pkg/kubelet: add KUBE-FIREWALL-IN chain, move localnet rule to it #91666

squeed · 2020-06-02T08:57:52Z

@champtar observed that the rule added in #91569 still allowed packets through unidirectionally, meaning UDP with a spoofed source wouldn't be caught. So we need to filter on source interface.

However, KUBE-FIREWALL is run on both OUTPUT and INPUT, so it can't reference interfaces. This PR, thus,

creates a chain KUBE-FIREWALL-IN
Add it to INPUT, pass through to KUBE-FIREWALL
Move the localnet protection rule to KUBE-FIREWALL-IN, and adjust it
to reference source if, not source address.

Signed-off-by: Casey Callendrello cdc@redhat.com

What type of PR is this?
/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #90259

Special notes for your reviewer:
You can test this pretty simply using cnitool if you don't want to spin up a whole kind cluster.

Does this PR introduce a user-facing change?:

NONE

/sig network

squeed · 2020-06-02T09:09:43Z

/cc @derekwaynecarr @matthyx

squeed · 2020-06-02T11:53:09Z

/hold
@champtar we can't do this - KUBE-FIREWALL is called in both INPUT and OUTPUT, and you can't do -i foo in an OUTPUT rule.

Arguably, iptables should never have allowed this rule to apply, but it does apply and block all traffic between localhost.

champtar · 2020-06-02T12:05:48Z

@squeed good catch, I only tested that 127.0.0.1:NodePort was working, nothing more ...
In that case you need a KUBE-FIREWALL-IN and KUBE-FIREWALL-OUT that chain to KUBE-FIREWALL

squeed · 2020-06-02T12:45:41Z

Created KUBE-FIREWALL-IN, but not KUBE-FIREWALL-OUT, since we don't need it (yet). If this should exist for symmetry, I'm happy to add it.

squeed · 2020-06-02T13:17:50Z

/hold cancel

squeed · 2020-06-02T13:18:38Z

/cc @danwinship

joelsmith · 2020-06-02T14:53:34Z

/retest

danwinship · 2020-06-02T17:41:20Z

well, this is ugly.
we put this into the KUBE-FIREWALL chain before because it seemed to logically make sense, but given that that won't work, would it be better to just create a new chain (KUBE-SECURITY?) only for input, rather than doing the nested thing?

ehashman · 2021-04-21T17:23:23Z

/assign @danwinship

ehashman · 2021-05-26T22:16:46Z

also
/cc @aojea

would love to get this one closed out @kubernetes/sig-network-bugs

aojea · 2021-05-26T22:25:43Z

/cc

aojea · 2021-05-27T07:47:20Z

I'm puzzled with this issue, the description of the original issue refers that traffic external to the node can send packets to the localhost of another node, and since it has route_localnet enabled, the external node should be able to reach the localhost of the other node

A host on the local segment can actually route 127.0.0.1 to a k8s-node and access ports that really should be local.

However, we are only filtering here traffic from/to the same node to localhost, what part I'm missing 😅 ?

k8s-triage-robot · 2021-08-25T08:05:09Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot · 2021-09-24T08:39:15Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot · 2021-10-24T08:59:48Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen
Mark this issue or PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2021-10-24T09:00:06Z

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen

Mark this issue or PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

champtar · 2021-10-24T12:00:40Z

Except if this was fixed in another PR, packet with src 192.168.1.2 and dst 127.0.0.1 can go through, can someone reopen this PR ?

SergeyKanzhelev · 2021-10-25T22:47:45Z

@champtar you can reopen using this command:

/reopen

@aojea is @champtar's comment makes it clearer? I'm lost in those rules so please take a look.

k8s-ci-robot · 2021-10-25T22:48:00Z

@SergeyKanzhelev: Reopened this PR.

In response to this:

@champtar you can reopen using this command:

/reopen

@aojea is @champtar's comment makes it clearer? I'm lost in those rules so please take a look.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2021-10-25T22:48:06Z

@squeed: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

SergeyKanzhelev · 2021-10-25T22:52:06Z

/remove-sig node

k8s-ci-robot · 2021-10-25T23:51:31Z

@squeed: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kubernetes-verify	`07b7cde`	link	true	`/test pull-kubernetes-verify`
pull-kubernetes-e2e-gce-ubuntu-containerd	`07b7cde`	link	true	`/test pull-kubernetes-e2e-gce-ubuntu-containerd`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2021-11-18T23:42:08Z

@squeed: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-triage-robot · 2021-12-18T23:48:37Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen
Mark this issue or PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2021-12-18T23:48:54Z

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen

Mark this issue or PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

squeed force-pushed the block-localnet branch from d320e6c to 5863c22 Compare June 2, 2020 08:58

k8s-ci-robot added area/kubelet sig/node Categorizes an issue or PR as relevant to SIG Node. and removed do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. labels Jun 2, 2020

k8s-ci-robot requested review from mattjmcnaughton and sjenning June 2, 2020 09:00

k8s-ci-robot requested review from derekwaynecarr and matthyx June 2, 2020 09:09

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 2, 2020

squeed force-pushed the block-localnet branch from 5863c22 to 149f055 Compare June 2, 2020 12:43

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jun 2, 2020

squeed changed the title ~~pkg/kubelet: adjust localnet firewall rule~~ pkg/kubelet: add KUBE-FIREWALL-IN chain, move localnet rule to it Jun 2, 2020

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 2, 2020

k8s-ci-robot requested a review from danwinship June 2, 2020 13:18

k8s-ci-robot assigned danwinship Apr 21, 2021

k8s-ci-robot requested a review from aojea May 26, 2021 22:16

aojea mentioned this pull request Jul 19, 2021

enable sysctl route_localnet kubernetes-sigs/kind#2375

Merged

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 25, 2021

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Sep 24, 2021

k8s-ci-robot closed this Oct 24, 2021

k8s-ci-robot reopened this Oct 25, 2021

k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Oct 25, 2021

k8s-ci-robot removed the sig/node Categorizes an issue or PR as relevant to SIG Node. label Oct 25, 2021

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 18, 2021

k8s-ci-robot closed this Dec 18, 2021

a1994sc mentioned this pull request Apr 18, 2025

Nodeports are not working on loopback addresses in nftables mode k0sproject/k0s#5760

Closed

4 tasks

pkg/kubelet: add KUBE-FIREWALL-IN chain, move localnet rule to it #91666

pkg/kubelet: add KUBE-FIREWALL-IN chain, move localnet rule to it #91666

Uh oh!

Conversation

squeed commented Jun 2, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

squeed commented Jun 2, 2020

Uh oh!

squeed commented Jun 2, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

champtar commented Jun 2, 2020

Uh oh!

squeed commented Jun 2, 2020

Uh oh!

squeed commented Jun 2, 2020

Uh oh!

squeed commented Jun 2, 2020

Uh oh!

joelsmith commented Jun 2, 2020

Uh oh!

danwinship commented Jun 2, 2020

Uh oh!

ehashman commented Apr 21, 2021

Uh oh!

ehashman commented May 26, 2021

Uh oh!

aojea commented May 26, 2021

Uh oh!

aojea commented May 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-triage-robot commented Aug 25, 2021

Uh oh!

k8s-triage-robot commented Sep 24, 2021

Uh oh!

k8s-triage-robot commented Oct 24, 2021

Uh oh!

k8s-ci-robot commented Oct 24, 2021

Uh oh!

champtar commented Oct 24, 2021

Uh oh!

SergeyKanzhelev commented Oct 25, 2021

Uh oh!

k8s-ci-robot commented Oct 25, 2021

Uh oh!

k8s-ci-robot commented Oct 25, 2021

Uh oh!

SergeyKanzhelev commented Oct 25, 2021

Uh oh!

k8s-ci-robot commented Oct 25, 2021

Uh oh!

k8s-ci-robot commented Nov 18, 2021

Uh oh!

k8s-triage-robot commented Dec 18, 2021

Uh oh!

k8s-ci-robot commented Dec 18, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

squeed commented Jun 2, 2020 •

edited

Loading

squeed commented Jun 2, 2020 •

edited

Loading

aojea commented May 27, 2021 •

edited

Loading