github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 21:47:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #32561 from zreigz/fix-incoming-udp

Browse Source 
Automatic merge from submit-queue

Bug fix. Incoming UDP packets not reach newly deployed services

**What this PR does / why we need it**:

Incoming UDP packets not reach newly deployed services when old connection's state in conntrack is not cleared. When a packet arrives, it will not go through NAT table again, because it is not "the first" packet. The PR fix the issue

**Which issue this PR fixes** 
Fixes #31983
xref https://github.com/docker/docker/issues/8795
This commit is contained in:
Kubernetes Submit Queue 2016-12-01 16:02:03 -08:00 committed by GitHub
commit 9defe2ce99
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/proxy/iptables/proxier.go
View File

@ -1105,6 +1105,9 @@ func (proxier *Proxier) syncProxyRules() {
glog.Errorf("can't open %s, skipping this nodePort: %v", lp.String(), err) glog.Errorf("can't open %s, skipping this nodePort: %v", lp.String(), err)
continue continue
} }
if lp.protocol == "udp" {
proxier.clearUdpConntrackForPort(lp.port)
}
replacementPortsMap[lp] = socket replacementPortsMap[lp] = socket
} // We're holding the port, so it's OK to install iptables rules. } // We're holding the port, so it's OK to install iptables rules.
@ -1323,6 +1326,24 @@ func (proxier *Proxier) syncProxyRules() {
proxier.portsMap = replacementPortsMap proxier.portsMap = replacementPortsMap
} }
// Clear UDP conntrack for port or all conntrack entries when port equal zero.
// When a packet arrives, it will not go through NAT table again, because it is not "the first" packet.
// The solution is clearing the conntrack. Known issus:
// https://github.com/docker/docker/issues/8795
// https://github.com/kubernetes/kubernetes/issues/31983
func (proxier *Proxier) clearUdpConntrackForPort(port int) {
var err error = nil
glog.V(2).Infof("Deleting conntrack entries for udp connections")
if port > 0 {
err = proxier.execConntrackTool("-D", "-p", "udp", "--dport", strconv.Itoa(port))
if err != nil && !strings.Contains(err.Error(), noConnectionToDelete) {
glog.Errorf("conntrack return with error: %v", err)
}
} else {
glog.Errorf("Wrong port number. The port number must be greater than zero")
}
}
// Join all words with spaces, terminate with newline and write to buf. // Join all words with spaces, terminate with newline and write to buf.
func writeLine(buf *bytes.Buffer, words ...string) { func writeLine(buf *bytes.Buffer, words ...string) {
buf.WriteString(strings.Join(words, " ") + "\n") buf.WriteString(strings.Join(words, " ") + "\n")