github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-10-12 18:18:51 +00:00
Code Issues Projects Releases Wiki Activity

feat(iptables): be able to override iptables-1.4-compatible lock path

Browse Source
This commit is contained in:
knight42
2020-09-09 18:12:16 +08:00
parent 66334f02e8
commit b25af8e3c9
3 changed files with 21 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pkg/util/iptables/iptables.go
View File

@@ -186,9 +186,12 @@ const WaitIntervalString = "-W"
// WaitIntervalUsecondsValue a constant for specifying the default wait interval useconds
const WaitIntervalUsecondsValue = "100000"
// LockfilePath16x is the iptables lock file acquired by any process that's making any change in the iptable rule
// LockfilePath16x is the iptables 1.6.x lock file acquired by any process that's making any change in the iptable rule
const LockfilePath16x = "/run/xtables.lock"
// LockfilePath14x is the iptables 1.4.x lock file acquired by any process that's making any change in the iptable rule
const LockfilePath14x = "@xtables"
// runner implements Interface in terms of exec("iptables").
type runner struct {
mu sync.Mutex
@@ -198,20 +201,24 @@ type runner struct {
hasRandomFully bool
waitFlag []string
restoreWaitFlag []string
lockfilePath string
lockfilePath14x string
lockfilePath16x string
}
// newInternal returns a new Interface which will exec iptables, and allows the
// caller to change the iptables-restore lockfile path
func newInternal(exec utilexec.Interface, protocol Protocol, lockfilePath string) Interface {
func newInternal(exec utilexec.Interface, protocol Protocol, lockfilePath14x, lockfilePath16x string) Interface {
version, err := getIPTablesVersion(exec, protocol)
if err != nil {
klog.Warningf("Error checking iptables version, assuming version at least %s: %v", MinCheckVersion, err)
version = MinCheckVersion
}
if lockfilePath == "" {
lockfilePath = LockfilePath16x
if lockfilePath16x == "" {
lockfilePath16x = LockfilePath16x
}
if lockfilePath14x == "" {
lockfilePath14x = LockfilePath14x
}
runner := &runner{
@@ -221,14 +228,15 @@ func newInternal(exec utilexec.Interface, protocol Protocol, lockfilePath string
hasRandomFully: version.AtLeast(RandomFullyMinVersion),
waitFlag: getIPTablesWaitFlag(version),
restoreWaitFlag: getIPTablesRestoreWaitFlag(version, exec, protocol),
lockfilePath: lockfilePath,
lockfilePath14x: lockfilePath14x,
lockfilePath16x: lockfilePath16x,
}
return runner
}
// New returns a new Interface which will exec iptables.
func New(exec utilexec.Interface, protocol Protocol) Interface {
return newInternal(exec, protocol, "")
return newInternal(exec, protocol, "", "")
}
// EnsureChain is part of Interface.
@@ -390,7 +398,7 @@ func (runner *runner) restoreInternal(args []string, data []byte, flush FlushFla
// from stepping on each other. iptables-restore 1.6.2 will have
// a --wait option like iptables itself, but that's not widely deployed.
if len(runner.restoreWaitFlag) == 0 {
locker, err := grabIptablesLocks(runner.lockfilePath)
locker, err := grabIptablesLocks(runner.lockfilePath14x, runner.lockfilePath16x)
if err != nil {
return err
}