ovn-org / ovn-kubernetes / 6079003029

53%

push

github

LGW: Fix the precedence of rules in FORWARD chain

This PR ensures that the IPTable rules for LGW
are of the correct priority. The ACCEPT forwarding
rules should be inserted and therefore be of higher
priority always compared to the default DROP rules
specially when forwarding is disabled by default
on clusters. If not traffic breaks. Without this fix
we end up in:

[98325:268968232] -A FORWARD -d 169.254.169.1/32 -j ACCEPT
[89489:13888546] -A FORWARD -s 169.254.169.1/32 -j ACCEPT
[18:1080] -A FORWARD -d 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -s 172.30.0.0/16 -j ACCEPT
[0:0] -A FORWARD -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[1262:75720] -A FORWARD -i br-ex -j DROP
[295724:17429107] -A FORWARD -o br-ex -j DROP
[0:0] -A FORWARD -o ovn-k8s-mp0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i ovn-k8s-mp0 -j ACCEPT

we need the mp0 rules above the DROP rules always

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>

19 of 19 new or added lines in 2 files covered. (100.0%)

24842 of 49704 relevant lines covered (49.98%)

88.37 hits per line