Skip to content

OCPBUGS-99652: prevent duplicate NOTRACK iptables rules on container restart #3153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ssonigra wants to merge 1 commit into
base: release-4.22
Choose a base branch
from
+26 −6
Open

OCPBUGS-99652: prevent duplicate NOTRACK iptables rules on container restart #3153

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 26 additions & 6 deletions bindata/network/ovn-kubernetes/common/008-script-lib.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,6 +487,26 @@ data:
cp -f "/usr/libexec/cni/ovn-k8s-cni-overlay" /cni-bin-dir/
}

# ensure-notrack-rule ensures exactly one NOTRACK rule exists for the given
# iptables command, chain, and port. Adds the rule if missing, removes only
# duplicates if present, and does nothing if a single rule already exists.
ensure-notrack-rule()
{
local cmd=$1
local chain=$2
local port=$3
local count
count=$($cmd -t raw -S $chain 2>/dev/null | grep -c "\-\-dport $port -j NOTRACK" || true)
if [ "$count" -eq 0 ]; then
$cmd -t raw -A $chain -p udp --dport $port -j NOTRACK
elif [ "$count" -gt 1 ]; then
local to_delete=$((count - 1))
for ((i=0; i<to_delete; i++)); do
$cmd -t raw -D $chain -p udp --dport $port -j NOTRACK
done
fi
}

# start-ovnkube-node starts the ovnkube-node process. This function does not
# return.
start-ovnkube-node()
Expand Down Expand Up @@ -520,15 +540,15 @@ data:
cni-bin-copy

echo "I$(date "+%m%d %H:%M:%S.%N") - disable conntrack on geneve port"
iptables -t raw -A PREROUTING -p udp --dport {{.GenevePort}} -j NOTRACK
iptables -t raw -A OUTPUT -p udp --dport {{.GenevePort}} -j NOTRACK
ip6tables -t raw -A PREROUTING -p udp --dport {{.GenevePort}} -j NOTRACK
ip6tables -t raw -A OUTPUT -p udp --dport {{.GenevePort}} -j NOTRACK
ensure-notrack-rule iptables PREROUTING {{.GenevePort}}
ensure-notrack-rule iptables OUTPUT {{.GenevePort}}
ensure-notrack-rule ip6tables PREROUTING {{.GenevePort}}
ensure-notrack-rule ip6tables OUTPUT {{.GenevePort}}

{{- if .OVNHybridOverlayVXLANPort}}
echo "I$(date "+%m%d %H:%M:%S.%N") - disable conntrack on hybrid overlay VXLAN port"
iptables -t raw -A PREROUTING -p udp --dport {{.OVNHybridOverlayVXLANPort}} -j NOTRACK
iptables -t raw -A OUTPUT -p udp --dport {{.OVNHybridOverlayVXLANPort}} -j NOTRACK
ensure-notrack-rule iptables PREROUTING {{.OVNHybridOverlayVXLANPort}}
ensure-notrack-rule iptables OUTPUT {{.OVNHybridOverlayVXLANPort}}
{{- end}}

echo "I$(date "+%m%d %H:%M:%S.%N") - starting ovnkube-node"
Expand Down