status-im
/
consul
mirror of https://github.com/status-im/consul.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix SDK iptables.Config marshalling (#20451) 

This fixes behavior introduced by hashicorp/consul#20232 where
a function was added to the iptables configuration struct. Since this
struct is actually marshalled into json by consul-k8s, we should not be
placing functions inside of it.
This commit is contained in:
Derek Menteer 2024-02-02 12:25:00 -06:00 committed by GitHub
parent 22e6ce0df1
commit 1fe0a87546
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 23 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
sdk/iptables/iptables.go
View File

@ -69,18 +69,18 @@ type Config struct {
// IptablesProvider is the Provider that will apply iptables rules.
IptablesProvider Provider
// AddAdditionalRulesFn can be implemented by the caller to
// add environment specific rules (like ECS) that needs to
// be executed for traffic redirection to work properly.
//
// This gets called by the Setup function after all the
// first class iptable rules are added. The implemented
// function should only call the `AddRule` and optionally
// the `Rules` method of the provider.
AddAdditionalRulesFn func(iptablesProvider Provider)
}
// AdditionalRulesFn can be implemented by the caller to
// add environment specific rules (like ECS) that needs to
// be executed for traffic redirection to work properly.
//
// This gets called by the Setup function after all the
// first class iptable rules are added. The implemented
// function should only call the `AddRule` and optionally
// the `Rules` method of the provider.
type AdditionalRulesFn func(iptablesProvider Provider)
// Provider is an interface for executing iptables rules.
type Provider interface {
// AddRule adds a rule without executing it.
@ -98,9 +98,15 @@ type Provider interface {
// Setup will set up iptables interception and redirection rules
// based on the configuration provided in cfg.
// This implementation was inspired by
// https://github.com/openservicemesh/osm/blob/650a1a1dcf081ae90825f3b5dba6f30a0e532725/pkg/injector/iptables.go
func Setup(cfg Config) error {
return SetupWithAdditionalRules(cfg, nil)
}
// SetupWithAdditionalRules will set up iptables interception and redirection rules
// based on the configuration provided in cfg. The additionalRulesFn will be applied
// after the normal set of rules. This implementation was inspired by
// https://github.com/openservicemesh/osm/blob/650a1a1dcf081ae90825f3b5dba6f30a0e532725/pkg/injector/iptables.go
func SetupWithAdditionalRules(cfg Config, additionalRulesFn AdditionalRulesFn) error {
if cfg.IptablesProvider == nil {
cfg.IptablesProvider = &iptablesExecutor{cfg: cfg}
}
@ -193,8 +199,8 @@ func Setup(cfg Config) error {
}
// Call function to add any additional rules passed on by the caller
if cfg.AddAdditionalRulesFn != nil {
cfg.AddAdditionalRulesFn(cfg.IptablesProvider)
if additionalRulesFn != nil {
additionalRulesFn(cfg.IptablesProvider)
}
return cfg.IptablesProvider.ApplyRules()

5
sdk/iptables/iptables_test.go
View File

@ -303,15 +303,16 @@ func TestSetup(t *testing.T) {
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
var fn AdditionalRulesFn
if c.additionalRules != nil {
c.cfg.AddAdditionalRulesFn = func(provider Provider) {
fn = func(provider Provider) {
for _, rule := range c.additionalRules {
provider.AddRule(rule[0], rule[1:]...)
}
}
}
err := Setup(c.cfg)
err := SetupWithAdditionalRules(c.cfg, fn)
require.NoError(t, err)
require.Equal(t, c.expectedRules, c.cfg.IptablesProvider.Rules())
})