policymap

Documentation

Index

• Constants
• func CallString(id uint16) string
• func RemoveGlobalMapping(id uint32) error
• type PolicyEntriesDump
  • func (p PolicyEntriesDump) Less(i, j int) bool
• type PolicyEntry
  • func (pe *PolicyEntry) Add(oPe PolicyEntry)
  • func (pe *PolicyEntry) GetValuePtr() unsafe.Pointer
  • func (pe *PolicyEntry) NewValue() bpf.MapValue
  • func (pe *PolicyEntry) String() string
• type PolicyEntryDump
• type PolicyKey
  • func (key *PolicyKey) GetKeyPtr() unsafe.Pointer
  • func (key *PolicyKey) NewValue() bpf.MapValue
  • func (key *PolicyKey) String() string
  • func (key *PolicyKey) ToHost() PolicyKey
  • func (key *PolicyKey) ToNetwork() PolicyKey
• type PolicyMap
  • func Open(path string) (*PolicyMap, error)
  • func OpenOrCreate(path string) (*PolicyMap, bool, error)
  • func (pm *PolicyMap) Allow(id uint32, dport uint16, proto u8proto.U8proto, ...) error
  • func (pm *PolicyMap) AllowKey(k PolicyKey, proxyPort uint16) error
  • func (pm *PolicyMap) Delete(id uint32, dport uint16, proto u8proto.U8proto, ...) error
  • func (pm *PolicyMap) DeleteEntry(entry *PolicyEntryDump) error
  • func (pm *PolicyMap) DeleteKey(key PolicyKey) error
  • func (pm *PolicyMap) Dump() (string, error)
  • func (pm *PolicyMap) DumpToSlice() (PolicyEntriesDump, error)
  • func (pm *PolicyMap) Exists(id uint32, dport uint16, proto u8proto.U8proto, ...) bool
  • func (pm *PolicyMap) String() string
• type PolicyPlumbingMap
  • func OpenCallMap() (*PolicyPlumbingMap, error)

Constants

const (
	// CallMapName is the name of the map to do tail calls into policy
	// enforcement programs
	CallMapName = "cilium_policy"

	// MapName is the prefix for endpoint-specific policy maps which map
	// identity+ports+direction to whether the policy allows communication
	// with that identity on that port for that direction.
	MapName = CallMapName + "_"

	// MaxEntries is the upper limit of entries in the per endpoint policy
	// table
	MaxEntries = 16384

	// ProgArrayMaxEntries is the upper limit of entries in the program
	// array for the tail calls to jump into the endpoint specific policy
	// programs. This number *MUST* be identical to the maximum endponit ID.
	ProgArrayMaxEntries = ^uint16(0)

	// AllPorts is used to ignore the L4 ports in PolicyMap lookups; all ports
	// are allowed. In the datapath, this is represented with the value 0 in the
	// port field of map elements.
	AllPorts = uint16(0)
)

Functions

func CallString

func CallString(id uint16) string

CallString returns the string which indicates the calls map by index in the ELF, and index into that call map for a specific endpoint.

Derived from __section_tail(CILIUM_MAP_CALLS, NAME) per bpf/lib/tailcall.h.

func RemoveGlobalMapping

func RemoveGlobalMapping(id uint32) error

RemoveGlobalMapping removes the mapping from the specified endpoint ID to the BPF policy program for that endpoint.

Types

type PolicyEntriesDump

type PolicyEntriesDump []PolicyEntryDump

PolicyEntriesDump is a wrapper for a slice of PolicyEntryDump

func (PolicyEntriesDump) Less

func (p PolicyEntriesDump) Less(i, j int) bool

Less returns true if the element in index `i` has the value of TrafficDirection lower than `j`'s TrafficDirection or if the element in index `i` has the value of TrafficDirection lower and equal than `j`'s TrafficDirection and the identity of element `i` is lower than the Identity of element j.

type PolicyEntry

type PolicyEntry struct {
	ProxyPort uint16 // In network byte-order
	Pad0      uint16
	Pad1      uint16
	Pad2      uint16
	Packets   uint64
	Bytes     uint64
}

PolicyEntry represents an entry in the BPF policy map for an endpoint. It must match the layout of policy_entry in bpf/lib/common.h.

func (*PolicyEntry) Add

func (pe *PolicyEntry) Add(oPe PolicyEntry)

func (*PolicyEntry) GetValuePtr

func (pe *PolicyEntry) GetValuePtr() unsafe.Pointer

func (*PolicyEntry) NewValue

func (pe *PolicyEntry) NewValue() bpf.MapValue

func (*PolicyEntry) String

func (pe *PolicyEntry) String() string

type PolicyEntryDump

type PolicyEntryDump struct {
	PolicyEntry
	Key PolicyKey
}

type PolicyKey

type PolicyKey struct {
	Identity         uint32
	DestPort         uint16 // In network byte-order
	Nexthdr          uint8
	TrafficDirection uint8
}

PolicyKey represents a key in the BPF policy map for an endpoint. It must match the layout of policy_key in bpf/lib/common.h.

func (*PolicyKey) GetKeyPtr

func (key *PolicyKey) GetKeyPtr() unsafe.Pointer

func (*PolicyKey) NewValue

func (key *PolicyKey) NewValue() bpf.MapValue

func (*PolicyKey) String

func (key *PolicyKey) String() string

func (*PolicyKey) ToHost

func (key *PolicyKey) ToHost() PolicyKey

ToHost returns a copy of key with fields converted from network byte-order to host-byte-order if necessary.

func (*PolicyKey) ToNetwork

func (key *PolicyKey) ToNetwork() PolicyKey

ToNetwork returns a copy of key with fields converted from host byte-order to network-byte-order if necessary.

type PolicyMap

type PolicyMap struct {
	*bpf.Map
}

func Open

func Open(path string) (*PolicyMap, error)

Open opens the policymap at the specified path.

func OpenOrCreate

func OpenOrCreate(path string) (*PolicyMap, bool, error)

OpenOrCreate opens (or creates) a policy map at the specified path, which is used to govern which peer identities can communicate with the endpoint protected by this map.

func (*PolicyMap) Allow

func (pm *PolicyMap) Allow(id uint32, dport uint16, proto u8proto.U8proto, trafficDirection trafficdirection.TrafficDirection, proxyPort uint16) error

Allow pushes an entry into the PolicyMap to allow traffic in the given `trafficDirection` for identity `id` with destination port `dport` over protocol `proto`. It is assumed that `dport` and `proxyPort` are in host byte-order.

func (*PolicyMap) AllowKey

func (pm *PolicyMap) AllowKey(k PolicyKey, proxyPort uint16) error

AllowKey pushes an entry into the PolicyMap for the given PolicyKey k. Returns an error if the update of the PolicyMap fails.

func (*PolicyMap) Delete

func (pm *PolicyMap) Delete(id uint32, dport uint16, proto u8proto.U8proto, trafficDirection trafficdirection.TrafficDirection) error

Delete removes an entry from the PolicyMap for identity `id` sending traffic in direction `trafficDirection` with destination port `dport` over protocol `proto`. It is assumed that `dport` is in host byte-order. Returns an error if the deletion did not succeed.

func (*PolicyMap) DeleteEntry

func (pm *PolicyMap) DeleteEntry(entry *PolicyEntryDump) error

DeleteEntry removes an entry from the PolicyMap. It can be used in conjunction with DumpToSlice() to inspect and delete map entries.

func (*PolicyMap) DeleteKey

func (pm *PolicyMap) DeleteKey(key PolicyKey) error

DeleteKey deletes the key-value pair from the given PolicyMap with PolicyKey k. Returns an error if deletion from the PolicyMap fails.

func (*PolicyMap) Dump

func (pm *PolicyMap) Dump() (string, error)

func (*PolicyMap) DumpToSlice

func (pm *PolicyMap) DumpToSlice() (PolicyEntriesDump, error)

func (*PolicyMap) Exists

func (pm *PolicyMap) Exists(id uint32, dport uint16, proto u8proto.U8proto, trafficDirection trafficdirection.TrafficDirection) bool

Exists determines whether PolicyMap currently contains an entry that allows traffic in `trafficDirection` for identity `id` with destination port `dport`over protocol `proto`. It is assumed that `dport` is in host byte-order.

func (*PolicyMap) String

func (pm *PolicyMap) String() string

String returns a human-readable string representing the policy map.

type PolicyPlumbingMap

type PolicyPlumbingMap struct {
	*bpf.Map
}

PolicyPlumbingMap maps endpoint IDs to the fd for the program which implements its policy.

func OpenCallMap

func OpenCallMap() (*PolicyPlumbingMap, error)

OpenCallMap opens the map that maps endpoint IDs to program file descriptors, which allows tail calling into the policy datapath code from other BPF programs.