fix: fix reverse routing for KubeSpan #10074
Conversation
| // Consider fwmark for rp_filter routing table lookup. | ||
| { | ||
| Key: "proc.sys.net.ipv4.conf.kubespan.src_valid_mark", | ||
| Value: "1", | ||
| }, |
There was a problem hiding this comment.
We might even consider enabling rp_filter on all interfaces by default as Red Hat and SUSE do for increased security against IP spoofing
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
There was a problem hiding this comment.
I guess we can set to 1 as default like RHEL
There was a problem hiding this comment.
Let's discuss that later for 1.10, it's not to be backported like this change is
| @@ -120,6 +120,11 @@ func (ctrl *KernelParamDefaultsController) getKernelParams() []*kernel.Param { | |||
| Key: "proc.sys.net.ipv4.tcp_keepalive_intvl", | |||
| Value: "60", | |||
| }, | |||
| // Consider fwmark for rp_filter routing table lookup. | |||
| { | |||
| Key: "proc.sys.net.ipv4.conf.kubespan.src_valid_mark", | |||
There was a problem hiding this comment.
shouldn't this be rp_filter instead of src_valid_mark 🤔 ?
There was a problem hiding this comment.
rp_filter will get overriden. This is what I mean:
src_valid_mark - BOOLEAN
0 - The fwmark of the packet is not included in reverse path route lookup. This allows for asymmetric routing configurations utilizing the fwmark in only one direction, e.g., transparent proxying.
1 - The fwmark of the packet is included in reverse path route lookup. This permits rp_filter to function when the fwmark is used for routing traffic in both directions.
This setting also affects the utilization of fmwark when performing source address selection for ICMP replies, or determining addresses stored for the IPOPT_TS_TSANDADDR and IPOPT_RR IP options.
The max value from conf/{all,interface}/src_valid_mark is used.
Default value is 0.
There was a problem hiding this comment.
It's not to disable rp_filter (you cannot override someone enabling rp_filter in mode 2 (loose), like current Kube-Router versions), but to make it honor policy-based routing. To avoid potential side effects we only do this on kubespan interface as it's the interface we do our policy-based routing on.
dsseng
force-pushed
the
kubespan-reverse
branch
from
de101ea to
f33df6b
Compare
This allows it to not come down when rp_filter is enabled. Fixes siderolabs#9814 Signed-off-by: Dmitry Sharshakov <[email protected]>
dsseng
force-pushed
the
kubespan-reverse
branch
from
f33df6b to
cbb11f3
Compare
This allows it to not come down when rp_filter is enabled.
Fixes #9814
Signed-off-by: Dmitry Sharshakov [email protected]