Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(linkerd-cni): add support for plain iptables commands #449

Merged
merged 2 commits into from
Dec 11, 2024
Merged

feat(linkerd-cni): add support for plain iptables commands #449

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
42eac9d
feat(linkerd-cni): add support for plain iptables commands
alpeb Dec 10, 2024
887ac60
s/default/plain
alpeb Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 25 additions & 11 deletions proxy-init/cmd/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ const (
IPTablesModeLegacy = "legacy"
// IPTablesModeNFT signals the usage of the iptables-nft commands
IPTablesModeNFT = "nft"
// IPTablesModePlain signals the usage of the iptables commands, which
// can be either legacy or nft
IPTablesModePlain = "plain"

cmdLegacy = "iptables-legacy"
cmdLegacySave = "iptables-legacy-save"
Expand All @@ -27,6 +30,10 @@ const (
cmdNFTSave = "iptables-nft-save"
cmdNFTIPv6 = "ip6tables-nft"
cmdNFTIPv6Save = "ip6tables-nft-save"
cmdPlain = "iptables"
cmdPlainSave = "iptables-save"
cmdPlainIPv6 = "ip6tables"
cmdPlainIPv6Save = "ip6tables-save"
)

// RootOptions provides the information that will be used to build a firewall configuration.
Expand Down Expand Up @@ -147,7 +154,7 @@ func NewRootCmd() *cobra.Command {
cmd.PersistentFlags().IntVar(&options.TimeoutCloseWaitSecs, "timeout-close-wait-secs", options.TimeoutCloseWaitSecs, "Sets nf_conntrack_tcp_timeout_close_wait")
cmd.PersistentFlags().StringVar(&options.LogFormat, "log-format", options.LogFormat, "Configure log format ('plain' or 'json')")
cmd.PersistentFlags().StringVar(&options.LogLevel, "log-level", options.LogLevel, "Configure log level")
cmd.PersistentFlags().StringVar(&options.IPTablesMode, "iptables-mode", options.IPTablesMode, "Variant of iptables command to use (\"legacy\" or \"nft\"); overrides --firewall-bin-path and --firewall-save-bin-path")
cmd.PersistentFlags().StringVar(&options.IPTablesMode, "iptables-mode", options.IPTablesMode, "Variant of iptables command to use (\"legacy\", \"nft\" or \"plain\"); overrides --firewall-bin-path and --firewall-save-bin-path")
cmd.PersistentFlags().BoolVar(&options.IPv6, "ipv6", options.IPv6, "Set rules both via iptables and ip6tables to support dual-stack networking")

// these two flags are kept for backwards-compatibility, but --iptables-mode is preferred
Expand All @@ -158,8 +165,8 @@ func NewRootCmd() *cobra.Command {

// BuildFirewallConfiguration returns an iptables FirewallConfiguration suitable to use to configure iptables.
func BuildFirewallConfiguration(options *RootOptions) (*iptables.FirewallConfiguration, error) {
if options.IPTablesMode != "" && options.IPTablesMode != IPTablesModeLegacy && options.IPTablesMode != IPTablesModeNFT {
return nil, fmt.Errorf("--iptables-mode valid values are only \"%s\" and \"%s\"", IPTablesModeLegacy, IPTablesModeNFT)
if options.IPTablesMode != "" && options.IPTablesMode != IPTablesModeLegacy && options.IPTablesMode != IPTablesModeNFT && options.IPTablesMode != IPTablesModePlain {
return nil, fmt.Errorf("--iptables-mode valid values are only \"%s\", \"%s\" and \"%s\"", IPTablesModeLegacy, IPTablesModeNFT, IPTablesModePlain)
}

if options.IPTablesMode == "" {
Expand All @@ -168,8 +175,10 @@ func BuildFirewallConfiguration(options *RootOptions) (*iptables.FirewallConfigu
options.IPTablesMode = IPTablesModeLegacy
case cmdNFT:
options.IPTablesMode = IPTablesModeNFT
case cmdPlain:
options.IPTablesMode = IPTablesModePlain
default:
return nil, fmt.Errorf("--firewall-bin-path valid values are only \"%s\" and \"%s\"", cmdLegacy, cmdNFT)
return nil, fmt.Errorf("--firewall-bin-path valid values are only \"%s\", \"%s\" and \"%s\"", cmdLegacy, cmdNFT, cmdPlain)
}
}

Expand Down Expand Up @@ -229,18 +238,23 @@ func getFormatter(format string) log.Formatter {
}

func getCommands(options *RootOptions) (string, string) {
if options.IPTablesMode == IPTablesModeLegacy {
switch options.IPTablesMode {
case IPTablesModeLegacy:
if options.IPv6 {
return cmdLegacyIPv6, cmdLegacyIPv6Save
}
return cmdLegacy, cmdLegacySave
case IPTablesModeNFT:
if options.IPv6 {
return cmdNFTIPv6, cmdNFTIPv6Save
}
return cmdNFT, cmdNFTSave
default:
if options.IPv6 {
return cmdPlainIPv6, cmdPlainIPv6Save
}
return cmdPlain, cmdPlainSave
}

if options.IPv6 {
return cmdNFTIPv6, cmdNFTIPv6Save
}

return cmdNFT, cmdNFTSave
}

func setLogLevel(logLevel string) error {
Expand Down
Loading