Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

iptables: Remove NOTRACK Netfilter target #17751

Merged
merged 2 commits into from Nov 4, 2021
Merged

iptables: Remove NOTRACK Netfilter target #17751

merged 2 commits into from Nov 4, 2021

Conversation

pchaigno
Copy link
Member

@pchaigno pchaigno commented Nov 1, 2021

No description provided.

@pchaigno
iptables: Use -j CT --notrack
7ab78da 
Netfilter target NOTRACK has been deprecated for a long time. The
ip{,6}tables binaries now tranparently replace it with target CT
--notrack, so we might as well explicitly use the latter.

Signed-off-by: Paul Chaignon <paul@cilium.io>
@pchaigno
docs: Update kernel requirements for proxy
5575d25 
Since we rely on the CT --notrack netfilter target, we require kernel
config CONFIG_NETFILTER_XT_TARGET_CT.

Signed-off-by: Paul Chaignon <paul@cilium.io>
@pchaigno pchaigno added sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. kind/cleanup This includes no functional changes. area/proxy Impacts proxy components, including DNS, Kafka, Envoy and/or XDS servers. release-note/misc This PR makes changes that have no direct user impact. labels Nov 1, 2021
@pchaigno
Copy link
Member Author

pchaigno commented Nov 1, 2021

/test

@pchaigno pchaigno marked this pull request as ready for review November 1, 2021 21:09
@pchaigno pchaigno requested a review from a team November 1, 2021 21:09
@pchaigno pchaigno requested review from a team as code owners November 1, 2021 21:09
@pchaigno pchaigno requested a review from jibi November 3, 2021 09:49
@pchaigno
Copy link
Member Author

pchaigno commented Nov 3, 2021

The two test failures are in unrelated tests:

All team review requests are covered except for cilium/ci-structure, but the test changes are trivial and have been reviewed by Gilberto, their original author. Marking ready to merge.

@pchaigno pchaigno added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Nov 3, 2021
@nathanjsweet nathanjsweet merged commit bc30198 into cilium:master Nov 4, 2021
@pchaigno pchaigno deleted the remove-notrack-target branch November 4, 2021 21:35
@pchaigno pchaigno mentioned this pull request Nov 5, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jibi jibi jibi approved these changes

@kkourt kkourt kkourt approved these changes

@qmonnet qmonnet qmonnet approved these changes

@nebril nebril Awaiting requested review from nebril nebril was automatically assigned from cilium/ci-structure

Assignees

@nebril nebril

Labels
area/proxy Impacts proxy components, including DNS, Kafka, Envoy and/or XDS servers. kind/cleanup This includes no functional changes. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact. sig/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@pchaigno @jibi @kkourt @qmonnet @nathanjsweet @nebril