@@ -113,6 +113,7 @@ func NewFakeProxier(ipt utiliptables.Interface) *Proxier {
113
113
networkInterfacer .AddInterfaceAddr (& itf1 , addrs1 )
114
114
115
115
p := & Proxier {
116
+ ipFamily : ipfamily ,
116
117
svcPortMap : make (proxy.ServicePortMap ),
117
118
serviceChanges : proxy .NewServiceChangeTracker (newServiceInfo , ipfamily , nil , nil ),
118
119
endpointsMap : make (proxy.EndpointsMap ),
@@ -135,6 +136,10 @@ func NewFakeProxier(ipt utiliptables.Interface) *Proxier {
135
136
localhostNodePorts : true ,
136
137
nodePortAddresses : proxyutil .NewNodePortAddresses (ipfamily , nil ),
137
138
networkInterfacer : networkInterfacer ,
139
+ nfAcctCounters : map [string ]bool {
140
+ metrics .IPTablesCTStateInvalidDroppedNFAcctCounter : true ,
141
+ metrics .LocalhostNodePortAcceptedNFAcctCounter : true ,
142
+ },
138
143
}
139
144
p .setInitialized (true )
140
145
p .syncRunner = async .NewBoundedFrequencyRunner ("test-sync-runner" , p .syncProxyRules , 0 , time .Minute , 1 )
@@ -1717,7 +1722,7 @@ func TestOverallIPTablesRules(t *testing.T) {
1717
1722
-A KUBE-EXTERNAL-SERVICES -m comment --comment "ns2/svc2:p80 has no local endpoints" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j DROP
1718
1723
-A KUBE-EXTERNAL-SERVICES -m comment --comment "ns2/svc2:p80 has no local endpoints" -m addrtype --dst-type LOCAL -m tcp -p tcp --dport 3001 -j DROP
1719
1724
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
1720
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
1725
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
1721
1726
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
1722
1727
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
1723
1728
-A KUBE-PROXY-FIREWALL -m comment --comment "ns5/svc5:p80 traffic not accepted by KUBE-FW-NUKIZ6OKUXPJNT4C" -m tcp -p tcp -d 5.6.7.8 --dport 80 -j DROP
@@ -1743,8 +1748,11 @@ func TestOverallIPTablesRules(t *testing.T) {
1743
1748
:KUBE-SVC-NUKIZ6OKUXPJNT4C - [0:0]
1744
1749
:KUBE-SVC-X27LE4BHSL4DOUIK - [0:0]
1745
1750
:KUBE-SVC-XPGD46QRK7WJZT7O - [0:0]
1751
+ -A KUBE-NODEPORTS -m comment --comment ns2/svc2:p80 -m tcp -p tcp -d 127.0.0.0/8 --dport 3001 -m nfacct --nfacct-name localhost_nps_accepted_pkts -j KUBE-EXT-GNZBNJ2PO5MGZ6GT
1746
1752
-A KUBE-NODEPORTS -m comment --comment ns2/svc2:p80 -m tcp -p tcp --dport 3001 -j KUBE-EXT-GNZBNJ2PO5MGZ6GT
1753
+ -A KUBE-NODEPORTS -m comment --comment ns3/svc3:p80 -m tcp -p tcp -d 127.0.0.0/8 --dport 3003 -m nfacct --nfacct-name localhost_nps_accepted_pkts -j KUBE-EXT-X27LE4BHSL4DOUIK
1747
1754
-A KUBE-NODEPORTS -m comment --comment ns3/svc3:p80 -m tcp -p tcp --dport 3003 -j KUBE-EXT-X27LE4BHSL4DOUIK
1755
+ -A KUBE-NODEPORTS -m comment --comment ns5/svc5:p80 -m tcp -p tcp -d 127.0.0.0/8 --dport 3002 -m nfacct --nfacct-name localhost_nps_accepted_pkts -j KUBE-EXT-NUKIZ6OKUXPJNT4C
1748
1756
-A KUBE-NODEPORTS -m comment --comment ns5/svc5:p80 -m tcp -p tcp --dport 3002 -j KUBE-EXT-NUKIZ6OKUXPJNT4C
1749
1757
-A KUBE-SERVICES -m comment --comment "ns1/svc1:p80 cluster IP" -m tcp -p tcp -d 172.30.0.41 --dport 80 -j KUBE-SVC-XPGD46QRK7WJZT7O
1750
1758
-A KUBE-SERVICES -m comment --comment "ns2/svc2:p80 cluster IP" -m tcp -p tcp -d 172.30.0.42 --dport 80 -j KUBE-SVC-GNZBNJ2PO5MGZ6GT
@@ -5916,7 +5924,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
5916
5924
:KUBE-FORWARD - [0:0]
5917
5925
:KUBE-PROXY-FIREWALL - [0:0]
5918
5926
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
5919
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
5927
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
5920
5928
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
5921
5929
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
5922
5930
COMMIT
@@ -5999,7 +6007,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
5999
6007
:KUBE-FORWARD - [0:0]
6000
6008
:KUBE-PROXY-FIREWALL - [0:0]
6001
6009
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6002
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6010
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6003
6011
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6004
6012
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6005
6013
COMMIT
@@ -6053,7 +6061,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6053
6061
:KUBE-FORWARD - [0:0]
6054
6062
:KUBE-PROXY-FIREWALL - [0:0]
6055
6063
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6056
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6064
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6057
6065
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6058
6066
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6059
6067
COMMIT
@@ -6117,7 +6125,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6117
6125
:KUBE-PROXY-FIREWALL - [0:0]
6118
6126
-A KUBE-SERVICES -m comment --comment "ns4/svc4:p80 has no endpoints" -m tcp -p tcp -d 172.30.0.44 --dport 80 -j REJECT
6119
6127
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6120
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6128
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6121
6129
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6122
6130
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6123
6131
COMMIT
@@ -6173,7 +6181,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6173
6181
:KUBE-FORWARD - [0:0]
6174
6182
:KUBE-PROXY-FIREWALL - [0:0]
6175
6183
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6176
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6184
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6177
6185
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6178
6186
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6179
6187
COMMIT
@@ -6230,7 +6238,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6230
6238
:KUBE-FORWARD - [0:0]
6231
6239
:KUBE-PROXY-FIREWALL - [0:0]
6232
6240
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6233
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6241
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6234
6242
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6235
6243
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6236
6244
COMMIT
@@ -6286,7 +6294,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6286
6294
:KUBE-FORWARD - [0:0]
6287
6295
:KUBE-PROXY-FIREWALL - [0:0]
6288
6296
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6289
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6297
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6290
6298
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6291
6299
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6292
6300
COMMIT
@@ -6344,7 +6352,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6344
6352
:KUBE-FORWARD - [0:0]
6345
6353
:KUBE-PROXY-FIREWALL - [0:0]
6346
6354
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6347
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6355
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6348
6356
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6349
6357
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6350
6358
COMMIT
@@ -6435,7 +6443,7 @@ func TestSyncProxyRulesRepeated(t *testing.T) {
6435
6443
:KUBE-FORWARD - [0:0]
6436
6444
:KUBE-PROXY-FIREWALL - [0:0]
6437
6445
-A KUBE-FIREWALL -m comment --comment "block incoming localnet connections" -d 127.0.0.0/8 ! -s 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
6438
- -A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
6446
+ -A KUBE-FORWARD -m conntrack --ctstate INVALID -m nfacct --nfacct-name ct_state_invalid_dropped_pkts - j DROP
6439
6447
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
6440
6448
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
6441
6449
COMMIT
0 commit comments