28867847791
58%

Ran 07 Jul 2026 01:27PM UTC

Jobs 1

Files 329

Run time 25s

Badge

Embed ▾

pending completion

Build # 28867847791

Build Type

push

github

Committed by

jcaamano

Commit Message

Only create ACCEPT rules for bypassing our own DROP rules

With iptables-based firewalls, you can subvert the firewall by adding
"-j ACCEPT" rules before the firewall rules. With nftables-based
firewalls, `accept` rules in one table will not override `drop` rules
in another table, so this doesn't work. If you want the firewall to
not block your traffic, you need to actually configure the firewall to
not block your traffic.

So, stop adding the "accept from OVN to localhost" rule, and only add
the "accept traffic forwarded to/from ovn-k8s-mp0" rule when
DisableForwarding is set (and thus we need to override *our own* DROP
policy on FORWARD). Also, clean up stale forwarding rules when
DisableForwarding is not set.

(The "accept traffic forwarded to/from OVN-Kubernetes CIDRs" rules are
already only added when DisableForwarding is set, and cleared when
it's not.)

(We don't bother trying to clean up the old "accept from OVN to
localhost" rule, because it's harmless, and will eventually get
cleaned up when the node is rebooted.)

Signed-off-by: Dan Winship <danwinship@redhat.com>

Coverage Stats

51629 of 88690 relevant lines covered (58.21%)

338.96 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	28867847791.1	07 Jul 2026 01:27PM UTC	329	58.21	GitHub Action Run

ovn-kubernetes / ovn-kubernetes / 28867847791
58%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 28867847791

ovn-kubernetes / ovn-kubernetes / 28867847791 58%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 28867847791

ovn-kubernetes / ovn-kubernetes / 28867847791
58%

README BADGES
x