// Sets the given secLabel on the endpoint with the given endpointID. Returns a pointer of
// a copy endpoint if the endpoint was found, nil otherwise.
func (d *Daemon) setEndpointSecLabel(endpointID *uint16, dockerID, dockerEPID string, labels *labels.SecCtxLabel) *endpoint.Endpoint {
var (
ep *endpoint.Endpoint
ok bool
)
setIfNotEmpty := func(receiver *string, provider string) {
if receiver != nil && *receiver == "" && provider != "" {
*receiver = provider
}
}
setIfNotEmptyUint16 := func(receiver *uint16, provider *uint16) {
if receiver != nil && *receiver == 0 && provider != nil && *provider != 0 {
*receiver = *provider
}
}
d.endpointsMU.Lock()
defer d.endpointsMU.Unlock()
if endpointID != nil {
ep, ok = d.endpoints[*endpointID]
} else if dockerID != "" {
ep, ok = d.endpointsDocker[dockerID]
} else if dockerEPID != "" {
ep, ok = d.endpointsDockerEP[dockerEPID]
} else {
return nil
}
if ok {
setIfNotEmpty(&ep.DockerID, dockerID)
setIfNotEmpty(&ep.DockerEndpointID, dockerEPID)
setIfNotEmptyUint16(&ep.ID, endpointID)
ep.SetSecLabel(labels)
// Update all IDs in respective MAPs
d.insertEndpoint(ep)
return ep.DeepCopy()
}
return nil
}
// syncLabels syncs the labels from the labels' database for the given endpoint. To be
// used with endpointsMU locked.
func (d *Daemon) syncLabels(ep *endpoint.Endpoint) error {
if ep.SecLabel == nil {
return fmt.Errorf("Endpoint doesn't have a security label.")
}
sha256sum, err := ep.SecLabel.Labels.SHA256Sum()
if err != nil {
return fmt.Errorf("Unable to get the sha256sum of labels: %+v\n", ep.SecLabel.Labels)
}
labels, err := d.GetLabelsBySHA256(sha256sum)
if err != nil {
return fmt.Errorf("Unable to get labels of sha256sum:%s: %+v\n", sha256sum, err)
}
if ep.DockerID == "" {
return nil
}
if labels == nil {
labels, _, err = d.PutLabels(ep.SecLabel.Labels, ep.DockerID)
if err != nil {
return fmt.Errorf("Unable to put labels %+v: %s\n", ep.SecLabel.Labels, err)
}
}
if !reflect.DeepEqual(labels.Labels, ep.SecLabel.Labels) {
return fmt.Errorf("The set of labels should be the same for " +
"the endpoint being restored and the labels stored")
}
if labels.ID != ep.SecLabel.ID {
log.Infof("Security label ID for endpoint %d is different "+
"that the one stored, updating from %d to %d\n",
ep.ID, ep.SecLabel.ID, labels.ID)
}
ep.SetSecLabel(labels)
return nil
}
func (ds *DaemonSuite) TestUpdateConsumerMap(c *C) {
lblProd := labels.NewLabel("io.cilium.Prod", "", common.CiliumLabelSource)
lblQA := labels.NewLabel("io.cilium.QA", "", common.CiliumLabelSource)
lblFoo := labels.NewLabel("io.cilium.foo", "", common.CiliumLabelSource)
lblBar := labels.NewLabel("io.cilium.bar", "", common.CiliumLabelSource)
lblJoe := labels.NewLabel("io.cilium.user", "joe", common.CiliumLabelSource)
lblPete := labels.NewLabel("io.cilium.user", "pete", common.CiliumLabelSource)
rootNode := policy.Node{
Name: common.GlobalLabelPrefix,
Rules: []policy.PolicyRule{
&policy.PolicyRuleConsumers{
Coverage: []labels.Label{*lblBar},
Allow: []policy.AllowRule{
// always-allow: user=joe
{Action: policy.ALWAYS_ACCEPT, Label: *lblJoe},
// allow: user=pete
{Action: policy.ACCEPT, Label: *lblPete},
},
},
&policy.PolicyRuleRequires{ // coverage qa, requires qa
Coverage: []labels.Label{*lblQA},
Requires: []labels.Label{*lblQA},
},
&policy.PolicyRuleRequires{ // coverage prod, requires: prod
Coverage: []labels.Label{*lblProd},
Requires: []labels.Label{*lblProd},
},
},
Children: map[string]*policy.Node{
"foo": {},
"bar": {
Rules: []policy.PolicyRule{
&policy.PolicyRuleConsumers{
Allow: []policy.AllowRule{
{ // allow: foo
Action: policy.ACCEPT,
Label: *lblFoo,
},
{Action: policy.DENY, Label: *lblJoe},
{Action: policy.DENY, Label: *lblPete},
},
},
},
},
},
}
c.Assert(rootNode.ResolveTree(), Equals, nil)
err := ds.d.PolicyAdd("io.cilium", &rootNode)
c.Assert(err, Equals, nil)
qaBarLbls := labels.Labels{lblBar.Key: lblBar, lblQA.Key: lblQA}
qaBarSecLblsCtx, _, err := ds.d.PutLabels(qaBarLbls, "cc08ff400e355f736dce1c291a6a4007ab9f2d56d42e1f3630ba87b861d45307")
c.Assert(err, Equals, nil)
prodBarLbls := labels.Labels{lblBar.Key: lblBar, lblProd.Key: lblProd}
prodBarSecLblsCtx, _, err := ds.d.PutLabels(prodBarLbls, "cc08ff400e355f736dce1c291a6a4007ab9f2d56d42e1f3630ba87b861d45307")
c.Assert(err, Equals, nil)
qaFooLbls := labels.Labels{lblFoo.Key: lblFoo, lblQA.Key: lblQA}
qaFooSecLblsCtx, _, err := ds.d.PutLabels(qaFooLbls, "cc08ff400e355f736dce1c291a6a4007ab9f2d56d42e1f3630ba87b861d45307")
c.Assert(err, Equals, nil)
prodFooLbls := labels.Labels{lblFoo.Key: lblFoo, lblProd.Key: lblProd}
prodFooSecLblsCtx, _, err := ds.d.PutLabels(prodFooLbls, "cc08ff400e355f736dce1c291a6a4007ab9f2d56d42e1f3630ba87b861d45307")
c.Assert(err, Equals, nil)
prodFooJoeLbls := labels.Labels{lblFoo.Key: lblFoo, lblProd.Key: lblProd, lblJoe.Key: lblJoe}
prodFooJoeSecLblsCtx, _, err := ds.d.PutLabels(prodFooJoeLbls, "cc08ff400e355f736dce1c291a6a4007ab9f2d56d42e1f3630ba87b861d45307")
c.Assert(err, Equals, nil)
e := endpoint.Endpoint{
ID: 1,
IfName: "dummy1",
IPv6: IPv6Addr,
IPv4: IPv4Addr,
LXCMAC: HardAddr,
NodeMAC: HardAddr,
}
e.Opts = option.NewBoolOptions(&DaemonOptionLibrary)
e.Opts.SetIfUnset(endpoint.OptionLearnTraffic, false)
err = os.Mkdir("1", 755)
c.Assert(err, IsNil)
defer func() {
err = os.RemoveAll("1/geneve_opts.cfg")
err = os.RemoveAll("1/lxc_config.h")
time.Sleep(1 * time.Second)
err = os.RemoveAll("1")
err = os.RemoveAll("1_backup")
}()
e.SetSecLabel(qaBarSecLblsCtx)
err = ds.d.regenerateEndpoint(&e)
c.Assert(err, Equals, nil)
c.Assert(e.Allows(qaBarSecLblsCtx.ID), Equals, false)
c.Assert(e.Allows(prodBarSecLblsCtx.ID), Equals, false)
c.Assert(e.Allows(qaFooSecLblsCtx.ID), Equals, true)
c.Assert(e.Allows(prodFooSecLblsCtx.ID), Equals, false)
c.Assert(e.Allows(prodFooJoeSecLblsCtx.ID), Equals, true)
e = endpoint.Endpoint{
ID: 1,
IfName: "dummy1",
IPv6: IPv6Addr,
IPv4: IPv4Addr,
LXCMAC: HardAddr,
NodeMAC: HardAddr,
}
e.Opts = option.NewBoolOptions(&DaemonOptionLibrary)
e.Opts.SetIfUnset(endpoint.OptionLearnTraffic, false)
e.SetSecLabel(prodBarSecLblsCtx)
err = ds.d.regenerateEndpoint(&e)
c.Assert(err, Equals, nil)
c.Assert(e.Allows(0), Equals, false)
c.Assert(e.Allows(qaBarSecLblsCtx.ID), Equals, false)
c.Assert(e.Allows(prodBarSecLblsCtx.ID), Equals, false)
c.Assert(e.Allows(qaFooSecLblsCtx.ID), Equals, false)
c.Assert(e.Allows(prodFooSecLblsCtx.ID), Equals, true)
c.Assert(e.Allows(prodFooJoeSecLblsCtx.ID), Equals, true)
err = ds.d.PolicyDelete("io.cilium")
c.Assert(err, Equals, nil)
}