifier, direction) fmt.Print(line) bpfProg := bpfEntry.Program - fmt.Println("Prog FD: ", bpfProg.ProgFD) + fmt.Println("Prog ID: ", bpfProg.ProgID) fmt.Println("Associated Maps -> ") bpfMaps := bpfEntry.Maps for k, v := range bpfMaps { @@ -111,17 +111,24 @@ func MapWalk(mapID int) error { } else { for { - iterValue := utils.BPFTrieVal{} + iterValue := [24]utils.BPFTrieVal{} err = goebpfmaps.GetMapEntryByID(uintptr(unsafe.Pointer(&iterKey)), uintptr(unsafe.Pointer(&iterValue)), mapID) if err != nil { return fmt.Errorf("Unable to get map entry: %v", err) } else { retrievedKey := fmt.Sprintf("Key : IP/Prefixlen - %s/%d ", utils.ConvIntToIPv4(iterKey.IP).String(), iterKey.PrefixLen) fmt.Println(retrievedKey) - fmt.Println("Value : ") - fmt.Println("Protocol - ", iterValue.Protocol) - fmt.Println("StartPort - ", iterValue.StartPort) - fmt.Println("Endport - ", iterValue.EndPort) + for i := 0; i < len(iterValue); i++ { + if iterValue[i].Protocol == 0 { + continue + } + fmt.Println("-------------------") + fmt.Println("Value Entry : ", i) + fmt.Println("Protocol - ", utils.GetProtocol(int(iterValue[i].Protocol))) + fmt.Println("StartPort - ", iterValue[i].StartPort) + fmt.Println("Endport - ", iterValue[i].EndPort) + fmt.Println("-------------------") + } fmt.Println("*******************************") } @@ -213,7 +220,7 @@ func MapWalkv6(mapID int) error { } else { for { - iterValue := utils.BPFTrieVal{} + iterValue := [24]utils.BPFTrieVal{} err = goebpfmaps.GetMapEntryByID(uintptr(unsafe.Pointer(&byteSlice[0])), uintptr(unsafe.Pointer(&iterValue)), mapID) if err != nil { @@ -222,10 +229,17 @@ func MapWalkv6(mapID int) error { v6key := utils.ConvByteToTrieV6(byteSlice) retrievedKey := fmt.Sprintf("Key : IP/Prefixlen - %s/%d ", utils.ConvByteToIPv6(v6key.IP).String(), v6key.PrefixLen) fmt.Println(retrievedKey) - fmt.Println("Value : ") - fmt.Println("Protocol - ", iterValue.Protocol) - fmt.Println("StartPort - ", iterValue.StartPort) - fmt.Println("Endport - ", iterValue.EndPort) + for i := 0; i < len(iterValue); i++ { + if iterValue[i].Protocol == 0 { + continue + } + fmt.Println("-------------------") + fmt.Println("Value Entry : ", i) + fmt.Println("Protocol - ", utils.GetProtocol(int(iterValue[i].Protocol))) + fmt.Println("StartPort - ", iterValue[i].StartPort) + fmt.Println("Endport - ", iterValue[i].EndPort) + fmt.Println("-------------------") + } fmt.Println("*******************************") } diff --git a/pkg/config/controller_config.go b/pkg/config/controller_config.go index ea24617..ad4b8ba 100644 --- a/pkg/config/controller_config.go +++ b/pkg/config/controller_config.go @@ -3,16 +3,18 @@ package config import "github.com/spf13/pflag" const ( - flagLogLevel = "log-level" - flagLogFile = "log-file" - flagMaxConcurrentReconciles = "max-concurrent-reconciles" - defaultLogLevel = "info" - defaultLogFile = "/var/log/aws-routed-eni/network-policy-agent.log" - defaultMaxConcurrentReconciles = 3 - flagEnablePolicyEventLogs = "enable-policy-event-logs" - flagEnableCloudWatchLogs = "enable-cloudwatch-logs" - flagEnableIPv6 = "enable-ipv6" - flagEnableNetworkPolicy = "enable-network-policy" + flagLogLevel = "log-level" + flagLogFile = "log-file" + flagMaxConcurrentReconciles = "max-concurrent-reconciles" + defaultLogLevel = "info" + defaultLogFile = "/var/log/aws-routed-eni/network-policy-agent.log" + defaultMaxConcurrentReconciles = 3 + defaultConntrackCacheCleanupPeriod = 300 + flagEnablePolicyEventLogs = "enable-policy-event-logs" + flagEnableCloudWatchLogs = "enable-cloudwatch-logs" + flagEnableIPv6 = "enable-ipv6" + flagEnableNetworkPolicy = "enable-network-policy" + flagConntrackCacheCleanupPeriod = "conntrack-cache-cleanup-period" ) // ControllerConfig contains the controller configuration @@ -31,6 +33,8 @@ type ControllerConfig struct { EnableIPv6 bool // Enable Network Policy EnableNetworkPolicy bool + // ConntrackCacheCleanupPeriod specifies the cleanup period + ConntrackCacheCleanupPeriod int // Configurations for the Controller Runtime RuntimeConfig RuntimeConfig } @@ -46,6 +50,8 @@ func (cfg *ControllerConfig) BindFlags(fs *pflag.FlagSet) { fs.BoolVar(&cfg.EnableCloudWatchLogs, flagEnableCloudWatchLogs, false, "If enabled, policy decision logs will be streamed to CloudWatch, requires \"enable-policy-event-logs=true\"") fs.BoolVar(&cfg.EnableIPv6, flagEnableIPv6, false, "If enabled, Network Policy agent will operate in IPv6 mode") fs.BoolVar(&cfg.EnableNetworkPolicy, flagEnableNetworkPolicy, false, "If enabled, Network Policy agent will initialize BPF maps and start reconciler") + fs.IntVar(&cfg.ConntrackCacheCleanupPeriod, flagConntrackCacheCleanupPeriod, defaultConntrackCacheCleanupPeriod, ""+ + "Cleanup interval for network policy agent conntrack cache") cfg.RuntimeConfig.BindFlags(fs) } diff --git a/pkg/ebpf/bpf_client.go b/pkg/ebpf/bpf_client.go index 8a7fa25..f8626e2 100644 --- a/pkg/ebpf/bpf_client.go +++ b/pkg/ebpf/bpf_client.go @@ -108,7 +108,7 @@ type EbpfFirewallRules struct { } func NewBpfClient(policyEndpointeBPFContext *sync.Map, nodeIP string, enablePolicyEventLogs, enableCloudWatchLogs bool, - enableIPv6 bool, conntrackTTL time.Duration) (*bpfClient, error) { + enableIPv6 bool, conntrackTTL int) (*bpfClient, error) { var conntrackMap goebpfmaps.BpfMap ebpfClient := &bpfClient{ @@ -227,9 +227,9 @@ func NewBpfClient(policyEndpointeBPFContext *sync.Map, nodeIP string, enablePoli // Start Conntrack routines if enableIPv6 { - go wait.Forever(ebpfClient.conntrackClient.Cleanupv6ConntrackMap, conntrackTTL*time.Second) + go wait.Forever(ebpfClient.conntrackClient.Cleanupv6ConntrackMap, time.Duration(conntrackTTL)*time.Second) } else { - go wait.Forever(ebpfClient.conntrackClient.CleanupConntrackMap, conntrackTTL*time.Second) + go wait.Forever(ebpfClient.conntrackClient.CleanupConntrackMap, time.Duration(conntrackTTL)*time.Second) } // Initializes prometheus metrics diff --git a/pkg/ebpf/conntrack/conntrack_client.go b/pkg/ebpf/conntrack/conntrack_client.go index 6e7f169..81ca3f0 100644 --- a/pkg/ebpf/conntrack/conntrack_client.go +++ b/pkg/ebpf/conntrack/conntrack_client.go @@ -39,6 +39,7 @@ func NewConntrackClient(conntrackMap goebpfmaps.BpfMap, enableIPv6 bool, logger } func (c *conntrackClient) CleanupConntrackMap() { + c.logger.Info("Check for any stale entries in the conntrack map") bpfMapApi := &goebpfmaps.BpfMap{} mapInfo, err := bpfMapApi.GetMapFromPinPath(CONNTRACK_MAP_PIN_PATH) if err != nil { @@ -99,20 +100,30 @@ func (c *conntrackClient) CleanupConntrackMap() { } return } else { + newKey := utils.ConntrackKey{} newKey.Source_ip = utils.ConvIPv4ToInt(utils.ConvIntToIPv4(iterKey.Source_ip)) newKey.Source_port = iterKey.Source_port newKey.Dest_ip = utils.ConvIPv4ToInt(utils.ConvIntToIPv4(iterKey.Dest_ip)) newKey.Dest_port = iterKey.Dest_port newKey.Protocol = iterKey.Protocol + newKey.Owner_ip = utils.ConvIPv4ToInt(utils.ConvIntToIPv4(iterKey.Owner_ip)) - newKey.Owner_ip = iterKey.Owner_ip _, ok := localConntrackCache[newKey] if !ok { //Delete the entry in local cache retrievedKey := fmt.Sprintf("Expired/Delete Conntrack Key : Source IP - %s Source port - %d Dest IP - %s Dest port - %d Protocol - %d Owner IP - %s", utils.ConvIntToIPv4(iterKey.Source_ip).String(), iterKey.Source_port, utils.ConvIntToIPv4(iterKey.Dest_ip).String(), iterKey.Dest_port, iterKey.Protocol, utils.ConvIntToIPv4(iterKey.Owner_ip).String()) c.logger.Info("Conntrack cleanup", "Entry - ", retrievedKey) - expiredList[iterKey] = true + + // Copy from iterKey since we will replace the value + nKey := utils.ConntrackKey{} + nKey.Source_ip = iterKey.Source_ip + nKey.Source_port = iterKey.Source_port + nKey.Dest_ip = iterKey.Dest_ip + nKey.Dest_port = iterKey.Dest_port + nKey.Protocol = iterKey.Protocol + nKey.Owner_ip = iterKey.Owner_ip + expiredList[nKey] = true } } @@ -124,6 +135,7 @@ func (c *conntrackClient) CleanupConntrackMap() { if err != nil { break } + iterKey = iterNextKey } } @@ -140,6 +152,7 @@ func (c *conntrackClient) CleanupConntrackMap() { } func (c *conntrackClient) Cleanupv6ConntrackMap() { + c.logger.Info("Check for any stale entries in the conntrack map") bpfMapApi := &goebpfmaps.BpfMap{} mapInfo, err := bpfMapApi.GetMapFromPinPath(CONNTRACK_MAP_PIN_PATH) if err != nil { diff --git a/pkg/ebpf/events/events.go b/pkg/ebpf/events/events.go index 095ee1b..28cb35b 100644 --- a/pkg/ebpf/events/events.go +++ b/pkg/ebpf/events/events.go @@ -107,20 +107,6 @@ func setupCW(logger logr.Logger) error { return nil } -func getProtocol(protocolNum int) string { - protocolStr := "UNKNOWN" - if protocolNum == utils.TCP_PROTOCOL_NUMBER { - protocolStr = "TCP" - } else if protocolNum == utils.UDP_PROTOCOL_NUMBER { - protocolStr = "UDP" - } else if protocolNum == utils.SCTP_PROTOCOL_NUMBER { - protocolStr = "SCTP" - } else if protocolNum == utils.ICMP_PROTOCOL_NUMBER { - protocolStr = "ICMP" - } - return protocolStr -} - func getVerdict(verdict int) string { verdictStr := "DENY" if verdict == utils.ACCEPT.Index() { @@ -186,7 +172,7 @@ func capturePolicyEvents(ringbufferdata <-chan []byte, log logr.Logger, enableCl continue } - protocol := getProtocol(int(rb.Protocol)) + protocol := utils.GetProtocol(int(rb.Protocol)) verdict := getVerdict(int(rb.Verdict)) log.Info("Flow Info: ", "Src IP", utils.ConvByteToIPv6(rb.SourceIP).String(), "Src Port", rb.SourcePort, @@ -201,7 +187,7 @@ func capturePolicyEvents(ringbufferdata <-chan []byte, log logr.Logger, enableCl log.Info("Failed to read from Ring buf", err) continue } - protocol := getProtocol(int(rb.Protocol)) + protocol := utils.GetProtocol(int(rb.Protocol)) verdict := getVerdict(int(rb.Verdict)) log.Info("Flow Info: ", "Src IP", utils.ConvByteArrayToIP(rb.SourceIP), "Src Port", rb.SourcePort, diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 930fd1a..905acfe 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -38,6 +38,24 @@ var ( ErrMissingFilter = "no active filter to detach" ) +func GetProtocol(protocolNum int) string { + protocolStr := "UNKNOWN" + if protocolNum == TCP_PROTOCOL_NUMBER { + protocolStr = "TCP" + } else if protocolNum == UDP_PROTOCOL_NUMBER { + protocolStr = "UDP" + } else if protocolNum == SCTP_PROTOCOL_NUMBER { + protocolStr = "SCTP" + } else if protocolNum == ICMP_PROTOCOL_NUMBER { + protocolStr = "ICMP" + } else if protocolNum == RESERVED_IP_PROTOCOL_NUMBER { + protocolStr = "RESERVED" + } else if protocolNum == ANY_IP_PROTOCOL { + protocolStr = "ANY PROTOCOL" + } + return protocolStr +} + type VerdictType int const ( @@ -91,6 +109,10 @@ func GetPolicyEndpointIdentifier(policyName, policyNamespace string) string { return policyName + policyNamespace } +func GetParentNPNameFromPEName(policyEndpointName string) string { + return policyEndpointName[0:strings.LastIndex(policyEndpointName, "-")] +} + func GetHostVethName(podName, podNamespace string) string { h := sha1.New() h.Write([]byte(fmt.Sprintf("%s.%s", podNamespace, podName))) @@ -296,9 +318,11 @@ type ConntrackKeyV6 struct { type ConntrackKey struct { Source_ip uint32 Source_port uint16 + _ uint16 //Padding Dest_ip uint32 Dest_port uint16 Protocol uint8 + _ uint8 //Padding Owner_ip uint32 }