Skip to content

Commit

Permalink
Pod in nat-outgoing should not be SNATed when it accesses local clust…
Browse files Browse the repository at this point in the history 
…er hosts
  • Loading branch information
@wayne-cheng
wayne-cheng committed Oct 8, 2024
1 parent 2f02c0d commit b3cc67c
Show file tree
Hide file tree
Showing 3 changed files with 40 additions and 19 deletions.
6 changes: 4 additions & 2 deletions felix/dataplane/linux/masq_mgr_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,8 @@ var _ = Describe("Masquerade manager", func() {
Action: iptables.MasqAction{},
Match: iptables.Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}}})
Expand Down Expand Up @@ -147,7 +148,8 @@ var _ = Describe("Masquerade manager", func() {
Action: iptables.MasqAction{},
Match: iptables.Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}}})
Expand Down
4 changes: 3 additions & 1 deletion felix/rules/nat.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,11 +52,13 @@ func (r *DefaultRuleRenderer) makeNATOutgoingRuleBPF(version uint8, protocol str
func (r *DefaultRuleRenderer) makeNATOutgoingRuleIPTables(ipVersion uint8, protocol string, action Action) Rule {
ipConf := r.ipSetConfig(ipVersion)
allIPsSetName := ipConf.NameForMainIPSet(IPSetIDNATOutgoingAllPools)
allHostsIPsSetName := ipConf.NameForMainIPSet(IPSetIDAllHostNets)
masqIPsSetName := ipConf.NameForMainIPSet(IPSetIDNATOutgoingMasqPools)

match := r.NewMatch().
SourceIPSet(masqIPsSetName).
NotDestIPSet(allIPsSetName)
NotDestIPSet(allIPsSetName).
NotDestIPSet(allHostsIPsSetName)

if protocol != "" {
match = match.Protocol(protocol)
Expand Down
49 changes: 33 additions & 16 deletions felix/rules/nat_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,8 @@ var _ = Describe("NAT", func() {
Action: MasqAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand All @@ -74,7 +75,8 @@ var _ = Describe("NAT", func() {
Action: SNATAction{ToAddr: snatAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand All @@ -92,31 +94,36 @@ var _ = Describe("NAT", func() {
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: MasqAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand All @@ -135,35 +142,40 @@ var _ = Describe("NAT", func() {
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp").
OutInterface("cali-123"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp").
OutInterface("cali-123"),
},
{
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp").
OutInterface("cali-123"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp").
OutInterface("cali-123"),
},
{
Action: MasqAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").
OutInterface("cali-123"),
},
},
Expand All @@ -186,31 +198,36 @@ var _ = Describe("NAT", func() {
Action: SNATAction{ToAddr: expectedAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: SNATAction{ToAddr: expectedAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: SNATAction{ToAddr: snatAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand Down

0 comments on commit b3cc67c

Please sign in to comment.