Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

iptables drop invalid rst #3484

Merged
merged 2 commits into from
Dec 5, 2023
Merged

iptables drop invalid rst #3484

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a7b0509
iptables drop invalid rst
changluyi Dec 4, 2023
bb721de
Update uninstall.sh
changluyi Dec 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions dist/images/uninstall.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ iptables -t mangle -F OVN-PREROUTING
iptables -t mangle -X OVN-PREROUTING
iptables -t mangle -F OVN-OUTPUT
iptables -t mangle -X OVN-OUTPUT
iptables -t mangle -F OVN-POSTROUTING
iptables -t mangle -X OVN-POSTROUTING

sleep 1

Expand Down Expand Up @@ -67,6 +69,8 @@ ip6tables -t mangle -F OVN-PREROUTING
ip6tables -t mangle -X OVN-PREROUTING
ip6tables -t mangle -F OVN-OUTPUT
ip6tables -t mangle -X OVN-OUTPUT
ip6tables -t mangle -F OVN-POSTROUTING
ip6tables -t mangle -X OVN-POSTROUTING

sleep 1

Expand Down
16 changes: 15 additions & 1 deletion pkg/daemon/gateway_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -551,6 +551,8 @@ func (c *Controller) setIptables() error {
{Table: "filter", Chain: "FORWARD", Rule: strings.Fields(`-m set --match-set ovn40services dst -j ACCEPT`)},
// Output unmark to bypass kernel nat checksum issue https://github.com/flannel-io/flannel/issues/1279
{Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 6081 -j MARK --set-xmark 0x0`)},
// Drop invalid rst
{Table: MANGLE, Chain: OvnPostrouting, Rule: strings.Fields(`-p tcp -m set --match-set ovn40subnets src -m tcp --tcp-flags RST RST -m state --state INVALID -j DROP`)},
}
v6Rules = []util.IPTableRule{
// mark packets from pod to service
Expand Down Expand Up @@ -588,6 +590,8 @@ func (c *Controller) setIptables() error {
{Table: "filter", Chain: "FORWARD", Rule: strings.Fields(`-m set --match-set ovn60services dst -j ACCEPT`)},
// Output unmark to bypass kernel nat checksum issue https://github.com/flannel-io/flannel/issues/1279
{Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 6081 -j MARK --set-xmark 0x0`)},
// Drop invalid rst
{Table: MANGLE, Chain: OvnPostrouting, Rule: strings.Fields(`-p tcp -m set --match-set ovn60subnets src -m tcp --tcp-flags RST RST -m state --state INVALID -j DROP`)},
}
)
protocols := make([]string, 2)
Expand Down Expand Up @@ -710,7 +714,7 @@ func (c *Controller) setIptables() error {
}
}

var natPreroutingRules, natPostroutingRules, ovnMasqueradeRules []util.IPTableRule
var natPreroutingRules, natPostroutingRules, ovnMasqueradeRules, manglePostrutingRules []util.IPTableRule
for _, rule := range iptablesRules {
if rule.Table == NAT {
if c.k8siptables[protocol].HasRandomFully() &&
Expand All @@ -729,6 +733,11 @@ func (c *Controller) setIptables() error {
ovnMasqueradeRules = append(ovnMasqueradeRules, rule)
continue
}
} else if rule.Table == MANGLE {
if rule.Chain == OvnPostrouting {
manglePostrutingRules = append(manglePostrutingRules, rule)
continue
}
}

if err = c.createIptablesRule(ipt, rule); err != nil {
Expand Down Expand Up @@ -780,6 +789,11 @@ func (c *Controller) setIptables() error {
return err
}

if err = c.updateIptablesChain(ipt, MANGLE, OvnPostrouting, Postrouting, manglePostrutingRules); err != nil {
klog.Errorf("failed to update chain %s/%s: %v", MANGLE, OvnPostrouting, err)
return err
}

if err = c.cleanObsoleteIptablesRules(protocol, obsoleteRules); err != nil {
klog.Errorf("failed to clean legacy iptables rules: %v", err)
return err
Expand Down
Loading