Skip to content

Commit 521cf48

Browse files
hedibouattourhedibouattour
committed
add policy default and profile default
1 parent a472145 commit 521cf48

File tree

8 files changed

+147
-40
lines changed

8 files changed

+147
-40
lines changed

‎calico-vpp-agent/felix/felix_server.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ type Server struct {
8282
/* workloadToHost may drop traffic that goes from the pods to the host */
8383
workloadsToHostPolicy *Policy
8484
defaultTap0IngressConf []uint32
85+
defaultTap0EgressConf []uint32
8586
/* always allow traffic coming from host to the pods (for healthchecks and so on) */
8687
// AllowFromHostPolicy persists the policy allowing host --> pod communications.
8788
// See CreateAllowFromHostPolicy definition
@@ -959,6 +960,22 @@ func (s *Server) handleHostEndpointUpdate(msg *proto.HostEndpointUpdate, pending
959960
// we are not supposed to fallback to expectedIPs if interfaceName doesn't match
960961
// this is the current behavior in calico linux
961962
s.log.Errorf("cannot find host endpoint: interface named %s does not exist", hep.InterfaceName)
963+
// *************************** this is temporary, for dev
964+
if hep.expectedIPs != nil {
965+
for _, existingIf := range s.interfacesMap {
966+
interfaceFound1:
967+
for _, address := range existingIf.addresses {
968+
for _, expectedIP := range hep.expectedIPs {
969+
if address == expectedIP {
970+
hep.UplinkSwIfIndexes = append(hep.UplinkSwIfIndexes, existingIf.uplinkIndex)
971+
hep.TapSwIfIndexes = append(hep.TapSwIfIndexes, existingIf.tapIndex)
972+
break interfaceFound1
973+
}
974+
}
975+
}
976+
}
977+
}
978+
// ***************************
962979
}
963980
} else if hep.InterfaceName == "" && hep.expectedIPs != nil {
964981
for _, existingIf := range s.interfacesMap {
@@ -1713,13 +1730,22 @@ func (s *Server) createEndpointToHostPolicy( /*may be return*/ ) (err error) {
17131730
},
17141731
},
17151732
},
1733+
OutboundRules: []*Rule{
1734+
{
1735+
VppID: types.InvalidID,
1736+
Rule: &types.Rule{
1737+
Action: types.ActionAllow,
1738+
},
1739+
},
1740+
},
17161741
}
17171742
err = allowAllPol.Create(s.vpp, &ps)
17181743
if err != nil {
17191744
return err
17201745
}
17211746
conf := types.NewInterfaceConfig()
17221747
conf.IngressPolicyIDs = append(conf.IngressPolicyIDs, s.workloadsToHostPolicy.VppID, allowAllPol.VppID)
1748+
conf.EgressPolicyIDs = append(conf.EgressPolicyIDs, allowAllPol.VppID)
17231749
swifindexes, err := s.vpp.SearchInterfacesWithTagPrefix("host-") // tap0 interfaces
17241750
if err != nil {
17251751
s.log.Error(err)
@@ -1731,6 +1757,7 @@ func (s *Server) createEndpointToHostPolicy( /*may be return*/ ) (err error) {
17311757
}
17321758
}
17331759
s.defaultTap0IngressConf = conf.IngressPolicyIDs
1760+
s.defaultTap0EgressConf = conf.EgressPolicyIDs
17341761
return nil
17351762
}
17361763

‎calico-vpp-agent/felix/host_endpoint.go‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"github.com/projectcalico/calico/felix/proto"
2323

2424
"github.com/projectcalico/vpp-dataplane/v3/vpplink"
25+
"github.com/projectcalico/vpp-dataplane/v3/vpplink/generated/bindings/capo"
2526
"github.com/projectcalico/vpp-dataplane/v3/vpplink/types"
2627
)
2728

@@ -180,10 +181,14 @@ func (h *HostEndpoint) getTapPolicies(state *PolicyState) (conf *types.Interface
180181
// If a host endpoint is created and network policy is not in place,
181182
// the Calico default is to deny traffic to/from that endpoint
182183
// (except for traffic allowed by failsafe rules).
184+
// note: this applies to ingress and egress separately, so if you don't have
185+
// ingress only you drop ingress
183186
conf.IngressPolicyIDs = []uint32{h.server.workloadsToHostPolicy.VppID, h.server.failSafePolicy.VppID, h.server.denyAllPolicy.VppID}
184187
} else {
185188
if len(conf.IngressPolicyIDs) > 0 {
186-
conf.UserDefinedTx = 1
189+
conf.PolicyDefaultTx = capo.CAPO_DEFAULT_DENY
190+
} else if len(conf.ProfileIDs) > 0 {
191+
conf.PolicyDefaultTx = capo.CAPO_DEFAULT_PASS
187192
}
188193
conf.IngressPolicyIDs = append([]uint32{h.server.failSafePolicy.VppID}, conf.IngressPolicyIDs...)
189194
conf.IngressPolicyIDs = append([]uint32{h.server.workloadsToHostPolicy.VppID}, conf.IngressPolicyIDs...)
@@ -192,7 +197,9 @@ func (h *HostEndpoint) getTapPolicies(state *PolicyState) (conf *types.Interface
192197
conf.EgressPolicyIDs = []uint32{h.server.AllowFromHostPolicy.VppID, h.server.failSafePolicy.VppID, h.server.denyAllPolicy.VppID}
193198
} else {
194199
if len(conf.EgressPolicyIDs) > 0 {
195-
conf.UserDefinedRx = 1
200+
conf.PolicyDefaultRx = capo.CAPO_DEFAULT_DENY
201+
} else if len(conf.ProfileIDs) > 0 {
202+
conf.PolicyDefaultRx = capo.CAPO_DEFAULT_PASS
196203
}
197204
conf.EgressPolicyIDs = append([]uint32{h.server.failSafePolicy.VppID}, conf.EgressPolicyIDs...)
198205
conf.EgressPolicyIDs = append([]uint32{h.server.AllowFromHostPolicy.VppID}, conf.EgressPolicyIDs...)
@@ -207,11 +214,15 @@ func (h *HostEndpoint) getForwardPolicies(state *PolicyState) (conf *types.Inter
207214
}
208215
if len(conf.EgressPolicyIDs) > 0 {
209216
conf.EgressPolicyIDs = append([]uint32{h.server.allowToHostPolicy.VppID}, conf.EgressPolicyIDs...)
210-
conf.UserDefinedRx = 1
217+
conf.PolicyDefaultRx = capo.CAPO_DEFAULT_DENY
218+
} else if len(conf.ProfileIDs) > 0 {
219+
conf.PolicyDefaultRx = capo.CAPO_DEFAULT_PASS
211220
}
212221
if len(conf.IngressPolicyIDs) > 0 {
213222
conf.IngressPolicyIDs = append([]uint32{h.server.allowToHostPolicy.VppID}, conf.IngressPolicyIDs...)
214-
conf.UserDefinedTx = 1
223+
conf.PolicyDefaultTx = capo.CAPO_DEFAULT_DENY
224+
} else if len(conf.ProfileIDs) > 0 {
225+
conf.PolicyDefaultTx = capo.CAPO_DEFAULT_PASS
215226
}
216227
return conf, nil
217228
}
@@ -288,6 +299,7 @@ func (h *HostEndpoint) Delete(vpp *vpplink.VppLink, state *PolicyState) (err err
288299
h.server.log.Infof("policy(del) interface swif=%d", swIfIndex)
289300
conf := types.NewInterfaceConfig()
290301
conf.IngressPolicyIDs = h.server.defaultTap0IngressConf
302+
conf.EgressPolicyIDs = h.server.defaultTap0EgressConf
291303
err = vpp.ConfigurePolicies(swIfIndex, conf, 0)
292304
if err != nil {
293305
return errors.Wrapf(err, "cannot unconfigure policies on interface %d", swIfIndex)

‎calico-vpp-agent/felix/workload_endpoint.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"github.com/projectcalico/calico/felix/proto"
2323

2424
"github.com/projectcalico/vpp-dataplane/v3/vpplink"
25+
"github.com/projectcalico/vpp-dataplane/v3/vpplink/generated/bindings/capo"
2526
"github.com/projectcalico/vpp-dataplane/v3/vpplink/types"
2627
)
2728

@@ -131,10 +132,14 @@ func (w *WorkloadEndpoint) getWorkloadPolicies(state *PolicyState, network strin
131132
}
132133
if len(conf.IngressPolicyIDs) > 0 {
133134
conf.IngressPolicyIDs = append([]uint32{w.server.AllowFromHostPolicy.VppID}, conf.IngressPolicyIDs...)
134-
conf.UserDefinedTx = 1
135+
conf.PolicyDefaultTx = capo.CAPO_DEFAULT_DENY
136+
} else if len(conf.ProfileIDs) > 0 {
137+
conf.PolicyDefaultTx = capo.CAPO_DEFAULT_PASS
135138
}
136139
if len(conf.EgressPolicyIDs) > 0 {
137-
conf.UserDefinedRx = 1
140+
conf.PolicyDefaultRx = capo.CAPO_DEFAULT_DENY
141+
} else if len(conf.ProfileIDs) > 0 {
142+
conf.PolicyDefaultRx = capo.CAPO_DEFAULT_PASS
138143
}
139144
return conf, nil
140145
}

‎vpplink/capo.go‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -200,14 +200,16 @@ func (v *VppLink) ConfigurePolicies(swIfIndex uint32, conf *types.InterfaceConfi
200200
ids := append(rxPolicyIDs, txPolicyIDs...)
201201
ids = append(ids, profileIDs...)
202202
_, err := client.CapoConfigurePolicies(v.GetContext(), &capo.CapoConfigurePolicies{
203-
SwIfIndex: swIfIndex,
204-
NumRxPolicies: uint32(len(rxPolicyIDs)),
205-
NumTxPolicies: uint32(len(txPolicyIDs)),
206-
TotalIds: uint32(len(rxPolicyIDs) + len(txPolicyIDs) + len(profileIDs)),
207-
PolicyIds: ids,
208-
InvertRxTx: invertRxTx,
209-
UserDefinedRx: conf.UserDefinedRx,
210-
UserDefinedTx: conf.UserDefinedTx,
203+
SwIfIndex: swIfIndex,
204+
NumRxPolicies: uint32(len(rxPolicyIDs)),
205+
NumTxPolicies: uint32(len(txPolicyIDs)),
206+
TotalIds: uint32(len(rxPolicyIDs) + len(txPolicyIDs) + len(profileIDs)),
207+
PolicyIds: ids,
208+
InvertRxTx: invertRxTx,
209+
PolicyDefaultRx: conf.PolicyDefaultRx,
210+
PolicyDefaultTx: conf.PolicyDefaultTx,
211+
ProfileDefaultRx: conf.ProfileDefaultRx,
212+
ProfileDefaultTx: conf.ProfileDefaultTx,
211213
})
212214
if err != nil {
213215
return fmt.Errorf("capoConfigurePolicies failed: %w", err)

‎vpplink/generated/bindings/capo/capo.ba.go‎

Lines changed: 56 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vpplink/generated/generate.log‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,32 @@
1-
VPP Version : 25.06-rc0~248-gfaaad85cd
1+
VPP Version : 25.06.0-20~g0cbcc38af-dirty
22
Binapi-generator version : v0.11.0
3-
VPP Base commit : 91a65d8a5 gerrit:34726/3 interface: add buffer stats api
3+
VPP Base commit : 47505bc21 misc: Initial changes for stable/2506 branch
44
------------------ Cherry picked commits --------------------
55
gerrit:43468/5 capo: fix default behavior and add user defined policy flag
6-
ip: add support for checksum in IP midchain
76
capo: Calico Policies plugin
87
acl: acl-plugin custom policies
98
cnat: [WIP] no k8s maglev from pods
109
pbl: Port based balancer
10+
gerrit:42876/10 gso: add support for ipip tso for phyiscal interfaces
11+
gerrit:42598/12 pg: add support for checksum offload
12+
gerrit:43336/3 gso: fix ip fragment support for gso packet
13+
gerrit:42425/8 interface: add support for proper checksum handling
14+
gerrit:43083/3 virtio: conditionally set checksum offload based on TCP/UDP offload flags
15+
gerrit:43084/3 af_packet: conditionally set checksum offload based on TCP/UDP offload flags
16+
gerrit:43082/6 ipip: fix the offload flags
17+
gerrit:42891/5 ip: compute checksums before fragmentation if offloaded
18+
gerrit:43081/2 interface: clear flags after checksum computation
19+
gerrit:42419/5 dpdk: fix the outer flags
20+
gerrit:42186/6 tap: enable IPv4 checksum offload on interface
21+
gerrit:42185/6 vnet: add assert for offload flags in debug mode
22+
gerrit:42184/6 interface: add a new cap for virtual interfaces
1123
gerrit:revert:39675/5 Revert "ip-neighbor: do not use sas to determine NS source address"
1224
gerrit:34726/3 interface: add buffer stats api
25+
misc: VPP 25.06 Release Notes
26+
hsa: http client init wrk->vlib_main in setup
27+
tls: add half close support
28+
af_packet: show host interface offload flags
29+
af_packet: fix the error handling on transmit
30+
dma_intel: fix ats_disable attribute handling
31+
misc: Initial changes for stable/2506 branch
1332
-------------------------------------------------------------

‎vpplink/generated/vpp_clone_current.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,4 +148,4 @@ git_apply_private 0003-acl-acl-plugin-custom-policies.patch
148148
git_apply_private 0004-capo-Calico-Policies-plugin.patch
149149

150150

151-
git_cherry_pick refs/changes/68/43468/5 https://gerrit.fd.io/r/c/vpp/+/43468
151+
git_cherry_pick refs/changes/68/43468/6 https://gerrit.fd.io/r/c/vpp/+/43468

‎vpplink/types/capo.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -326,17 +326,21 @@ type InterfaceConfig struct {
326326
IngressPolicyIDs []uint32
327327
EgressPolicyIDs []uint32
328328
ProfileIDs []uint32
329-
UserDefinedRx uint8
330-
UserDefinedTx uint8
329+
PolicyDefaultRx capo.CapoPolicyDefault
330+
PolicyDefaultTx capo.CapoPolicyDefault
331+
ProfileDefaultRx capo.CapoPolicyDefault
332+
ProfileDefaultTx capo.CapoPolicyDefault
331333
}
332334

333335
func NewInterfaceConfig() *InterfaceConfig {
334336
return &InterfaceConfig{
335337
IngressPolicyIDs: make([]uint32, 0),
336338
EgressPolicyIDs: make([]uint32, 0),
337339
ProfileIDs: make([]uint32, 0),
338-
UserDefinedRx: 0,
339-
UserDefinedTx: 0,
340+
PolicyDefaultRx: capo.CAPO_DEFAULT_ALLOW,
341+
PolicyDefaultTx: capo.CAPO_DEFAULT_ALLOW,
342+
ProfileDefaultRx: capo.CAPO_DEFAULT_DENY,
343+
ProfileDefaultTx: capo.CAPO_DEFAULT_DENY,
340344
}
341345
}
342346

0 commit comments

Comments
 (0)