Skip to content

Commit 9296c5f

Browse files
champtarsqueed
champtar
authored and
squeed
committed
portmap: fix nftables backend
We can't use dnat from the input hook, depending on nftables (and kernel ?) version we get "Error: Could not process rule: Operation not supported" iptables backend also uses prerouting. Also 'ip6 protocol tcp' is invalid, so rework / simplify the rules Fixes 01a94e1 Signed-off-by: Etienne Champetier <[email protected]>
1 parent fec2d62 commit 9296c5f

File tree

2 files changed

+28
-29
lines changed

2 files changed

+28
-29
lines changed

‎plugins/meta/portmap/portmap_nftables.go

+10-11
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"context"
1919
"fmt"
2020
"net"
21+
"strconv"
2122

2223
"sigs.k8s.io/knftables"
2324
)
@@ -110,23 +111,23 @@ func (pmNFT *portMapperNFTables) forwardPorts(config *PortMapConf, containerNet
110111
})
111112

112113
tx.Add(&knftables.Chain{
113-
Name: "input",
114+
Name: "prerouting",
114115
Type: knftables.PtrTo(knftables.NATType),
115-
Hook: knftables.PtrTo(knftables.InputHook),
116+
Hook: knftables.PtrTo(knftables.PreroutingHook),
116117
Priority: knftables.PtrTo(knftables.DNATPriority),
117118
})
118119
tx.Flush(&knftables.Chain{
119-
Name: "input",
120+
Name: "prerouting",
120121
})
121122
tx.Add(&knftables.Rule{
122-
Chain: "input",
123+
Chain: "prerouting",
123124
Rule: knftables.Concat(
124125
conditions,
125126
"jump", hostIPHostPortsChain,
126127
),
127128
})
128129
tx.Add(&knftables.Rule{
129-
Chain: "input",
130+
Chain: "prerouting",
130131
Rule: knftables.Concat(
131132
conditions,
132133
"jump", hostPortsChain,
@@ -187,19 +188,17 @@ func (pmNFT *portMapperNFTables) forwardPorts(config *PortMapConf, containerNet
187188
Chain: hostIPHostPortsChain,
188189
Rule: knftables.Concat(
189190
ipX, "daddr", e.HostIP,
190-
ipX, "protocol", e.Protocol,
191-
"th dport", e.HostPort,
192-
"dnat", ipX, "addr . port", "to", containerNet.IP, ".", e.ContainerPort,
191+
e.Protocol, "dport", e.HostPort,
192+
"dnat to", net.JoinHostPort(containerNet.IP.String(), strconv.Itoa(e.ContainerPort)),
193193
),
194194
Comment: &config.ContainerID,
195195
})
196196
} else {
197197
tx.Add(&knftables.Rule{
198198
Chain: hostPortsChain,
199199
Rule: knftables.Concat(
200-
ipX, "protocol", e.Protocol,
201-
"th dport", e.HostPort,
202-
"dnat", ipX, "addr . port", "to", containerNet.IP, ".", e.ContainerPort,
200+
e.Protocol, "dport", e.HostPort,
201+
"dnat to", net.JoinHostPort(containerNet.IP.String(), strconv.Itoa(e.ContainerPort)),
203202
),
204203
Comment: &config.ContainerID,
205204
})

‎plugins/meta/portmap/portmap_nftables_test.go

+18-18
Original file line numberDiff line numberDiff line change
@@ -82,21 +82,21 @@ var _ = Describe("portmapping configuration (nftables)", func() {
8282
add table ip cni_hostport { comment "CNI portmap plugin" ; }
8383
add chain ip cni_hostport hostip_hostports
8484
add chain ip cni_hostport hostports
85-
add chain ip cni_hostport input { type nat hook input priority -100 ; }
8685
add chain ip cni_hostport masquerading { type nat hook postrouting priority 100 ; }
8786
add chain ip cni_hostport output { type nat hook output priority -100 ; }
88-
add rule ip cni_hostport hostip_hostports ip daddr 192.168.0.2 ip protocol tcp th dport 8083 dnat ip addr . port to 10.0.0.2 . 83 comment "icee6giejonei6so"
89-
add rule ip cni_hostport hostports ip protocol tcp th dport 8080 dnat ip addr . port to 10.0.0.2 . 80 comment "icee6giejonei6so"
90-
add rule ip cni_hostport hostports ip protocol tcp th dport 8081 dnat ip addr . port to 10.0.0.2 . 80 comment "icee6giejonei6so"
91-
add rule ip cni_hostport hostports ip protocol udp th dport 8080 dnat ip addr . port to 10.0.0.2 . 81 comment "icee6giejonei6so"
92-
add rule ip cni_hostport hostports ip protocol udp th dport 8082 dnat ip addr . port to 10.0.0.2 . 82 comment "icee6giejonei6so"
93-
add rule ip cni_hostport hostports ip protocol tcp th dport 8084 dnat ip addr . port to 10.0.0.2 . 84 comment "icee6giejonei6so"
94-
add rule ip cni_hostport input a b jump hostip_hostports
95-
add rule ip cni_hostport input a b jump hostports
87+
add chain ip cni_hostport prerouting { type nat hook prerouting priority -100 ; }
88+
add rule ip cni_hostport hostip_hostports ip daddr 192.168.0.2 tcp dport 8083 dnat to 10.0.0.2:83 comment "icee6giejonei6so"
89+
add rule ip cni_hostport hostports tcp dport 8080 dnat to 10.0.0.2:80 comment "icee6giejonei6so"
90+
add rule ip cni_hostport hostports tcp dport 8081 dnat to 10.0.0.2:80 comment "icee6giejonei6so"
91+
add rule ip cni_hostport hostports udp dport 8080 dnat to 10.0.0.2:81 comment "icee6giejonei6so"
92+
add rule ip cni_hostport hostports udp dport 8082 dnat to 10.0.0.2:82 comment "icee6giejonei6so"
93+
add rule ip cni_hostport hostports tcp dport 8084 dnat to 10.0.0.2:84 comment "icee6giejonei6so"
9694
add rule ip cni_hostport masquerading ip saddr 10.0.0.2 ip daddr 10.0.0.2 masquerade comment "icee6giejonei6so"
9795
add rule ip cni_hostport masquerading ip saddr 127.0.0.1 ip daddr 10.0.0.2 masquerade comment "icee6giejonei6so"
9896
add rule ip cni_hostport output a b jump hostip_hostports
9997
add rule ip cni_hostport output a b fib daddr type local jump hostports
98+
add rule ip cni_hostport prerouting a b jump hostip_hostports
99+
add rule ip cni_hostport prerouting a b jump hostports
100100
`)
101101
actualRules := strings.TrimSpace(ipv4Fake.Dump())
102102
Expect(actualRules).To(Equal(expectedRules))
@@ -113,18 +113,18 @@ add rule ip cni_hostport output a b fib daddr type local jump hostports
113113
add table ip6 cni_hostport { comment "CNI portmap plugin" ; }
114114
add chain ip6 cni_hostport hostip_hostports
115115
add chain ip6 cni_hostport hostports
116-
add chain ip6 cni_hostport input { type nat hook input priority -100 ; }
117116
add chain ip6 cni_hostport output { type nat hook output priority -100 ; }
118-
add rule ip6 cni_hostport hostip_hostports ip6 daddr 2001:db8:a::1 ip6 protocol tcp th dport 8085 dnat ip6 addr . port to 2001:db8::2 . 85 comment "icee6giejonei6so"
119-
add rule ip6 cni_hostport hostports ip6 protocol tcp th dport 8080 dnat ip6 addr . port to 2001:db8::2 . 80 comment "icee6giejonei6so"
120-
add rule ip6 cni_hostport hostports ip6 protocol tcp th dport 8081 dnat ip6 addr . port to 2001:db8::2 . 80 comment "icee6giejonei6so"
121-
add rule ip6 cni_hostport hostports ip6 protocol udp th dport 8080 dnat ip6 addr . port to 2001:db8::2 . 81 comment "icee6giejonei6so"
122-
add rule ip6 cni_hostport hostports ip6 protocol udp th dport 8082 dnat ip6 addr . port to 2001:db8::2 . 82 comment "icee6giejonei6so"
123-
add rule ip6 cni_hostport hostports ip6 protocol tcp th dport 8086 dnat ip6 addr . port to 2001:db8::2 . 86 comment "icee6giejonei6so"
124-
add rule ip6 cni_hostport input c d jump hostip_hostports
125-
add rule ip6 cni_hostport input c d jump hostports
117+
add chain ip6 cni_hostport prerouting { type nat hook prerouting priority -100 ; }
118+
add rule ip6 cni_hostport hostip_hostports ip6 daddr 2001:db8:a::1 tcp dport 8085 dnat to [2001:db8::2]:85 comment "icee6giejonei6so"
119+
add rule ip6 cni_hostport hostports tcp dport 8080 dnat to [2001:db8::2]:80 comment "icee6giejonei6so"
120+
add rule ip6 cni_hostport hostports tcp dport 8081 dnat to [2001:db8::2]:80 comment "icee6giejonei6so"
121+
add rule ip6 cni_hostport hostports udp dport 8080 dnat to [2001:db8::2]:81 comment "icee6giejonei6so"
122+
add rule ip6 cni_hostport hostports udp dport 8082 dnat to [2001:db8::2]:82 comment "icee6giejonei6so"
123+
add rule ip6 cni_hostport hostports tcp dport 8086 dnat to [2001:db8::2]:86 comment "icee6giejonei6so"
126124
add rule ip6 cni_hostport output c d jump hostip_hostports
127125
add rule ip6 cni_hostport output c d fib daddr type local jump hostports
126+
add rule ip6 cni_hostport prerouting c d jump hostip_hostports
127+
add rule ip6 cni_hostport prerouting c d jump hostports
128128
`)
129129
actualRules = strings.TrimSpace(ipv6Fake.Dump())
130130
Expect(actualRules).To(Equal(expectedRules))

0 commit comments

Comments
 (0)