add ns networkpolicy

2019-08-05 18:48:32 +08:00
parent cc15fbe983
commit 90fa38851f
101 changed files with 3737 additions and 120 deletions
--- a/pkg/apis/network/v1alpha1/numorstring/asnumber.go
+++ b/pkg/apis/network/v1alpha1/numorstring/asnumber.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2016 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package numorstring
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type ASNumber uint32
+
+// ASNumberFromString creates an ASNumber struct from a string value.  The
+// string value may simply be a number or may be the ASN in dotted notation.
+func ASNumberFromString(s string) (ASNumber, error) {
+	if num, err := strconv.ParseUint(s, 10, 32); err == nil {
+		return ASNumber(num), nil
+	}
+
+	parts := strings.Split(s, ".")
+	if len(parts) != 2 {
+		msg := fmt.Sprintf("invalid AS Number format (%s)", s)
+		return 0, errors.New(msg)
+	}
+
+	if num1, err := strconv.ParseUint(parts[0], 10, 16); err != nil {
+		msg := fmt.Sprintf("invalid AS Number format (%s)", s)
+		return 0, errors.New(msg)
+	} else if num2, err := strconv.ParseUint(parts[1], 10, 16); err != nil {
+		msg := fmt.Sprintf("invalid AS Number format (%s)", s)
+		return 0, errors.New(msg)
+	} else {
+		return ASNumber((num1 << 16) + num2), nil
+	}
+}
+
+// UnmarshalJSON implements the json.Unmarshaller uinterface.
+func (a *ASNumber) UnmarshalJSON(b []byte) error {
+	if err := json.Unmarshal(b, (*uint32)(a)); err == nil {
+		return nil
+	} else {
+		var s string
+		if err := json.Unmarshal(b, &s); err != nil {
+			return err
+		}
+
+		if v, err := ASNumberFromString(s); err != nil {
+			return err
+		} else {
+			*a = v
+			return nil
+		}
+	}
+}
+
+// String returns the string value, or the Itoa of the uint value.
+func (a ASNumber) String() string {
+	return strconv.FormatUint(uint64(a), 10)
+}
--- a/pkg/apis/network/v1alpha1/numorstring/doc.go
+++ b/pkg/apis/network/v1alpha1/numorstring/doc.go
@@ -0,0 +1,19 @@
+// Copyright (c) 2016 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package numorstring implements a set of type definitions that in YAML or JSON
+format may be represented by either a number or a string.
+*/
+package numorstring
--- a/pkg/apis/network/v1alpha1/numorstring/numorstring_suite_test.go
+++ b/pkg/apis/network/v1alpha1/numorstring/numorstring_suite_test.go
@@ -0,0 +1,26 @@
+// Copyright (c) 2016,2018 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package numorstring_test
+
+import (
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
+	"testing"
+)
+
+func TestNumorstring(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Numorstring Suite")
+}
--- a/pkg/apis/network/v1alpha1/numorstring/numorstring_test.go
+++ b/pkg/apis/network/v1alpha1/numorstring/numorstring_test.go
@@ -0,0 +1,204 @@
+// Copyright (c) 2016-2017 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package numorstring_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	. "github.com/onsi/ginkgo/extensions/table"
+	. "github.com/onsi/gomega"
+	"github.com/projectcalico/libcalico-go/lib/numorstring"
+)
+
+func init() {
+
+	asNumberType := reflect.TypeOf(numorstring.ASNumber(0))
+	protocolType := reflect.TypeOf(numorstring.Protocol{})
+	portType := reflect.TypeOf(numorstring.Port{})
+
+	// Perform tests of JSON unmarshaling of the various field types.
+	DescribeTable("NumOrStringJSONUnmarshaling",
+		func(jtext string, typ reflect.Type, expected interface{}) {
+			// Create a new field type and invoke the unmarshaller interface
+			// directly (this covers a couple more error cases than calling
+			// through json.Unmarshal.
+			new := reflect.New(typ)
+			u := new.Interface().(json.Unmarshaler)
+			err := u.UnmarshalJSON([]byte(jtext))
+
+			if expected != nil {
+				Expect(err).To(BeNil(),
+					"expected json unmarshal to not error")
+				Expect(new.Elem().Interface()).To(Equal(expected),
+					"expected value not same as json unmarshalled value")
+			} else {
+				Expect(err).ToNot(BeNil(),
+					"expected json unmarshal to error")
+			}
+		},
+		// ASNumber tests.
+		Entry("should accept 0 AS number as int", "0", asNumberType, numorstring.ASNumber(0)),
+		Entry("should accept 4294967295 AS number as int", "4294967295", asNumberType, numorstring.ASNumber(4294967295)),
+		Entry("should accept 0 AS number as string", "\"0\"", asNumberType, numorstring.ASNumber(0)),
+		Entry("should accept 4294967295 AS number as string", "\"4294967295\"", asNumberType, numorstring.ASNumber(4294967295)),
+		Entry("should accept 1.10 AS number as string", "\"1.10\"", asNumberType, numorstring.ASNumber(65546)),
+		Entry("should accept 00.00 AS number as string", "\"00.00\"", asNumberType, numorstring.ASNumber(0)),
+		Entry("should accept 00.01 AS number as string", "\"00.01\"", asNumberType, numorstring.ASNumber(1)),
+		Entry("should accept 65535.65535 AS number as string", "\"65535.65535\"", asNumberType, numorstring.ASNumber(4294967295)),
+		Entry("should reject 1.1.1 AS number as string", "\"1.1.1\"", asNumberType, nil),
+		Entry("should reject 65536.65535 AS number as string", "\"65536.65535\"", asNumberType, nil),
+		Entry("should reject 65535.65536 AS number as string", "\"65535.65536\"", asNumberType, nil),
+		Entry("should reject 0.-1 AS number as string", "\"0.-1\"", asNumberType, nil),
+		Entry("should reject -1 AS number as int", "-1", asNumberType, nil),
+		Entry("should reject 4294967296 AS number as int", "4294967296", asNumberType, nil),
+
+		// Port tests.
+		Entry("should accept 0 port as int", "0", portType, numorstring.SinglePort(0)),
+		Entry("should accept 65535 port as int", "65535", portType, numorstring.SinglePort(65535)),
+		Entry("should accept 0:65535 port range as string", "\"0:65535\"", portType, portFromRange(0, 65535)),
+		Entry("should accept 1:10 port range as string", "\"1:10\"", portType, portFromRange(1, 10)),
+		Entry("should accept foo-bar as named port", "\"foo-bar\"", portType, numorstring.NamedPort("foo-bar")),
+		Entry("should reject -1 port as int", "-1", portType, nil),
+		Entry("should reject 65536 port as int", "65536", portType, nil),
+		Entry("should reject 0:65536 port range as string", "\"0:65536\"", portType, nil),
+		Entry("should reject -1:65535 port range as string", "\"-1:65535\"", portType, nil),
+		Entry("should reject 10:1 port range as string", "\"10:1\"", portType, nil),
+		Entry("should reject 1:2:3 port range as string", "\"1:2:3\"", portType, nil),
+		Entry("should reject bad named port string", "\"*\"", portType, nil),
+		Entry("should reject bad port string", "\"1:2", portType, nil),
+
+		// Protocol tests.  Invalid integer values will be stored as strings.
+		Entry("should accept 0 protocol as int", "0", protocolType, numorstring.ProtocolFromInt(0)),
+		Entry("should accept 255 protocol as int", "255", protocolType, numorstring.ProtocolFromInt(255)),
+		Entry("should accept tcp protocol as string", "\"TCP\"", protocolType, numorstring.ProtocolFromString("TCP")),
+		Entry("should accept tcp protocol as string", "\"TCP\"", protocolType, numorstring.ProtocolFromString("TCP")),
+		Entry("should accept 0 protocol as string", "\"0\"", protocolType, numorstring.ProtocolFromInt(0)),
+		Entry("should accept 0 protocol as string", "\"255\"", protocolType, numorstring.ProtocolFromInt(255)),
+		Entry("should accept 256 protocol as string", "\"256\"", protocolType, numorstring.ProtocolFromString("256")),
+		Entry("should reject bad protocol string", "\"25", protocolType, nil),
+	)
+
+	// Perform tests of JSON marshaling of the various field types.
+	DescribeTable("NumOrStringJSONMarshaling",
+		func(field interface{}, jtext string) {
+			b, err := json.Marshal(field)
+			if jtext != "" {
+				Expect(err).To(BeNil(),
+					"expected json marshal to not error")
+				Expect(string(b)).To(Equal(jtext),
+					"expected json not same as marshalled value")
+			} else {
+				Expect(err).ToNot(BeNil(),
+					"expected json marshal to error")
+			}
+		},
+		// ASNumber tests.
+		Entry("should marshal ASN of 0", numorstring.ASNumber(0), "0"),
+		Entry("should marshal ASN of 4294967295", numorstring.ASNumber(4294967295), "4294967295"),
+
+		// Port tests.
+		Entry("should marshal port of 0", numorstring.SinglePort(0), "0"),
+		Entry("should marshal port of 65535", portFromRange(65535, 65535), "65535"),
+		Entry("should marshal port of 10", portFromString("10"), "10"),
+		Entry("should marshal port range of 10:20", portFromRange(10, 20), "\"10:20\""),
+		Entry("should marshal port range of 20:30", portFromRange(20, 30), "\"20:30\""),
+		Entry("should marshal named port", numorstring.NamedPort("foobar"), `"foobar"`),
+
+		// Protocol tests.
+		Entry("should marshal protocol of 0", numorstring.ProtocolFromInt(0), "0"),
+		Entry("should marshal protocol of udp", numorstring.ProtocolFromString("UDP"), "\"UDP\""),
+	)
+
+	// Perform tests of Stringer interface various field types.
+	DescribeTable("NumOrStringStringify",
+		func(field interface{}, s string) {
+			a := fmt.Sprint(field)
+			Expect(a).To(Equal(s),
+				"expected String() value to match")
+		},
+		// ASNumber tests.
+		Entry("should stringify ASN of 0", numorstring.ASNumber(0), "0"),
+		Entry("should stringify ASN of 4294967295", numorstring.ASNumber(4294967295), "4294967295"),
+
+		// Port tests.
+		Entry("should stringify port of 20", numorstring.SinglePort(20), "20"),
+		Entry("should stringify port range of 10:20", portFromRange(10, 20), "10:20"),
+
+		// Protocol tests.
+		Entry("should stringify protocol of 0", numorstring.ProtocolFromInt(0), "0"),
+		Entry("should stringify protocol of udp", numorstring.ProtocolFromString("UDP"), "UDP"),
+	)
+
+	// Perform tests of Protocols supporting ports.
+	DescribeTable("NumOrStringProtocolsSupportingPorts",
+		func(protocol numorstring.Protocol, supportsPorts bool) {
+			Expect(protocol.SupportsPorts()).To(Equal(supportsPorts),
+				"expected protocol port support to match")
+		},
+		Entry("protocol 6 supports ports", numorstring.ProtocolFromInt(6), true),
+		Entry("protocol 17 supports ports", numorstring.ProtocolFromInt(17), true),
+		Entry("protocol udp supports ports", numorstring.ProtocolFromString("UDP"), true),
+		Entry("protocol udp supports ports", numorstring.ProtocolFromString("TCP"), true),
+		Entry("protocol foo does not support ports", numorstring.ProtocolFromString("foo"), false),
+		Entry("protocol 2 does not support ports", numorstring.ProtocolFromInt(2), false),
+	)
+
+	// Perform tests of Protocols FromString method.
+	DescribeTable("NumOrStringProtocols FromString is not case sensitive",
+		func(input, expected string) {
+			Expect(numorstring.ProtocolFromString(input).StrVal).To(Equal(expected),
+				"expected parsed protocol to match")
+		},
+		Entry("protocol udp -> UDP", "udp", "UDP"),
+		Entry("protocol tcp -> TCP", "tcp", "TCP"),
+		Entry("protocol updlite -> UDPLite", "udplite", "UDPLite"),
+		Entry("unknown protocol xxxXXX", "xxxXXX", "xxxXXX"),
+	)
+
+	// Perform tests of Protocols FromStringV1 method.
+	DescribeTable("NumOrStringProtocols FromStringV1 is lowercase",
+		func(input, expected string) {
+			Expect(numorstring.ProtocolFromStringV1(input).StrVal).To(Equal(expected),
+				"expected parsed protocol to match")
+		},
+		Entry("protocol udp -> UDP", "UDP", "udp"),
+		Entry("protocol tcp -> TCP", "TCP", "tcp"),
+		Entry("protocol updlite -> UDPLite", "UDPLite", "udplite"),
+		Entry("unknown protocol xxxXXX", "xxxXXX", "xxxxxx"),
+	)
+
+	// Perform tests of Protocols ToV1 method.
+	DescribeTable("NumOrStringProtocols FromStringV1 is lowercase",
+		func(input, expected numorstring.Protocol) {
+			Expect(input.ToV1()).To(Equal(expected),
+				"expected parsed protocol to match")
+		},
+		// Protocol tests.
+		Entry("protocol udp -> UDP", numorstring.ProtocolFromInt(2), numorstring.ProtocolFromInt(2)),
+		Entry("protocol tcp -> TCP", numorstring.ProtocolFromString("TCP"), numorstring.ProtocolFromStringV1("TCP")),
+	)
+}
+
+func portFromRange(minPort, maxPort uint16) numorstring.Port {
+	p, _ := numorstring.PortFromRange(minPort, maxPort)
+	return p
+}
+
+func portFromString(s string) numorstring.Port {
+	p, _ := numorstring.PortFromString(s)
+	return p
+}
--- a/pkg/apis/network/v1alpha1/numorstring/port.go
+++ b/pkg/apis/network/v1alpha1/numorstring/port.go
@@ -0,0 +1,144 @@
+// Copyright (c) 2016-2017 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package numorstring
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+)
+
+// Port represents either a range of numeric ports or a named port.
+//
+//     - For a named port, set the PortName, leaving MinPort and MaxPort as 0.
+//     - For a port range, set MinPort and MaxPort to the (inclusive) port numbers.  Set
+//       PortName to "".
+//     - For a single port, set MinPort = MaxPort and PortName = "".
+type Port struct {
+	MinPort  uint16 `json:"minPort,omitempty"`
+	MaxPort  uint16 `json:"maxPort,omitempty"`
+	PortName string `validate:"omitempty,portName" json:"portName,omitempty"`
+}
+
+// SinglePort creates a Port struct representing a single port.
+func SinglePort(port uint16) Port {
+	return Port{MinPort: port, MaxPort: port}
+}
+
+func NamedPort(name string) Port {
+	return Port{PortName: name}
+}
+
+// PortFromRange creates a Port struct representing a range of ports.
+func PortFromRange(minPort, maxPort uint16) (Port, error) {
+	port := Port{MinPort: minPort, MaxPort: maxPort}
+	if minPort > maxPort {
+		msg := fmt.Sprintf("minimum port number (%d) is greater than maximum port number (%d) in port range", minPort, maxPort)
+		return port, errors.New(msg)
+	}
+	return port, nil
+}
+
+var (
+	allDigits = regexp.MustCompile(`^\d+$`)
+	portRange = regexp.MustCompile(`^(\d+):(\d+)$`)
+	nameRegex = regexp.MustCompile("^[a-zA-Z0-9_.-]{1,128}$")
+)
+
+// PortFromString creates a Port struct from its string representation.  A port
+// may either be single value "1234", a range of values "100:200" or a named port: "name".
+func PortFromString(s string) (Port, error) {
+	if allDigits.MatchString(s) {
+		// Port is all digits, it should parse as a single port.
+		num, err := strconv.ParseUint(s, 10, 16)
+		if err != nil {
+			msg := fmt.Sprintf("invalid port format (%s)", s)
+			return Port{}, errors.New(msg)
+		}
+		return SinglePort(uint16(num)), nil
+	}
+
+	if groups := portRange.FindStringSubmatch(s); len(groups) > 0 {
+		// Port matches <digits>:<digits>, it should parse as a range of ports.
+		if pmin, err := strconv.ParseUint(groups[1], 10, 16); err != nil {
+			msg := fmt.Sprintf("invalid minimum port number in range (%s)", s)
+			return Port{}, errors.New(msg)
+		} else if pmax, err := strconv.ParseUint(groups[2], 10, 16); err != nil {
+			msg := fmt.Sprintf("invalid maximum port number in range (%s)", s)
+			return Port{}, errors.New(msg)
+		} else {
+			return PortFromRange(uint16(pmin), uint16(pmax))
+		}
+	}
+
+	if !nameRegex.MatchString(s) {
+		msg := fmt.Sprintf("invalid name for named port (%s)", s)
+		return Port{}, errors.New(msg)
+	}
+
+	return NamedPort(s), nil
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (p *Port) UnmarshalJSON(b []byte) error {
+	if b[0] == '"' {
+		var s string
+		if err := json.Unmarshal(b, &s); err != nil {
+			return err
+		}
+
+		if v, err := PortFromString(s); err != nil {
+			return err
+		} else {
+			*p = v
+			return nil
+		}
+	}
+
+	// It's not a string, it must be a single int.
+	var i uint16
+	if err := json.Unmarshal(b, &i); err != nil {
+		return err
+	}
+	v := SinglePort(i)
+	*p = v
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (p Port) MarshalJSON() ([]byte, error) {
+	if p.PortName != "" {
+		return json.Marshal(p.PortName)
+	} else if p.MinPort == p.MaxPort {
+		return json.Marshal(p.MinPort)
+	} else {
+		return json.Marshal(p.String())
+	}
+}
+
+// String returns the string value.  If the min and max port are the same
+// this returns a single string representation of the port number, otherwise
+// if returns a colon separated range of ports.
+func (p Port) String() string {
+	if p.PortName != "" {
+		return p.PortName
+	} else if p.MinPort == p.MaxPort {
+		return strconv.FormatUint(uint64(p.MinPort), 10)
+	} else {
+		return fmt.Sprintf("%d:%d", p.MinPort, p.MaxPort)
+	}
+}
--- a/pkg/apis/network/v1alpha1/numorstring/protocol.go
+++ b/pkg/apis/network/v1alpha1/numorstring/protocol.go
@@ -0,0 +1,134 @@
+// Copyright (c) 2016 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package numorstring
+
+import "strings"
+
+const (
+	ProtocolUDP     = "UDP"
+	ProtocolTCP     = "TCP"
+	ProtocolICMP    = "ICMP"
+	ProtocolICMPv6  = "ICMPv6"
+	ProtocolSCTP    = "SCTP"
+	ProtocolUDPLite = "UDPLite"
+
+	ProtocolUDPV1 = "udp"
+	ProtocolTCPV1 = "tcp"
+)
+
+var (
+	allProtocolNames = []string{
+		ProtocolUDP,
+		ProtocolTCP,
+		ProtocolICMP,
+		ProtocolICMPv6,
+		ProtocolSCTP,
+		ProtocolUDPLite,
+	}
+)
+
+type Protocol Uint8OrString
+
+// ProtocolFromInt creates a Protocol struct from an integer value.
+func ProtocolFromInt(p uint8) Protocol {
+	return Protocol(
+		Uint8OrString{Type: NumOrStringNum, NumVal: p},
+	)
+}
+
+// ProtocolV3FromProtocolV1 creates a v3 Protocol from a v1 Protocol,
+// while handling case conversion.
+func ProtocolV3FromProtocolV1(p Protocol) Protocol {
+	if p.Type == NumOrStringNum {
+		return p
+	}
+
+	for _, n := range allProtocolNames {
+		if strings.ToLower(n) == strings.ToLower(p.StrVal) {
+			return Protocol(
+				Uint8OrString{Type: NumOrStringString, StrVal: n},
+			)
+		}
+	}
+
+	return p
+}
+
+// ProtocolFromString creates a Protocol struct from a string value.
+func ProtocolFromString(p string) Protocol {
+	for _, n := range allProtocolNames {
+		if strings.ToLower(n) == strings.ToLower(p) {
+			return Protocol(
+				Uint8OrString{Type: NumOrStringString, StrVal: n},
+			)
+		}
+	}
+
+	// Unknown protocol - return the value unchanged.  Validation should catch this.
+	return Protocol(
+		Uint8OrString{Type: NumOrStringString, StrVal: p},
+	)
+}
+
+// ProtocolFromStringV1 creates a Protocol struct from a string value (for the v1 API)
+func ProtocolFromStringV1(p string) Protocol {
+	return Protocol(
+		Uint8OrString{Type: NumOrStringString, StrVal: strings.ToLower(p)},
+	)
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (p *Protocol) UnmarshalJSON(b []byte) error {
+	return (*Uint8OrString)(p).UnmarshalJSON(b)
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (p Protocol) MarshalJSON() ([]byte, error) {
+	return Uint8OrString(p).MarshalJSON()
+}
+
+// String returns the string value, or the Itoa of the int value.
+func (p Protocol) String() string {
+	return (Uint8OrString)(p).String()
+}
+
+// String returns the string value, or the Itoa of the int value.
+func (p Protocol) ToV1() Protocol {
+	if p.Type == NumOrStringNum {
+		return p
+	}
+	return ProtocolFromStringV1(p.StrVal)
+}
+
+// NumValue returns the NumVal if type Int, or if
+// it is a String, will attempt a conversion to int.
+func (p Protocol) NumValue() (uint8, error) {
+	return (Uint8OrString)(p).NumValue()
+}
+
+// SupportsProtocols returns whether this protocol supports ports.  This returns true if
+// the numerical or string verion of the protocol indicates TCP (6) or UDP (17).
+func (p Protocol) SupportsPorts() bool {
+	num, err := p.NumValue()
+	if err == nil {
+		return num == 6 || num == 17
+	} else {
+		switch p.StrVal {
+		case ProtocolTCP, ProtocolUDP, ProtocolTCPV1, ProtocolUDPV1:
+			return true
+		}
+		return false
+	}
+}
--- a/pkg/apis/network/v1alpha1/numorstring/type.go
+++ b/pkg/apis/network/v1alpha1/numorstring/type.go
@@ -0,0 +1,23 @@
+// Copyright (c) 2016 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package numorstring
+
+// Type represents the stored type of Int32OrString.
+type NumOrStringType int
+
+const (
+	NumOrStringNum    NumOrStringType = iota // The structure holds a number.
+	NumOrStringString                        // The structure holds a string.
+)
--- a/pkg/apis/network/v1alpha1/numorstring/uint8orstring.go
+++ b/pkg/apis/network/v1alpha1/numorstring/uint8orstring.go
@@ -0,0 +1,80 @@
+// Copyright (c) 2016 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package numorstring
+
+import (
+	"encoding/json"
+	"strconv"
+)
+
+// UInt8OrString is a type that can hold an uint8 or a string.  When used in
+// JSON or YAML marshalling and unmarshalling, it produces or consumes the
+// inner type.  This allows you to have, for example, a JSON field that can
+// accept a name or number.
+type Uint8OrString struct {
+	Type   NumOrStringType
+	NumVal uint8
+	StrVal string
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (i *Uint8OrString) UnmarshalJSON(b []byte) error {
+	if b[0] == '"' {
+		var s string
+		if err := json.Unmarshal(b, &s); err != nil {
+			return err
+		}
+
+		num, err := strconv.ParseUint(s, 10, 8)
+		if err == nil {
+			i.Type = NumOrStringNum
+			i.NumVal = uint8(num)
+		} else {
+			i.Type = NumOrStringString
+			i.StrVal = s
+		}
+
+		return nil
+	}
+	i.Type = NumOrStringNum
+	return json.Unmarshal(b, &i.NumVal)
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (i Uint8OrString) MarshalJSON() ([]byte, error) {
+	if num, err := i.NumValue(); err == nil {
+		return json.Marshal(num)
+	} else {
+		return json.Marshal(i.StrVal)
+	}
+}
+
+// String returns the string value, or the Itoa of the int value.
+func (i Uint8OrString) String() string {
+	if i.Type == NumOrStringString {
+		return i.StrVal
+	}
+	return strconv.FormatUint(uint64(i.NumVal), 10)
+}
+
+// NumValue returns the NumVal if type Int, or if
+// it is a String, will attempt a conversion to int.
+func (i Uint8OrString) NumValue() (uint8, error) {
+	if i.Type == NumOrStringString {
+		num, err := strconv.ParseUint(i.StrVal, 10, 8)
+		return uint8(num), err
+	}
+	return i.NumVal, nil
+}