-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
felix: ensure vxlan udp flows are not tracked in conntrack #8977
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the contribution @cyclinder! I spotted one issue (there's a dedicated action for NOTRACK)
felix/rules/static.go
Outdated
@@ -1409,6 +1418,16 @@ func (r *DefaultRuleRenderer) StaticRawOutputChain(tcBypassMark uint32) *Chain { | |||
// return here without the mark bit set if the interface wasn't one that | |||
// we're policing. | |||
} | |||
|
|||
// ensure VXLAN UDP Flows are not tracked in conntrack |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// ensure VXLAN UDP Flows are not tracked in conntrack | |
// Ensure VXLAN UDP Flows are not tracked in conntrack. |
fe77f9f
to
44ad905
Compare
All the unit tests are green.
|
/sem-approve |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice! Looks great to me, thanks for making the PR @cyclinder.
Tests are failing due to a typo in the iptables rule...
should be
|
felix/iptables/match_builder.go
Outdated
@@ -251,6 +251,10 @@ func (m MatchCriteria) DestPorts(ports ...uint16) MatchCriteria { | |||
return append(m, fmt.Sprintf("-m multiport --destination-ports %s", portsString)) | |||
} | |||
|
|||
func (m MatchCriteria) DestPort(port uint16) MatchCriteria { | |||
return append(m, fmt.Sprintf("-dport %v", port)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
return append(m, fmt.Sprintf("-dport %v", port)) | |
return append(m, fmt.Sprintf("--dport %v", port)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks! updated.
Sorry @cyclinder , a big refactor PR just landed to add nftables support to Felix so this will need to be rebased on top of that. The biggest change that'll affect you is that the match criteria builder is now abstracted to support iptables or nftables so you'll need to add the new port match to both. |
hi @fasaxc, I'm not sure we need to add such a vxlan notrack rule for nftables as well. |
I believe it is needed for nftables as well. |
Yes, nftables works the same way as iptables at least in our "v1". Later we may take advantage of some more advanced nftables features. |
Signed-off-by: cyclinder <qifeng.guo@daocloud.io>
Thanks for the explanation! I just fixed the conflicts, and all the tests have passed. please recheck it. |
Description
felix: ensure vxlan udp flows are not tracked in conntrack
Related issues/PRs
fixes #8934
Todos
Release Note
Reminder for the reviewer
Make sure that this PR has the correct labels and milestone set.
Every PR needs one
docs-*
label.docs-pr-required
: This change requires a change to the documentation that has not been completed yet.docs-completed
: This change has all necessary documentation completed.docs-not-required
: This change has no user-facing impact and requires no docs.Every PR needs one
release-note-*
label.release-note-required
: This PR has user-facing changes. Most PRs should have this label.release-note-not-required
: This PR has no user-facing changes.Other optional labels:
cherry-pick-candidate
: This PR should be cherry-picked to an earlier release. For bug fixes only.needs-operator-pr
: This PR is related to install and requires a corresponding change to the operator.