Skip to content

Commit c6c472a

Browse files
zhangzujianzhangzujian
authored
iptables: reject access to invalid service port when kube-proxy works in IPVS mode (#3059)
1 parent f8835ef commit c6c472a

File tree

2 files changed

+27
-8
lines changed

2 files changed

+27
-8
lines changed

‎dist/images/uninstall.sh

+4
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,13 @@ iptables -t filter -D INPUT -m set --match-set ovn40subnets dst -j ACCEPT
1616
iptables -t filter -D INPUT -m set --match-set ovn40subnets src -j ACCEPT
1717
iptables -t filter -D INPUT -m set --match-set ovn40services dst -j ACCEPT
1818
iptables -t filter -D INPUT -m set --match-set ovn40services src -j ACCEPT
19+
iptables -t filter -D INPUT -m mark ! --mark 0x4000/0x4000 -m set --match-set ovn40services dst -m conntrack --ctstate NEW -j REJECT
1920
iptables -t filter -D FORWARD -m set --match-set ovn40subnets dst -j ACCEPT
2021
iptables -t filter -D FORWARD -m set --match-set ovn40subnets src -j ACCEPT
2122
iptables -t filter -D FORWARD -m set --match-set ovn40services dst -j ACCEPT
2223
iptables -t filter -D FORWARD -m set --match-set ovn40services src -j ACCEPT
2324
iptables -t filter -D OUTPUT -p udp -m udp --dport 6081 -j MARK --set-xmark 0x0
25+
iptables -t filter -D OUTPUT -m mark ! --mark 0x4000/0x4000 -m set --match-set ovn40services dst -m conntrack --ctstate NEW -j REJECT
2426
iptables -t mangle -D PREROUTING -m comment --comment "kube-ovn prerouting rules" -j OVN-PREROUTING
2527
iptables -t mangle -D OUTPUT -m comment --comment "kube-ovn output rules" -j OVN-OUTPUT
2628
iptables -t mangle -F OVN-PREROUTING
@@ -52,11 +54,13 @@ ip6tables -t filter -D INPUT -m set --match-set ovn60subnets dst -j ACCEPT
5254
ip6tables -t filter -D INPUT -m set --match-set ovn60subnets src -j ACCEPT
5355
ip6tables -t filter -D INPUT -m set --match-set ovn60services dst -j ACCEPT
5456
ip6tables -t filter -D INPUT -m set --match-set ovn60services src -j ACCEPT
57+
ip6tables -t filter -D INPUT -m mark ! --mark 0x4000/0x4000 -m set --match-set ovn60services dst -m conntrack --ctstate NEW -j REJECT
5558
ip6tables -t filter -D FORWARD -m set --match-set ovn60subnets dst -j ACCEPT
5659
ip6tables -t filter -D FORWARD -m set --match-set ovn60subnets src -j ACCEPT
5760
ip6tables -t filter -D FORWARD -m set --match-set ovn60services dst -j ACCEPT
5861
ip6tables -t filter -D FORWARD -m set --match-set ovn60services src -j ACCEPT
5962
ip6tables -t filter -D OUTPUT -p udp -m udp --dport 6081 -j MARK --set-xmark 0x0
63+
ip6tables -t filter -D OUTPUT -m mark ! --mark 0x4000/0x4000 -m set --match-set ovn60services dst -m conntrack --ctstate NEW -j REJECT
6064
ip6tables -t mangle -D PREROUTING -m comment --comment "kube-ovn prerouting rules" -j OVN-PREROUTING
6165
ip6tables -t mangle -D OUTPUT -m comment --comment "kube-ovn output rules" -j OVN-OUTPUT
6266
ip6tables -t mangle -F OVN-PREROUTING

‎pkg/daemon/gateway_linux.go

+23-8
Original file line numberDiff line numberDiff line change
@@ -616,6 +616,21 @@ func (c *Controller) setIptables() error {
616616
kubeProxyIpsetProtocol, matchset, svcMatchset, nodeMatchSet = "6-", "ovn60subnets", "ovn60services", "ovn60"+OtherNodeSet
617617
}
618618

619+
ipset := fmt.Sprintf("KUBE-%sCLUSTER-IP", kubeProxyIpsetProtocol)
620+
ipsetExists, err := c.ipsetExists(ipset)
621+
if err != nil {
622+
klog.Error("failed to check existence of ipset %s: %v", ipset, err)
623+
return err
624+
}
625+
if ipsetExists {
626+
iptablesRules[0].Rule = strings.Fields(fmt.Sprintf(`-i ovn0 -m set --match-set %s src -m set --match-set %s dst,dst -j MARK --set-xmark 0x4000/0x4000`, matchset, ipset))
627+
rejectRule := strings.Fields(fmt.Sprintf(`-m mark ! --mark 0x4000/0x4000 -m set --match-set %s dst -m conntrack --ctstate NEW -j REJECT`, svcMatchset))
628+
iptablesRules = append(iptablesRules,
629+
util.IPTableRule{Table: "filter", Chain: "INPUT", Rule: rejectRule},
630+
util.IPTableRule{Table: "filter", Chain: "OUTPUT", Rule: rejectRule},
631+
)
632+
}
633+
619634
if nodeIP := nodeIPs[protocol]; nodeIP != "" {
620635
obsoleteRules = []util.IPTableRule{
621636
{Table: NAT, Chain: Postrouting, Rule: strings.Fields(fmt.Sprintf(`! -s %s -m set --match-set %s dst -j MASQUERADE`, nodeIP, matchset))},
@@ -956,8 +971,8 @@ func (c *Controller) generateNatOutgoingPolicyChainRules(protocol string) ([]uti
956971
natPolicySubnetUIDs.Add(util.GetTruncatedUID(string(subnet.GetUID())))
957972
cidrBlock := getCidrByProtocol(subnet.Spec.CIDRBlock, protocol)
958973

959-
OvnNatPolicySubnetChainName := OvnNatOutGoingPolicySubnet + util.GetTruncatedUID(string(subnet.GetUID()))
960-
natPolicySubnetIptables = append(natPolicySubnetIptables, util.IPTableRule{Table: NAT, Chain: OvnNatOutGoingPolicy, Rule: strings.Fields(fmt.Sprintf(`-s %s -m comment --comment natPolicySubnet-%s -j %s`, cidrBlock, subnet.Name, OvnNatPolicySubnetChainName))})
974+
ovnNatPolicySubnetChainName := OvnNatOutGoingPolicySubnet + util.GetTruncatedUID(string(subnet.GetUID()))
975+
natPolicySubnetIptables = append(natPolicySubnetIptables, util.IPTableRule{Table: NAT, Chain: OvnNatOutGoingPolicy, Rule: strings.Fields(fmt.Sprintf(`-s %s -m comment --comment natPolicySubnet-%s -j %s`, cidrBlock, subnet.Name, ovnNatPolicySubnetChainName))})
961976
for _, rule := range subnet.Status.NatOutgoingPolicyRules {
962977
var markCode string
963978
if rule.Action == util.NatPolicyRuleActionNat {
@@ -981,21 +996,21 @@ func (c *Controller) generateNatOutgoingPolicyChainRules(protocol string) ([]uti
981996
srcMatch := getNatOutGoingPolicyRuleIPSetName(rule.RuleID, "src", protocol, true)
982997
dstMatch := getNatOutGoingPolicyRuleIPSetName(rule.RuleID, "dst", protocol, true)
983998

984-
var OvnNatoutGoingPolicyRule util.IPTableRule
999+
var ovnNatoutGoingPolicyRule util.IPTableRule
9851000
if rule.Match.DstIPs != "" && rule.Match.SrcIPs != "" {
986-
OvnNatoutGoingPolicyRule = util.IPTableRule{Table: NAT, Chain: OvnNatPolicySubnetChainName, Rule: strings.Fields(fmt.Sprintf(`-m set --match-set %s src -m set --match-set %s dst -j MARK --set-xmark %s`, srcMatch, dstMatch, markCode))}
1001+
ovnNatoutGoingPolicyRule = util.IPTableRule{Table: NAT, Chain: ovnNatPolicySubnetChainName, Rule: strings.Fields(fmt.Sprintf(`-m set --match-set %s src -m set --match-set %s dst -j MARK --set-xmark %s`, srcMatch, dstMatch, markCode))}
9871002
} else if rule.Match.SrcIPs != "" {
9881003
protocol = getMatchProtocol(rule.Match.SrcIPs)
989-
OvnNatoutGoingPolicyRule = util.IPTableRule{Table: NAT, Chain: OvnNatPolicySubnetChainName, Rule: strings.Fields(fmt.Sprintf(`-m set --match-set %s src -j MARK --set-xmark %s`, srcMatch, markCode))}
1004+
ovnNatoutGoingPolicyRule = util.IPTableRule{Table: NAT, Chain: ovnNatPolicySubnetChainName, Rule: strings.Fields(fmt.Sprintf(`-m set --match-set %s src -j MARK --set-xmark %s`, srcMatch, markCode))}
9901005
} else if rule.Match.DstIPs != "" {
9911006
protocol = getMatchProtocol(rule.Match.DstIPs)
992-
OvnNatoutGoingPolicyRule = util.IPTableRule{Table: NAT, Chain: OvnNatPolicySubnetChainName, Rule: strings.Fields(fmt.Sprintf(`-m set --match-set %s dst -j MARK --set-xmark %s`, dstMatch, markCode))}
1007+
ovnNatoutGoingPolicyRule = util.IPTableRule{Table: NAT, Chain: ovnNatPolicySubnetChainName, Rule: strings.Fields(fmt.Sprintf(`-m set --match-set %s dst -j MARK --set-xmark %s`, dstMatch, markCode))}
9931008
} else {
9941009
continue
9951010
}
996-
natPolicyRuleIptables = append(natPolicyRuleIptables, OvnNatoutGoingPolicyRule)
1011+
natPolicyRuleIptables = append(natPolicyRuleIptables, ovnNatoutGoingPolicyRule)
9971012
}
998-
natPolicyRuleIptablesMap[OvnNatPolicySubnetChainName] = natPolicyRuleIptables
1013+
natPolicyRuleIptablesMap[ovnNatPolicySubnetChainName] = natPolicyRuleIptables
9991014
}
10001015

10011016
existNatChains, err := c.iptables[protocol].ListChains(NAT)

0 commit comments

Comments
 (0)