Skip to content

Commit

Permalink
Perform cleanup of depreciated masquerade iptables rules (if needed)
Browse files Browse the repository at this point in the history
  • Loading branch information
lucasmundim committed Jan 31, 2020
1 parent 1fb12f3 commit 59b9a56
Showing 1 changed file with 40 additions and 1 deletion.
41 changes: 40 additions & 1 deletion pkg/controllers/proxy/network_services_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -283,8 +283,14 @@ func (nsc *NetworkServicesController) Run(healthChan chan<- *healthcheck.Control

glog.Infof("Starting network services controller")

glog.V(1).Info("Performing cleanup of depreciated masquerade iptables rules (if needed).")
err := nsc.deleteBadMasqueradeIptablesRules()
if err != nil {
glog.Errorf("Error cleaning up old/bad masquerade rules: %s", err.Error())
}

// enable masquerade rule
err := nsc.ensureMasqueradeIptablesRule()
err = nsc.ensureMasqueradeIptablesRule()
if err != nil {
glog.Errorf("Failed to do add masquerade rule in POSTROUTING chain of nat table due to: %s", err.Error())
}
Expand Down Expand Up @@ -1182,6 +1188,39 @@ func (nsc *NetworkServicesController) ensureMasqueradeIptablesRule() error {
return nil
}

// Delete old/bad iptables rules to masquerade outbound IPVS traffic.
func (nsc *NetworkServicesController) deleteBadMasqueradeIptablesRules() error {
iptablesCmdHandler, err := iptables.New()
if err != nil {
return errors.New("Failed create iptables handler:" + err.Error())
}

var argsBad = [][]string{
{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "-j", "MASQUERADE"},
{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "!", "-s", nsc.podCidr, "!", "-d", nsc.podCidr, "-j", "MASQUERADE"},
}

for _, args := range argsBad {
exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...)
if err != nil {
return fmt.Errorf("Failed to lookup iptables rule: %s", err.Error())
}

if exists {
err = iptablesCmdHandler.Delete("nat", "POSTROUTING", args...)
if err != nil {
return fmt.Errorf("Failed to delete old/bad iptables rule to "+
"masquerade outbound IVPS traffic: %s.\n"+
"Masquerade all might still work, or bugs may persist after upgrade...",
err)
}
glog.Infof("Deleted old/bad iptables rule to masquerade outbound traffic.")
}
}

return nil
}

// syncHairpinIptablesRules adds/removes iptables rules pertaining to traffic
// from an Endpoint (Pod) to its own service VIP. Rules are only applied if
// enabled globally via CLI argument or a service has an annotation requesting
Expand Down

0 comments on commit 59b9a56

Please sign in to comment.