Skip to content

Commit 7965c57

Browse files
robbertklrobbertkl
committed
Fix golint errors
1 parent 50f86d8 commit 7965c57

File tree

4 files changed

+100
-66
lines changed

4 files changed

+100
-66
lines changed

‎firewall.go

+51-32
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,19 @@ import (
77
"github.com/coreos/go-iptables/iptables"
88
)
99

10+
// Table describes an ip(6)tables table
1011
type Table string
1112

13+
// All ip(6)tables tables we use
1214
const (
1315
TableFilter = "filter"
1416
TableNat = "nat"
1517
)
1618

19+
// Chain describes an ip(6)tables chain
1720
type Chain string
1821

22+
// All ip(6)tables chains we use
1923
const (
2024
ChainInput = "INPUT"
2125
ChainOutput = "OUTPUT"
@@ -28,58 +32,65 @@ const (
2832
ChainDockerIsolation2 = "DOCKER-ISOLATION-STAGE-2"
2933
)
3034

35+
// TableChain references a combination of an ip(6)tables table and chain
3136
type TableChain struct {
3237
table Table
3338
chain Chain
3439
}
3540

36-
type rule struct {
41+
// Rule represents a unique firewall rule
42+
type Rule struct {
3743
tc TableChain
3844
spec []string
3945
prepend bool
4046
}
4147

42-
func NewRule(table Table, chain Chain, spec ...string) *rule {
43-
return &rule{
48+
// NewRule constructs a new (non prepended) Rule
49+
func NewRule(table Table, chain Chain, spec ...string) *Rule {
50+
return &Rule{
4451
tc: TableChain{table, chain},
4552
spec: spec,
4653
prepend: false,
4754
}
4855
}
4956

50-
func NewPrependRule(table Table, chain Chain, spec ...string) *rule {
51-
return &rule{
57+
// NewPrependRule constructs a new Rule with prepend set to true
58+
func NewPrependRule(table Table, chain Chain, spec ...string) *Rule {
59+
return &Rule{
5260
tc: TableChain{table, chain},
5361
spec: spec,
5462
prepend: true,
5563
}
5664
}
5765

58-
func (r *rule) hash() string {
66+
func (r *Rule) hash() string {
5967
return strings.Join(r.spec, "#")
6068
}
6169

62-
func (r1 *rule) Equal(r2 *rule) bool {
63-
if r1.tc != r2.tc {
70+
// Equal compares 2 Rules
71+
func (r *Rule) Equal(other *Rule) bool {
72+
if r.tc != other.tc {
6473
return false
6574
}
6675

67-
if len(r1.spec) != len(r2.spec) {
76+
if len(r.spec) != len(other.spec) {
6877
return false
6978
}
7079

71-
for index := range r1.spec {
72-
if r1.spec[index] != r2.spec[index] {
80+
for index := range r.spec {
81+
if r.spec[index] != other.spec[index] {
7382
return false
7483
}
7584
}
7685

7786
return true
7887
}
7988

80-
type Ruleset []*rule
89+
// Ruleset contains a list of unique rules
90+
type Ruleset []*Rule
8191

82-
func (s *Ruleset) Contains(r *rule) bool {
92+
// Contains checks if a Rule is part of the Ruleset
93+
func (s *Ruleset) Contains(r *Rule) bool {
8394
for _, sr := range *s {
8495
if r.Equal(sr) {
8596
return true
@@ -89,54 +100,58 @@ func (s *Ruleset) Contains(r *rule) bool {
89100
return false
90101
}
91102

92-
func (s1 *Ruleset) Diff(s2 *Ruleset) *Ruleset {
93-
if len(*s2) == 0 {
94-
return s1
103+
// Diff returns a new Ruleset with only the rules that are not part of other
104+
func (s *Ruleset) Diff(other *Ruleset) *Ruleset {
105+
if len(*other) == 0 {
106+
return s
95107
}
96108

97-
s := make(Ruleset, 0, len(*s1))
98-
for _, r := range *s1 {
99-
if !s2.Contains(r) {
100-
s = append(s, r)
109+
diffed := make(Ruleset, 0, len(*s))
110+
for _, r := range *s {
111+
if !other.Contains(r) {
112+
diffed = append(diffed, r)
101113
}
102114
}
103115

104-
return &s
116+
return &diffed
105117
}
106118

107-
type firewall struct {
119+
// Firewall keeps track of the active rules, in order to perform proper appends/prepends
120+
type Firewall struct {
108121
ipt *iptables.IPTables
109122
activeRules map[TableChain]map[string]bool
110123
debug bool
111-
userChainJumpRule *rule
124+
userChainJumpRule *Rule
112125
}
113126

114-
func NewFirewall(debug bool) (*firewall, error) {
127+
// NewFirewall constructs a new Firewall
128+
func NewFirewall(debug bool) (*Firewall, error) {
115129
ipt, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)
116130
if err != nil {
117131
return nil, err
118132
}
119133

120-
return &firewall{
134+
return &Firewall{
121135
ipt: ipt,
122136
activeRules: make(map[TableChain]map[string]bool),
123137
debug: debug,
124138
userChainJumpRule: NewRule(TableFilter, ChainForward, "-j", ChainDockerUser),
125139
}, nil
126140
}
127141

128-
func (fw *firewall) activateRule(r *rule) {
142+
func (fw *Firewall) activateRule(r *Rule) {
129143
if _, exists := fw.activeRules[r.tc]; !exists {
130144
fw.activeRules[r.tc] = make(map[string]bool)
131145
}
132146
fw.activeRules[r.tc][r.hash()] = true
133147
}
134148

135-
func (fw *firewall) deactivateRule(r *rule) {
149+
func (fw *Firewall) deactivateRule(r *Rule) {
136150
delete(fw.activeRules[r.tc], r.hash())
137151
}
138152

139-
func (fw *firewall) EnsureTableChains(tableChains []TableChain) error {
153+
// EnsureTableChains creates (and clears!) the given TableChains
154+
func (fw *Firewall) EnsureTableChains(tableChains []TableChain) error {
140155
for _, tc := range tableChains {
141156
if err := fw.ipt.ClearChain(string(tc.table), string(tc.chain)); err != nil {
142157
return err
@@ -147,7 +162,8 @@ func (fw *firewall) EnsureTableChains(tableChains []TableChain) error {
147162
return nil
148163
}
149164

150-
func (fw *firewall) RemoveTableChains(tableChains []TableChain) error {
165+
// RemoveTableChains deletes the given TableChains
166+
func (fw *Firewall) RemoveTableChains(tableChains []TableChain) error {
151167
for _, tc := range tableChains {
152168
fw.ipt.ClearChain(string(tc.table), string(tc.chain))
153169
fw.ipt.DeleteChain(string(tc.table), string(tc.chain))
@@ -157,7 +173,8 @@ func (fw *firewall) RemoveTableChains(tableChains []TableChain) error {
157173
return nil
158174
}
159175

160-
func (fw *firewall) EnsureRules(rules *Ruleset) error {
176+
// EnsureRules makes sure the Rules in the given Ruleset exist or it creates them
177+
func (fw *Firewall) EnsureRules(rules *Ruleset) error {
161178
// A regular loop to append only the non-prepend rules
162179
for _, rule := range *rules {
163180
if rule.prepend {
@@ -206,7 +223,8 @@ func (fw *firewall) EnsureRules(rules *Ruleset) error {
206223
return nil
207224
}
208225

209-
func (fw *firewall) RemoveRules(rules *Ruleset) error {
226+
// RemoveRules makes sure the Rules in the given Ruleset don't exist or removes them
227+
func (fw *Firewall) RemoveRules(rules *Ruleset) error {
210228
for _, rule := range *rules {
211229
if rule.Equal(fw.userChainJumpRule) {
212230
continue
@@ -231,7 +249,8 @@ func (fw *firewall) RemoveRules(rules *Ruleset) error {
231249
return nil
232250
}
233251

234-
func (fw *firewall) EnsureUserFilterChain() error {
252+
// EnsureUserFilterChain makes sure the DOCKER-USER chain exists, without clearing it
253+
func (fw *Firewall) EnsureUserFilterChain() error {
235254
chains, err := fw.ipt.ListChains(TableFilter)
236255
if err != nil {
237256
return err

‎manager.go

+13-8
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,14 @@ type managedPort struct {
3232
hostPort uint16
3333
}
3434

35-
type manager struct {
36-
fw *firewall
35+
// Manager controls the firewall by managing rules for Docker networks and containers
36+
type Manager struct {
37+
fw *Firewall
3738
hairpinMode bool
3839
}
3940

40-
func NewManager(debug bool) (*manager, error) {
41+
// NewManager constructs a new Manager
42+
func NewManager(debug bool) (*Manager, error) {
4143
hairpinMode, err := detectHairpinMode()
4244
if err != nil {
4345
return nil, err
@@ -60,7 +62,7 @@ func NewManager(debug bool) (*manager, error) {
6062
return nil, err
6163
}
6264

63-
return &manager{
65+
return &Manager{
6466
fw: fw,
6567
hairpinMode: hairpinMode,
6668
}, nil
@@ -100,7 +102,8 @@ func detectHairpinMode() (bool, error) {
100102
return false, errors.New("unable to detect hairpin mode (is the docker daemon running?)")
101103
}
102104

103-
func (m *manager) Cleanup() error {
105+
// Cleanup removes the base rules and table-chains (per-network / per-container rules should already be removed)
106+
func (m *Manager) Cleanup() error {
104107
if err := m.fw.RemoveRules(getBaseRules(m.hairpinMode)); err != nil {
105108
return err
106109
}
@@ -112,15 +115,17 @@ func (m *manager) Cleanup() error {
112115
return nil
113116
}
114117

115-
func (m *manager) ReplaceNetwork(oldNetwork, newNetwork *managedNetwork) error {
118+
// ReplaceNetwork applies relative rule changes for a network
119+
func (m *Manager) ReplaceNetwork(oldNetwork, newNetwork *managedNetwork) error {
116120
return m.applyRules(getRulesForNetwork(oldNetwork, m.hairpinMode), getRulesForNetwork(newNetwork, m.hairpinMode))
117121
}
118122

119-
func (m *manager) ReplaceContainer(oldContainer, newContainer *managedContainer) error {
123+
// ReplaceContainer applies relative rule changes for a container
124+
func (m *Manager) ReplaceContainer(oldContainer, newContainer *managedContainer) error {
120125
return m.applyRules(getRulesForContainer(oldContainer, m.hairpinMode), getRulesForContainer(newContainer, m.hairpinMode))
121126
}
122127

123-
func (m *manager) applyRules(oldRules, newRules *Ruleset) error {
128+
func (m *Manager) applyRules(oldRules, newRules *Ruleset) error {
124129
oldRules = oldRules.Diff(newRules)
125130

126131
if err := m.fw.EnsureRules(newRules); err != nil {

‎state.go

+20-13
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ import (
88
"github.com/fsouza/go-dockerclient"
99
)
1010

11-
type state struct {
12-
manager *manager
11+
// State keeps track of the current Docker containers and networks to apply relative updates to the manager
12+
type State struct {
13+
manager *Manager
1314
networks map[string]*managedNetwork
1415
containers map[string]*managedContainer
1516
}
@@ -20,20 +21,22 @@ var ulaCIDR = net.IPNet{
2021
Mask: net.CIDRMask(7, 128),
2122
}
2223

23-
func NewState(debug bool) (*state, error) {
24+
// NewState constructs a new state
25+
func NewState(debug bool) (*State, error) {
2426
manager, err := NewManager(debug)
2527
if err != nil {
2628
return nil, err
2729
}
2830

29-
return &state{
31+
return &State{
3032
manager: manager,
3133
networks: make(map[string]*managedNetwork),
3234
containers: make(map[string]*managedContainer),
3335
}, nil
3436
}
3537

36-
func (s *state) Cleanup() error {
38+
// Cleanup resets the state
39+
func (s *State) Cleanup() error {
3740
s.RemoveMissingContainers([]string{})
3841
s.RemoveMissingNetworks([]string{})
3942

@@ -44,7 +47,8 @@ func (s *state) Cleanup() error {
4447
return nil
4548
}
4649

47-
func (s *state) RemoveMissingNetworks(networkIDs []string) error {
50+
// RemoveMissingNetworks removes any of the given networks, if they don't exist
51+
func (s *State) RemoveMissingNetworks(networkIDs []string) error {
4852
for id := range s.networks {
4953
if !contains(networkIDs, id) {
5054
if err := s.UpdateNetwork(id, nil); err != nil {
@@ -56,7 +60,8 @@ func (s *state) RemoveMissingNetworks(networkIDs []string) error {
5660
return nil
5761
}
5862

59-
func (s *state) RemoveMissingContainers(containerIDs []string) error {
63+
// RemoveMissingContainers removes any of the given containers if they don't exist
64+
func (s *State) RemoveMissingContainers(containerIDs []string) error {
6065
for id := range s.containers {
6166
if !contains(containerIDs, id) {
6267
if err := s.UpdateContainer(id, nil); err != nil {
@@ -68,7 +73,8 @@ func (s *state) RemoveMissingContainers(containerIDs []string) error {
6873
return nil
6974
}
7075

71-
func (s *state) UpdateNetwork(id string, network *docker.Network) error {
76+
// UpdateNetwork applies a network, which can add, remove or update it
77+
func (s *State) UpdateNetwork(id string, network *docker.Network) error {
7278
oldNetwork := s.networks[id]
7379
newNetwork := s.parseNetwork(network)
7480

@@ -87,7 +93,8 @@ func (s *state) UpdateNetwork(id string, network *docker.Network) error {
8793
return nil
8894
}
8995

90-
func (s *state) UpdateContainer(id string, container *docker.Container) error {
96+
// UpdateContainer applies a container, which can add, remove or update it
97+
func (s *State) UpdateContainer(id string, container *docker.Container) error {
9198
oldContainer := s.containers[id]
9299
newContainer := s.parseContainer(container)
93100

@@ -106,7 +113,7 @@ func (s *state) UpdateContainer(id string, container *docker.Container) error {
106113
return nil
107114
}
108115

109-
func (s *state) parseNetwork(network *docker.Network) *managedNetwork {
116+
func (s *State) parseNetwork(network *docker.Network) *managedNetwork {
110117
if network == nil {
111118
return nil
112119
}
@@ -172,7 +179,7 @@ func (s *state) parseNetwork(network *docker.Network) *managedNetwork {
172179
return &n
173180
}
174181

175-
func (s *state) findFirstKnownNetwork(networks map[string]docker.ContainerNetwork) (*managedNetwork, net.IP) {
182+
func (s *State) findFirstKnownNetwork(networks map[string]docker.ContainerNetwork) (*managedNetwork, net.IP) {
176183
for _, network := range networks {
177184
ip := net.ParseIP(network.GlobalIPv6Address)
178185
if !ulaCIDR.Contains(ip) {
@@ -190,7 +197,7 @@ func (s *state) findFirstKnownNetwork(networks map[string]docker.ContainerNetwor
190197
return nil, nil
191198
}
192199

193-
func (s *state) getKnownNetworks() []*managedNetwork {
200+
func (s *State) getKnownNetworks() []*managedNetwork {
194201
networks := make([]*managedNetwork, len(s.networks))
195202
index := 0
196203
for _, network := range s.networks {
@@ -201,7 +208,7 @@ func (s *state) getKnownNetworks() []*managedNetwork {
201208
return networks
202209
}
203210

204-
func (s *state) parseContainer(container *docker.Container) *managedContainer {
211+
func (s *State) parseContainer(container *docker.Container) *managedContainer {
205212
if container == nil {
206213
return nil
207214
}

0 commit comments

Comments
 (0)