Skip to content

[Swift] Add snat rule to host IP for IMDS for CNS IPAM #988

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 3, 2021
Merged

[Swift] Add snat rule to host IP for IMDS for CNS IPAM #988

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d5bde5b
add snat rule to host IP for IMDS
thatmattlong Sep 2, 2021
7ac0e02
add comment for rules
thatmattlong Sep 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions cni/network/invoker_cns.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,16 +161,18 @@ func setHostOptions(nwCfg *cni.NetworkConfig, hostSubnetPrefix *net.IPNet, ncSub
}

azureDNSMatch := fmt.Sprintf(" -m addrtype ! --dst-type local -s %s -d %s -p %s --dport %d", ncSubnetPrefix.String(), iptables.AzureDNS, iptables.UDP, iptables.DNSPort)
azureIMDSMatch := fmt.Sprintf(" -m addrtype ! --dst-type local -s %s -d %s -p %s --dport %d", ncSubnetPrefix.String(), iptables.AzureIMDS, iptables.TCP, iptables.HTTPPort)

// TODO remove this rule once we remove adding MASQUEARDE from AgentBaker, check below PR
// https://github.com/Azure/AgentBaker/pull/367/files
podTrafficAccept := fmt.Sprintf(" -m iprange ! --dst-range 168.63.129.16-168.63.129.16 -s %s ", ncSubnetPrefix.String())
snatPrimaryIPJump := fmt.Sprintf("%s --to %s", iptables.Snat, info.ncPrimaryIP)
// we need to snat IMDS traffic to node IP, this sets up snat '--to'
snatHostIPJump := fmt.Sprintf("%s --to %s", iptables.Snat, info.hostPrimaryIP)
Copy link
Member

@tamilmani1989 tamilmani1989 Sep 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a comment what the rule is?

Copy link
Collaborator Author

@thatmattlong thatmattlong Sep 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

options[network.IPTablesKey] = []iptables.IPTableEntry{
iptables.GetCreateChainCmd(iptables.V4, iptables.Nat, iptables.Swift),
iptables.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Postrouting, podTrafficAccept, iptables.Accept),
iptables.GetAppendIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Postrouting, "", iptables.Swift),
// add a snat rule to primary NC IP for DNS
iptables.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureDNSMatch, snatPrimaryIPJump),
// add a snat rule to node IP for IMDS http traffic
iptables.GetInsertIptableRuleCmd(iptables.V4, iptables.Nat, iptables.Swift, azureIMDSMatch, snatHostIPJump),
}

return nil
Expand Down
6 changes: 4 additions & 2 deletions iptables/iptables.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,8 @@ const (

// known ports
const (
DNSPort = 53
DNSPort = 53
HTTPPort = 80
)

// known protocols
Expand All @@ -78,7 +79,8 @@ const (

// known IP's
const (
AzureDNS = "168.63.129.16"
AzureDNS = "168.63.129.16"
AzureIMDS = "169.254.169.254"
Copy link
Collaborator

@rbtr rbtr Sep 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

idk what this is for, specifically, but should we do it for the whole link-local block?

Copy link
Collaborator Author

@thatmattlong thatmattlong Sep 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is specifically to allow http traffic to the metadata service from pods. Since NCs are considered "secondary interfaces" and there is an explicit deny rule on the host to drop http traffic from secondary interfaces. So really we only want to snat traffic to this one IP against the host IP , since it gets dropped otherwise. For the rest of link-local there is no explicit deny rule so no need to snat.

)

var (
Expand Down