ovn-kubernetes / ovn-kubernetes / 28833783359

58%

Build Type

push

github

Committed by jcaamano

Commit Message

Only create ACCEPT rules for bypassing our own DROP rules

With iptables-based firewalls, you can subvert the firewall by adding
"-j ACCEPT" rules before the firewall rules. With nftables-based
firewalls, `accept` rules in one table will not override `drop` rules
in another table, so this doesn't work. If you want the firewall to
not block your traffic, you need to actually configure the firewall to
not block your traffic.

So, stop adding the "accept from OVN to localhost" rule, and only add
the "accept traffic forwarded to/from ovn-k8s-mp0" rule when
DisableForwarding is set (and thus we need to override *our own* DROP
policy on FORWARD). Also, clean up stale forwarding rules when
DisableForwarding is not set.

(The "accept traffic forwarded to/from OVN-Kubernetes CIDRs" rules are
already only added when DisableForwarding is set, and cleared when
it's not.)

(We don't bother trying to clean up the old "accept from OVN to
localhost" rule, because it's harmless, and will eventually get
cleaned up when the node is rebooted.)

Signed-off-by: Dan Winship <danwinship@redhat.com>

Coverage Stats

11 of 16 new or added lines in 2 files covered. (68.75%)

32 existing lines in 6 files now uncovered.

51646 of 88690 relevant lines covered (58.23%)

339.24 hits per line