Backport selected upstream conntrack improvements onto the Nebius v1.3.1 branch#2
Merged
pasteley merged 6 commits intoJul 13, 2026
Conversation
This change ensures that the necessary netfilter hooks are in place for conntrack tests to run reliably. Previously, the tests would fail in environments where the host's firewall was not configured to accept conntrack traffic. This change introduces a new function, `ensureCtHooksInThisNS`, that uses `iptables` or `nftables` to install the necessary hooks. This function is called from `nsCreateAndEnter`, so all tests that use this function will have a properly configured netns. This change also removes the `CI` environment variable check from the tests, as they are now expected to pass in CI environments. (cherry picked from commit 7b78f24)
The logic for updating conntrack labels was missing. The conntrack labels is an slice of bytes, if is not nil we send its current value. The all zeros slice has a special meaning , that wipes out the existing labels. There is also some unexpected behavior, the conntrack table does not reserve space for the labels if there is no label set in any rule, causing the netlink calls to fail with ENOSPC Signed-off-by: Antonio Ojea <aojea@google.com> (cherry picked from commit 03b8f90)
Add a new ConntrackDelete() function that operates directly on flows, same as the ConntrackCreate() and ConntrackUpdate() functions. We already have ConntrackDeleteFilters() that is very useful to batch operations and to express the intent based on filter matches, but having the function that operate on flows allow to create much more complex filtering without having to use an additional abstraction with filters. Signed-off-by: Antonio Ojea <aojea@google.com> (cherry picked from commit f16f0db)
this allows to use the zone for conntrack delete Signed-off-by: Antonio Ojea <aojea@google.com> (cherry picked from commit ccaca5d)
Currently the Status field of conntrack flows is ignored. This change: * adds constants for the bits of the status field * parses the Status field when dumping flows * handles Status values when creating or updating flows * adds status strings to ConntrackFlow.String() to match the conntrack cli with unit tests for all of the above. (cherry picked from commit d99a981)
(cherry picked from commit c05a276)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport selected upstream conntrack improvements onto the Nebius v1.3.1 branch.
The commits retain their original authorship and include
cherry picked fromreferences.Testing