Skip to content

Commit 957f147

Browse files
huntergregoryhuntergregory
authored
[backport] fix: [NPM] [Linux] improve iptables version detection and cleanup (#3110)
* fix: [NPM] [Linux] improve iptables version detection and cleanup (#3090) * fix: improve iptables version detection Signed-off-by: Hunter Gregory <[email protected]> * fix: redo everything and add tests Signed-off-by: Hunter Gregory <[email protected]> * fix: address comments Signed-off-by: Hunter Gregory <[email protected]> * fix: avoid segfault by only listing one chain Signed-off-by: Hunter Gregory <[email protected]> * style: log the kernel version Signed-off-by: Hunter Gregory <[email protected]> * style: fix lints Signed-off-by: Hunter Gregory <[email protected]> * fix: don't use stale chains. add comments. minor style change Signed-off-by: Hunter Gregory <[email protected]> * fix: listing kube chain. get stderr too. also add missing ut Signed-off-by: Hunter Gregory <[email protected]> * fix: log messages Signed-off-by: Hunter Gregory <[email protected]> * fix: stop checking kernel version. default nft, never crash Signed-off-by: Hunter Gregory <[email protected]> * style: fix lint Signed-off-by: Hunter Gregory <[email protected]> * style: try fixing gci/gofumpt lint Signed-off-by: Hunter Gregory <[email protected]> * test: fix unit tests referencing iptables legacy Signed-off-by: Hunter Gregory <[email protected]> * style: fix lint in iptm_test.go Signed-off-by: Hunter Gregory <[email protected]> --------- Signed-off-by: Hunter Gregory <[email protected]> * fix: crash NPM if unable to locate kube chain Signed-off-by: Hunter Gregory <[email protected]> --------- Signed-off-by: Hunter Gregory <[email protected]>
1 parent b1eb4cf commit 957f147

12 files changed

+1053
-443
lines changed

‎npm/iptm/iptm_test.go

+178-170
Large diffs are not rendered by default.

‎npm/pkg/dataplane/dataplane_linux.go

-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package dataplane
22

33
import (
44
"github.com/Azure/azure-container-networking/npm/pkg/dataplane/policies"
5-
"github.com/Azure/azure-container-networking/npm/util"
65
npmerrors "github.com/Azure/azure-container-networking/npm/util/errors"
76
)
87

@@ -21,8 +20,6 @@ func (dp *DataPlane) updatePod(pod *updateNPMPod) error {
2120
}
2221

2322
func (dp *DataPlane) bootupDataPlane() error {
24-
util.DetectIptablesVersion(dp.ioShim)
25-
2623
// It is important to keep order to clean-up ACLs before ipsets. Otherwise we won't be able to delete ipsets referenced by ACLs
2724
if err := dp.policyMgr.Bootup(nil); err != nil {
2825
return npmerrors.ErrorWrapper(npmerrors.BootupDataplane, false, "failed to reset policy dataplane", err)

‎npm/pkg/dataplane/dataplane_linux_test.go

+6-10
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package dataplane
22

33
import (
4-
"fmt"
54
"testing"
65
"time"
76

@@ -74,9 +73,6 @@ func TestNetPolInBackgroundUpdatePolicy(t *testing.T) {
7473
calls := append(getBootupTestCalls(), getAddPolicyTestCallsForDP(&testPolicyobj)...)
7574
calls = append(calls, getRemovePolicyTestCallsForDP(&testPolicyobj)...)
7675
calls = append(calls, getAddPolicyTestCallsForDP(&updatedTestPolicyobj)...)
77-
for _, call := range calls {
78-
fmt.Println(call)
79-
}
8076
ioshim := common.NewMockIOShim(calls)
8177
defer ioshim.VerifyCalls(t, calls)
8278
dp, err := NewDataPlane("testnode", ioshim, netpolInBackgroundCfg, nil)
@@ -133,31 +129,31 @@ func TestNetPolInBackgroundFailureToAddFirstTime(t *testing.T) {
133129
},
134130
// restore will try twice per pMgr.AddPolicies() call
135131
testutils.TestCmd{
136-
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
132+
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
137133
ExitCode: 1,
138134
},
139135
testutils.TestCmd{
140-
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
136+
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
141137
ExitCode: 1,
142138
},
143139
// first policy succeeds
144140
testutils.TestCmd{
145-
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
141+
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
146142
ExitCode: 0,
147143
},
148144
// second policy succeeds
149145
testutils.TestCmd{
150-
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
146+
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
151147
ExitCode: 0,
152148
},
153149
// third policy fails
154150
// restore will try twice per pMgr.AddPolicies() call
155151
testutils.TestCmd{
156-
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
152+
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
157153
ExitCode: 1,
158154
},
159155
testutils.TestCmd{
160-
Cmd: []string{"iptables-restore", "-w", "60", "-T", "filter", "--noflush"},
156+
Cmd: []string{"iptables-nft-restore", "-w", "60", "-T", "filter", "--noflush"},
161157
ExitCode: 1,
162158
},
163159
)

‎npm/pkg/dataplane/dataplane_test.go

+1-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package dataplane
22

33
import (
4-
"fmt"
54
"testing"
65

76
"github.com/Azure/azure-container-networking/common"
@@ -262,9 +261,6 @@ func TestUpdatePolicy(t *testing.T) {
262261
calls := append(getBootupTestCalls(), getAddPolicyTestCallsForDP(&testPolicyobj)...)
263262
calls = append(calls, getRemovePolicyTestCallsForDP(&testPolicyobj)...)
264263
calls = append(calls, getAddPolicyTestCallsForDP(&updatedTestPolicyobj)...)
265-
for _, call := range calls {
266-
fmt.Println(call)
267-
}
268264
ioshim := common.NewMockIOShim(calls)
269265
defer ioshim.VerifyCalls(t, calls)
270266
dp, err := NewDataPlane("testnode", ioshim, dpCfg, nil)
@@ -420,7 +416,7 @@ func TestUpdatePodCache(t *testing.T) {
420416
}
421417

422418
func getBootupTestCalls() []testutils.TestCmd {
423-
return append(policies.GetBootupTestCalls(true), ipsets.GetResetTestCalls()...)
419+
return append(policies.GetBootupTestCalls(), ipsets.GetResetTestCalls()...)
424420
}
425421

426422
func getAddPolicyTestCallsForDP(networkPolicy *policies.NPMNetworkPolicy) []testutils.TestCmd {

‎npm/pkg/dataplane/parse/parser_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func TestParseIptablesObjectFileV2(t *testing.T) {
3030

3131
func TestParseIptablesObject(t *testing.T) {
3232
calls := []testutils.TestCmd{
33-
{Cmd: []string{"iptables-save", "-t", "filter"}},
33+
{Cmd: []string{"iptables-nft-save", "-t", "filter"}},
3434
}
3535

3636
parser := IPTablesParser{

0 commit comments

Comments
 (0)