connections

Documentation

Index

• func NetlinkFlowToAntreaConnection(conn *conntrack.Flow) *flowexporter.Connection
• func NewConnTrackOvsAppCtl(nodeConfig *config.NodeConfig, serviceCIDRv4 *net.IPNet, ...) *connTrackOvsCtl
• func NewConnTrackSystem(nodeConfig *config.NodeConfig, serviceCIDRv4 *net.IPNet, ...) *connTrackSystem
• func NewConnectionStore(ifaceStore interfacestore.InterfaceStore, proxier proxy.Proxier, ...) connectionStore
• func SetupConntrackParameters() error
• type ConnTrackDumper
  • func InitializeConnTrackDumper(nodeConfig *config.NodeConfig, serviceCIDRv4 *net.IPNet, ...) ConnTrackDumper
• type ConntrackConnectionStore
  • func NewConntrackConnectionStore(connTrackDumper ConnTrackDumper, v4Enabled bool, v6Enabled bool, ...) *ConntrackConnectionStore
  • func (cs *ConntrackConnectionStore) AcquireConnStoreLock()
  • func (cs *ConntrackConnectionStore) AddConnToMap(connKey *flowexporter.ConnectionKey, conn *flowexporter.Connection)
  • func (cs *ConntrackConnectionStore) AddOrUpdateConn(conn *flowexporter.Connection)
  • func (cs *ConntrackConnectionStore) ForAllConnectionsDo(callback flowexporter.ConnectionMapCallBack) error
  • func (cs *ConntrackConnectionStore) ForAllConnectionsDoWithoutLock(callback flowexporter.ConnectionMapCallBack) error
  • func (cs *ConntrackConnectionStore) GetConnByKey(connKey flowexporter.ConnectionKey) (*flowexporter.Connection, bool)
  • func (cs *ConntrackConnectionStore) GetExpiredConns(expiredConns []flowexporter.Connection, currTime time.Time, maxSize int) ([]flowexporter.Connection, time.Duration)
  • func (cs *ConntrackConnectionStore) GetPriorityQueue() *priorityqueue.ExpirePriorityQueue
  • func (cs *ConntrackConnectionStore) Poll() ([]int, error)
  • func (cs *ConntrackConnectionStore) ReleaseConnStoreLock()
  • func (cs *ConntrackConnectionStore) Run(stopCh <-chan struct{})
  • func (cs *ConntrackConnectionStore) UpdateConnAndQueue(pqItem *flowexporter.ItemToExpire, currTime time.Time)
• type DenyConnectionStore
  • func NewDenyConnectionStore(ifaceStore interfacestore.InterfaceStore, proxier proxy.Proxier, ...) *DenyConnectionStore
  • func (cs *DenyConnectionStore) AcquireConnStoreLock()
  • func (cs *DenyConnectionStore) AddConnToMap(connKey *flowexporter.ConnectionKey, conn *flowexporter.Connection)
  • func (ds *DenyConnectionStore) AddOrUpdateConn(conn *flowexporter.Connection, timeSeen time.Time, bytes uint64)
  • func (cs *DenyConnectionStore) ForAllConnectionsDo(callback flowexporter.ConnectionMapCallBack) error
  • func (cs *DenyConnectionStore) ForAllConnectionsDoWithoutLock(callback flowexporter.ConnectionMapCallBack) error
  • func (cs *DenyConnectionStore) GetConnByKey(connKey flowexporter.ConnectionKey) (*flowexporter.Connection, bool)
  • func (ds *DenyConnectionStore) GetExpiredConns(expiredConns []flowexporter.Connection, currTime time.Time, maxSize int) ([]flowexporter.Connection, time.Duration)
  • func (ds *DenyConnectionStore) GetPriorityQueue() *priorityqueue.ExpirePriorityQueue
  • func (cs *DenyConnectionStore) ReleaseConnStoreLock()
  • func (ds *DenyConnectionStore) RunPeriodicDeletion(stopCh <-chan struct{})
  • func (cs *DenyConnectionStore) UpdateConnAndQueue(pqItem *flowexporter.ItemToExpire, currTime time.Time)
• type NetFilterConnTrack

Functions

func NetlinkFlowToAntreaConnection

func NetlinkFlowToAntreaConnection(conn *conntrack.Flow) *flowexporter.Connection

func NewConnTrackOvsAppCtl

func NewConnTrackOvsAppCtl(nodeConfig *config.NodeConfig, serviceCIDRv4 *net.IPNet, serviceCIDRv6 *net.IPNet, isAntreaProxyEnabled bool) *connTrackOvsCtl

func NewConnTrackSystem

func NewConnTrackSystem(nodeConfig *config.NodeConfig, serviceCIDRv4 *net.IPNet, serviceCIDRv6 *net.IPNet, isAntreaProxyEnabled bool) *connTrackSystem

TODO: detect the endianness of the system when initializing conntrack dumper to handle situations on big-endian platforms. All connection labels are required to store in little endian format in conntrack dumper.

func NewConnectionStore

func NewConnectionStore(
	ifaceStore interfacestore.InterfaceStore,
	proxier proxy.Proxier,
	o *flowexporter.FlowExporterOptions) connectionStore

func SetupConntrackParameters

func SetupConntrackParameters() error

Types

type ConnTrackDumper

type ConnTrackDumper interface {
	// DumpFlows returns a list of filtered connections and the number of total connections.
	DumpFlows(zoneFilter uint16) ([]*flowexporter.Connection, int, error)
	// GetMaxConnections returns the size of the connection tracking table.
	GetMaxConnections() (int, error)
}

ConnTrackDumper is an interface that is used to dump connections from conntrack module. This supports dumping through netfilter socket (OVS kernel datapath) and ovs-appctl command (OVS userspace datapath). In future, support will be extended to Windows.

func InitializeConnTrackDumper

func InitializeConnTrackDumper(nodeConfig *config.NodeConfig, serviceCIDRv4 *net.IPNet, serviceCIDRv6 *net.IPNet, ovsDatapathType ovsconfig.OVSDatapathType, isAntreaProxyEnabled bool) ConnTrackDumper

InitializeConnTrackDumper initializes the ConnTrackDumper interface for different OS and datapath types.

type ConntrackConnectionStore

type ConntrackConnectionStore struct {
	// contains filtered or unexported fields
}

func NewConntrackConnectionStore

func NewConntrackConnectionStore(
	connTrackDumper ConnTrackDumper,
	v4Enabled bool,
	v6Enabled bool,
	npQuerier querier.AgentNetworkPolicyInfoQuerier,
	ifaceStore interfacestore.InterfaceStore,
	proxier proxy.Proxier,
	o *flowexporter.FlowExporterOptions,
) *ConntrackConnectionStore

func (*ConntrackConnectionStore) AcquireConnStoreLock

func (cs *ConntrackConnectionStore) AcquireConnStoreLock()

func (*ConntrackConnectionStore) AddConnToMap

func (cs *ConntrackConnectionStore) AddConnToMap(connKey *flowexporter.ConnectionKey, conn *flowexporter.Connection)

AddConnToMap adds the connection to connections map given connection key. This is used only for unit tests.

func (*ConntrackConnectionStore) AddOrUpdateConn

func (cs *ConntrackConnectionStore) AddOrUpdateConn(conn *flowexporter.Connection)

AddOrUpdateConn updates the connection if it is already present, i.e., update timestamp, counters etc., or adds a new connection with the resolved K8s metadata.

func (*ConntrackConnectionStore) ForAllConnectionsDo

func (cs *ConntrackConnectionStore) ForAllConnectionsDo(callback flowexporter.ConnectionMapCallBack) error

ForAllConnectionsDo execute the callback for each connection in connection map.

func (*ConntrackConnectionStore) ForAllConnectionsDoWithoutLock

func (cs *ConntrackConnectionStore) ForAllConnectionsDoWithoutLock(callback flowexporter.ConnectionMapCallBack) error

ForAllConnectionsDoWithoutLock execute the callback for each connection in connection map, without grabbing the lock. Caller is expected to grab lock.

func (*ConntrackConnectionStore) GetConnByKey

func (cs *ConntrackConnectionStore) GetConnByKey(connKey flowexporter.ConnectionKey) (*flowexporter.Connection, bool)

GetConnByKey gets the connection in connection map given the connection key.

func (*ConntrackConnectionStore) GetExpiredConns

func (cs *ConntrackConnectionStore) GetExpiredConns(expiredConns []flowexporter.Connection, currTime time.Time, maxSize int) ([]flowexporter.Connection, time.Duration)

func (*ConntrackConnectionStore) GetPriorityQueue

func (cs *ConntrackConnectionStore) GetPriorityQueue() *priorityqueue.ExpirePriorityQueue

func (*ConntrackConnectionStore) Poll

func (cs *ConntrackConnectionStore) Poll() ([]int, error)

Poll calls into conntrackDumper interface to dump conntrack flows. It returns the number of connections for each address family, as a slice. In dual-stack clusters, the slice will contain 2 values (number of IPv4 connections first, then number of IPv6 connections). TODO: As optimization, only poll invalid/closed connections during every poll, and poll the established connections right before the export.

func (*ConntrackConnectionStore) ReleaseConnStoreLock

func (cs *ConntrackConnectionStore) ReleaseConnStoreLock()

func (*ConntrackConnectionStore) Run

func (cs *ConntrackConnectionStore) Run(stopCh <-chan struct{})

Run enables the periodical polling of conntrack connections at a given flowPollInterval.

func (*ConntrackConnectionStore) UpdateConnAndQueue

func (cs *ConntrackConnectionStore) UpdateConnAndQueue(pqItem *flowexporter.ItemToExpire, currTime time.Time)

UpdateConnAndQueue deletes the inactive connection from keyToItem map, without adding it back to the PQ. In this way, we can avoid to reset the item's expire time every time we encounter it in the PQ. The method also updates active connection's stats fields and adds it back to the PQ.

type DenyConnectionStore

type DenyConnectionStore struct {
	// contains filtered or unexported fields
}

func NewDenyConnectionStore

func NewDenyConnectionStore(ifaceStore interfacestore.InterfaceStore, proxier proxy.Proxier, o *flowexporter.FlowExporterOptions) *DenyConnectionStore

func (*DenyConnectionStore) AcquireConnStoreLock

func (cs *DenyConnectionStore) AcquireConnStoreLock()

func (*DenyConnectionStore) AddConnToMap

func (cs *DenyConnectionStore) AddConnToMap(connKey *flowexporter.ConnectionKey, conn *flowexporter.Connection)

AddConnToMap adds the connection to connections map given connection key. This is used only for unit tests.

func (*DenyConnectionStore) AddOrUpdateConn

func (ds *DenyConnectionStore) AddOrUpdateConn(conn *flowexporter.Connection, timeSeen time.Time, bytes uint64)

AddOrUpdateConn updates the connection if it is already present, i.e., update timestamp, counters etc., or adds a new connection with the resolved K8s metadata.

func (*DenyConnectionStore) ForAllConnectionsDo

func (cs *DenyConnectionStore) ForAllConnectionsDo(callback flowexporter.ConnectionMapCallBack) error

ForAllConnectionsDo execute the callback for each connection in connection map.

func (*DenyConnectionStore) ForAllConnectionsDoWithoutLock

func (cs *DenyConnectionStore) ForAllConnectionsDoWithoutLock(callback flowexporter.ConnectionMapCallBack) error

ForAllConnectionsDoWithoutLock execute the callback for each connection in connection map, without grabbing the lock. Caller is expected to grab lock.

func (*DenyConnectionStore) GetConnByKey

func (cs *DenyConnectionStore) GetConnByKey(connKey flowexporter.ConnectionKey) (*flowexporter.Connection, bool)

GetConnByKey gets the connection in connection map given the connection key.

func (*DenyConnectionStore) GetExpiredConns

func (ds *DenyConnectionStore) GetExpiredConns(expiredConns []flowexporter.Connection, currTime time.Time, maxSize int) ([]flowexporter.Connection, time.Duration)

func (*DenyConnectionStore) GetPriorityQueue

func (ds *DenyConnectionStore) GetPriorityQueue() *priorityqueue.ExpirePriorityQueue

func (*DenyConnectionStore) ReleaseConnStoreLock

func (cs *DenyConnectionStore) ReleaseConnStoreLock()

func (*DenyConnectionStore) RunPeriodicDeletion

func (ds *DenyConnectionStore) RunPeriodicDeletion(stopCh <-chan struct{})

func (*DenyConnectionStore) UpdateConnAndQueue

func (cs *DenyConnectionStore) UpdateConnAndQueue(pqItem *flowexporter.ItemToExpire, currTime time.Time)

UpdateConnAndQueue deletes the inactive connection from keyToItem map, without adding it back to the PQ. In this way, we can avoid to reset the item's expire time every time we encounter it in the PQ. The method also updates active connection's stats fields and adds it back to the PQ.

type NetFilterConnTrack

type NetFilterConnTrack interface {
	Dial() error
	DumpFlowsInCtZone(zoneFilter uint16) ([]*flowexporter.Connection, error)
}

NetFilterConnTrack interface helps for testing the code that contains the third party library functions ("github.com/ti-mo/conntrack")