Merge pull request #1638 from nwoodmsft/master

Add experimental support for Felix on Windows.  This has a number of limitations:
- it requires a testing release of Windows Server
- it only supports positive match criteria, due to limits in the Windows dataplane
- some match criteria are further limited (no port ranges, for example)

Makefile

@@ -363,6 +363,15 @@ dist/calico-felix/calico-felix: bin/calico-felix
 	mkdir -p dist/calico-felix/
 	cp bin/calico-felix dist/calico-felix/calico-felix
 
+# Cross-compile Felix for Windows
+bin/calico-felix.exe: $(FELIX_GO_FILES) vendor/.up-to-date
+	@echo Building felix for Windows...
+	mkdir -p bin
+	$(DOCKER_GO_BUILD) \
+           sh -c 'GOOS=windows go build -v -o $@ -v $(LDFLAGS) "github.com/projectcalico/felix" && \
+		( ldd $@ 2>&1 | grep -q "Not a valid dynamic program" || \
+		( echo "Error: $@ was not statically linked"; false ) )'
+
 # Install or update the tools used by the build
 .PHONY: update-tools
 update-tools:
@@ -449,12 +458,12 @@ static-checks:
 .PHONY: ut-no-cover
 ut-no-cover: vendor/.up-to-date $(FELIX_GO_FILES)
 	@echo Running Go UTs without coverage.
-	$(DOCKER_GO_BUILD) ginkgo -r -skipPackage fv,k8sfv $(GINKGO_OPTIONS)
+	$(DOCKER_GO_BUILD) ginkgo -r -skipPackage fv,k8sfv,windows $(GINKGO_OPTIONS)
 
 .PHONY: ut-watch
 ut-watch: vendor/.up-to-date $(FELIX_GO_FILES)
 	@echo Watching go UTs for changes...
-	$(DOCKER_GO_BUILD) ginkgo watch -r -skipPackage fv,k8sfv $(GINKGO_OPTIONS)
+	$(DOCKER_GO_BUILD) ginkgo watch -r -skipPackage fv,k8sfv,windows $(GINKGO_OPTIONS)
 
 # Launch a browser with Go coverage stats for the whole project.
 .PHONY: cover-browser

dataplane/driver.go

@@ -0,0 +1,123 @@
+// +build !windows
+
+// Copyright (c) 2017 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dataplane
+
+import (
+	"net"
+	"os/exec"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/projectcalico/felix/config"
+	"github.com/projectcalico/felix/dataplane/external"
+	"github.com/projectcalico/felix/dataplane/linux"
+	"github.com/projectcalico/felix/ifacemonitor"
+	"github.com/projectcalico/felix/ipsets"
+	"github.com/projectcalico/felix/logutils"
+	"github.com/projectcalico/felix/rules"
+	"github.com/projectcalico/libcalico-go/lib/health"
+)
+
+func StartDataplaneDriver(configParams *config.Config, healthAggregator *health.HealthAggregator) (DataplaneDriver, *exec.Cmd) {
+	if configParams.UseInternalDataplaneDriver {
+		log.Info("Using internal (linux) dataplane driver.")
+		// Dedicated mark bits for accept and pass actions.  These are long lived bits
+		// that we use for communicating between chains.
+		markAccept := configParams.NextIptablesMark()
+		markPass := configParams.NextIptablesMark()
+		// Short-lived mark bits for local calculations within a chain.
+		markScratch0 := configParams.NextIptablesMark()
+		markScratch1 := configParams.NextIptablesMark()
+		log.WithFields(log.Fields{
+			"acceptMark":   markAccept,
+			"passMark":     markPass,
+			"scratch0Mark": markScratch0,
+			"scratch1Mark": markScratch1,
+		}).Info("Calculated iptables mark bits")
+		dpConfig := intdataplane.Config{
+			IfaceMonitorConfig: ifacemonitor.Config{
+				InterfaceExcludes: configParams.InterfaceExcludes(),
+			},
+			RulesConfig: rules.Config{
+				WorkloadIfacePrefixes: configParams.InterfacePrefixes(),
+
+				IPSetConfigV4: ipsets.NewIPVersionConfig(
+					ipsets.IPFamilyV4,
+					rules.IPSetNamePrefix,
+					rules.AllHistoricIPSetNamePrefixes,
+					rules.LegacyV4IPSetNames,
+				),
+				IPSetConfigV6: ipsets.NewIPVersionConfig(
+					ipsets.IPFamilyV6,
+					rules.IPSetNamePrefix,
+					rules.AllHistoricIPSetNamePrefixes,
+					nil,
+				),
+
+				OpenStackSpecialCasesEnabled: configParams.OpenstackActive(),
+				OpenStackMetadataIP:          net.ParseIP(configParams.MetadataAddr),
+				OpenStackMetadataPort:        uint16(configParams.MetadataPort),
+
+				IptablesMarkAccept:   markAccept,
+				IptablesMarkPass:     markPass,
+				IptablesMarkScratch0: markScratch0,
+				IptablesMarkScratch1: markScratch1,
+
+				IPIPEnabled:       configParams.IpInIpEnabled,
+				IPIPTunnelAddress: configParams.IpInIpTunnelAddr,
+
+				IptablesLogPrefix:         configParams.LogPrefix,
+				EndpointToHostAction:      configParams.DefaultEndpointToHostAction,
+				IptablesFilterAllowAction: configParams.IptablesFilterAllowAction,
+				IptablesMangleAllowAction: configParams.IptablesMangleAllowAction,
+
+				FailsafeInboundHostPorts:  configParams.FailsafeInboundHostPorts,
+				FailsafeOutboundHostPorts: configParams.FailsafeOutboundHostPorts,
+
+				DisableConntrackInvalid: configParams.DisableConntrackInvalidCheck,
+			},
+			IPIPMTU:                        configParams.IpInIpMtu,
+			IptablesRefreshInterval:        configParams.IptablesRefreshInterval,
+			RouteRefreshInterval:           configParams.RouteRefreshInterval,
+			IPSetsRefreshInterval:          configParams.IpsetsRefreshInterval,
+			IptablesPostWriteCheckInterval: configParams.IptablesPostWriteCheckIntervalSecs,
+			IptablesInsertMode:             configParams.ChainInsertMode,
+			IptablesLockFilePath:           configParams.IptablesLockFilePath,
+			IptablesLockTimeout:            configParams.IptablesLockTimeoutSecs,
+			IptablesLockProbeInterval:      configParams.IptablesLockProbeIntervalMillis,
+			MaxIPSetSize:                   configParams.MaxIpsetSize,
+			IgnoreLooseRPF:                 configParams.IgnoreLooseRPF,
+			IPv6Enabled:                    configParams.Ipv6Support,
+			StatusReportingInterval:        configParams.ReportingIntervalSecs,
+
+			NetlinkTimeout: configParams.NetlinkTimeoutSecs,
+
+			PostInSyncCallback:              func() { logutils.DumpHeapMemoryProfile(configParams) },
+			HealthAggregator:                healthAggregator,
+			DebugSimulateDataplaneHangAfter: configParams.DebugSimulateDataplaneHangAfter,
+		}
+		intDP := intdataplane.NewIntDataplaneDriver(dpConfig)
+		intDP.Start()
+
+		return intDP, nil
+	} else {
+		log.WithField("driver", configParams.DataplaneDriver).Info(
+			"Using external dataplane driver.")
+
+		return extdataplane.StartExtDataplaneDriver(configParams.DataplaneDriver)
+	}
+}

dataplane/driver_defs.go

@@ -0,0 +1,20 @@
+// Copyright (c) 2017 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dataplane
+
+type DataplaneDriver interface {
+	SendMessage(msg interface{}) error
+	RecvMessage() (msg interface{}, err error)
+}

dataplane/driver_windows.go

@@ -0,0 +1,39 @@
+// Copyright (c) 2017 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dataplane
+
+import (
+	"os/exec"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/projectcalico/felix/config"
+	"github.com/projectcalico/felix/dataplane/windows"
+	"github.com/projectcalico/libcalico-go/lib/health"
+)
+
+func StartDataplaneDriver(configParams *config.Config, healthAggregator *health.HealthAggregator) (DataplaneDriver, *exec.Cmd) {
+	log.Info("Using Windows dataplane driver.")
+
+	dpConfig := windataplane.Config{
+		IPv6Enabled:      configParams.Ipv6Support,
+		HealthAggregator: healthAggregator,
+	}
+
+	winDP := windataplane.NewWinDataplaneDriver(dpConfig)
+	winDP.Start()
+
+	return winDP, nil
+}

intdataplane/int_dataplane.go → dataplane/linux/int_dataplane.go

@@ -15,7 +15,6 @@
 package intdataplane
 
 import (
-	"fmt"
 	"io/ioutil"
 	"os"
 	"reflect"
@@ -571,7 +570,7 @@ func (d *InternalDataplane) loopUpdatingDataplane() {
 	datastoreInSync := false
 
 	processMsgFromCalcGraph := func(msg interface{}) {
-		log.WithField("msg", msgStringer{msg: msg}).Infof(
+		log.WithField("msg", proto.MsgStringer{Msg: msg}).Infof(
 			"Received %T update from calculation graph", msg)
 		d.recordMsgStat(msg)
 		for _, mgr := range d.allManagers {
@@ -943,42 +942,6 @@ type iptablesTable interface {
 	RemoveChainByName(name string)
 }
 
-// msgStringer wraps an API message to customise how we stringify it.  For example, it truncates
-// the lists of members in the (potentially very large) IPSetsUpdate messages.
-type msgStringer struct {
-	msg interface{}
-}
-
-func (m msgStringer) String() string {
-	if log.GetLevel() < log.DebugLevel && m.msg != nil {
-		const truncateAt = 10
-		switch msg := m.msg.(type) {
-		case *proto.IPSetUpdate:
-			if len(msg.Members) < truncateAt {
-				return fmt.Sprintf("%v", msg)
-			}
-			return fmt.Sprintf("id:%#v members(%d):%#v(truncated)",
-				msg.Id, len(msg.Members), msg.Members[:truncateAt])
-		case *proto.IPSetDeltaUpdate:
-			if len(msg.AddedMembers) < truncateAt && len(msg.RemovedMembers) < truncateAt {
-				return fmt.Sprintf("%v", msg)
-			}
-			addedNum := truncateAt
-			removedNum := truncateAt
-			if len(msg.AddedMembers) < addedNum {
-				addedNum = len(msg.AddedMembers)
-			}
-			if len(msg.RemovedMembers) < removedNum {
-				removedNum = len(msg.RemovedMembers)
-			}
-			return fmt.Sprintf("id:%#v addedMembers(%d):%#v(truncated) removedMembers(%d):%#v(truncated)",
-				msg.Id, len(msg.AddedMembers), msg.AddedMembers[:addedNum],
-				len(msg.RemovedMembers), msg.RemovedMembers[:removedNum])
-		}
-	}
-	return fmt.Sprintf("%v", m.msg)
-}
-
 func (d *InternalDataplane) reportHealth() {
 	if d.config.HealthAggregator != nil {
 		d.config.HealthAggregator.Report(

intdataplane/int_dataplane_test.go → dataplane/linux/int_dataplane_test.go

@@ -21,8 +21,8 @@ import (
 	. "github.com/onsi/gomega"
 
 	"github.com/projectcalico/felix/config"
+	"github.com/projectcalico/felix/dataplane/linux"
 	"github.com/projectcalico/felix/ifacemonitor"
-	"github.com/projectcalico/felix/intdataplane"
 	"github.com/projectcalico/felix/ipsets"
 	"github.com/projectcalico/felix/rules"
 	"github.com/projectcalico/libcalico-go/lib/health"