vendor files

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/BUILD

@@ -0,0 +1,65 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "loadbalancer.go",
+        "proxier.go",
+        "proxysocket.go",
+        "roundrobin.go",
+        "types.go",
+        "udp_server.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/proxy/winuserspace",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//pkg/apis/core/helper:go_default_library",
+        "//pkg/proxy:go_default_library",
+        "//pkg/util/ipconfig:go_default_library",
+        "//pkg/util/netsh:go_default_library",
+        "//pkg/util/slice:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/miekg/dns:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/net:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
+        "//vendor/k8s.io/utils/exec:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "proxier_test.go",
+        "roundrobin_test.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/proxy/winuserspace",
+    library = ":go_default_library",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//pkg/proxy:go_default_library",
+        "//pkg/util/netsh/testing:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/loadbalancer.go

@@ -0,0 +1,33 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/proxy"
+	"net"
+)
+
+// LoadBalancer is an interface for distributing incoming requests to service endpoints.
+type LoadBalancer interface {
+	// NextEndpoint returns the endpoint to handle a request for the given
+	// service-port and source address.
+	NextEndpoint(service proxy.ServicePortName, srcAddr net.Addr, sessionAffinityReset bool) (string, error)
+	NewService(service proxy.ServicePortName, sessionAffinityType api.ServiceAffinity, stickyMaxAgeMinutes int) error
+	DeleteService(service proxy.ServicePortName)
+	CleanupStaleStickySessions(service proxy.ServicePortName)
+}

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/proxier.go

@@ -0,0 +1,481 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/types"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/pkg/util/runtime"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/core/helper"
+	"k8s.io/kubernetes/pkg/proxy"
+	"k8s.io/kubernetes/pkg/util/netsh"
+)
+
+const allAvailableInterfaces string = ""
+
+type portal struct {
+	ip         string
+	port       int
+	isExternal bool
+}
+
+type serviceInfo struct {
+	isAliveAtomic       int32 // Only access this with atomic ops
+	portal              portal
+	protocol            api.Protocol
+	socket              proxySocket
+	timeout             time.Duration
+	activeClients       *clientCache
+	dnsClients          *dnsClientCache
+	sessionAffinityType api.ServiceAffinity
+}
+
+func (info *serviceInfo) setAlive(b bool) {
+	var i int32
+	if b {
+		i = 1
+	}
+	atomic.StoreInt32(&info.isAliveAtomic, i)
+}
+
+func (info *serviceInfo) isAlive() bool {
+	return atomic.LoadInt32(&info.isAliveAtomic) != 0
+}
+
+func logTimeout(err error) bool {
+	if e, ok := err.(net.Error); ok {
+		if e.Timeout() {
+			glog.V(3).Infof("connection to endpoint closed due to inactivity")
+			return true
+		}
+	}
+	return false
+}
+
+// Proxier is a simple proxy for TCP connections between a localhost:lport
+// and services that provide the actual implementations.
+type Proxier struct {
+	loadBalancer   LoadBalancer
+	mu             sync.Mutex // protects serviceMap
+	serviceMap     map[ServicePortPortalName]*serviceInfo
+	syncPeriod     time.Duration
+	udpIdleTimeout time.Duration
+	portMapMutex   sync.Mutex
+	portMap        map[portMapKey]*portMapValue
+	numProxyLoops  int32 // use atomic ops to access this; mostly for testing
+	netsh          netsh.Interface
+	hostIP         net.IP
+}
+
+// assert Proxier is a ProxyProvider
+var _ proxy.ProxyProvider = &Proxier{}
+
+// A key for the portMap.  The ip has to be a string because slices can't be map
+// keys.
+type portMapKey struct {
+	ip       string
+	port     int
+	protocol api.Protocol
+}
+
+func (k *portMapKey) String() string {
+	return fmt.Sprintf("%s:%d/%s", k.ip, k.port, k.protocol)
+}
+
+// A value for the portMap
+type portMapValue struct {
+	owner  ServicePortPortalName
+	socket interface {
+		Close() error
+	}
+}
+
+var (
+	// ErrProxyOnLocalhost is returned by NewProxier if the user requests a proxier on
+	// the loopback address. May be checked for by callers of NewProxier to know whether
+	// the caller provided invalid input.
+	ErrProxyOnLocalhost = fmt.Errorf("cannot proxy on localhost")
+)
+
+// Used below.
+var localhostIPv4 = net.ParseIP("127.0.0.1")
+var localhostIPv6 = net.ParseIP("::1")
+
+// NewProxier returns a new Proxier given a LoadBalancer and an address on
+// which to listen. It is assumed that there is only a single Proxier active
+// on a machine. An error will be returned if the proxier cannot be started
+// due to an invalid ListenIP (loopback)
+func NewProxier(loadBalancer LoadBalancer, listenIP net.IP, netsh netsh.Interface, pr utilnet.PortRange, syncPeriod, udpIdleTimeout time.Duration) (*Proxier, error) {
+	if listenIP.Equal(localhostIPv4) || listenIP.Equal(localhostIPv6) {
+		return nil, ErrProxyOnLocalhost
+	}
+
+	hostIP, err := utilnet.ChooseHostInterface()
+	if err != nil {
+		return nil, fmt.Errorf("failed to select a host interface: %v", err)
+	}
+
+	glog.V(2).Infof("Setting proxy IP to %v", hostIP)
+	return createProxier(loadBalancer, listenIP, netsh, hostIP, syncPeriod, udpIdleTimeout)
+}
+
+func createProxier(loadBalancer LoadBalancer, listenIP net.IP, netsh netsh.Interface, hostIP net.IP, syncPeriod, udpIdleTimeout time.Duration) (*Proxier, error) {
+	return &Proxier{
+		loadBalancer:   loadBalancer,
+		serviceMap:     make(map[ServicePortPortalName]*serviceInfo),
+		portMap:        make(map[portMapKey]*portMapValue),
+		syncPeriod:     syncPeriod,
+		udpIdleTimeout: udpIdleTimeout,
+		netsh:          netsh,
+		hostIP:         hostIP,
+	}, nil
+}
+
+// Sync is called to immediately synchronize the proxier state
+func (proxier *Proxier) Sync() {
+	proxier.cleanupStaleStickySessions()
+}
+
+// SyncLoop runs periodic work.  This is expected to run as a goroutine or as the main loop of the app.  It does not return.
+func (proxier *Proxier) SyncLoop() {
+	t := time.NewTicker(proxier.syncPeriod)
+	defer t.Stop()
+	for {
+		<-t.C
+		glog.V(6).Infof("Periodic sync")
+		proxier.Sync()
+	}
+}
+
+// cleanupStaleStickySessions cleans up any stale sticky session records in the hash map.
+func (proxier *Proxier) cleanupStaleStickySessions() {
+	proxier.mu.Lock()
+	defer proxier.mu.Unlock()
+	servicePortNameMap := make(map[proxy.ServicePortName]bool)
+	for name := range proxier.serviceMap {
+		servicePortName := proxy.ServicePortName{
+			NamespacedName: types.NamespacedName{
+				Namespace: name.Namespace,
+				Name:      name.Name,
+			},
+			Port: name.Port,
+		}
+		if servicePortNameMap[servicePortName] == false {
+			// ensure cleanup sticky sessions only gets called once per serviceportname
+			servicePortNameMap[servicePortName] = true
+			proxier.loadBalancer.CleanupStaleStickySessions(servicePortName)
+		}
+	}
+}
+
+// This assumes proxier.mu is not locked.
+func (proxier *Proxier) stopProxy(service ServicePortPortalName, info *serviceInfo) error {
+	proxier.mu.Lock()
+	defer proxier.mu.Unlock()
+	return proxier.stopProxyInternal(service, info)
+}
+
+// This assumes proxier.mu is locked.
+func (proxier *Proxier) stopProxyInternal(service ServicePortPortalName, info *serviceInfo) error {
+	delete(proxier.serviceMap, service)
+	info.setAlive(false)
+	err := info.socket.Close()
+	return err
+}
+
+func (proxier *Proxier) getServiceInfo(service ServicePortPortalName) (*serviceInfo, bool) {
+	proxier.mu.Lock()
+	defer proxier.mu.Unlock()
+	info, ok := proxier.serviceMap[service]
+	return info, ok
+}
+
+func (proxier *Proxier) setServiceInfo(service ServicePortPortalName, info *serviceInfo) {
+	proxier.mu.Lock()
+	defer proxier.mu.Unlock()
+	proxier.serviceMap[service] = info
+}
+
+// addServicePortPortal starts listening for a new service, returning the serviceInfo.
+// The timeout only applies to UDP connections, for now.
+func (proxier *Proxier) addServicePortPortal(servicePortPortalName ServicePortPortalName, protocol api.Protocol, listenIP string, port int, timeout time.Duration) (*serviceInfo, error) {
+	var serviceIP net.IP
+	if listenIP != allAvailableInterfaces {
+		if serviceIP = net.ParseIP(listenIP); serviceIP == nil {
+			return nil, fmt.Errorf("could not parse ip '%q'", listenIP)
+		}
+		// add the IP address.  Node port binds to all interfaces.
+		args := proxier.netshIpv4AddressAddArgs(serviceIP)
+		if existed, err := proxier.netsh.EnsureIPAddress(args, serviceIP); err != nil {
+			return nil, err
+		} else if !existed {
+			glog.V(3).Infof("Added ip address to fowarder interface for service %q at %s:%d/%s", servicePortPortalName, listenIP, port, protocol)
+		}
+	}
+
+	// add the listener, proxy
+	sock, err := newProxySocket(protocol, serviceIP, port)
+	if err != nil {
+		return nil, err
+	}
+	si := &serviceInfo{
+		isAliveAtomic: 1,
+		portal: portal{
+			ip:         listenIP,
+			port:       port,
+			isExternal: false,
+		},
+		protocol:            protocol,
+		socket:              sock,
+		timeout:             timeout,
+		activeClients:       newClientCache(),
+		dnsClients:          newDNSClientCache(),
+		sessionAffinityType: api.ServiceAffinityNone, // default
+	}
+	proxier.setServiceInfo(servicePortPortalName, si)
+
+	glog.V(2).Infof("Proxying for service %q at %s:%d/%s", servicePortPortalName, listenIP, port, protocol)
+	go func(service ServicePortPortalName, proxier *Proxier) {
+		defer runtime.HandleCrash()
+		atomic.AddInt32(&proxier.numProxyLoops, 1)
+		sock.ProxyLoop(service, si, proxier)
+		atomic.AddInt32(&proxier.numProxyLoops, -1)
+	}(servicePortPortalName, proxier)
+
+	return si, nil
+}
+
+func (proxier *Proxier) closeServicePortPortal(servicePortPortalName ServicePortPortalName, info *serviceInfo) error {
+	// turn off the proxy
+	if err := proxier.stopProxy(servicePortPortalName, info); err != nil {
+		return err
+	}
+
+	// close the PortalProxy by deleting the service IP address
+	if info.portal.ip != allAvailableInterfaces {
+		serviceIP := net.ParseIP(info.portal.ip)
+		args := proxier.netshIpv4AddressDeleteArgs(serviceIP)
+		if err := proxier.netsh.DeleteIPAddress(args); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// getListenIPPortMap returns a slice of all listen IPs for a service.
+func getListenIPPortMap(service *api.Service, listenPort int, nodePort int) map[string]int {
+	listenIPPortMap := make(map[string]int)
+	listenIPPortMap[service.Spec.ClusterIP] = listenPort
+
+	for _, ip := range service.Spec.ExternalIPs {
+		listenIPPortMap[ip] = listenPort
+	}
+
+	for _, ingress := range service.Status.LoadBalancer.Ingress {
+		listenIPPortMap[ingress.IP] = listenPort
+	}
+
+	if nodePort != 0 {
+		listenIPPortMap[allAvailableInterfaces] = nodePort
+	}
+
+	return listenIPPortMap
+}
+
+func (proxier *Proxier) mergeService(service *api.Service) map[ServicePortPortalName]bool {
+	if service == nil {
+		return nil
+	}
+	svcName := types.NamespacedName{Namespace: service.Namespace, Name: service.Name}
+	if !helper.IsServiceIPSet(service) {
+		glog.V(3).Infof("Skipping service %s due to clusterIP = %q", svcName, service.Spec.ClusterIP)
+		return nil
+	}
+	existingPortPortals := make(map[ServicePortPortalName]bool)
+
+	for i := range service.Spec.Ports {
+		servicePort := &service.Spec.Ports[i]
+		// create a slice of all the source IPs to use for service port portals
+		listenIPPortMap := getListenIPPortMap(service, int(servicePort.Port), int(servicePort.NodePort))
+		protocol := servicePort.Protocol
+
+		for listenIP, listenPort := range listenIPPortMap {
+			servicePortPortalName := ServicePortPortalName{
+				NamespacedName: svcName,
+				Port:           servicePort.Name,
+				PortalIPName:   listenIP,
+			}
+			existingPortPortals[servicePortPortalName] = true
+			info, exists := proxier.getServiceInfo(servicePortPortalName)
+			if exists && sameConfig(info, service, protocol, listenPort) {
+				// Nothing changed.
+				continue
+			}
+			if exists {
+				glog.V(4).Infof("Something changed for service %q: stopping it", servicePortPortalName)
+				if err := proxier.closeServicePortPortal(servicePortPortalName, info); err != nil {
+					glog.Errorf("Failed to close service port portal %q: %v", servicePortPortalName, err)
+				}
+			}
+			glog.V(1).Infof("Adding new service %q at %s:%d/%s", servicePortPortalName, listenIP, listenPort, protocol)
+			info, err := proxier.addServicePortPortal(servicePortPortalName, protocol, listenIP, listenPort, proxier.udpIdleTimeout)
+			if err != nil {
+				glog.Errorf("Failed to start proxy for %q: %v", servicePortPortalName, err)
+				continue
+			}
+			info.sessionAffinityType = service.Spec.SessionAffinity
+			glog.V(10).Infof("info: %#v", info)
+		}
+		if len(listenIPPortMap) > 0 {
+			// only one loadbalancer per service port portal
+			servicePortName := proxy.ServicePortName{
+				NamespacedName: types.NamespacedName{
+					Namespace: service.Namespace,
+					Name:      service.Name,
+				},
+				Port: servicePort.Name,
+			}
+			timeoutSeconds := 0
+			if service.Spec.SessionAffinity == api.ServiceAffinityClientIP {
+				timeoutSeconds = int(*service.Spec.SessionAffinityConfig.ClientIP.TimeoutSeconds)
+			}
+			proxier.loadBalancer.NewService(servicePortName, service.Spec.SessionAffinity, timeoutSeconds)
+		}
+	}
+
+	return existingPortPortals
+}
+
+func (proxier *Proxier) unmergeService(service *api.Service, existingPortPortals map[ServicePortPortalName]bool) {
+	if service == nil {
+		return
+	}
+	svcName := types.NamespacedName{Namespace: service.Namespace, Name: service.Name}
+	if !helper.IsServiceIPSet(service) {
+		glog.V(3).Infof("Skipping service %s due to clusterIP = %q", svcName, service.Spec.ClusterIP)
+		return
+	}
+
+	servicePortNameMap := make(map[proxy.ServicePortName]bool)
+	for name := range existingPortPortals {
+		servicePortName := proxy.ServicePortName{
+			NamespacedName: types.NamespacedName{
+				Namespace: name.Namespace,
+				Name:      name.Name,
+			},
+			Port: name.Port,
+		}
+		servicePortNameMap[servicePortName] = true
+	}
+
+	for i := range service.Spec.Ports {
+		servicePort := &service.Spec.Ports[i]
+		serviceName := proxy.ServicePortName{NamespacedName: svcName, Port: servicePort.Name}
+		// create a slice of all the source IPs to use for service port portals
+		listenIPPortMap := getListenIPPortMap(service, int(servicePort.Port), int(servicePort.NodePort))
+
+		for listenIP := range listenIPPortMap {
+			servicePortPortalName := ServicePortPortalName{
+				NamespacedName: svcName,
+				Port:           servicePort.Name,
+				PortalIPName:   listenIP,
+			}
+			if existingPortPortals[servicePortPortalName] {
+				continue
+			}
+
+			glog.V(1).Infof("Stopping service %q", servicePortPortalName)
+			info, exists := proxier.getServiceInfo(servicePortPortalName)
+			if !exists {
+				glog.Errorf("Service %q is being removed but doesn't exist", servicePortPortalName)
+				continue
+			}
+
+			if err := proxier.closeServicePortPortal(servicePortPortalName, info); err != nil {
+				glog.Errorf("Failed to close service port portal %q: %v", servicePortPortalName, err)
+			}
+		}
+
+		// Only delete load balancer if all listen ips per name/port show inactive.
+		if !servicePortNameMap[serviceName] {
+			proxier.loadBalancer.DeleteService(serviceName)
+		}
+	}
+}
+
+func (proxier *Proxier) OnServiceAdd(service *api.Service) {
+	_ = proxier.mergeService(service)
+}
+
+func (proxier *Proxier) OnServiceUpdate(oldService, service *api.Service) {
+	existingPortPortals := proxier.mergeService(service)
+	proxier.unmergeService(oldService, existingPortPortals)
+}
+
+func (proxier *Proxier) OnServiceDelete(service *api.Service) {
+	proxier.unmergeService(service, map[ServicePortPortalName]bool{})
+}
+
+func (proxier *Proxier) OnServiceSynced() {
+}
+
+func sameConfig(info *serviceInfo, service *api.Service, protocol api.Protocol, listenPort int) bool {
+	return info.protocol == protocol && info.portal.port == listenPort && info.sessionAffinityType == service.Spec.SessionAffinity
+}
+
+func isTooManyFDsError(err error) bool {
+	return strings.Contains(err.Error(), "too many open files")
+}
+
+func isClosedError(err error) bool {
+	// A brief discussion about handling closed error here:
+	// https://code.google.com/p/go/issues/detail?id=4373#c14
+	// TODO: maybe create a stoppable TCP listener that returns a StoppedError
+	return strings.HasSuffix(err.Error(), "use of closed network connection")
+}
+
+func (proxier *Proxier) netshIpv4AddressAddArgs(destIP net.IP) []string {
+	intName := proxier.netsh.GetInterfaceToAddIP()
+	args := []string{
+		"interface", "ipv4", "add", "address",
+		"name=" + intName,
+		"address=" + destIP.String(),
+	}
+
+	return args
+}
+
+func (proxier *Proxier) netshIpv4AddressDeleteArgs(destIP net.IP) []string {
+	intName := proxier.netsh.GetInterfaceToAddIP()
+	args := []string{
+		"interface", "ipv4", "delete", "address",
+		"name=" + intName,
+		"address=" + destIP.String(),
+	}
+
+	return args
+}

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/proxier_test.go

@@ -0,0 +1,928 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strconv"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/runtime"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/proxy"
+	netshtest "k8s.io/kubernetes/pkg/util/netsh/testing"
+)
+
+const (
+	udpIdleTimeoutForTest = 250 * time.Millisecond
+)
+
+func joinHostPort(host string, port int) string {
+	return net.JoinHostPort(host, fmt.Sprintf("%d", port))
+}
+
+func waitForClosedPortTCP(p *Proxier, proxyPort int) error {
+	for i := 0; i < 50; i++ {
+		conn, err := net.Dial("tcp", joinHostPort("", proxyPort))
+		if err != nil {
+			return nil
+		}
+		conn.Close()
+		time.Sleep(1 * time.Millisecond)
+	}
+	return fmt.Errorf("port %d still open", proxyPort)
+}
+
+func waitForClosedPortUDP(p *Proxier, proxyPort int) error {
+	for i := 0; i < 50; i++ {
+		conn, err := net.Dial("udp", joinHostPort("", proxyPort))
+		if err != nil {
+			return nil
+		}
+		conn.SetReadDeadline(time.Now().Add(10 * time.Millisecond))
+		// To detect a closed UDP port write, then read.
+		_, err = conn.Write([]byte("x"))
+		if err != nil {
+			if e, ok := err.(net.Error); ok && !e.Timeout() {
+				return nil
+			}
+		}
+		var buf [4]byte
+		_, err = conn.Read(buf[0:])
+		if err != nil {
+			if e, ok := err.(net.Error); ok && !e.Timeout() {
+				return nil
+			}
+		}
+		conn.Close()
+		time.Sleep(1 * time.Millisecond)
+	}
+	return fmt.Errorf("port %d still open", proxyPort)
+}
+
+var tcpServerPort int32
+var udpServerPort int32
+
+func TestMain(m *testing.M) {
+	// Don't handle panics
+	runtime.ReallyCrash = true
+
+	// TCP setup.
+	tcp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(r.URL.Path[1:]))
+	}))
+	defer tcp.Close()
+
+	u, err := url.Parse(tcp.URL)
+	if err != nil {
+		panic(fmt.Sprintf("failed to parse: %v", err))
+	}
+	_, port, err := net.SplitHostPort(u.Host)
+	if err != nil {
+		panic(fmt.Sprintf("failed to parse: %v", err))
+	}
+	tcpServerPortValue, err := strconv.Atoi(port)
+	if err != nil {
+		panic(fmt.Sprintf("failed to atoi(%s): %v", port, err))
+	}
+	tcpServerPort = int32(tcpServerPortValue)
+
+	// UDP setup.
+	udp, err := newUDPEchoServer()
+	if err != nil {
+		panic(fmt.Sprintf("failed to make a UDP server: %v", err))
+	}
+	_, port, err = net.SplitHostPort(udp.LocalAddr().String())
+	if err != nil {
+		panic(fmt.Sprintf("failed to parse: %v", err))
+	}
+	udpServerPortValue, err := strconv.Atoi(port)
+	if err != nil {
+		panic(fmt.Sprintf("failed to atoi(%s): %v", port, err))
+	}
+	udpServerPort = int32(udpServerPortValue)
+	go udp.Loop()
+
+	ret := m.Run()
+	// it should be safe to call Close() multiple times.
+	tcp.Close()
+	os.Exit(ret)
+}
+
+func testEchoTCP(t *testing.T, address string, port int) {
+	path := "aaaaa"
+	res, err := http.Get("http://" + address + ":" + fmt.Sprintf("%d", port) + "/" + path)
+	if err != nil {
+		t.Fatalf("error connecting to server: %v", err)
+	}
+	defer res.Body.Close()
+	data, err := ioutil.ReadAll(res.Body)
+	if err != nil {
+		t.Errorf("error reading data: %v %v", err, string(data))
+	}
+	if string(data) != path {
+		t.Errorf("expected: %s, got %s", path, string(data))
+	}
+}
+
+func testEchoUDP(t *testing.T, address string, port int) {
+	data := "abc123"
+
+	conn, err := net.Dial("udp", joinHostPort(address, port))
+	if err != nil {
+		t.Fatalf("error connecting to server: %v", err)
+	}
+	if _, err := conn.Write([]byte(data)); err != nil {
+		t.Fatalf("error sending to server: %v", err)
+	}
+	var resp [1024]byte
+	n, err := conn.Read(resp[0:])
+	if err != nil {
+		t.Errorf("error receiving data: %v", err)
+	}
+	if string(resp[0:n]) != data {
+		t.Errorf("expected: %s, got %s", data, string(resp[0:n]))
+	}
+}
+
+func waitForNumProxyLoops(t *testing.T, p *Proxier, want int32) {
+	var got int32
+	for i := 0; i < 600; i++ {
+		got = atomic.LoadInt32(&p.numProxyLoops)
+		if got == want {
+			return
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	t.Errorf("expected %d ProxyLoops running, got %d", want, got)
+}
+
+func waitForNumProxyClients(t *testing.T, s *serviceInfo, want int, timeout time.Duration) {
+	var got int
+	now := time.Now()
+	deadline := now.Add(timeout)
+	for time.Now().Before(deadline) {
+		s.activeClients.mu.Lock()
+		got = len(s.activeClients.clients)
+		s.activeClients.mu.Unlock()
+		if got == want {
+			return
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	t.Errorf("expected %d ProxyClients live, got %d", want, got)
+}
+
+func getPortNum(t *testing.T, addr string) int {
+	_, portStr, err := net.SplitHostPort(addr)
+	if err != nil {
+		t.Errorf("error getting port from %s", addr)
+		return 0
+	}
+	portNum, err := strconv.Atoi(portStr)
+	if err != nil {
+		t.Errorf("error getting port from %s", addr)
+		return 0
+	}
+
+	return portNum
+}
+
+func TestTCPProxy(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestUDPProxy(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: udpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoUDP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestUDPProxyTimeout(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: udpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	waitForNumProxyLoops(t, p, 1)
+	testEchoUDP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	// When connecting to a UDP service endpoint, there should be a Conn for proxy.
+	waitForNumProxyClients(t, svcInfo, 1, time.Second)
+	// If conn has no activity for serviceInfo.timeout since last Read/Write, it should be closed because of timeout.
+	waitForNumProxyClients(t, svcInfo, 0, 2*time.Second)
+}
+
+func TestMultiPortProxy(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	serviceP := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo-p"}, Port: "p"}
+	serviceQ := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo-q"}, Port: "q"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: serviceP.Name, Namespace: serviceP.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Protocol: "TCP", Port: tcpServerPort}},
+		}},
+	})
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: serviceQ.Name, Namespace: serviceQ.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "q", Protocol: "UDP", Port: udpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalNameP := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: serviceP.Namespace, Name: serviceP.Name}, Port: serviceP.Port, PortalIPName: listenIP}
+	svcInfoP, err := p.addServicePortPortal(servicePortPortalNameP, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfoP.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+
+	servicePortPortalNameQ := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: serviceQ.Namespace, Name: serviceQ.Name}, Port: serviceQ.Port, PortalIPName: listenIP}
+	svcInfoQ, err := p.addServicePortPortal(servicePortPortalNameQ, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoUDP(t, "127.0.0.1", getPortNum(t, svcInfoQ.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 2)
+}
+
+func TestMultiPortOnServiceAdd(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	serviceP := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	serviceQ := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "q"}
+	serviceX := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "x"}
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	p.OnServiceAdd(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: serviceP.Name, Namespace: serviceP.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: "0.0.0.0", Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     0,
+			Protocol: "TCP",
+		}, {
+			Name:     "q",
+			Port:     0,
+			Protocol: "UDP",
+		}}},
+	})
+	waitForNumProxyLoops(t, p, 2)
+
+	servicePortPortalNameP := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: serviceP.Namespace, Name: serviceP.Name}, Port: serviceP.Port, PortalIPName: listenIP}
+	svcInfo, exists := p.getServiceInfo(servicePortPortalNameP)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalNameP)
+	}
+	if svcInfo.portal.ip != "0.0.0.0" || svcInfo.portal.port != 0 || svcInfo.protocol != "TCP" {
+		t.Errorf("unexpected serviceInfo for %s: %#v", serviceP, svcInfo)
+	}
+
+	servicePortPortalNameQ := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: serviceQ.Namespace, Name: serviceQ.Name}, Port: serviceQ.Port, PortalIPName: listenIP}
+	svcInfo, exists = p.getServiceInfo(servicePortPortalNameQ)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalNameQ)
+	}
+	if svcInfo.portal.ip != "0.0.0.0" || svcInfo.portal.port != 0 || svcInfo.protocol != "UDP" {
+		t.Errorf("unexpected serviceInfo for %s: %#v", serviceQ, svcInfo)
+	}
+
+	servicePortPortalNameX := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: serviceX.Namespace, Name: serviceX.Name}, Port: serviceX.Port, PortalIPName: listenIP}
+	svcInfo, exists = p.getServiceInfo(servicePortPortalNameX)
+	if exists {
+		t.Fatalf("found unwanted serviceInfo for %s: %#v", serviceX, svcInfo)
+	}
+}
+
+// Helper: Stops the proxy for the named service.
+func stopProxyByName(proxier *Proxier, service ServicePortPortalName) error {
+	info, found := proxier.getServiceInfo(service)
+	if !found {
+		return fmt.Errorf("unknown service: %s", service)
+	}
+	return proxier.stopProxy(service, info)
+}
+
+func TestTCPProxyStop(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Namespace: service.Namespace, Name: service.Name},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	if !svcInfo.isAlive() {
+		t.Fatalf("wrong value for isAlive(): expected true")
+	}
+	conn, err := net.Dial("tcp", joinHostPort("", getPortNum(t, svcInfo.socket.Addr().String())))
+	if err != nil {
+		t.Fatalf("error connecting to proxy: %v", err)
+	}
+	conn.Close()
+	waitForNumProxyLoops(t, p, 1)
+
+	stopProxyByName(p, servicePortPortalName)
+	if svcInfo.isAlive() {
+		t.Fatalf("wrong value for isAlive(): expected false")
+	}
+	// Wait for the port to really close.
+	if err := waitForClosedPortTCP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	waitForNumProxyLoops(t, p, 0)
+}
+
+func TestUDPProxyStop(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Namespace: service.Namespace, Name: service.Name},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: udpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	conn, err := net.Dial("udp", joinHostPort("", getPortNum(t, svcInfo.socket.Addr().String())))
+	if err != nil {
+		t.Fatalf("error connecting to proxy: %v", err)
+	}
+	conn.Close()
+	waitForNumProxyLoops(t, p, 1)
+
+	stopProxyByName(p, servicePortPortalName)
+	// Wait for the port to really close.
+	if err := waitForClosedPortUDP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	waitForNumProxyLoops(t, p, 0)
+}
+
+func TestTCPProxyUpdateDelete(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Namespace: service.Namespace, Name: service.Name},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	fmt.Println("here0")
+	conn, err := net.Dial("tcp", joinHostPort("", getPortNum(t, svcInfo.socket.Addr().String())))
+	if err != nil {
+		t.Fatalf("error connecting to proxy: %v", err)
+	}
+	conn.Close()
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceDelete(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "TCP",
+		}}},
+	})
+	if err := waitForClosedPortTCP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	waitForNumProxyLoops(t, p, 0)
+}
+
+func TestUDPProxyUpdateDelete(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Namespace: service.Namespace, Name: service.Name},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: udpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	conn, err := net.Dial("udp", joinHostPort("", getPortNum(t, svcInfo.socket.Addr().String())))
+	if err != nil {
+		t.Fatalf("error connecting to proxy: %v", err)
+	}
+	conn.Close()
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceDelete(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "UDP",
+		}}},
+	})
+	if err := waitForClosedPortUDP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	waitForNumProxyLoops(t, p, 0)
+}
+
+func TestTCPProxyUpdateDeleteUpdate(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	endpoint := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	}
+	lb.OnEndpointsAdd(endpoint)
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	conn, err := net.Dial("tcp", joinHostPort("", getPortNum(t, svcInfo.socket.Addr().String())))
+	if err != nil {
+		t.Fatalf("error connecting to proxy: %v", err)
+	}
+	conn.Close()
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceDelete(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "TCP",
+		}}},
+	})
+	if err := waitForClosedPortTCP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	// need to add endpoint here because it got clean up during service delete
+	lb.OnEndpointsAdd(endpoint)
+	p.OnServiceAdd(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "TCP",
+		}}},
+	})
+	svcInfo, exists := p.getServiceInfo(servicePortPortalName)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalName)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestUDPProxyUpdateDeleteUpdate(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	endpoint := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: udpServerPort}},
+		}},
+	}
+	lb.OnEndpointsAdd(endpoint)
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	conn, err := net.Dial("udp", joinHostPort("", getPortNum(t, svcInfo.socket.Addr().String())))
+	if err != nil {
+		t.Fatalf("error connecting to proxy: %v", err)
+	}
+	conn.Close()
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceDelete(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "UDP",
+		}}},
+	})
+	if err := waitForClosedPortUDP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	// need to add endpoint here because it got clean up during service delete
+	lb.OnEndpointsAdd(endpoint)
+	p.OnServiceAdd(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "UDP",
+		}}},
+	})
+	svcInfo, exists := p.getServiceInfo(servicePortPortalName)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalName)
+	}
+	testEchoUDP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestTCPProxyUpdatePort(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceAdd(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     0,
+			Protocol: "TCP",
+		}}},
+	})
+	// Wait for the socket to actually get free.
+	if err := waitForClosedPortTCP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	svcInfo, exists := p.getServiceInfo(servicePortPortalName)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalName)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	// This is a bit async, but this should be sufficient.
+	time.Sleep(500 * time.Millisecond)
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestUDPProxyUpdatePort(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: udpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "UDP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceAdd(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     0,
+			Protocol: "UDP",
+		}}},
+	})
+	// Wait for the socket to actually get free.
+	if err := waitForClosedPortUDP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	svcInfo, exists := p.getServiceInfo(servicePortPortalName)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalName)
+	}
+	testEchoUDP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestProxyUpdatePublicIPs(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	lb.OnEndpointsAdd(&api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	})
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+
+	p.OnServiceAdd(&api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{
+			Ports: []api.ServicePort{{
+				Name:     "p",
+				Port:     int32(svcInfo.portal.port),
+				Protocol: "TCP",
+			}},
+			ClusterIP:   svcInfo.portal.ip,
+			ExternalIPs: []string{"0.0.0.0"},
+		},
+	})
+	// Wait for the socket to actually get free.
+	if err := waitForClosedPortTCP(p, getPortNum(t, svcInfo.socket.Addr().String())); err != nil {
+		t.Fatalf(err.Error())
+	}
+	svcInfo, exists := p.getServiceInfo(servicePortPortalName)
+	if !exists {
+		t.Fatalf("can't find serviceInfo for %s", servicePortPortalName)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	// This is a bit async, but this should be sufficient.
+	time.Sleep(500 * time.Millisecond)
+	waitForNumProxyLoops(t, p, 1)
+}
+
+func TestProxyUpdatePortal(t *testing.T) {
+	lb := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "echo"}, Port: "p"}
+	endpoint := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "127.0.0.1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: tcpServerPort}},
+		}},
+	}
+	lb.OnEndpointsAdd(endpoint)
+
+	listenIP := "0.0.0.0"
+	p, err := createProxier(lb, net.ParseIP(listenIP), netshtest.NewFake(), net.ParseIP("127.0.0.1"), time.Minute, udpIdleTimeoutForTest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForNumProxyLoops(t, p, 0)
+
+	servicePortPortalName := ServicePortPortalName{NamespacedName: types.NamespacedName{Namespace: service.Namespace, Name: service.Name}, Port: service.Port, PortalIPName: listenIP}
+	svcInfo, err := p.addServicePortPortal(servicePortPortalName, "TCP", listenIP, 0, time.Second)
+	if err != nil {
+		t.Fatalf("error adding new service: %#v", err)
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+
+	svcv0 := &api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(svcInfo.portal.port),
+			Protocol: "TCP",
+		}}},
+	}
+
+	svcv1 := &api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: "", Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(svcInfo.portal.port),
+			Protocol: "TCP",
+		}}},
+	}
+
+	p.OnServiceUpdate(svcv0, svcv1)
+	_, exists := p.getServiceInfo(servicePortPortalName)
+	if exists {
+		t.Fatalf("service with empty ClusterIP should not be included in the proxy")
+	}
+
+	svcv2 := &api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: "None", Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(getPortNum(t, svcInfo.socket.Addr().String())),
+			Protocol: "TCP",
+		}}},
+	}
+	p.OnServiceUpdate(svcv1, svcv2)
+	_, exists = p.getServiceInfo(servicePortPortalName)
+	if exists {
+		t.Fatalf("service with 'None' as ClusterIP should not be included in the proxy")
+	}
+
+	svcv3 := &api.Service{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Spec: api.ServiceSpec{ClusterIP: listenIP, Ports: []api.ServicePort{{
+			Name:     "p",
+			Port:     int32(svcInfo.portal.port),
+			Protocol: "TCP",
+		}}},
+	}
+	p.OnServiceUpdate(svcv2, svcv3)
+	lb.OnEndpointsAdd(endpoint)
+	svcInfo, exists = p.getServiceInfo(servicePortPortalName)
+	if !exists {
+		t.Fatalf("service with ClusterIP set not found in the proxy")
+	}
+	testEchoTCP(t, "127.0.0.1", getPortNum(t, svcInfo.socket.Addr().String()))
+	waitForNumProxyLoops(t, p, 1)
+}
+
+// TODO(justinsb): Add test for nodePort conflict detection, once we have nodePort wired in

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/proxysocket.go

@@ -0,0 +1,632 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/golang/glog"
+	"github.com/miekg/dns"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/runtime"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/proxy"
+	"k8s.io/kubernetes/pkg/util/ipconfig"
+	"k8s.io/utils/exec"
+)
+
+const (
+	// Kubernetes DNS suffix search list
+	// TODO: Get DNS suffix search list from docker containers.
+	// --dns-search option doesn't work on Windows containers and has been
+	// fixed recently in docker.
+
+	// Kubernetes cluster domain
+	clusterDomain = "cluster.local"
+
+	// Kubernetes service domain
+	serviceDomain = "svc." + clusterDomain
+
+	// Kubernetes default namespace domain
+	namespaceServiceDomain = "default." + serviceDomain
+
+	// Kubernetes DNS service port name
+	dnsPortName = "dns"
+
+	// DNS TYPE value A (a host address)
+	dnsTypeA uint16 = 0x01
+
+	// DNS TYPE value AAAA (a host IPv6 address)
+	dnsTypeAAAA uint16 = 0x1c
+
+	// DNS CLASS value IN (the Internet)
+	dnsClassInternet uint16 = 0x01
+)
+
+// Abstraction over TCP/UDP sockets which are proxied.
+type proxySocket interface {
+	// Addr gets the net.Addr for a proxySocket.
+	Addr() net.Addr
+	// Close stops the proxySocket from accepting incoming connections.
+	// Each implementation should comment on the impact of calling Close
+	// while sessions are active.
+	Close() error
+	// ProxyLoop proxies incoming connections for the specified service to the service endpoints.
+	ProxyLoop(service ServicePortPortalName, info *serviceInfo, proxier *Proxier)
+	// ListenPort returns the host port that the proxySocket is listening on
+	ListenPort() int
+}
+
+func newProxySocket(protocol api.Protocol, ip net.IP, port int) (proxySocket, error) {
+	host := ""
+	if ip != nil {
+		host = ip.String()
+	}
+
+	switch strings.ToUpper(string(protocol)) {
+	case "TCP":
+		listener, err := net.Listen("tcp", net.JoinHostPort(host, strconv.Itoa(port)))
+		if err != nil {
+			return nil, err
+		}
+		return &tcpProxySocket{Listener: listener, port: port}, nil
+	case "UDP":
+		addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(host, strconv.Itoa(port)))
+		if err != nil {
+			return nil, err
+		}
+		conn, err := net.ListenUDP("udp", addr)
+		if err != nil {
+			return nil, err
+		}
+		return &udpProxySocket{UDPConn: conn, port: port}, nil
+	}
+	return nil, fmt.Errorf("unknown protocol %q", protocol)
+}
+
+// How long we wait for a connection to a backend in seconds
+var endpointDialTimeout = []time.Duration{250 * time.Millisecond, 500 * time.Millisecond, 1 * time.Second, 2 * time.Second}
+
+// tcpProxySocket implements proxySocket.  Close() is implemented by net.Listener.  When Close() is called,
+// no new connections are allowed but existing connections are left untouched.
+type tcpProxySocket struct {
+	net.Listener
+	port int
+}
+
+func (tcp *tcpProxySocket) ListenPort() int {
+	return tcp.port
+}
+
+func tryConnect(service ServicePortPortalName, srcAddr net.Addr, protocol string, proxier *Proxier) (out net.Conn, err error) {
+	sessionAffinityReset := false
+	for _, dialTimeout := range endpointDialTimeout {
+		servicePortName := proxy.ServicePortName{
+			NamespacedName: types.NamespacedName{
+				Namespace: service.Namespace,
+				Name:      service.Name,
+			},
+			Port: service.Port,
+		}
+		endpoint, err := proxier.loadBalancer.NextEndpoint(servicePortName, srcAddr, sessionAffinityReset)
+		if err != nil {
+			glog.Errorf("Couldn't find an endpoint for %s: %v", service, err)
+			return nil, err
+		}
+		glog.V(3).Infof("Mapped service %q to endpoint %s", service, endpoint)
+		// TODO: This could spin up a new goroutine to make the outbound connection,
+		// and keep accepting inbound traffic.
+		outConn, err := net.DialTimeout(protocol, endpoint, dialTimeout)
+		if err != nil {
+			if isTooManyFDsError(err) {
+				panic("Dial failed: " + err.Error())
+			}
+			glog.Errorf("Dial failed: %v", err)
+			sessionAffinityReset = true
+			continue
+		}
+		return outConn, nil
+	}
+	return nil, fmt.Errorf("failed to connect to an endpoint.")
+}
+
+func (tcp *tcpProxySocket) ProxyLoop(service ServicePortPortalName, myInfo *serviceInfo, proxier *Proxier) {
+	for {
+		if !myInfo.isAlive() {
+			// The service port was closed or replaced.
+			return
+		}
+		// Block until a connection is made.
+		inConn, err := tcp.Accept()
+		if err != nil {
+			if isTooManyFDsError(err) {
+				panic("Accept failed: " + err.Error())
+			}
+
+			if isClosedError(err) {
+				return
+			}
+			if !myInfo.isAlive() {
+				// Then the service port was just closed so the accept failure is to be expected.
+				return
+			}
+			glog.Errorf("Accept failed: %v", err)
+			continue
+		}
+		glog.V(3).Infof("Accepted TCP connection from %v to %v", inConn.RemoteAddr(), inConn.LocalAddr())
+		outConn, err := tryConnect(service, inConn.(*net.TCPConn).RemoteAddr(), "tcp", proxier)
+		if err != nil {
+			glog.Errorf("Failed to connect to balancer: %v", err)
+			inConn.Close()
+			continue
+		}
+		// Spin up an async copy loop.
+		go proxyTCP(inConn.(*net.TCPConn), outConn.(*net.TCPConn))
+	}
+}
+
+// proxyTCP proxies data bi-directionally between in and out.
+func proxyTCP(in, out *net.TCPConn) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+	glog.V(4).Infof("Creating proxy between %v <-> %v <-> %v <-> %v",
+		in.RemoteAddr(), in.LocalAddr(), out.LocalAddr(), out.RemoteAddr())
+	go copyBytes("from backend", in, out, &wg)
+	go copyBytes("to backend", out, in, &wg)
+	wg.Wait()
+}
+
+func copyBytes(direction string, dest, src *net.TCPConn, wg *sync.WaitGroup) {
+	defer wg.Done()
+	glog.V(4).Infof("Copying %s: %s -> %s", direction, src.RemoteAddr(), dest.RemoteAddr())
+	n, err := io.Copy(dest, src)
+	if err != nil {
+		if !isClosedError(err) {
+			glog.Errorf("I/O error: %v", err)
+		}
+	}
+	glog.V(4).Infof("Copied %d bytes %s: %s -> %s", n, direction, src.RemoteAddr(), dest.RemoteAddr())
+	dest.Close()
+	src.Close()
+}
+
+// udpProxySocket implements proxySocket.  Close() is implemented by net.UDPConn.  When Close() is called,
+// no new connections are allowed and existing connections are broken.
+// TODO: We could lame-duck this ourselves, if it becomes important.
+type udpProxySocket struct {
+	*net.UDPConn
+	port int
+}
+
+func (udp *udpProxySocket) ListenPort() int {
+	return udp.port
+}
+
+func (udp *udpProxySocket) Addr() net.Addr {
+	return udp.LocalAddr()
+}
+
+// Holds all the known UDP clients that have not timed out.
+type clientCache struct {
+	mu      sync.Mutex
+	clients map[string]net.Conn // addr string -> connection
+}
+
+func newClientCache() *clientCache {
+	return &clientCache{clients: map[string]net.Conn{}}
+}
+
+// DNS query client classified by address and QTYPE
+type dnsClientQuery struct {
+	clientAddress string
+	dnsQType      uint16
+}
+
+// Holds DNS client query, the value contains the index in DNS suffix search list,
+// the original DNS message and length for the same client and QTYPE
+type dnsClientCache struct {
+	mu      sync.Mutex
+	clients map[dnsClientQuery]*dnsQueryState
+}
+
+type dnsQueryState struct {
+	searchIndex int32
+	msg         *dns.Msg
+}
+
+func newDNSClientCache() *dnsClientCache {
+	return &dnsClientCache{clients: map[dnsClientQuery]*dnsQueryState{}}
+}
+
+func packetRequiresDNSSuffix(dnsType, dnsClass uint16) bool {
+	return (dnsType == dnsTypeA || dnsType == dnsTypeAAAA) && dnsClass == dnsClassInternet
+}
+
+func isDNSService(portName string) bool {
+	return portName == dnsPortName
+}
+
+func appendDNSSuffix(msg *dns.Msg, buffer []byte, length int, dnsSuffix string) (int, error) {
+	if msg == nil || len(msg.Question) == 0 {
+		return length, fmt.Errorf("DNS message parameter is invalid")
+	}
+
+	// Save the original name since it will be reused for next iteration
+	origName := msg.Question[0].Name
+	if dnsSuffix != "" {
+		msg.Question[0].Name += dnsSuffix + "."
+	}
+	mbuf, err := msg.PackBuffer(buffer)
+	msg.Question[0].Name = origName
+
+	if err != nil {
+		glog.Warningf("Unable to pack DNS packet. Error is: %v", err)
+		return length, err
+	}
+
+	if &buffer[0] != &mbuf[0] {
+		return length, fmt.Errorf("Buffer is too small in packing DNS packet")
+	}
+
+	return len(mbuf), nil
+}
+
+func recoverDNSQuestion(origName string, msg *dns.Msg, buffer []byte, length int) (int, error) {
+	if msg == nil || len(msg.Question) == 0 {
+		return length, fmt.Errorf("DNS message parameter is invalid")
+	}
+
+	if origName == msg.Question[0].Name {
+		return length, nil
+	}
+
+	msg.Question[0].Name = origName
+	if len(msg.Answer) > 0 {
+		msg.Answer[0].Header().Name = origName
+	}
+	mbuf, err := msg.PackBuffer(buffer)
+
+	if err != nil {
+		glog.Warningf("Unable to pack DNS packet. Error is: %v", err)
+		return length, err
+	}
+
+	if &buffer[0] != &mbuf[0] {
+		return length, fmt.Errorf("Buffer is too small in packing DNS packet")
+	}
+
+	return len(mbuf), nil
+}
+
+func processUnpackedDNSQueryPacket(
+	dnsClients *dnsClientCache,
+	msg *dns.Msg,
+	host string,
+	dnsQType uint16,
+	buffer []byte,
+	length int,
+	dnsSearch []string) int {
+	if dnsSearch == nil || len(dnsSearch) == 0 {
+		glog.V(1).Infof("DNS search list is not initialized and is empty.")
+		return length
+	}
+
+	// TODO: handle concurrent queries from a client
+	dnsClients.mu.Lock()
+	state, found := dnsClients.clients[dnsClientQuery{host, dnsQType}]
+	if !found {
+		state = &dnsQueryState{0, msg}
+		dnsClients.clients[dnsClientQuery{host, dnsQType}] = state
+	}
+	dnsClients.mu.Unlock()
+
+	index := atomic.SwapInt32(&state.searchIndex, state.searchIndex+1)
+	// Also update message ID if the client retries due to previous query time out
+	state.msg.MsgHdr.Id = msg.MsgHdr.Id
+
+	if index < 0 || index >= int32(len(dnsSearch)) {
+		glog.V(1).Infof("Search index %d is out of range.", index)
+		return length
+	}
+
+	length, err := appendDNSSuffix(msg, buffer, length, dnsSearch[index])
+	if err != nil {
+		glog.Errorf("Append DNS suffix failed: %v", err)
+	}
+
+	return length
+}
+
+func processUnpackedDNSResponsePacket(
+	svrConn net.Conn,
+	dnsClients *dnsClientCache,
+	msg *dns.Msg,
+	rcode int,
+	host string,
+	dnsQType uint16,
+	buffer []byte,
+	length int,
+	dnsSearch []string) (bool, int) {
+	var drop bool
+	var err error
+	if dnsSearch == nil || len(dnsSearch) == 0 {
+		glog.V(1).Infof("DNS search list is not initialized and is empty.")
+		return drop, length
+	}
+
+	dnsClients.mu.Lock()
+	state, found := dnsClients.clients[dnsClientQuery{host, dnsQType}]
+	dnsClients.mu.Unlock()
+
+	if found {
+		index := atomic.SwapInt32(&state.searchIndex, state.searchIndex+1)
+		if rcode != 0 && index >= 0 && index < int32(len(dnsSearch)) {
+			// If the reponse has failure and iteration through the search list has not
+			// reached the end, retry on behalf of the client using the original query message
+			drop = true
+			length, err = appendDNSSuffix(state.msg, buffer, length, dnsSearch[index])
+			if err != nil {
+				glog.Errorf("Append DNS suffix failed: %v", err)
+			}
+
+			_, err = svrConn.Write(buffer[0:length])
+			if err != nil {
+				if !logTimeout(err) {
+					glog.Errorf("Write failed: %v", err)
+				}
+			}
+		} else {
+			length, err = recoverDNSQuestion(state.msg.Question[0].Name, msg, buffer, length)
+			if err != nil {
+				glog.Errorf("Recover DNS question failed: %v", err)
+			}
+
+			dnsClients.mu.Lock()
+			delete(dnsClients.clients, dnsClientQuery{host, dnsQType})
+			dnsClients.mu.Unlock()
+		}
+	}
+
+	return drop, length
+}
+
+func processDNSQueryPacket(
+	dnsClients *dnsClientCache,
+	cliAddr net.Addr,
+	buffer []byte,
+	length int,
+	dnsSearch []string) (int, error) {
+	msg := &dns.Msg{}
+	if err := msg.Unpack(buffer[:length]); err != nil {
+		glog.Warningf("Unable to unpack DNS packet. Error is: %v", err)
+		return length, err
+	}
+
+	// Query - Response bit that specifies whether this message is a query (0) or a response (1).
+	if msg.MsgHdr.Response == true {
+		return length, fmt.Errorf("DNS packet should be a query message")
+	}
+
+	// QDCOUNT
+	if len(msg.Question) != 1 {
+		glog.V(1).Infof("Number of entries in the question section of the DNS packet is: %d", len(msg.Question))
+		glog.V(1).Infof("DNS suffix appending does not support more than one question.")
+		return length, nil
+	}
+
+	// ANCOUNT, NSCOUNT, ARCOUNT
+	if len(msg.Answer) != 0 || len(msg.Ns) != 0 || len(msg.Extra) != 0 {
+		glog.V(1).Infof("DNS packet contains more than question section.")
+		return length, nil
+	}
+
+	dnsQType := msg.Question[0].Qtype
+	dnsQClass := msg.Question[0].Qclass
+	if packetRequiresDNSSuffix(dnsQType, dnsQClass) {
+		host, _, err := net.SplitHostPort(cliAddr.String())
+		if err != nil {
+			glog.V(1).Infof("Failed to get host from client address: %v", err)
+			host = cliAddr.String()
+		}
+
+		length = processUnpackedDNSQueryPacket(dnsClients, msg, host, dnsQType, buffer, length, dnsSearch)
+	}
+
+	return length, nil
+}
+
+func processDNSResponsePacket(
+	svrConn net.Conn,
+	dnsClients *dnsClientCache,
+	cliAddr net.Addr,
+	buffer []byte,
+	length int,
+	dnsSearch []string) (bool, int, error) {
+	var drop bool
+	msg := &dns.Msg{}
+	if err := msg.Unpack(buffer[:length]); err != nil {
+		glog.Warningf("Unable to unpack DNS packet. Error is: %v", err)
+		return drop, length, err
+	}
+
+	// Query - Response bit that specifies whether this message is a query (0) or a response (1).
+	if msg.MsgHdr.Response == false {
+		return drop, length, fmt.Errorf("DNS packet should be a response message")
+	}
+
+	// QDCOUNT
+	if len(msg.Question) != 1 {
+		glog.V(1).Infof("Number of entries in the reponse section of the DNS packet is: %d", len(msg.Answer))
+		return drop, length, nil
+	}
+
+	dnsQType := msg.Question[0].Qtype
+	dnsQClass := msg.Question[0].Qclass
+	if packetRequiresDNSSuffix(dnsQType, dnsQClass) {
+		host, _, err := net.SplitHostPort(cliAddr.String())
+		if err != nil {
+			glog.V(1).Infof("Failed to get host from client address: %v", err)
+			host = cliAddr.String()
+		}
+
+		drop, length = processUnpackedDNSResponsePacket(svrConn, dnsClients, msg, msg.MsgHdr.Rcode, host, dnsQType, buffer, length, dnsSearch)
+	}
+
+	return drop, length, nil
+}
+
+func (udp *udpProxySocket) ProxyLoop(service ServicePortPortalName, myInfo *serviceInfo, proxier *Proxier) {
+	var buffer [4096]byte // 4KiB should be enough for most whole-packets
+	var dnsSearch []string
+	if isDNSService(service.Port) {
+		dnsSearch = []string{"", namespaceServiceDomain, serviceDomain, clusterDomain}
+		execer := exec.New()
+		ipconfigInterface := ipconfig.New(execer)
+		suffixList, err := ipconfigInterface.GetDnsSuffixSearchList()
+		if err == nil {
+			for _, suffix := range suffixList {
+				dnsSearch = append(dnsSearch, suffix)
+			}
+		}
+	}
+
+	for {
+		if !myInfo.isAlive() {
+			// The service port was closed or replaced.
+			break
+		}
+
+		// Block until data arrives.
+		// TODO: Accumulate a histogram of n or something, to fine tune the buffer size.
+		n, cliAddr, err := udp.ReadFrom(buffer[0:])
+		if err != nil {
+			if e, ok := err.(net.Error); ok {
+				if e.Temporary() {
+					glog.V(1).Infof("ReadFrom had a temporary failure: %v", err)
+					continue
+				}
+			}
+			glog.Errorf("ReadFrom failed, exiting ProxyLoop: %v", err)
+			break
+		}
+
+		// If this is DNS query packet
+		if isDNSService(service.Port) {
+			n, err = processDNSQueryPacket(myInfo.dnsClients, cliAddr, buffer[:], n, dnsSearch)
+			if err != nil {
+				glog.Errorf("Process DNS query packet failed: %v", err)
+			}
+		}
+
+		// If this is a client we know already, reuse the connection and goroutine.
+		svrConn, err := udp.getBackendConn(myInfo.activeClients, myInfo.dnsClients, cliAddr, proxier, service, myInfo.timeout, dnsSearch)
+		if err != nil {
+			continue
+		}
+		// TODO: It would be nice to let the goroutine handle this write, but we don't
+		// really want to copy the buffer.  We could do a pool of buffers or something.
+		_, err = svrConn.Write(buffer[0:n])
+		if err != nil {
+			if !logTimeout(err) {
+				glog.Errorf("Write failed: %v", err)
+				// TODO: Maybe tear down the goroutine for this client/server pair?
+			}
+			continue
+		}
+		err = svrConn.SetDeadline(time.Now().Add(myInfo.timeout))
+		if err != nil {
+			glog.Errorf("SetDeadline failed: %v", err)
+			continue
+		}
+	}
+}
+
+func (udp *udpProxySocket) getBackendConn(activeClients *clientCache, dnsClients *dnsClientCache, cliAddr net.Addr, proxier *Proxier, service ServicePortPortalName, timeout time.Duration, dnsSearch []string) (net.Conn, error) {
+	activeClients.mu.Lock()
+	defer activeClients.mu.Unlock()
+
+	svrConn, found := activeClients.clients[cliAddr.String()]
+	if !found {
+		// TODO: This could spin up a new goroutine to make the outbound connection,
+		// and keep accepting inbound traffic.
+		glog.V(3).Infof("New UDP connection from %s", cliAddr)
+		var err error
+		svrConn, err = tryConnect(service, cliAddr, "udp", proxier)
+		if err != nil {
+			return nil, err
+		}
+		if err = svrConn.SetDeadline(time.Now().Add(timeout)); err != nil {
+			glog.Errorf("SetDeadline failed: %v", err)
+			return nil, err
+		}
+		activeClients.clients[cliAddr.String()] = svrConn
+		go func(cliAddr net.Addr, svrConn net.Conn, activeClients *clientCache, dnsClients *dnsClientCache, service ServicePortPortalName, timeout time.Duration, dnsSearch []string) {
+			defer runtime.HandleCrash()
+			udp.proxyClient(cliAddr, svrConn, activeClients, dnsClients, service, timeout, dnsSearch)
+		}(cliAddr, svrConn, activeClients, dnsClients, service, timeout, dnsSearch)
+	}
+	return svrConn, nil
+}
+
+// This function is expected to be called as a goroutine.
+// TODO: Track and log bytes copied, like TCP
+func (udp *udpProxySocket) proxyClient(cliAddr net.Addr, svrConn net.Conn, activeClients *clientCache, dnsClients *dnsClientCache, service ServicePortPortalName, timeout time.Duration, dnsSearch []string) {
+	defer svrConn.Close()
+	var buffer [4096]byte
+	for {
+		n, err := svrConn.Read(buffer[0:])
+		if err != nil {
+			if !logTimeout(err) {
+				glog.Errorf("Read failed: %v", err)
+			}
+			break
+		}
+
+		drop := false
+		if isDNSService(service.Port) {
+			drop, n, err = processDNSResponsePacket(svrConn, dnsClients, cliAddr, buffer[:], n, dnsSearch)
+			if err != nil {
+				glog.Errorf("Process DNS response packet failed: %v", err)
+			}
+		}
+
+		if !drop {
+			err = svrConn.SetDeadline(time.Now().Add(timeout))
+			if err != nil {
+				glog.Errorf("SetDeadline failed: %v", err)
+				break
+			}
+			n, err = udp.WriteTo(buffer[0:n], cliAddr)
+			if err != nil {
+				if !logTimeout(err) {
+					glog.Errorf("WriteTo failed: %v", err)
+				}
+				break
+			}
+		}
+	}
+	activeClients.mu.Lock()
+	delete(activeClients.clients, cliAddr.String())
+	activeClients.mu.Unlock()
+}

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/roundrobin.go

@@ -0,0 +1,374 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"reflect"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/types"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/proxy"
+	"k8s.io/kubernetes/pkg/util/slice"
+)
+
+var (
+	ErrMissingServiceEntry = errors.New("missing service entry")
+	ErrMissingEndpoints    = errors.New("missing endpoints")
+)
+
+type affinityState struct {
+	clientIP string
+	//clientProtocol  api.Protocol //not yet used
+	//sessionCookie   string       //not yet used
+	endpoint string
+	lastUsed time.Time
+}
+
+type affinityPolicy struct {
+	affinityType api.ServiceAffinity
+	affinityMap  map[string]*affinityState // map client IP -> affinity info
+	ttlSeconds   int
+}
+
+// LoadBalancerRR is a round-robin load balancer.
+type LoadBalancerRR struct {
+	lock     sync.RWMutex
+	services map[proxy.ServicePortName]*balancerState
+}
+
+// Ensure this implements LoadBalancer.
+var _ LoadBalancer = &LoadBalancerRR{}
+
+type balancerState struct {
+	endpoints []string // a list of "ip:port" style strings
+	index     int      // current index into endpoints
+	affinity  affinityPolicy
+}
+
+func newAffinityPolicy(affinityType api.ServiceAffinity, ttlSeconds int) *affinityPolicy {
+	return &affinityPolicy{
+		affinityType: affinityType,
+		affinityMap:  make(map[string]*affinityState),
+		ttlSeconds:   ttlSeconds,
+	}
+}
+
+// NewLoadBalancerRR returns a new LoadBalancerRR.
+func NewLoadBalancerRR() *LoadBalancerRR {
+	return &LoadBalancerRR{
+		services: map[proxy.ServicePortName]*balancerState{},
+	}
+}
+
+func (lb *LoadBalancerRR) NewService(svcPort proxy.ServicePortName, affinityType api.ServiceAffinity, ttlSeconds int) error {
+	glog.V(4).Infof("LoadBalancerRR NewService %q", svcPort)
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+	lb.newServiceInternal(svcPort, affinityType, ttlSeconds)
+	return nil
+}
+
+// This assumes that lb.lock is already held.
+func (lb *LoadBalancerRR) newServiceInternal(svcPort proxy.ServicePortName, affinityType api.ServiceAffinity, ttlSeconds int) *balancerState {
+	if ttlSeconds == 0 {
+		ttlSeconds = int(api.DefaultClientIPServiceAffinitySeconds) //default to 3 hours if not specified.  Should 0 be unlimited instead????
+	}
+
+	if _, exists := lb.services[svcPort]; !exists {
+		lb.services[svcPort] = &balancerState{affinity: *newAffinityPolicy(affinityType, ttlSeconds)}
+		glog.V(4).Infof("LoadBalancerRR service %q did not exist, created", svcPort)
+	} else if affinityType != "" {
+		lb.services[svcPort].affinity.affinityType = affinityType
+	}
+	return lb.services[svcPort]
+}
+
+func (lb *LoadBalancerRR) DeleteService(svcPort proxy.ServicePortName) {
+	glog.V(4).Infof("LoadBalancerRR DeleteService %q", svcPort)
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+	delete(lb.services, svcPort)
+}
+
+// return true if this service is using some form of session affinity.
+func isSessionAffinity(affinity *affinityPolicy) bool {
+	// Should never be empty string, but checking for it to be safe.
+	if affinity.affinityType == "" || affinity.affinityType == api.ServiceAffinityNone {
+		return false
+	}
+	return true
+}
+
+// NextEndpoint returns a service endpoint.
+// The service endpoint is chosen using the round-robin algorithm.
+func (lb *LoadBalancerRR) NextEndpoint(svcPort proxy.ServicePortName, srcAddr net.Addr, sessionAffinityReset bool) (string, error) {
+	// Coarse locking is simple.  We can get more fine-grained if/when we
+	// can prove it matters.
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+
+	state, exists := lb.services[svcPort]
+	if !exists || state == nil {
+		return "", ErrMissingServiceEntry
+	}
+	if len(state.endpoints) == 0 {
+		return "", ErrMissingEndpoints
+	}
+	glog.V(4).Infof("NextEndpoint for service %q, srcAddr=%v: endpoints: %+v", svcPort, srcAddr, state.endpoints)
+
+	sessionAffinityEnabled := isSessionAffinity(&state.affinity)
+
+	var ipaddr string
+	if sessionAffinityEnabled {
+		// Caution: don't shadow ipaddr
+		var err error
+		ipaddr, _, err = net.SplitHostPort(srcAddr.String())
+		if err != nil {
+			return "", fmt.Errorf("malformed source address %q: %v", srcAddr.String(), err)
+		}
+		if !sessionAffinityReset {
+			sessionAffinity, exists := state.affinity.affinityMap[ipaddr]
+			if exists && int(time.Now().Sub(sessionAffinity.lastUsed).Seconds()) < state.affinity.ttlSeconds {
+				// Affinity wins.
+				endpoint := sessionAffinity.endpoint
+				sessionAffinity.lastUsed = time.Now()
+				glog.V(4).Infof("NextEndpoint for service %q from IP %s with sessionAffinity %#v: %s", svcPort, ipaddr, sessionAffinity, endpoint)
+				return endpoint, nil
+			}
+		}
+	}
+	// Take the next endpoint.
+	endpoint := state.endpoints[state.index]
+	state.index = (state.index + 1) % len(state.endpoints)
+
+	if sessionAffinityEnabled {
+		var affinity *affinityState
+		affinity = state.affinity.affinityMap[ipaddr]
+		if affinity == nil {
+			affinity = new(affinityState) //&affinityState{ipaddr, "TCP", "", endpoint, time.Now()}
+			state.affinity.affinityMap[ipaddr] = affinity
+		}
+		affinity.lastUsed = time.Now()
+		affinity.endpoint = endpoint
+		affinity.clientIP = ipaddr
+		glog.V(4).Infof("Updated affinity key %s: %#v", ipaddr, state.affinity.affinityMap[ipaddr])
+	}
+
+	return endpoint, nil
+}
+
+type hostPortPair struct {
+	host string
+	port int
+}
+
+func isValidEndpoint(hpp *hostPortPair) bool {
+	return hpp.host != "" && hpp.port > 0
+}
+
+func flattenValidEndpoints(endpoints []hostPortPair) []string {
+	// Convert Endpoint objects into strings for easier use later.  Ignore
+	// the protocol field - we'll get that from the Service objects.
+	var result []string
+	for i := range endpoints {
+		hpp := &endpoints[i]
+		if isValidEndpoint(hpp) {
+			result = append(result, net.JoinHostPort(hpp.host, strconv.Itoa(hpp.port)))
+		}
+	}
+	return result
+}
+
+// Remove any session affinity records associated to a particular endpoint (for example when a pod goes down).
+func removeSessionAffinityByEndpoint(state *balancerState, svcPort proxy.ServicePortName, endpoint string) {
+	for _, affinity := range state.affinity.affinityMap {
+		if affinity.endpoint == endpoint {
+			glog.V(4).Infof("Removing client: %s from affinityMap for service %q", affinity.endpoint, svcPort)
+			delete(state.affinity.affinityMap, affinity.clientIP)
+		}
+	}
+}
+
+// Loop through the valid endpoints and then the endpoints associated with the Load Balancer.
+// Then remove any session affinity records that are not in both lists.
+// This assumes the lb.lock is held.
+func (lb *LoadBalancerRR) updateAffinityMap(svcPort proxy.ServicePortName, newEndpoints []string) {
+	allEndpoints := map[string]int{}
+	for _, newEndpoint := range newEndpoints {
+		allEndpoints[newEndpoint] = 1
+	}
+	state, exists := lb.services[svcPort]
+	if !exists {
+		return
+	}
+	for _, existingEndpoint := range state.endpoints {
+		allEndpoints[existingEndpoint] = allEndpoints[existingEndpoint] + 1
+	}
+	for mKey, mVal := range allEndpoints {
+		if mVal == 1 {
+			glog.V(2).Infof("Delete endpoint %s for service %q", mKey, svcPort)
+			removeSessionAffinityByEndpoint(state, svcPort, mKey)
+		}
+	}
+}
+
+// buildPortsToEndpointsMap builds a map of portname -> all ip:ports for that
+// portname. Explode Endpoints.Subsets[*] into this structure.
+func buildPortsToEndpointsMap(endpoints *api.Endpoints) map[string][]hostPortPair {
+	portsToEndpoints := map[string][]hostPortPair{}
+	for i := range endpoints.Subsets {
+		ss := &endpoints.Subsets[i]
+		for i := range ss.Ports {
+			port := &ss.Ports[i]
+			for i := range ss.Addresses {
+				addr := &ss.Addresses[i]
+				portsToEndpoints[port.Name] = append(portsToEndpoints[port.Name], hostPortPair{addr.IP, int(port.Port)})
+				// Ignore the protocol field - we'll get that from the Service objects.
+			}
+		}
+	}
+	return portsToEndpoints
+}
+
+func (lb *LoadBalancerRR) OnEndpointsAdd(endpoints *api.Endpoints) {
+	portsToEndpoints := buildPortsToEndpointsMap(endpoints)
+
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+
+	for portname := range portsToEndpoints {
+		svcPort := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: endpoints.Namespace, Name: endpoints.Name}, Port: portname}
+		newEndpoints := flattenValidEndpoints(portsToEndpoints[portname])
+		state, exists := lb.services[svcPort]
+
+		if !exists || state == nil || len(newEndpoints) > 0 {
+			glog.V(1).Infof("LoadBalancerRR: Setting endpoints for %s to %+v", svcPort, newEndpoints)
+			lb.updateAffinityMap(svcPort, newEndpoints)
+			// OnEndpointsAdd can be called without NewService being called externally.
+			// To be safe we will call it here.  A new service will only be created
+			// if one does not already exist.  The affinity will be updated
+			// later, once NewService is called.
+			state = lb.newServiceInternal(svcPort, api.ServiceAffinity(""), 0)
+			state.endpoints = slice.ShuffleStrings(newEndpoints)
+
+			// Reset the round-robin index.
+			state.index = 0
+		}
+	}
+}
+
+func (lb *LoadBalancerRR) OnEndpointsUpdate(oldEndpoints, endpoints *api.Endpoints) {
+	portsToEndpoints := buildPortsToEndpointsMap(endpoints)
+	oldPortsToEndpoints := buildPortsToEndpointsMap(oldEndpoints)
+	registeredEndpoints := make(map[proxy.ServicePortName]bool)
+
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+
+	for portname := range portsToEndpoints {
+		svcPort := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: endpoints.Namespace, Name: endpoints.Name}, Port: portname}
+		newEndpoints := flattenValidEndpoints(portsToEndpoints[portname])
+		state, exists := lb.services[svcPort]
+
+		curEndpoints := []string{}
+		if state != nil {
+			curEndpoints = state.endpoints
+		}
+
+		if !exists || state == nil || len(curEndpoints) != len(newEndpoints) || !slicesEquiv(slice.CopyStrings(curEndpoints), newEndpoints) {
+			glog.V(1).Infof("LoadBalancerRR: Setting endpoints for %s to %+v", svcPort, newEndpoints)
+			lb.updateAffinityMap(svcPort, newEndpoints)
+			// OnEndpointsUpdate can be called without NewService being called externally.
+			// To be safe we will call it here.  A new service will only be created
+			// if one does not already exist.  The affinity will be updated
+			// later, once NewService is called.
+			state = lb.newServiceInternal(svcPort, api.ServiceAffinity(""), 0)
+			state.endpoints = slice.ShuffleStrings(newEndpoints)
+
+			// Reset the round-robin index.
+			state.index = 0
+		}
+		registeredEndpoints[svcPort] = true
+	}
+
+	for portname := range oldPortsToEndpoints {
+		svcPort := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: endpoints.Namespace, Name: endpoints.Name}, Port: portname}
+		if _, exists := registeredEndpoints[svcPort]; !exists {
+			glog.V(2).Infof("LoadBalancerRR: Removing endpoints for %s", svcPort)
+			// Reset but don't delete.
+			state := lb.services[svcPort]
+			state.endpoints = []string{}
+			state.index = 0
+			state.affinity.affinityMap = map[string]*affinityState{}
+		}
+	}
+}
+
+func (lb *LoadBalancerRR) OnEndpointsDelete(endpoints *api.Endpoints) {
+	portsToEndpoints := buildPortsToEndpointsMap(endpoints)
+
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+
+	for portname := range portsToEndpoints {
+		svcPort := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: endpoints.Namespace, Name: endpoints.Name}, Port: portname}
+		glog.V(2).Infof("LoadBalancerRR: Removing endpoints for %s", svcPort)
+		// If the service is still around, reset but don't delete.
+		if state, ok := lb.services[svcPort]; ok {
+			state.endpoints = []string{}
+			state.index = 0
+			state.affinity.affinityMap = map[string]*affinityState{}
+		}
+	}
+}
+
+func (lb *LoadBalancerRR) OnEndpointsSynced() {
+}
+
+// Tests whether two slices are equivalent.  This sorts both slices in-place.
+func slicesEquiv(lhs, rhs []string) bool {
+	if len(lhs) != len(rhs) {
+		return false
+	}
+	if reflect.DeepEqual(slice.SortStrings(lhs), slice.SortStrings(rhs)) {
+		return true
+	}
+	return false
+}
+
+func (lb *LoadBalancerRR) CleanupStaleStickySessions(svcPort proxy.ServicePortName) {
+	lb.lock.Lock()
+	defer lb.lock.Unlock()
+
+	state, exists := lb.services[svcPort]
+	if !exists {
+		return
+	}
+	for ip, affinity := range state.affinity.affinityMap {
+		if int(time.Now().Sub(affinity.lastUsed).Seconds()) >= state.affinity.ttlSeconds {
+			glog.V(4).Infof("Removing client %s from affinityMap for service %q", affinity.clientIP, svcPort)
+			delete(state.affinity.affinityMap, ip)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/roundrobin_test.go

@@ -0,0 +1,717 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"net"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/proxy"
+)
+
+func TestValidateWorks(t *testing.T) {
+	if isValidEndpoint(&hostPortPair{}) {
+		t.Errorf("Didn't fail for empty set")
+	}
+	if isValidEndpoint(&hostPortPair{host: "foobar"}) {
+		t.Errorf("Didn't fail with invalid port")
+	}
+	if isValidEndpoint(&hostPortPair{host: "foobar", port: -1}) {
+		t.Errorf("Didn't fail with a negative port")
+	}
+	if !isValidEndpoint(&hostPortPair{host: "foobar", port: 8080}) {
+		t.Errorf("Failed a valid config.")
+	}
+}
+
+func TestFilterWorks(t *testing.T) {
+	endpoints := []hostPortPair{
+		{host: "foobar", port: 1},
+		{host: "foobar", port: 2},
+		{host: "foobar", port: -1},
+		{host: "foobar", port: 3},
+		{host: "foobar", port: -2},
+	}
+	filtered := flattenValidEndpoints(endpoints)
+
+	if len(filtered) != 3 {
+		t.Errorf("Failed to filter to the correct size")
+	}
+	if filtered[0] != "foobar:1" {
+		t.Errorf("Index zero is not foobar:1")
+	}
+	if filtered[1] != "foobar:2" {
+		t.Errorf("Index one is not foobar:2")
+	}
+	if filtered[2] != "foobar:3" {
+		t.Errorf("Index two is not foobar:3")
+	}
+}
+
+func TestLoadBalanceFailsWithNoEndpoints(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "does-not-exist"}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	if len(endpoint) != 0 {
+		t.Errorf("Got an endpoint")
+	}
+}
+
+func expectEndpoint(t *testing.T, loadBalancer *LoadBalancerRR, service proxy.ServicePortName, expected string, netaddr net.Addr) {
+	endpoint, err := loadBalancer.NextEndpoint(service, netaddr, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s, expected %s, failed with: %v", service, expected, err)
+	}
+	if endpoint != expected {
+		t.Errorf("Didn't get expected endpoint for service %s client %v, expected %s, got: %s", service, netaddr, expected, endpoint)
+	}
+}
+
+func expectEndpointWithSessionAffinityReset(t *testing.T, loadBalancer *LoadBalancerRR, service proxy.ServicePortName, expected string, netaddr net.Addr) {
+	endpoint, err := loadBalancer.NextEndpoint(service, netaddr, true)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s, expected %s, failed with: %v", service, expected, err)
+	}
+	if endpoint != expected {
+		t.Errorf("Didn't get expected endpoint for service %s client %v, expected %s, got: %s", service, netaddr, expected, endpoint)
+	}
+}
+
+func TestLoadBalanceWorksWithSingleEndpoint(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "p"}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	endpoints := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "endpoint1"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: 40}},
+		}},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints)
+	expectEndpoint(t, loadBalancer, service, "endpoint1:40", nil)
+	expectEndpoint(t, loadBalancer, service, "endpoint1:40", nil)
+	expectEndpoint(t, loadBalancer, service, "endpoint1:40", nil)
+	expectEndpoint(t, loadBalancer, service, "endpoint1:40", nil)
+}
+
+func stringsInSlice(haystack []string, needles ...string) bool {
+	for _, needle := range needles {
+		found := false
+		for i := range haystack {
+			if haystack[i] == needle {
+				found = true
+				break
+			}
+		}
+		if found == false {
+			return false
+		}
+	}
+	return true
+}
+
+func TestLoadBalanceWorksWithMultipleEndpoints(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "p"}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	endpoints := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{{
+			Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+			Ports:     []api.EndpointPort{{Name: "p", Port: 1}, {Name: "p", Port: 2}, {Name: "p", Port: 3}},
+		}},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints)
+
+	shuffledEndpoints := loadBalancer.services[service].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint:1", "endpoint:2", "endpoint:3") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], nil)
+}
+
+func TestLoadBalanceWorksWithMultipleEndpointsMultiplePorts(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	serviceP := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "p"}
+	serviceQ := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "q"}
+	endpoint, err := loadBalancer.NextEndpoint(serviceP, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	endpoints := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: serviceP.Name, Namespace: serviceP.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint1"}, {IP: "endpoint2"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 1}, {Name: "q", Port: 2}},
+			},
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint3"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 3}, {Name: "q", Port: 4}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints)
+
+	shuffledEndpoints := loadBalancer.services[serviceP].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint1:1", "endpoint2:1", "endpoint3:3") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[0], nil)
+
+	shuffledEndpoints = loadBalancer.services[serviceQ].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint1:2", "endpoint2:2", "endpoint3:4") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[0], nil)
+}
+
+func TestLoadBalanceWorksWithMultipleEndpointsAndUpdates(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	serviceP := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "p"}
+	serviceQ := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "q"}
+	endpoint, err := loadBalancer.NextEndpoint(serviceP, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	endpointsv1 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: serviceP.Name, Namespace: serviceP.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint1"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 1}, {Name: "q", Port: 10}},
+			},
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint2"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 2}, {Name: "q", Port: 20}},
+			},
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint3"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 3}, {Name: "q", Port: 30}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpointsv1)
+
+	shuffledEndpoints := loadBalancer.services[serviceP].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint1:1", "endpoint2:2", "endpoint3:3") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[0], nil)
+
+	shuffledEndpoints = loadBalancer.services[serviceQ].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint1:10", "endpoint2:20", "endpoint3:30") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[0], nil)
+
+	// Then update the configuration with one fewer endpoints, make sure
+	// we start in the beginning again
+	endpointsv2 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: serviceP.Name, Namespace: serviceP.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint4"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 4}, {Name: "q", Port: 40}},
+			},
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint5"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 5}, {Name: "q", Port: 50}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsUpdate(endpointsv1, endpointsv2)
+
+	shuffledEndpoints = loadBalancer.services[serviceP].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint4:4", "endpoint5:5") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceP, shuffledEndpoints[1], nil)
+
+	shuffledEndpoints = loadBalancer.services[serviceQ].endpoints
+	if !stringsInSlice(shuffledEndpoints, "endpoint4:40", "endpoint5:50") {
+		t.Errorf("did not find expected endpoints: %v", shuffledEndpoints)
+	}
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, serviceQ, shuffledEndpoints[1], nil)
+
+	// Clear endpoints
+	endpointsv3 := &api.Endpoints{ObjectMeta: metav1.ObjectMeta{Name: serviceP.Name, Namespace: serviceP.Namespace}, Subsets: nil}
+	loadBalancer.OnEndpointsUpdate(endpointsv2, endpointsv3)
+
+	endpoint, err = loadBalancer.NextEndpoint(serviceP, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+}
+
+func TestLoadBalanceWorksWithServiceRemoval(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	fooServiceP := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: "p"}
+	barServiceP := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "bar"}, Port: "p"}
+	endpoint, err := loadBalancer.NextEndpoint(fooServiceP, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	endpoints1 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: fooServiceP.Name, Namespace: fooServiceP.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint1"}, {IP: "endpoint2"}, {IP: "endpoint3"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 123}},
+			},
+		},
+	}
+	endpoints2 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: barServiceP.Name, Namespace: barServiceP.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint4"}, {IP: "endpoint5"}, {IP: "endpoint6"}},
+				Ports:     []api.EndpointPort{{Name: "p", Port: 456}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints1)
+	loadBalancer.OnEndpointsAdd(endpoints2)
+	shuffledFooEndpoints := loadBalancer.services[fooServiceP].endpoints
+	expectEndpoint(t, loadBalancer, fooServiceP, shuffledFooEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, fooServiceP, shuffledFooEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, fooServiceP, shuffledFooEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, fooServiceP, shuffledFooEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, fooServiceP, shuffledFooEndpoints[1], nil)
+
+	shuffledBarEndpoints := loadBalancer.services[barServiceP].endpoints
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[1], nil)
+
+	// Then update the configuration by removing foo
+	loadBalancer.OnEndpointsDelete(endpoints1)
+	endpoint, err = loadBalancer.NextEndpoint(fooServiceP, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	// but bar is still there, and we continue RR from where we left off.
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[2], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[0], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[1], nil)
+	expectEndpoint(t, loadBalancer, barServiceP, shuffledBarEndpoints[2], nil)
+}
+
+func TestStickyLoadBalanceWorksWithNewServiceCalledFirst(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: ""}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	// Call NewService() before OnEndpointsUpdate()
+	loadBalancer.NewService(service, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+	endpoints := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{Addresses: []api.EndpointAddress{{IP: "endpoint1"}}, Ports: []api.EndpointPort{{Port: 1}}},
+			{Addresses: []api.EndpointAddress{{IP: "endpoint2"}}, Ports: []api.EndpointPort{{Port: 2}}},
+			{Addresses: []api.EndpointAddress{{IP: "endpoint3"}}, Ports: []api.EndpointPort{{Port: 3}}},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints)
+
+	client1 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+	client2 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 2), Port: 0}
+	client3 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 3), Port: 0}
+
+	ep1, err := loadBalancer.NextEndpoint(service, client1, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+
+	ep2, err := loadBalancer.NextEndpoint(service, client2, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+
+	ep3, err := loadBalancer.NextEndpoint(service, client3, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+}
+
+func TestStickyLoadBalanceWorksWithNewServiceCalledSecond(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: ""}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	// Call OnEndpointsUpdate() before NewService()
+	endpoints := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{Addresses: []api.EndpointAddress{{IP: "endpoint1"}}, Ports: []api.EndpointPort{{Port: 1}}},
+			{Addresses: []api.EndpointAddress{{IP: "endpoint2"}}, Ports: []api.EndpointPort{{Port: 2}}},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints)
+	loadBalancer.NewService(service, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+
+	client1 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+	client2 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 2), Port: 0}
+	client3 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 3), Port: 0}
+
+	ep1, err := loadBalancer.NextEndpoint(service, client1, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+
+	ep2, err := loadBalancer.NextEndpoint(service, client2, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+
+	ep3, err := loadBalancer.NextEndpoint(service, client3, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+	expectEndpoint(t, loadBalancer, service, ep1, client1)
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpoint(t, loadBalancer, service, ep3, client3)
+}
+
+func TestStickyLoadBalanaceWorksWithMultipleEndpointsRemoveOne(t *testing.T) {
+	client1 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+	client2 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 2), Port: 0}
+	client3 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 3), Port: 0}
+	client4 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 4), Port: 0}
+	client5 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 5), Port: 0}
+	client6 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 6), Port: 0}
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: ""}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	loadBalancer.NewService(service, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+	endpointsv1 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 1}, {Port: 2}, {Port: 3}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpointsv1)
+	shuffledEndpoints := loadBalancer.services[service].endpoints
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	client1Endpoint := shuffledEndpoints[0]
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	client2Endpoint := shuffledEndpoints[1]
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[2], client3)
+	client3Endpoint := shuffledEndpoints[2]
+
+	endpointsv2 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 1}, {Port: 2}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsUpdate(endpointsv1, endpointsv2)
+	shuffledEndpoints = loadBalancer.services[service].endpoints
+	if client1Endpoint == "endpoint:3" {
+		client1Endpoint = shuffledEndpoints[0]
+	} else if client2Endpoint == "endpoint:3" {
+		client2Endpoint = shuffledEndpoints[0]
+	} else if client3Endpoint == "endpoint:3" {
+		client3Endpoint = shuffledEndpoints[0]
+	}
+	expectEndpoint(t, loadBalancer, service, client1Endpoint, client1)
+	expectEndpoint(t, loadBalancer, service, client2Endpoint, client2)
+	expectEndpoint(t, loadBalancer, service, client3Endpoint, client3)
+
+	endpointsv3 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 1}, {Port: 2}, {Port: 4}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsUpdate(endpointsv2, endpointsv3)
+	shuffledEndpoints = loadBalancer.services[service].endpoints
+	expectEndpoint(t, loadBalancer, service, client1Endpoint, client1)
+	expectEndpoint(t, loadBalancer, service, client2Endpoint, client2)
+	expectEndpoint(t, loadBalancer, service, client3Endpoint, client3)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client4)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client5)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[2], client6)
+}
+
+func TestStickyLoadBalanceWorksWithMultipleEndpointsAndUpdates(t *testing.T) {
+	client1 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+	client2 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 2), Port: 0}
+	client3 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 3), Port: 0}
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: ""}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	loadBalancer.NewService(service, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+	endpointsv1 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 1}, {Port: 2}, {Port: 3}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpointsv1)
+	shuffledEndpoints := loadBalancer.services[service].endpoints
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[2], client3)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	// Then update the configuration with one fewer endpoints, make sure
+	// we start in the beginning again
+	endpointsv2 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 4}, {Port: 5}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsUpdate(endpointsv1, endpointsv2)
+	shuffledEndpoints = loadBalancer.services[service].endpoints
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, service, shuffledEndpoints[1], client2)
+
+	// Clear endpoints
+	endpointsv3 := &api.Endpoints{ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace}, Subsets: nil}
+	loadBalancer.OnEndpointsUpdate(endpointsv2, endpointsv3)
+
+	endpoint, err = loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+}
+
+func TestStickyLoadBalanceWorksWithServiceRemoval(t *testing.T) {
+	client1 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+	client2 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 2), Port: 0}
+	client3 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 3), Port: 0}
+	loadBalancer := NewLoadBalancerRR()
+	fooService := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: ""}
+	endpoint, err := loadBalancer.NextEndpoint(fooService, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+	loadBalancer.NewService(fooService, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+	endpoints1 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: fooService.Name, Namespace: fooService.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 1}, {Port: 2}, {Port: 3}},
+			},
+		},
+	}
+	barService := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "bar"}, Port: ""}
+	loadBalancer.NewService(barService, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+	endpoints2 := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: barService.Name, Namespace: barService.Namespace},
+		Subsets: []api.EndpointSubset{
+			{
+				Addresses: []api.EndpointAddress{{IP: "endpoint"}},
+				Ports:     []api.EndpointPort{{Port: 4}, {Port: 5}},
+			},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints1)
+	loadBalancer.OnEndpointsAdd(endpoints2)
+
+	shuffledFooEndpoints := loadBalancer.services[fooService].endpoints
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[2], client3)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[2], client3)
+	expectEndpoint(t, loadBalancer, fooService, shuffledFooEndpoints[2], client3)
+
+	shuffledBarEndpoints := loadBalancer.services[barService].endpoints
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[1], client2)
+
+	// Then update the configuration by removing foo
+	loadBalancer.OnEndpointsDelete(endpoints1)
+	endpoint, err = loadBalancer.NextEndpoint(fooService, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	// but bar is still there, and we continue RR from where we left off.
+	shuffledBarEndpoints = loadBalancer.services[barService].endpoints
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[1], client2)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+	expectEndpoint(t, loadBalancer, barService, shuffledBarEndpoints[0], client1)
+}
+
+func TestStickyLoadBalanceWorksWithEndpointFails(t *testing.T) {
+	loadBalancer := NewLoadBalancerRR()
+	service := proxy.ServicePortName{NamespacedName: types.NamespacedName{Namespace: "testnamespace", Name: "foo"}, Port: ""}
+	endpoint, err := loadBalancer.NextEndpoint(service, nil, false)
+	if err == nil || len(endpoint) != 0 {
+		t.Errorf("Didn't fail with non-existent service")
+	}
+
+	// Call NewService() before OnEndpointsUpdate()
+	loadBalancer.NewService(service, api.ServiceAffinityClientIP, int(api.DefaultClientIPServiceAffinitySeconds))
+	endpoints := &api.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{Name: service.Name, Namespace: service.Namespace},
+		Subsets: []api.EndpointSubset{
+			{Addresses: []api.EndpointAddress{{IP: "endpoint1"}}, Ports: []api.EndpointPort{{Port: 1}}},
+			{Addresses: []api.EndpointAddress{{IP: "endpoint2"}}, Ports: []api.EndpointPort{{Port: 2}}},
+			{Addresses: []api.EndpointAddress{{IP: "endpoint3"}}, Ports: []api.EndpointPort{{Port: 3}}},
+		},
+	}
+	loadBalancer.OnEndpointsAdd(endpoints)
+
+	client1 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+	client2 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 2), Port: 0}
+	client3 := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 3), Port: 0}
+
+	ep1, err := loadBalancer.NextEndpoint(service, client1, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+
+	ep2, err := loadBalancer.NextEndpoint(service, client2, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+
+	ep3, err := loadBalancer.NextEndpoint(service, client3, false)
+	if err != nil {
+		t.Errorf("Didn't find a service for %s: %v", service, err)
+	}
+
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep1, client1)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep2, client1)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep3, client1)
+
+	expectEndpoint(t, loadBalancer, service, ep2, client2)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep1, client2)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep2, client3)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep3, client1)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep1, client2)
+	expectEndpointWithSessionAffinityReset(t, loadBalancer, service, ep2, client3)
+}

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/types.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// ServicePortPortalName carries a namespace + name + portname + portalip.  This is the unique
+// identifier for a windows service port portal.
+type ServicePortPortalName struct {
+	types.NamespacedName
+	Port         string
+	PortalIPName string
+}
+
+func (spn ServicePortPortalName) String() string {
+	return fmt.Sprintf("%s:%s:%s", spn.NamespacedName.String(), spn.Port, spn.PortalIPName)
+}

vendor/k8s.io/kubernetes/pkg/proxy/winuserspace/udp_server.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package winuserspace
+
+import (
+	"fmt"
+	"net"
+)
+
+// udpEchoServer is a simple echo server in UDP, intended for testing the proxy.
+type udpEchoServer struct {
+	net.PacketConn
+}
+
+func (r *udpEchoServer) Loop() {
+	var buffer [4096]byte
+	for {
+		n, cliAddr, err := r.ReadFrom(buffer[0:])
+		if err != nil {
+			fmt.Printf("ReadFrom failed: %v\n", err)
+			continue
+		}
+		r.WriteTo(buffer[0:n], cliAddr)
+	}
+}
+
+func newUDPEchoServer() (*udpEchoServer, error) {
+	packetconn, err := net.ListenPacket("udp", ":0")
+	if err != nil {
+		return nil, err
+	}
+	return &udpEchoServer{packetconn}, nil
+}