Skip to content

Commit 1d17fb7

Browse files
Kendall Strattonkestratt
Kendall Stratton
authored and
kestratt
committed
Adding an ipv6 policy for port mapping policies when dual stack is enabled
1 parent 0f85901 commit 1d17fb7

File tree

3 files changed

+182
-4
lines changed

3 files changed

+182
-4
lines changed

‎cni/cni.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -342,9 +342,9 @@ func (config *NetworkConfig) GetEndpointInfo(
342342
runtimeConf := config.RuntimeConfig
343343
logrus.Debugf("Parsing port mappings from %+v", runtimeConf.PortMappings)
344344

345-
flags := uint32(0)
345+
flags := hcn.NatFlagsNone
346346
if config.OptionalFlags.LocalRoutePortMapping {
347-
flags = 1
347+
flags = hcn.NatFlagsLocalRoutedVip
348348
}
349349
var aclPriority uint16 = 1000
350350
for _, mapping := range runtimeConf.PortMappings {
@@ -355,6 +355,16 @@ func (config *NetworkConfig) GetEndpointInfo(
355355
logrus.Debugf("Created raw policy from mapping: %+v --- %+v", mapping, policy)
356356
epInfo.Policies = append(epInfo.Policies, policy)
357357

358+
if config.OptionalFlags.EnableDualStack {
359+
v6flags := flags | hcn.NatFlagsIPv6
360+
v6policy, err := network.GetPortMappingPolicy(mapping.HostPort, mapping.ContainerPort, mapping.Protocol, "", v6flags)
361+
if err != nil {
362+
return nil, fmt.Errorf("failed during GetEndpointInfo from netconf: %v", err)
363+
}
364+
logrus.Debugf("Created raw V6 policy from mapping: %+v --- %+v", mapping, v6policy)
365+
epInfo.Policies = append(epInfo.Policies, v6policy)
366+
}
367+
358368
if config.OptionalFlags.AllowAclPortMapping {
359369
pol, err := getInACLRule(&mapping, aclPriority)
360370
if err != nil {

‎example/l2bridge-dualstack-cni-template.conf

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
{
2+
"cniVersion": "0.2.0",
3+
"name": "{{NAME}}",
4+
"type": "{{TYPE}}",
5+
"master": "Ethernet",
6+
"capabilities": {
7+
"portMappings": true,
8+
"dns" : true
9+
},
10+
"ipam": {
11+
"environment": "azure",
12+
"subnet": "192.168.0.0/24",
13+
"routes": [
14+
{
15+
"GW": "192.168.0.2"
16+
}
17+
]
18+
},
19+
"dns": {
20+
"Nameservers": [
21+
"{{DNSSERVER}}"
22+
],
23+
"Search": [
24+
"svc.cluster.local"
25+
]
26+
},
27+
"optionalFlags" : {
28+
"localRoutedPortMapping" : true,
29+
"allowAclPortMapping" : true,
30+
"enableDualStack" : true,
31+
"gatewayFromAdditionalRoutes" : true
32+
},
33+
"additionalRoutes": [
34+
{
35+
"GW": "10::2",
36+
"Dst": "::/0"
37+
}
38+
],
39+
"AdditionalArgs": [
40+
{
41+
"Name": "EndpointPolicy",
42+
"Value": {
43+
"Type": "OutBoundNAT",
44+
"Settings": {
45+
"Exceptions": [
46+
"192.168.0.0/24",
47+
"{{LOCAL_ENDPOINT}}/32"
48+
]
49+
}
50+
}
51+
}
52+
53+
,{
54+
"Name": "EndpointPolicy",
55+
"Value": {
56+
"Type": "OutBoundNAT",
57+
"Settings": {
58+
"Exceptions": [
59+
"10::0/120",
60+
"{{LOCAL_ENDPOINT_IPV6}}/128"
61+
]
62+
}
63+
}
64+
}
65+
66+
,{
67+
"Name": "EndpointPolicy",
68+
"Value": {
69+
"Type":"ACL",
70+
"Settings": {
71+
"Action": "Allow",
72+
"Protocols": "6",
73+
"LocalPorts": "1111",
74+
"Direction": "In",
75+
"Priority": 101
76+
}
77+
}
78+
}
79+
,{
80+
"Name": "EndpointPolicy",
81+
"Value": {
82+
"Type":"ACL",
83+
"Settings": {
84+
"RemoteAddresses" : "{{LOCAL_ENDPOINT}}",
85+
"RemotePorts" : "31002",
86+
"Action": "Allow",
87+
"Protocols": "6",
88+
"Direction": "Out",
89+
"Priority": 200
90+
}
91+
}
92+
}
93+
,{
94+
"Name": "EndpointPolicy",
95+
"Value": {
96+
"Type":"ACL",
97+
"Settings": {
98+
"RemoteAddresses" : "{{LOCAL_ENDPOINT_IPV6}}",
99+
"RemotePorts" : "31002",
100+
"Action": "Allow",
101+
"Protocols": "6",
102+
"Direction": "Out",
103+
"Priority": 200
104+
}
105+
}
106+
}
107+
,{
108+
"Name": "EndpointPolicy",
109+
"Value": {
110+
"Type":"ACL",
111+
"Settings": {
112+
"RemoteAddresses" : "{{INFRA_PREFIX}}",
113+
"Action": "Block",
114+
"Direction": "Out",
115+
"Priority": 1998
116+
}
117+
}
118+
}
119+
,{
120+
"Name": "EndpointPolicy",
121+
"Value": {
122+
"Type":"ACL",
123+
"Settings": {
124+
"RemoteAddresses" : "{{INFRA_PREFIX_IPV6}}",
125+
"Action": "Block",
126+
"Direction": "Out",
127+
"Priority": 1998
128+
}
129+
}
130+
}
131+
,{
132+
"Name": "EndpointPolicy",
133+
"Value": {
134+
"Type":"ACL",
135+
"Settings": {
136+
"RemoteAddresses" : "192.168.0.0/24",
137+
"Action": "Block",
138+
"Direction": "Out",
139+
"Priority": 1999
140+
}
141+
}
142+
}
143+
,{
144+
"Name": "EndpointPolicy",
145+
"Value": {
146+
"Type":"ACL",
147+
"Settings": {
148+
"RemoteAddresses" : "10::0/120",
149+
"Action": "Block",
150+
"Direction": "Out",
151+
"Priority": 1999
152+
}
153+
}
154+
}
155+
,{
156+
"Name": "EndpointPolicy",
157+
"Value": {
158+
"Type":"ACL",
159+
"Settings": {
160+
"Action": "Allow",
161+
"Direction": "Out",
162+
"Priority": 2000
163+
}
164+
}
165+
}
166+
167+
]
168+
}

‎network/policy.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ func GetPortEnumValue(protocol string) (uint32, error) {
5353
}
5454

5555
// GetPortMappingPolicy creates an HCN PortMappingPolicy and stores it in CNI Policy.
56-
func GetPortMappingPolicy(externalPort int, internalPort int, protocol string, hostIp string, flags uint32) (Policy, error) {
56+
func GetPortMappingPolicy(externalPort int, internalPort int, protocol string, hostIp string, flags hcn.NatFlags) (Policy, error) {
5757
// protocol can be passed either as a number or a name
5858
protocolInt, err := GetPortEnumValue(protocol)
5959
if err != nil {
@@ -65,7 +65,7 @@ func GetPortMappingPolicy(externalPort int, internalPort int, protocol string, h
6565
InternalPort: uint16(internalPort),
6666
Protocol: protocolInt,
6767
VIP: hostIp,
68-
Flags: hcn.NatFlags(flags),
68+
Flags: flags,
6969
}
7070
rawPolicy, _ := json.Marshal(portMappingPolicy)
7171
endpointPolicy := hcn.EndpointPolicy{

0 commit comments

Comments
 (0)