Skip to content

Commit 3eea0d1

Browse files
michaelbeaumontmichaelbeaumont
committed
kube-proxy: Only open ipv4 sockets for ipv4 clusters
1 parent 53376cd commit 3eea0d1

File tree

5 files changed

+36
-20
lines changed

5 files changed

+36
-20
lines changed

‎pkg/proxy/iptables/proxier.go‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,8 @@ type Proxier struct {
241241
type listenPortOpener struct{}
242242

243243
// OpenLocalPort holds the given local port open.
244-
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
245-
return openLocalPort(lp)
244+
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
245+
return openLocalPort(lp, isIPv6)
246246
}
247247

248248
// Proxier implements proxy.Provider
@@ -1043,7 +1043,7 @@ func (proxier *Proxier) syncProxyRules() {
10431043
klog.V(4).Infof("Port %s was open before and is still needed", lp.String())
10441044
replacementPortsMap[lp] = proxier.portsMap[lp]
10451045
} else {
1046-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1046+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
10471047
if err != nil {
10481048
msg := fmt.Sprintf("can't open %s, skipping this externalIP: %v", lp.String(), err)
10491049

@@ -1212,7 +1212,7 @@ func (proxier *Proxier) syncProxyRules() {
12121212
klog.V(4).Infof("Port %s was open before and is still needed", lp.String())
12131213
replacementPortsMap[lp] = proxier.portsMap[lp]
12141214
} else if svcInfo.Protocol() != v1.ProtocolSCTP {
1215-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1215+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
12161216
if err != nil {
12171217
klog.Errorf("can't open %s, skipping this nodePort: %v", lp.String(), err)
12181218
continue
@@ -1612,7 +1612,7 @@ func writeBytesLine(buf *bytes.Buffer, bytes []byte) {
16121612
buf.WriteByte('\n')
16131613
}
16141614

1615-
func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
1615+
func openLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
16161616
// For ports on node IPs, open the actual port and hold it, even though we
16171617
// use iptables to redirect traffic.
16181618
// This ensures a) that it's safe to use that port and b) that (a) stays
@@ -1628,17 +1628,25 @@ func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
16281628
var socket utilproxy.Closeable
16291629
switch lp.Protocol {
16301630
case "tcp":
1631-
listener, err := net.Listen("tcp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
1631+
network := "tcp4"
1632+
if isIPv6 {
1633+
network = "tcp6"
1634+
}
1635+
listener, err := net.Listen(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
16321636
if err != nil {
16331637
return nil, err
16341638
}
16351639
socket = listener
16361640
case "udp":
1637-
addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
1641+
network := "udp4"
1642+
if isIPv6 {
1643+
network = "udp6"
1644+
}
1645+
addr, err := net.ResolveUDPAddr(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
16381646
if err != nil {
16391647
return nil, err
16401648
}
1641-
conn, err := net.ListenUDP("udp", addr)
1649+
conn, err := net.ListenUDP(network, addr)
16421650
if err != nil {
16431651
return nil, err
16441652
}

‎pkg/proxy/iptables/proxier_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ type fakePortOpener struct {
335335

336336
// OpenLocalPort fakes out the listen() and bind() used by syncProxyRules
337337
// to lock a local port.
338-
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
338+
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
339339
f.openPorts = append(f.openPorts, lp)
340340
return nil, nil
341341
}

‎pkg/proxy/ipvs/proxier.go‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1145,6 +1145,7 @@ func (proxier *Proxier) syncProxyRules() {
11451145
klog.Errorf("Failed to cast serviceInfo %q", svcName.String())
11461146
continue
11471147
}
1148+
isIPv6 := utilnet.IsIPv6(svcInfo.ClusterIP())
11481149
protocol := strings.ToLower(string(svcInfo.Protocol()))
11491150
// Precompute svcNameString; with many services the many calls
11501151
// to ServicePortName.String() show up in CPU profiles.
@@ -1236,7 +1237,7 @@ func (proxier *Proxier) syncProxyRules() {
12361237
klog.V(4).Infof("Port %s was open before and is still needed", lp.String())
12371238
replacementPortsMap[lp] = proxier.portsMap[lp]
12381239
} else {
1239-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1240+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
12401241
if err != nil {
12411242
msg := fmt.Sprintf("can't open %s, skipping this externalIP: %v", lp.String(), err)
12421243

@@ -1425,13 +1426,12 @@ func (proxier *Proxier) syncProxyRules() {
14251426
// We do not start listening on SCTP ports, according to our agreement in the
14261427
// SCTP support KEP
14271428
} else if svcInfo.Protocol() != v1.ProtocolSCTP {
1428-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1429+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
14291430
if err != nil {
14301431
klog.Errorf("can't open %s, skipping this nodePort: %v", lp.String(), err)
14311432
continue
14321433
}
14331434
if lp.Protocol == "udp" {
1434-
isIPv6 := utilnet.IsIPv6(svcInfo.ClusterIP())
14351435
conntrack.ClearEntriesForPort(proxier.exec, lp.Port, isIPv6, v1.ProtocolUDP)
14361436
}
14371437
replacementPortsMap[lp] = socket
@@ -2122,11 +2122,11 @@ func writeBytesLine(buf *bytes.Buffer, bytes []byte) {
21222122
type listenPortOpener struct{}
21232123

21242124
// OpenLocalPort holds the given local port open.
2125-
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
2126-
return openLocalPort(lp)
2125+
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
2126+
return openLocalPort(lp, isIPv6)
21272127
}
21282128

2129-
func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
2129+
func openLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
21302130
// For ports on node IPs, open the actual port and hold it, even though we
21312131
// use ipvs to redirect traffic.
21322132
// This ensures a) that it's safe to use that port and b) that (a) stays
@@ -2142,17 +2142,25 @@ func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
21422142
var socket utilproxy.Closeable
21432143
switch lp.Protocol {
21442144
case "tcp":
2145-
listener, err := net.Listen("tcp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
2145+
network := "tcp4"
2146+
if isIPv6 {
2147+
network = "tcp6"
2148+
}
2149+
listener, err := net.Listen(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
21462150
if err != nil {
21472151
return nil, err
21482152
}
21492153
socket = listener
21502154
case "udp":
2151-
addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
2155+
network := "udp4"
2156+
if isIPv6 {
2157+
network = "udp6"
2158+
}
2159+
addr, err := net.ResolveUDPAddr(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
21522160
if err != nil {
21532161
return nil, err
21542162
}
2155-
conn, err := net.ListenUDP("udp", addr)
2163+
conn, err := net.ListenUDP(network, addr)
21562164
if err != nil {
21572165
return nil, err
21582166
}

‎pkg/proxy/ipvs/proxier_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ type fakePortOpener struct {
6767

6868
// OpenLocalPort fakes out the listen() and bind() used by syncProxyRules
6969
// to lock a local port.
70-
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
70+
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
7171
f.openPorts = append(f.openPorts, lp)
7272
return nil, nil
7373
}

‎pkg/proxy/util/port.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ type Closeable interface {
5151
// PortOpener is an interface around port opening/closing.
5252
// Abstracted out for testing.
5353
type PortOpener interface {
54-
OpenLocalPort(lp *LocalPort) (Closeable, error)
54+
OpenLocalPort(lp *LocalPort, isIPv6 bool) (Closeable, error)
5555
}
5656

5757
// RevertPorts is closing ports in replacementPortsMap but not in originalPortsMap. In other words, it only

0 commit comments

Comments
 (0)