Skip to content

Commit

Permalink
Pod in nat-outgoing should not be SNATed when it accesses local clust…
Browse files Browse the repository at this point in the history 
…er hosts
  • Loading branch information
@wayne-cheng
wayne-cheng committed Jun 29, 2024
1 parent e592387 commit 919b3e0
Show file tree
Hide file tree
Showing 2 changed files with 36 additions and 17 deletions.
4 changes: 3 additions & 1 deletion felix/rules/nat.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,11 +52,13 @@ func (r *DefaultRuleRenderer) makeNATOutgoingRuleBPF(version uint8, protocol str
func (r *DefaultRuleRenderer) makeNATOutgoingRuleIPTables(ipVersion uint8, protocol string, action iptables.Action) iptables.Rule {
ipConf := r.ipSetConfig(ipVersion)
allIPsSetName := ipConf.NameForMainIPSet(IPSetIDNATOutgoingAllPools)
allHostsIPsSetName := ipConf.NameForMainIPSet(IPSetIDAllHostNets)
masqIPsSetName := ipConf.NameForMainIPSet(IPSetIDNATOutgoingMasqPools)

match := iptables.Match().
SourceIPSet(masqIPsSetName).
NotDestIPSet(allIPsSetName)
NotDestIPSet(allIPsSetName).
NotDestIPSet(allHostsIPsSetName)

if protocol != "" {
match = match.Protocol(protocol)
Expand Down
49 changes: 33 additions & 16 deletions felix/rules/nat_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,8 @@ var _ = Describe("NAT", func() {
Action: MasqAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand All @@ -73,7 +74,8 @@ var _ = Describe("NAT", func() {
Action: SNATAction{ToAddr: snatAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand All @@ -92,31 +94,36 @@ var _ = Describe("NAT", func() {
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: MasqAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand All @@ -136,35 +143,40 @@ var _ = Describe("NAT", func() {
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp").
OutInterface("cali-123"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp").
OutInterface("cali-123"),
},
{
Action: MasqAction{ToPorts: "99-100"},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp").
OutInterface("cali-123"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp").
OutInterface("cali-123"),
},
{
Action: MasqAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").
OutInterface("cali-123"),
},
},
Expand All @@ -188,31 +200,36 @@ var _ = Describe("NAT", func() {
Action: SNATAction{ToAddr: expectedAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("tcp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("tcp"),
},
{
Action: SNATAction{ToAddr: expectedAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: ReturnAction{},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools").Protocol("udp"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net").Protocol("udp"),
},
{
Action: SNATAction{ToAddr: snatAddress},
Match: Match().
SourceIPSet("cali40masq-ipam-pools").
NotDestIPSet("cali40all-ipam-pools"),
NotDestIPSet("cali40all-ipam-pools").
NotDestIPSet("cali40all-hosts-net"),
},
},
}))
Expand Down

0 comments on commit 919b3e0

Please sign in to comment.