endpoint

package
v0.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 30, 2017 License: Apache-2.0 Imports: 32 Imported by: 0

Documentation

Index

Constants

View Source
const (
	OptionAllowToHost         = "AllowToHost"
	OptionAllowToWorld        = "AllowToWorld"
	OptionConntrackAccounting = "ConntrackAccounting"
	OptionConntrackLocal      = "ConntrackLocal"
	OptionConntrack           = "Conntrack"
	OptionDebug               = "Debug"
	OptionDropNotify          = "DropNotification"
	OptionNAT46               = "NAT46"
	OptionPolicy              = "Policy"
	AlwaysEnforce             = "always"
	NeverEnforce              = "never"
	DefaultEnforcement        = "default"
)
View Source
const (
	// StateCreating is used to set the endpoint is being created.
	StateCreating = string(models.EndpointStateCreating)
	// StateDisconnected is used to set the endpoint is disconnected.
	StateDisconnected = string(models.EndpointStateDisconnected)
	// StateWaitingForIdentity is used to set if the endpoint is waiting
	// for an identity from the KVStore.
	StateWaitingForIdentity = string(models.EndpointStateWaitingForIdentity)
	// StateReady specifies if the endpoint is read to be used.
	StateReady = string(models.EndpointStateReady)
	// StateRegenerating specifies when the endpoint is being regenerated.
	StateRegenerating = string(models.EndpointStateRegenerating)

	// CallsMapName specifies the base prefix for EP specific call map.
	CallsMapName = "cilium_calls_"
	// PolicyGlobalMapName specifies the global tail call map for EP handle_policy() lookup.
	PolicyGlobalMapName = "cilium_policy"
)
View Source
const (
	CiliumLocalIdPrefix  PrefixType = "cilium-local"
	CiliumGlobalIdPrefix            = "cilium-global"
	ContainerIdPrefix               = "container-id"
	DockerEndpointPrefix            = "docker-endpoint"
)
View Source
const (
	// ExecTimeout is the execution timeout to use in join_ep.sh executions
	ExecTimeout = time.Duration(30 * time.Second)
)

Variables

View Source
var (
	OptionSpecAllowToHost = option.Option{
		Define:      "ALLOW_TO_HOST",
		Immutable:   true,
		Description: "Allow all traffic to local host",
	}

	OptionSpecAllowToWorld = option.Option{
		Define:      "ALLOW_TO_WORLD",
		Immutable:   true,
		Description: "Allow all traffic to outside world",
	}

	OptionSpecConntrackAccounting = option.Option{
		Define:      "CONNTRACK_ACCOUNTING",
		Description: "Enable per flow (conntrack) statistics",
		Requires:    []string{OptionConntrack},
	}

	OptionSpecConntrackLocal = option.Option{
		Define:      "CONNTRACK_LOCAL",
		Description: "Use endpoint dedicated tracking table instead of global one",
		Requires:    []string{OptionConntrack},
	}

	OptionSpecConntrack = option.Option{
		Define:      "CONNTRACK",
		Description: "Enable stateful connection tracking",
	}

	OptionSpecDebug = option.Option{
		Define:      "DEBUG",
		Description: "Enable debugging trace statements",
	}

	OptionSpecDropNotify = option.Option{
		Define:      "DROP_NOTIFY",
		Description: "Enable drop notifications",
	}

	OptionSpecNAT46 = option.Option{
		Define:      "ENABLE_NAT46",
		Description: "Enable automatic NAT46 translation",
		Requires:    []string{OptionConntrack},
		Verify: func(key string, val bool) error {
			if !IPv4Enabled {
				return fmt.Errorf("NAT46 requires IPv4 to be enabled")
			} else {
				return nil
			}
		},
	}

	OptionSpecPolicy = option.Option{
		Define:      "POLICY_ENFORCEMENT",
		Description: "Enable policy enforcement",
	}

	EndpointMutableOptionLibrary = option.OptionLibrary{
		OptionConntrackAccounting: &OptionSpecConntrackAccounting,
		OptionConntrackLocal:      &OptionSpecConntrackLocal,
		OptionConntrack:           &OptionSpecConntrack,
		OptionDebug:               &OptionSpecDebug,
		OptionDropNotify:          &OptionSpecDropNotify,
		OptionNAT46:               &OptionSpecNAT46,
		OptionPolicy:              &OptionSpecPolicy,
	}

	EndpointOptionLibrary = option.OptionLibrary{
		OptionAllowToHost:  &OptionSpecAllowToHost,
		OptionAllowToWorld: &OptionSpecAllowToWorld,
	}
)
View Source
var (
	//IPv4Enabled can be set to false to indicate IPv6 only operation
	IPv4Enabled = true
)

Functions

func CallsMapPath added in v0.9.0

func CallsMapPath(id int) string

func Ct4MapPath

func Ct4MapPath(id int) string

func Ct6MapPath

func Ct6MapPath(id int) string

func FilterEPDir

func FilterEPDir(dirFiles []os.FileInfo) []string

FilterEPDir returns a list of directories' names that possible belong to an endpoint.

func NewCiliumID

func NewCiliumID(id int64) string

func NewID

func NewID(prefix PrefixType, id string) string

func OptionChanged

func OptionChanged(key string, value bool, data interface{})

func OrderEndpointAsc

func OrderEndpointAsc(eps []*models.Endpoint)

OrderEndpointAsc orders the slice of Endpoint in ascending ID order.

func ParseCiliumID

func ParseCiliumID(id string) (int64, error)

ParseCiliumID parses id as cilium endpoint id and returns numeric portion.

func PolicyMapPath

func PolicyMapPath(id int) string

PolicyMapPath returns the path to policy map for endpoint ID.

Types

type Endpoint

type Endpoint struct {
	ID               uint16                // Endpoint ID.
	Mutex            sync.RWMutex          // Protects all variables from this structure below this line
	DockerID         string                // Docker ID.
	DockerNetworkID  string                // Docker network ID.
	DockerEndpointID string                // Docker endpoint ID.
	IfName           string                // Container's interface name.
	LXCMAC           mac.MAC               // Container MAC address.
	IPv6             addressing.CiliumIPv6 // Container IPv6 address.
	IPv4             addressing.CiliumIPv4 // Container IPv4 address.
	IfIndex          int                   // Host's interface index.
	NodeMAC          mac.MAC               // Node MAC address.
	NodeIP           net.IP                // Node IPv6 address.
	SecLabel         *policy.Identity      // Security Label  set to this endpoint.
	PortMap          []PortMap             // Port mapping used for this endpoint.
	Consumable       *policy.Consumable
	PolicyMap        *policymap.PolicyMap
	Opts             *option.BoolOptions // Endpoint bpf options.
	Status           *EndpointStatus
	State            string
	// PolicyCalculated is true as soon as the policy has been calculated
	// for the first time
	PolicyCalculated bool
}

Endpoint contains all the details for a particular LXC and the host interface to where is connected to.

func NewEndpointFromChangeModel

func NewEndpointFromChangeModel(base *models.EndpointChangeRequest) (*Endpoint, error)

func ParseEndpoint

func ParseEndpoint(strEp string) (*Endpoint, error)

ParseEndpoint parses the given strEp which is in the form of: common.CiliumCHeaderPrefix + common.Version + ":" + endpointBase64

func (*Endpoint) Allows

func (e *Endpoint) Allows(id policy.NumericIdentity) bool

func (*Endpoint) ApplyOptsLocked added in v0.9.0

func (e *Endpoint) ApplyOptsLocked(opts map[string]string) bool

ApplyOptsLocked applies the given options to the endpoint's options and returns true if there were any options changed.

func (*Endpoint) CallsMapPathLocked added in v0.9.0

func (e *Endpoint) CallsMapPathLocked() string

CallsMapPathLocked returns the path to cilium tail calls map of an endpoint.

func (*Endpoint) CreateDirectory

func (e *Endpoint) CreateDirectory() error

func (*Endpoint) Ct4MapPathLocked added in v0.9.0

func (e *Endpoint) Ct4MapPathLocked() string

Ct4MapPath returns the path to IPv4 connection tracking map of endpoint.

func (*Endpoint) Ct6MapPathLocked added in v0.9.0

func (e *Endpoint) Ct6MapPathLocked() string

Ct6MapPath returns the path to IPv6 connection tracking map of endpoint.

func (*Endpoint) DeepCopy

func (e *Endpoint) DeepCopy() *Endpoint

func (*Endpoint) GetIdentity

func (e *Endpoint) GetIdentity() policy.NumericIdentity

func (*Endpoint) GetModel

func (e *Endpoint) GetModel() *models.Endpoint

func (*Endpoint) LeaveLocked added in v0.9.0

func (e *Endpoint) LeaveLocked(owner Owner)

LeaveLocked removes the endpoint's directory from the system. Must be called with Endpoint's mutex locked.

func (*Endpoint) LogStatus

func (e *Endpoint) LogStatus(typ StatusType, code StatusCode, msg string)

func (*Endpoint) LogStatusOK

func (e *Endpoint) LogStatusOK(typ StatusType, msg string)

func (*Endpoint) PolicyGlobalMapPathLocked added in v0.9.0

func (e *Endpoint) PolicyGlobalMapPathLocked() string

PolicyGlobalMapPathLocked returns the path to the global policy map.

func (*Endpoint) PolicyID added in v0.9.0

func (e *Endpoint) PolicyID() string

PolicyID returns an identifier for the endpoint's policy. Must be called with the endpoint's lock held.

func (*Endpoint) PolicyMapPathLocked added in v0.9.0

func (e *Endpoint) PolicyMapPathLocked() string

PolicyMapPath returns the path to policy map of endpoint.

func (*Endpoint) Regenerate

func (e *Endpoint) Regenerate(owner Owner) <-chan bool

Regenerate forces the regeneration of endpoint programs & policy

func (*Endpoint) RegenerateIfReady

func (e *Endpoint) RegenerateIfReady(owner Owner) error

func (*Endpoint) RemoveDirectory

func (e *Endpoint) RemoveDirectory()

func (*Endpoint) RemoveFromGlobalPolicyMap added in v0.9.0

func (e *Endpoint) RemoveFromGlobalPolicyMap() error

func (*Endpoint) SetDefaultOpts

func (e *Endpoint) SetDefaultOpts(opts *option.BoolOptions)

func (*Endpoint) SetID

func (e *Endpoint) SetID()

SetID sets the endpoint's host local unique ID.

func (*Endpoint) SetIdentity

func (e *Endpoint) SetIdentity(owner Owner, id *policy.Identity)

func (*Endpoint) String

func (e *Endpoint) String() string

String returns endpoint on a JSON format.

func (*Endpoint) StringIDLocked added in v0.9.0

func (e *Endpoint) StringIDLocked() string

StringIDLocked returns the endpoint's ID in a string. Must be called with the endpoint's mutex locked.

func (*Endpoint) TriggerPolicyUpdates

func (e *Endpoint) TriggerPolicyUpdates(owner Owner) (bool, error)

TriggerPolicyUpdates indicates that a policy change is likely to affect this endpoint. Will update all required endpoint configuration and state to reflect new policy and regenerate programs if required.

Returns true if policy was changed and endpoints needs to be rebuilt

func (*Endpoint) Update

func (e *Endpoint) Update(owner Owner, opts models.ConfigurationMap) error

Update modifies the endpoint options and regenerates the program.

type EndpointStatus

type EndpointStatus struct {
	// CurrentStatuses is the last status of a given priority.
	CurrentStatuses componentStatus `json:"current-status,omitempty"`
	// Contains the last maxLogs messages for this endpoint.
	Log statusLog `json:"log,omitempty"`
	// Index is the index in the statusLog, is used to keep track the next
	// available position to write a new log message.
	Index int `json:"index"`
	// contains filtered or unexported fields
}

EndpointStatus represents the endpoint status.

func NewEndpointStatus

func NewEndpointStatus() *EndpointStatus

func (*EndpointStatus) CurrentStatus

func (e *EndpointStatus) CurrentStatus() StatusCode

func (*EndpointStatus) DeepCopy

func (e *EndpointStatus) DeepCopy() *EndpointStatus

func (*EndpointStatus) GetModel

func (e *EndpointStatus) GetModel() []*models.EndpointStatusChange

func (*EndpointStatus) String

func (e *EndpointStatus) String() string

type Owner

type Owner interface {
	// Must return true if tracing of the policy resolution is to be enabled
	TracingEnabled() bool

	// Must return true if dry mode is enabled
	DryModeEnabled() bool

	// PolicyEnabled returns whether policy enforcement is enabled
	PolicyEnabled() bool

	// UpdatePolicyEnforcement returns whether policy enforcement needs to be updated.
	UpdatePolicyEnforcement(ep *Endpoint) bool

	// GetPolicyEnforcementType returns the type of policy enforcement for the Owner.
	PolicyEnforcement() string

	// AlwaysAllowLocalhost returns true if localhost is always allowed to
	// reach local endpoints
	AlwaysAllowLocalhost() bool

	// Must return an instance of a ConsumableCache
	GetConsumableCache() *policy.ConsumableCache

	// Must resolve label id to an identiy
	GetCachedLabelList(ID policy.NumericIdentity) ([]*labels.Label, error)

	// Must return the policy repository
	GetPolicyRepository() *policy.Repository

	// Return the next available global identity
	GetCachedMaxLabelID() (policy.NumericIdentity, error)

	// Must return proxy object
	GetProxy() *proxy.Proxy

	// Must synchronize endpoint object with datapath
	WriteEndpoint(ep *Endpoint) error

	// GetStateDir must return path to the state directory
	GetStateDir() string

	// Must return path to BPF template files directory
	GetBpfDir() string

	// QueueEndpointBuild puts the given request in the processing queue
	QueueEndpointBuild(*Request)

	// RemoveFromEndpointQueue removes all requests from the working que
	RemoveFromEndpointQueue(epID uint64)

	// Returns true if debugging has been enabled
	DebugEnabled() bool
}

Owner is the interface defines the requirements for anybody owning policies.

type PortMap

type PortMap struct {
	From  uint16 `json:"from"`
	To    uint16 `json:"to"`
	Proto uint8  `json:"proto"`
}

PortMap is the port mapping representation for a particular endpoint.

type PrefixType

type PrefixType string

func ParseID

func ParseID(id string) (PrefixType, string, error)

ParseID parses specified id and returns normalized id as string.

func SplitID

func SplitID(id string) (PrefixType, string)

SplitID splits ID into prefix and id. No validation is performed on prefix.

func ValidateID

func ValidateID(id string) (PrefixType, string, error)

ValidateID parses specified id and returns normalized id as string.

func (PrefixType) String

func (s PrefixType) String() string

type Request added in v0.9.0

type Request struct {
	// ID request ID.
	ID uint64
	// MyTurn is used to know when is its turn.
	MyTurn chan bool
	// Done is used to tell the Processor the request as finished.
	Done chan bool
	// ExternalDone is used for external listeners this request as finished
	// if returns true the build was successful, false otherwise.
	ExternalDone chan bool
}

Request is used to create the endpoint's request and send it to the endpoints processor.

type Status

type Status struct {
	Code StatusCode `json:"code"`
	Msg  string     `json:"msg"`
	Type StatusType `json:"status-type"`
}

func NewStatusOK

func NewStatusOK(typ StatusType, info string) Status

func (Status) String

func (s Status) String() string

type StatusCode

type StatusCode int
const (
	OK       StatusCode = 0
	Warning  StatusCode = -1
	Failure  StatusCode = -2
	Disabled StatusCode = -3
)

func (StatusCode) ColorString

func (sc StatusCode) ColorString() string

func (StatusCode) String

func (sc StatusCode) String() string

type StatusResponse

type StatusResponse struct {
	KVStore    Status              `json:"kvstore"`
	Docker     Status              `json:"docker"`
	Kubernetes Status              `json:"kubernetes"`
	Logstash   Status              `json:"logstash"`
	Cilium     Status              `json:"cilium"`
	IPAMStatus map[string][]string `json:",omitempty"`
}

type StatusType

type StatusType int

StatusType represents the type for the given status, higher the value, higher the priority.

const (
	BPF    StatusType = 200
	Policy StatusType = 100
	Other  StatusType = 0
)

type UpdateCompilationError

type UpdateCompilationError struct {
	// contains filtered or unexported fields
}

func (UpdateCompilationError) Error

func (e UpdateCompilationError) Error() string

type UpdateValidationError

type UpdateValidationError struct {
	// contains filtered or unexported fields
}

func (UpdateValidationError) Error

func (e UpdateValidationError) Error() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL