From 435f1ee2d3dc8dbae43ee1596d1d6ece0a9ebca7 Mon Sep 17 00:00:00 2001 From: zcq98 Date: Fri, 18 Oct 2024 16:04:49 +0800 Subject: [PATCH] fix: udp bad checksum on VXLAN interface Signed-off-by: zcq98 --- dist/images/uninstall.sh | 2 ++ pkg/daemon/gateway_linux.go | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/dist/images/uninstall.sh b/dist/images/uninstall.sh index 5acec205230..a29d951ab66 100644 --- a/dist/images/uninstall.sh +++ b/dist/images/uninstall.sh @@ -22,6 +22,7 @@ iptables -t filter -D FORWARD -m set --match-set ovn40subnets src -j ACCEPT iptables -t filter -D FORWARD -m set --match-set ovn40services dst -j ACCEPT iptables -t filter -D FORWARD -m set --match-set ovn40services src -j ACCEPT iptables -t filter -D OUTPUT -p udp -m udp --dport 6081 -j MARK --set-xmark 0x0 +iptables -t filter -D OUTPUT -p udp -m udp --dport 4789 -j MARK --set-xmark 0x0 iptables -t filter -D OUTPUT -p tcp -m mark ! --mark 0x4000/0x4000 -m set --match-set ovn40services dst -m conntrack --ctstate NEW -j REJECT iptables -t mangle -D PREROUTING -m comment --comment "kube-ovn prerouting rules" -j OVN-PREROUTING iptables -t mangle -D POSTROUTING -m comment --comment "kube-ovn postrouting rules" -j OVN-POSTROUTING @@ -63,6 +64,7 @@ ip6tables -t filter -D FORWARD -m set --match-set ovn60subnets src -j ACCEPT ip6tables -t filter -D FORWARD -m set --match-set ovn60services dst -j ACCEPT ip6tables -t filter -D FORWARD -m set --match-set ovn60services src -j ACCEPT ip6tables -t filter -D OUTPUT -p udp -m udp --dport 6081 -j MARK --set-xmark 0x0 +ip6tables -t filter -D OUTPUT -p udp -m udp --dport 4789 -j MARK --set-xmark 0x0 ip6tables -t filter -D OUTPUT -p tcp -m mark ! --mark 0x4000/0x4000 -m set --match-set ovn60services dst -m conntrack --ctstate NEW -j REJECT ip6tables -t mangle -D PREROUTING -m comment --comment "kube-ovn prerouting rules" -j OVN-PREROUTING ip6tables -t mangle -D POSTROUTING -m comment --comment "kube-ovn postrouting rules" -j OVN-POSTROUTING diff --git a/pkg/daemon/gateway_linux.go b/pkg/daemon/gateway_linux.go index 916cdf43c18..73c7c318f0a 100644 --- a/pkg/daemon/gateway_linux.go +++ b/pkg/daemon/gateway_linux.go @@ -591,6 +591,7 @@ func (c *Controller) setIptables() error { {Table: "filter", Chain: "FORWARD", Rule: strings.Fields(`-m set --match-set ovn40services dst -j ACCEPT`)}, // Output unmark to bypass kernel nat checksum issue https://github.com/flannel-io/flannel/issues/1279 {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 6081 -j MARK --set-xmark 0x0`)}, + {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 4789 -j MARK --set-xmark 0x0`)}, // Drop invalid rst {Table: MANGLE, Chain: OvnPostrouting, Rule: strings.Fields(`-p tcp -m set --match-set ovn40subnets src -m tcp --tcp-flags RST RST -m state --state INVALID -j DROP`)}, } @@ -630,6 +631,7 @@ func (c *Controller) setIptables() error { {Table: "filter", Chain: "FORWARD", Rule: strings.Fields(`-m set --match-set ovn60services dst -j ACCEPT`)}, // Output unmark to bypass kernel nat checksum issue https://github.com/flannel-io/flannel/issues/1279 {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 6081 -j MARK --set-xmark 0x0`)}, + {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 4789 -j MARK --set-xmark 0x0`)}, // Drop invalid rst {Table: MANGLE, Chain: OvnPostrouting, Rule: strings.Fields(`-p tcp -m set --match-set ovn60subnets src -m tcp --tcp-flags RST RST -m state --state INVALID -j DROP`)}, } @@ -1135,6 +1137,7 @@ func (c *Controller) cleanObsoleteIptablesRules(protocol string, rules []util.IP {Table: "filter", Chain: "FORWARD", Rule: strings.Fields(`-m set --match-set ovn40services dst -j ACCEPT`)}, // Output unmark to bypass kernel nat checksum issue https://github.com/flannel-io/flannel/issues/1279 {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 6081 -j MARK --set-xmark 0x0`)}, + {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 4789 -j MARK --set-xmark 0x0`)}, } v6ObsoleteRules = []util.IPTableRule{ {Table: NAT, Chain: Postrouting, Rule: strings.Fields(`-m mark --mark 0x40000/0x40000 -j MASQUERADE`)}, @@ -1168,6 +1171,7 @@ func (c *Controller) cleanObsoleteIptablesRules(protocol string, rules []util.IP {Table: "filter", Chain: "FORWARD", Rule: strings.Fields(`-m set --match-set ovn60services dst -j ACCEPT`)}, // Output unmark to bypass kernel nat checksum issue https://github.com/flannel-io/flannel/issues/1279 {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 6081 -j MARK --set-xmark 0x0`)}, + {Table: "filter", Chain: "OUTPUT", Rule: strings.Fields(`-p udp -m udp --dport 4789 -j MARK --set-xmark 0x0`)}, } )