Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handled IPAM policy properly to fully support strict IPAM #619

Merged
merged 5 commits into from
Oct 17, 2024
Merged

Handled IPAM policy properly to fully support strict IPAM #619

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
14c8d6f
Handled IPAM policy properly to fully support strict IPAM
Oct 11, 2024
f681e86
Fix linter
Oct 11, 2024
e95da0d
Fix gogenerate
Oct 11, 2024
300690b
Fix review comments
Oct 17, 2024
0f4b5b0
Fix gogenerate linter error
Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ linters-settings:
threshold: 150
funlen:
Lines: 175
Statements: 90
Statements: 100
goconst:
min-len: 2
min-occurrences: 2
Expand Down
2 changes: 0 additions & 2 deletions internal/pkg/imports/imports_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ import (
_ "github.com/networkservicemesh/sdk/pkg/networkservice/common/policyroute"
_ "github.com/networkservicemesh/sdk/pkg/networkservice/connectioncontext/dnscontext"
_ "github.com/networkservicemesh/sdk/pkg/networkservice/ipam/groupipam"
_ "github.com/networkservicemesh/sdk/pkg/networkservice/ipam/point2pointipam"
_ "github.com/networkservicemesh/sdk/pkg/networkservice/ipam/strictipam"
_ "github.com/networkservicemesh/sdk/pkg/registry/chains/client"
_ "github.com/networkservicemesh/sdk/pkg/registry/common/authorize"
Expand Down Expand Up @@ -71,7 +70,6 @@ import (
_ "os"
_ "os/signal"
_ "path/filepath"
_ "strings"
_ "sync/atomic"
_ "syscall"
_ "testing"
Expand Down
40 changes: 19 additions & 21 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@ import (
"os"
"os/signal"
"path/filepath"
"strings"
"sync/atomic"
"syscall"
"time"
Expand Down Expand Up @@ -67,7 +66,6 @@ import (
"github.com/networkservicemesh/sdk/pkg/networkservice/common/policyroute"
"github.com/networkservicemesh/sdk/pkg/networkservice/connectioncontext/dnscontext"
"github.com/networkservicemesh/sdk/pkg/networkservice/ipam/groupipam"
"github.com/networkservicemesh/sdk/pkg/networkservice/ipam/point2pointipam"
"github.com/networkservicemesh/sdk/pkg/networkservice/ipam/strictipam"
registryclient "github.com/networkservicemesh/sdk/pkg/registry/chains/client"
registryauthorize "github.com/networkservicemesh/sdk/pkg/registry/common/authorize"
Expand All @@ -94,7 +92,7 @@ type Config struct {
ConnectTo url.URL `default:"unix:///var/lib/networkservicemesh/nsm.io.sock" desc:"url to connect to" split_words:"true"`
MaxTokenLifetime time.Duration `default:"10m" desc:"maximum lifetime of tokens" split_words:"true"`
RegistryClientPolicies []string `default:"etc/nsm/opa/common/.*.rego,etc/nsm/opa/registry/.*.rego,etc/nsm/opa/client/.*.rego" desc:"paths to files and directories that contain registry client policies" split_words:"true"`
IPAMPolicy ipamPolicyFunc `default:"polite" desc:"defines NSE's IPAM Policy. Possible values: polite, strict. Polite policy accepts any addresses sent by client. Strict policy resets ip_context if any of the client's addresses doesn't match endpoint's CIDR." split_words:"true"`
IPAMPolicy string `default:"polite" desc:"defines NSE's IPAM Policy. Possible values: polite, strict. Polite policy accepts any addresses sent by client. Strict policy resets ip_context if any of the client's addresses doesn't match endpoint's CIDR." split_words:"true"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
IPAMPolicy string `default:"polite" desc:"defines NSE's IPAM Policy. Possible values: polite, strict. Polite policy accepts any addresses sent by client. Strict policy resets ip_context if any of the client's addresses doesn't match endpoint's CIDR." split_words:"true"`
IPAMPolicy newIPAMFunc `default:"polite" desc:"defines NSE's IPAM Policy. Possible values: polite, strict. Polite policy accepts any addresses sent by client. Strict policy resets ip_context if any of the client's addresses doesn't match endpoint's CIDR." split_words:"true"`

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

ServiceNames []string `default:"icmp-responder" desc:"Name of provided services" split_words:"true"`
Payload string `default:"ETHERNET" desc:"Name of provided service payload" split_words:"true"`
Labels map[string]string `default:"" desc:"Endpoint labels"`
Expand All @@ -111,23 +109,6 @@ type Config struct {
PprofListenOn string `default:"localhost:6060" desc:"pprof URL to ListenAndServe" split_words:"true"`
}

Copy link
Member

@denis-tingaikin denis-tingaikin Oct 16, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
type newIPAMFunc func(...*net.IPNet) networkservice.NetworkServiceServer
// Decode takes a string IPAM Policy and returns the IPAM Policy func
func (f *newIPAMFunc) Decode(policy string) error {
switch config.IPAMPolicy {
case "strict":
*f = func(cidrPrefix [][]*net.IPNet) {
var ipnetList []*net.IPNet
for _, group := range cidrPrefix {
ipnetList = append(ipnetList, group...)
}
return strictipam.NewServer(func(i ...*net.IPNet) networkservice.NetworkServiceServer {
return groupipam.NewServer(cidrPrefix)
}, ipnetList...)
case "polite":
*f = func(cidrPrefix [][]*net.IPNet) {
return groupipam.NewServer(cidrPrefix)
}
default:
logrus.Fatalf("not a valid IPAM Policy: %s", config.IPAMPolicy)
}
}

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

type ipamPolicyFunc func(...*net.IPNet) networkservice.NetworkServiceServer

// Decode takes a string IPAM Policy and returns the IPAM Policy func
func (f *ipamPolicyFunc) Decode(policy string) error {
switch strings.ToLower(policy) {
case "strict":
*f = func(prefixes ...*net.IPNet) networkservice.NetworkServiceServer {
return strictipam.NewServer(point2pointipam.NewServer, prefixes...)
}
return nil
case "polite":
*f = point2pointipam.NewServer
return nil
}
return errors.Errorf("not a valid IPAM Policy: %s", policy)
}

// Process prints and processes env to config
func (c *Config) Process() error {
if err := envconfig.Usage("nsm", c); err != nil {
Expand Down Expand Up @@ -239,13 +220,30 @@ func main() {

tokenServer := getSriovTokenServerChainElement(ctx)

ipnetList := []*net.IPNet{}
for _, group := range config.CidrPrefix {
ipnetList = append(ipnetList, group...)
}
var IPAMServer networkservice.NetworkServiceServer

switch config.IPAMPolicy {
case "strict":
IPAMServer = strictipam.NewServer(func(i ...*net.IPNet) networkservice.NetworkServiceServer {
return groupipam.NewServer(config.CidrPrefix)
}, ipnetList...)
case "polite":
IPAMServer = groupipam.NewServer(config.CidrPrefix)
default:
logrus.Fatalf("not a valid IPAM Policy: %s", config.IPAMPolicy)
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
ipnetList := []*net.IPNet{}
for _, group := range config.CidrPrefix {
ipnetList = append(ipnetList, group...)
}
var IPAMServer networkservice.NetworkServiceServer
switch config.IPAMPolicy {
case "strict":
IPAMServer = strictipam.NewServer(func(i ...*net.IPNet) networkservice.NetworkServiceServer {
return groupipam.NewServer(config.CidrPrefix)
}, ipnetList...)
case "polite":
IPAMServer = groupipam.NewServer(config.CidrPrefix)
default:
logrus.Fatalf("not a valid IPAM Policy: %s", config.IPAMPolicy)
}

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


responderEndpoint := endpoint.NewServer(ctx,
spiffejwt.TokenGeneratorFunc(source, config.MaxTokenLifetime),
endpoint.WithName(config.Name),
endpoint.WithAuthorizeServer(authorize.NewServer()),
endpoint.WithAdditionalFunctionality(
onidle.NewServer(ctx, cancel, config.IdleTimeout),
groupipam.NewServer(config.CidrPrefix, groupipam.WithCustomIPAMServer(config.IPAMPolicy)),
IPAMServer,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
IPAMServer,
config.newIPAMFunc(config.CidrPrefix),

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

policyroute.NewServer(newPolicyRoutesGetter(ctx, config.PBRConfigPath).Get),
mechanisms.NewServer(map[string]networkservice.NetworkServiceServer{
kernelmech.MECHANISM: kernel.NewServer(),
Expand Down
Loading