ctmap: limit NAT purging to expected CT tuple types #28871
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
For some more context, see #28857. |
|
/test |
dylandreimerink
requested changes
Oct 31, 2023
There is only a limited number of CT tuple types that potentially have NAT entries associated with them: 1. DSR, for CT_EGRESS entries with `dsr` flag set 2. legacy DSR, for CT_INGRESS entries with `dsr` flag set 3. SNAT (eg. Masquerading), for CT_EGRESS entries. We don't need to consider TUPLE_F_RELATED here, as the SNAT code doesn't support any of the ICMP types where ct_extract_ports*() would set TUPLE_F_RELATED. So it will also never create NAT entries for such CT entries. When we don't match any of these types, avoid falling through to nat.DeleteMapping*(). In particular this means we're no longer trying to apply NAT purging when GC removes a "related" ICMP entry or a CT_SERVICE entry. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
07ea5bd to
dfe2c63
Compare
|
/test |
dylandreimerink
approved these changes
Oct 31, 2023
gentoo-root
approved these changes
Nov 9, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is only a limited number of CT tuple types that potentially have NAT
entries associated with them:
dsrflag setdsrflag setconsider TUPLE_F_RELATED here, as the SNAT code doesn't support any of
the ICMP types where ct_extract_ports*() would set TUPLE_F_RELATED. So
it will also never create NAT entries for such CT entries.
When we don't match any of these types, avoid falling through to
nat.DeleteMapping*(). In particular this means we're no longer trying to
apply NAT purging when GC removes a "related" ICMP entry or a CT_SERVICE
entry.