reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3453 from weaveworks/issue-3449

Browse Source 
add --physdev-is-bridged flag when using physdev module for iptables
This commit is contained in:
Bryan Boreham authored and GitHub committed 2018-12-05 10:18:21 +00:00
2 parents 5e271363cf 99e360ce3b
commit a332af3146
1 file changed
+7 -4
Download Patch File Download Diff File Expand all files Collapse all files
prog/weave-npc/main.go
+7 -4
View File
@@ -128,7 +128,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
// If the destination address is not any of the local pods, let it through
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "physdev", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
"-m", "physdev", "--physdev-is-bridged", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
return err
}
@@ -150,8 +150,8 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
// Egress rules:
//
// -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j ACCEPT
// -A WEAVE-NPC-EGRESS -m physdev --physdev-in=vethwe-bridge -j RETURN
// -A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
// -A WEAVE-NPC-EGRESS -m physdev --physdev-in vethwe-bridge --physdev-is-bridged -j RETURN
// -A WEAVE-NPC-EGRESS -m addrtype --dst-type LOCAL -j RETURN
// -A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
// -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
// -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
@@ -171,7 +171,10 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
ruleSpecs := [][]string{
{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
{"-m", "physdev", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
// skip running through egress network policies for the traffic not coming from local pods
{"-m", "physdev", "--physdev-is-bridged", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
// skip running through egress network policies for the traffic bound for IP address assigned for the bridge
{"-m", "addrtype", "--dst-type", "LOCAL", "-j", "RETURN"},
}
if allowMcast {
ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})