portmap: fix nftables backend #1116
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
champtar
force-pushed
the
portmap-nftables-prerouting-hook
branch
2 times, most recently
from
2e32a3f to
92965ed
Compare
champtar
changed the title
We can't use dnat from the input hook, depending on nftables (and kernel ?) version we get "Error: Could not process rule: Operation not supported" iptables backend also uses prerouting. Also 'ip6 protocol tcp' is invalid, so rework / simplify the rules Fixes 01a94e1 Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
champtar
force-pushed
the
portmap-nftables-prerouting-hook
branch
from
92965ed to
32d1489
Compare
|
Tested with |
danwinship
approved these changes
Nov 6, 2024
| Type: knftables.PtrTo(knftables.NATType), | ||
| Hook: knftables.PtrTo(knftables.InputHook), | ||
| Hook: knftables.PtrTo(knftables.PreroutingHook), |
There was a problem hiding this comment.
OK, I think I know what I was confused about: in prerouting it hasn't yet decided where it's going to route the packet to, so you can't use oifname. I was thinking that meant you couldn't use fib daddr type either, but that's wrong; fib daddr type answers "what does the routing table say we should do with this packet?", not "what are we actually going to do with this packet?", so it doesn't depend on the routing decision.
| "th dport", e.HostPort, | ||
| "dnat", ipX, "addr . port", "to", containerNet.IP, ".", e.ContainerPort, | ||
| e.Protocol, "dport", e.HostPort, | ||
| "dnat to", net.JoinHostPort(containerNet.IP.String(), strconv.Itoa(e.ContainerPort)), |
There was a problem hiding this comment.
(yeah, this rule was complicated because it's derived from a kube-proxy rule where we look up the "addr . protocol . port" in a map rather than just having a static rule)
squeed
approved these changes
Nov 18, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We can't use dnat from the input hook,
depending on nftables (and kernel ?) version we get
"Error: Could not process rule: Operation not supported"
iptables backend also uses prerouting.
Also 'ip6 protocol tcp' is invalid, so rework / simplify the rules
Fixes 01a94e1
Fixes #1115