Documentation ¶
Index ¶
- Constants
- Variables
- func EndpointChainName(prefix string, ifaceName string) string
- func PolicyChainName(prefix PolicyChainNamePrefix, polID *proto.PolicyID) string
- func ProfileChainName(prefix ProfileChainNamePrefix, profID *proto.ProfileID) string
- func SplitPortList(ports []*proto.PortRange) (splits [][]*proto.PortRange)
- type Config
- type DefaultEPMarkManager
- type DefaultRuleRenderer
- func (r *DefaultRuleRenderer) CalculateActions(pRule *proto.Rule, ipVersion uint8) (mark uint32, actions []iptables.Action)
- func (r *DefaultRuleRenderer) CalculateRuleMatch(pRule *proto.Rule, ipVersion uint8) (iptables.MatchCriteria, error)
- func (r *DefaultRuleRenderer) DNATsToIptablesChains(dnats map[string]string) []*iptables.Chain
- func (r *DefaultRuleRenderer) EndpointMarkDispatchChains(epMarkMapper EndpointMarkMapper, ...) []*Chain
- func (r *DefaultRuleRenderer) FromHostDispatchChains(endpoints map[string]proto.HostEndpointID, defaultChainName string) []*Chain
- func (r *DefaultRuleRenderer) HostDispatchChains(endpoints map[string]proto.HostEndpointID, applyOnForward bool) []*Chain
- func (r *DefaultRuleRenderer) HostEndpointToFilterChains(ifaceName string, epMarkMapper EndpointMarkMapper, ingressPolicyNames []string, ...) []*Chain
- func (r *DefaultRuleRenderer) HostEndpointToMangleChains(ifaceName string, preDNATPolicyNames []string) []*Chain
- func (r *DefaultRuleRenderer) HostEndpointToRawChains(ifaceName string, ingressPolicyNames []string, egressPolicyNames []string) []*Chain
- func (r *DefaultRuleRenderer) MakeNatOutgoingRule(protocol string, action iptables.Action, ipVersion uint8) iptables.Rule
- func (r *DefaultRuleRenderer) NATOutgoingChain(natOutgoingActive bool, ipVersion uint8) *iptables.Chain
- func (r *DefaultRuleRenderer) PolicyToIptablesChains(policyID *proto.PolicyID, policy *proto.Policy, ipVersion uint8) []*iptables.Chain
- func (r *DefaultRuleRenderer) ProfileToIptablesChains(profileID *proto.ProfileID, profile *proto.Profile, ipVersion uint8) []*iptables.Chain
- func (r *DefaultRuleRenderer) ProtoRuleToIptablesRules(pRule *proto.Rule, ipVersion uint8) []iptables.Rule
- func (r *DefaultRuleRenderer) ProtoRulesToIptablesRules(protoRules []*proto.Rule, ipVersion uint8) []iptables.Rule
- func (r *DefaultRuleRenderer) SNATsToIptablesChains(snats map[string]string) []*iptables.Chain
- func (r *DefaultRuleRenderer) StaticFilterForwardChains() []*Chain
- func (r *DefaultRuleRenderer) StaticFilterInputChains(ipVersion uint8) []*Chain
- func (r *DefaultRuleRenderer) StaticFilterInputForwardCheckChain(ipVersion uint8) *Chain
- func (r *DefaultRuleRenderer) StaticFilterOutputChains(ipVersion uint8) []*Chain
- func (r *DefaultRuleRenderer) StaticFilterOutputForwardEndpointMarkChain() *Chain
- func (r *DefaultRuleRenderer) StaticFilterTableChains(ipVersion uint8) (chains []*Chain)
- func (r *DefaultRuleRenderer) StaticManglePreroutingChain(ipVersion uint8) *Chain
- func (r *DefaultRuleRenderer) StaticMangleTableChains(ipVersion uint8) (chains []*Chain)
- func (r *DefaultRuleRenderer) StaticNATOutputChains(ipVersion uint8) []*Chain
- func (r *DefaultRuleRenderer) StaticNATPostroutingChains(ipVersion uint8) []*Chain
- func (r *DefaultRuleRenderer) StaticNATPreroutingChains(ipVersion uint8) []*Chain
- func (r *DefaultRuleRenderer) StaticNATTableChains(ipVersion uint8) (chains []*Chain)
- func (r *DefaultRuleRenderer) StaticRawOutputChain() *Chain
- func (r *DefaultRuleRenderer) StaticRawPreroutingChain(ipVersion uint8) *Chain
- func (r *DefaultRuleRenderer) StaticRawTableChains(ipVersion uint8) []*Chain
- func (r *DefaultRuleRenderer) WorkloadDispatchChains(endpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint) []*Chain
- func (r *DefaultRuleRenderer) WorkloadEndpointToIptablesChains(ifaceName string, epMarkMapper EndpointMarkMapper, adminUp bool, ...) []*Chain
- type EndpointMarkMapper
- type HashCalculator32
- type PolicyChainNamePrefix
- type ProfileChainNamePrefix
- type RuleRenderer
Constants ¶
const ( // ChainNamePrefix is a prefix used for all our iptables chain names. We include a '-' at // the end to reduce clashes with other apps. Our OpenStack DHCP agent uses prefix // 'calico-dhcp-', for example. ChainNamePrefix = "cali-" // IPSetNamePrefix: similarly for IP sets, we use the following prefix; the IP sets layer // adds its own "-" so it isn't included here. IPSetNamePrefix = "cali" ChainFilterInput = ChainNamePrefix + "INPUT" ChainFilterForward = ChainNamePrefix + "FORWARD" ChainFilterOutput = ChainNamePrefix + "OUTPUT" ChainRawPrerouting = ChainNamePrefix + "PREROUTING" ChainRawOutput = ChainNamePrefix + "OUTPUT" ChainFailsafeIn = ChainNamePrefix + "failsafe-in" ChainFailsafeOut = ChainNamePrefix + "failsafe-out" ChainNATPrerouting = ChainNamePrefix + "PREROUTING" ChainNATPostrouting = ChainNamePrefix + "POSTROUTING" ChainNATOutput = ChainNamePrefix + "OUTPUT" ChainNATOutgoing = ChainNamePrefix + "nat-outgoing" ChainManglePrerouting = ChainNamePrefix + "PREROUTING" IPSetIDNATOutgoingAllPools = "all-ipam-pools" IPSetIDNATOutgoingMasqPools = "masq-ipam-pools" IPSetIDAllHostNets = "all-hosts-net" IPSetIDAllVXLANSourceNets = "all-vxlan-net" IPSetIDThisHostIPs = "this-host" ChainFIPDnat = ChainNamePrefix + "fip-dnat" ChainFIPSnat = ChainNamePrefix + "fip-snat" PolicyInboundPfx PolicyChainNamePrefix = ChainNamePrefix + "pi-" PolicyOutboundPfx PolicyChainNamePrefix = ChainNamePrefix + "po-" ProfileInboundPfx ProfileChainNamePrefix = ChainNamePrefix + "pri-" ProfileOutboundPfx ProfileChainNamePrefix = ChainNamePrefix + "pro-" ChainWorkloadToHost = ChainNamePrefix + "wl-to-host" ChainFromWorkloadDispatch = ChainNamePrefix + "from-wl-dispatch" ChainToWorkloadDispatch = ChainNamePrefix + "to-wl-dispatch" ChainDispatchToHostEndpoint = ChainNamePrefix + "to-host-endpoint" ChainDispatchFromHostEndpoint = ChainNamePrefix + "from-host-endpoint" ChainDispatchToHostEndpointForward = ChainNamePrefix + "to-hep-forward" ChainDispatchFromHostEndPointForward = ChainNamePrefix + "from-hep-forward" ChainDispatchSetEndPointMark = ChainNamePrefix + "set-endpoint-mark" ChainDispatchFromEndPointMark = ChainNamePrefix + "from-endpoint-mark" ChainForwardCheck = ChainNamePrefix + "forward-check" ChainForwardEndpointMark = ChainNamePrefix + "forward-endpoint-mark" WorkloadToEndpointPfx = ChainNamePrefix + "tw-" WorkloadFromEndpointPfx = ChainNamePrefix + "fw-" SetEndPointMarkPfx = ChainNamePrefix + "sm-" HostToEndpointPfx = ChainNamePrefix + "th-" HostFromEndpointPfx = ChainNamePrefix + "fh-" HostToEndpointForwardPfx = ChainNamePrefix + "thfw-" HostFromEndpointForwardPfx = ChainNamePrefix + "fhfw-" RuleHashPrefix = "cali:" // HistoricNATRuleInsertRegex is a regex pattern to match to match // special-case rules inserted by old versions of felix. Specifically, // Python felix used to insert a masquerade rule directly into the // POSTROUTING chain. // // Note: this regex depends on the output format of iptables-save so, // where possible, it's best to match only on part of the rule that // we're sure can't change (such as the ipset name in the masquerade // rule). HistoricInsertedNATRuleRegex = `-A POSTROUTING .* felix-masq-ipam-pools .*|` + `-A POSTROUTING -o tunl0 -m addrtype ! --src-type LOCAL --limit-iface-out -m addrtype --src-type LOCAL -j MASQUERADE` )
const ( ProtoIPIP = 4 ProtoTCP = 6 ProtoUDP = 17 ProtoICMPv6 = 58 )
Variables ¶
var ( // AllHistoricChainNamePrefixes lists all the prefixes that we've used for chains. Keeping // track of the old names lets us clean them up. AllHistoricChainNamePrefixes = []string{ "cali-", "califw-", "calitw-", "califh-", "calith-", "calipi-", "calipo-", "felix-", } // AllHistoricIPSetNamePrefixes, similarly contains all the prefixes we've ever used for IP // sets. AllHistoricIPSetNamePrefixes = []string{"felix-", "cali"} // LegacyV4IPSetNames contains some extra IP set names that were used in older versions of // Felix and don't fit our versioned pattern. LegacyV4IPSetNames = []string{"felix-masq-ipam-pools", "felix-all-ipam-pools"} )
var SkipRule = errors.New("Rule skipped")
Functions ¶
func EndpointChainName ¶
func PolicyChainName ¶
func PolicyChainName(prefix PolicyChainNamePrefix, polID *proto.PolicyID) string
func ProfileChainName ¶
func ProfileChainName(prefix ProfileChainNamePrefix, profID *proto.ProfileID) string
func SplitPortList ¶
SplitPortList splits the input list of ports into groups containing up to 15 port numbers. If the input list is empty, it returns an empty slice.
The requirement to split into groups of 15, comes from iptables' limit on the number of ports "slots" in a multiport match. A single port takes up one slot, a range of ports requires 2.
Types ¶
type Config ¶
type Config struct { IPSetConfigV4 *ipsets.IPVersionConfig IPSetConfigV6 *ipsets.IPVersionConfig WorkloadIfacePrefixes []string IptablesMarkAccept uint32 IptablesMarkPass uint32 IptablesMarkScratch0 uint32 IptablesMarkScratch1 uint32 IptablesMarkEndpoint uint32 // IptablesMarkNonCaliEndpoint is an endpoint mark which is reserved // to mark non-calico (workload or host) endpoint. IptablesMarkNonCaliEndpoint uint32 KubeNodePortRanges []numorstring.Port KubeIPVSSupportEnabled bool OpenStackMetadataIP net.IP OpenStackMetadataPort uint16 OpenStackSpecialCasesEnabled bool VXLANEnabled bool VXLANPort int VXLANVNI int IPIPEnabled bool // IPIPTunnelAddress is an address chosen from an IPAM pool, used as a source address // by the host when sending traffic to a workload over IPIP. IPIPTunnelAddress net.IP // Same for VXLAN. VXLANTunnelAddress net.IP IptablesLogPrefix string EndpointToHostAction string IptablesFilterAllowAction string IptablesMangleAllowAction string FailsafeInboundHostPorts []config.ProtoPort FailsafeOutboundHostPorts []config.ProtoPort DisableConntrackInvalid bool NATPortRange numorstring.Port IptablesNATOutgoingInterfaceFilter string NATOutgoingAddress net.IP }
type DefaultEPMarkManager ¶
type DefaultEPMarkManager struct {
// contains filtered or unexported fields
}
func (*DefaultEPMarkManager) GetEndpointMark ¶
func (epmm *DefaultEPMarkManager) GetEndpointMark(ep string) (uint32, error)
func (*DefaultEPMarkManager) GetMask ¶
func (epmm *DefaultEPMarkManager) GetMask() uint32
func (*DefaultEPMarkManager) ReleaseEndpointMark ¶
func (epmm *DefaultEPMarkManager) ReleaseEndpointMark(ep string)
func (*DefaultEPMarkManager) SetEndpointMark ¶
func (epmm *DefaultEPMarkManager) SetEndpointMark(ep string, mark uint32) error
This is used to set a mark for an endpoint from previous allocated mark. The endpoint should not have a mark already.
type DefaultRuleRenderer ¶
type DefaultRuleRenderer struct { Config // contains filtered or unexported fields }
func (*DefaultRuleRenderer) CalculateActions ¶
func (*DefaultRuleRenderer) CalculateRuleMatch ¶
func (r *DefaultRuleRenderer) CalculateRuleMatch(pRule *proto.Rule, ipVersion uint8) (iptables.MatchCriteria, error)
func (*DefaultRuleRenderer) DNATsToIptablesChains ¶
func (r *DefaultRuleRenderer) DNATsToIptablesChains(dnats map[string]string) []*iptables.Chain
func (*DefaultRuleRenderer) EndpointMarkDispatchChains ¶
func (r *DefaultRuleRenderer) EndpointMarkDispatchChains( epMarkMapper EndpointMarkMapper, wlEndpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint, hepEndpoints map[string]proto.HostEndpointID, ) []*Chain
In some scenario, e.g. packet goes to an kubernetes ipvs service ip. Traffic goes through input/output filter chain instead of forward filter chain. It is not feasible to match on an incoming workload/host interface with service ips. Assemble a set-endpoint-mark chain to set the endpoint mark matching on the incoming workload/host interface and a from-endpoint-mark chain to jump to a corresponding endpoint chain matching on its endpoint mark.
func (*DefaultRuleRenderer) FromHostDispatchChains ¶
func (r *DefaultRuleRenderer) FromHostDispatchChains( endpoints map[string]proto.HostEndpointID, defaultChainName string, ) []*Chain
func (*DefaultRuleRenderer) HostDispatchChains ¶
func (r *DefaultRuleRenderer) HostDispatchChains( endpoints map[string]proto.HostEndpointID, applyOnForward bool, ) []*Chain
func (*DefaultRuleRenderer) HostEndpointToFilterChains ¶
func (r *DefaultRuleRenderer) HostEndpointToFilterChains( ifaceName string, epMarkMapper EndpointMarkMapper, ingressPolicyNames []string, egressPolicyNames []string, ingressForwardPolicyNames []string, egressForwardPolicyNames []string, profileIDs []string, ) []*Chain
func (*DefaultRuleRenderer) HostEndpointToMangleChains ¶
func (r *DefaultRuleRenderer) HostEndpointToMangleChains( ifaceName string, preDNATPolicyNames []string, ) []*Chain
func (*DefaultRuleRenderer) HostEndpointToRawChains ¶
func (r *DefaultRuleRenderer) HostEndpointToRawChains( ifaceName string, ingressPolicyNames []string, egressPolicyNames []string, ) []*Chain
func (*DefaultRuleRenderer) MakeNatOutgoingRule ¶
func (*DefaultRuleRenderer) NATOutgoingChain ¶
func (r *DefaultRuleRenderer) NATOutgoingChain(natOutgoingActive bool, ipVersion uint8) *iptables.Chain
func (*DefaultRuleRenderer) PolicyToIptablesChains ¶
func (*DefaultRuleRenderer) ProfileToIptablesChains ¶
func (*DefaultRuleRenderer) ProtoRuleToIptablesRules ¶
func (*DefaultRuleRenderer) ProtoRulesToIptablesRules ¶
func (*DefaultRuleRenderer) SNATsToIptablesChains ¶
func (r *DefaultRuleRenderer) SNATsToIptablesChains(snats map[string]string) []*iptables.Chain
func (*DefaultRuleRenderer) StaticFilterForwardChains ¶
func (r *DefaultRuleRenderer) StaticFilterForwardChains() []*Chain
func (*DefaultRuleRenderer) StaticFilterInputChains ¶
func (r *DefaultRuleRenderer) StaticFilterInputChains(ipVersion uint8) []*Chain
func (*DefaultRuleRenderer) StaticFilterInputForwardCheckChain ¶
func (r *DefaultRuleRenderer) StaticFilterInputForwardCheckChain(ipVersion uint8) *Chain
Forward check chain is to check if a packet belongs to a forwarded traffic or not. With kube-proxy running in ipvs mode, both local or forwarded traffic goes through INPUT filter chain.
func (*DefaultRuleRenderer) StaticFilterOutputChains ¶
func (r *DefaultRuleRenderer) StaticFilterOutputChains(ipVersion uint8) []*Chain
func (*DefaultRuleRenderer) StaticFilterOutputForwardEndpointMarkChain ¶
func (r *DefaultRuleRenderer) StaticFilterOutputForwardEndpointMarkChain() *Chain
With kube-proxy running in ipvs mode, we categorise traffic going through OUTPUT chain into three classes. Class 1. forwarded packet originated from a calico workload or host endpoint --> INPUT filter --> OUTPUT filter Class 2. forwarded packet originated from a non calico endpoint --> INPUT filter --> OUTPUT filter Class 3. local process originated packet --> OUTPUT filter This function handles traffic in Class 1 and Class 2.
func (*DefaultRuleRenderer) StaticFilterTableChains ¶
func (r *DefaultRuleRenderer) StaticFilterTableChains(ipVersion uint8) (chains []*Chain)
func (*DefaultRuleRenderer) StaticManglePreroutingChain ¶
func (r *DefaultRuleRenderer) StaticManglePreroutingChain(ipVersion uint8) *Chain
func (*DefaultRuleRenderer) StaticMangleTableChains ¶
func (r *DefaultRuleRenderer) StaticMangleTableChains(ipVersion uint8) (chains []*Chain)
func (*DefaultRuleRenderer) StaticNATOutputChains ¶
func (r *DefaultRuleRenderer) StaticNATOutputChains(ipVersion uint8) []*Chain
func (*DefaultRuleRenderer) StaticNATPostroutingChains ¶
func (r *DefaultRuleRenderer) StaticNATPostroutingChains(ipVersion uint8) []*Chain
func (*DefaultRuleRenderer) StaticNATPreroutingChains ¶
func (r *DefaultRuleRenderer) StaticNATPreroutingChains(ipVersion uint8) []*Chain
func (*DefaultRuleRenderer) StaticNATTableChains ¶
func (r *DefaultRuleRenderer) StaticNATTableChains(ipVersion uint8) (chains []*Chain)
func (*DefaultRuleRenderer) StaticRawOutputChain ¶
func (r *DefaultRuleRenderer) StaticRawOutputChain() *Chain
func (*DefaultRuleRenderer) StaticRawPreroutingChain ¶
func (r *DefaultRuleRenderer) StaticRawPreroutingChain(ipVersion uint8) *Chain
func (*DefaultRuleRenderer) StaticRawTableChains ¶
func (r *DefaultRuleRenderer) StaticRawTableChains(ipVersion uint8) []*Chain
func (*DefaultRuleRenderer) WorkloadDispatchChains ¶
func (r *DefaultRuleRenderer) WorkloadDispatchChains( endpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint, ) []*Chain
func (*DefaultRuleRenderer) WorkloadEndpointToIptablesChains ¶
func (r *DefaultRuleRenderer) WorkloadEndpointToIptablesChains( ifaceName string, epMarkMapper EndpointMarkMapper, adminUp bool, ingressPolicies []string, egressPolicies []string, profileIDs []string, ) []*Chain
type EndpointMarkMapper ¶
type EndpointMarkMapper interface { GetMask() uint32 GetEndpointMark(ep string) (uint32, error) ReleaseEndpointMark(ep string) SetEndpointMark(ep string, mark uint32) error }
Endpoint Mark Mapper (EPM) provides set of functions to manage allocation/free endpoint mark bit given a mark bit mask. Note: This is not thread safe.
func NewEndpointMarkMapper ¶
func NewEndpointMarkMapper(markMask, nonCaliMark uint32) EndpointMarkMapper
func NewEndpointMarkMapperWithShim ¶
func NewEndpointMarkMapperWithShim(markMask, nonCaliMark uint32, hash32 HashCalculator32) EndpointMarkMapper
type HashCalculator32 ¶
type HashCalculator32 interface { // Write (via the embedded io.Writer interface) adds more data to the running hash. // It never returns an error. io.Writer // Sum32 returns a hash result of uint32. // It does not change the underlying hash state. Sum32() uint32 // Reset resets the Hash to its initial state. Reset() }
This interface has subset of functions of built in hash32 interface.
type PolicyChainNamePrefix ¶
type PolicyChainNamePrefix string
Typedefs to prevent accidentally passing the wrong prefix to the Policy/ProfileChainName()
type ProfileChainNamePrefix ¶
type ProfileChainNamePrefix string
type RuleRenderer ¶
type RuleRenderer interface { StaticFilterTableChains(ipVersion uint8) []*iptables.Chain StaticNATTableChains(ipVersion uint8) []*iptables.Chain StaticRawTableChains(ipVersion uint8) []*iptables.Chain StaticMangleTableChains(ipVersion uint8) []*iptables.Chain WorkloadDispatchChains(map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint) []*iptables.Chain WorkloadEndpointToIptablesChains( ifaceName string, epMarkMapper EndpointMarkMapper, adminUp bool, ingressPolicies []string, egressPolicies []string, profileIDs []string, ) []*iptables.Chain EndpointMarkDispatchChains( epMarkMapper EndpointMarkMapper, wlEndpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint, hepEndpoints map[string]proto.HostEndpointID, ) []*iptables.Chain HostDispatchChains(map[string]proto.HostEndpointID, bool) []*iptables.Chain FromHostDispatchChains(map[string]proto.HostEndpointID, string) []*iptables.Chain HostEndpointToFilterChains( ifaceName string, epMarkMapper EndpointMarkMapper, ingressPolicyNames []string, egressPolicyNames []string, ingressForwardPolicyNames []string, egressForwardPolicyNames []string, profileIDs []string, ) []*iptables.Chain HostEndpointToRawChains( ifaceName string, ingressPolicyNames []string, egressPolicyNames []string, ) []*iptables.Chain HostEndpointToMangleChains( ifaceName string, preDNATPolicyNames []string, ) []*iptables.Chain PolicyToIptablesChains(policyID *proto.PolicyID, policy *proto.Policy, ipVersion uint8) []*iptables.Chain ProfileToIptablesChains(profileID *proto.ProfileID, policy *proto.Profile, ipVersion uint8) []*iptables.Chain ProtoRuleToIptablesRules(pRule *proto.Rule, ipVersion uint8) []iptables.Rule MakeNatOutgoingRule(protocol string, action iptables.Action, ipVersion uint8) iptables.Rule NATOutgoingChain(active bool, ipVersion uint8) *iptables.Chain DNATsToIptablesChains(dnats map[string]string) []*iptables.Chain SNATsToIptablesChains(snats map[string]string) []*iptables.Chain }
func NewRenderer ¶
func NewRenderer(config Config) RuleRenderer