Skip to content

Commit ad68c4a

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#87699 from michaelbeaumont/fix_66766
kube-proxy: Only open ipv4 sockets for ipv4 clusters
2 parents 0e37bce + 3eea0d1 commit ad68c4a

File tree

5 files changed

+36
-20
lines changed

5 files changed

+36
-20
lines changed

‎pkg/proxy/iptables/proxier.go‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,8 @@ type Proxier struct {
241241
type listenPortOpener struct{}
242242

243243
// OpenLocalPort holds the given local port open.
244-
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
245-
return openLocalPort(lp)
244+
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
245+
return openLocalPort(lp, isIPv6)
246246
}
247247

248248
// Proxier implements proxy.Provider
@@ -1051,7 +1051,7 @@ func (proxier *Proxier) syncProxyRules() {
10511051
klog.V(4).Infof("Port %s was open before and is still needed", lp.String())
10521052
replacementPortsMap[lp] = proxier.portsMap[lp]
10531053
} else {
1054-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1054+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
10551055
if err != nil {
10561056
msg := fmt.Sprintf("can't open %s, skipping this externalIP: %v", lp.String(), err)
10571057

@@ -1220,7 +1220,7 @@ func (proxier *Proxier) syncProxyRules() {
12201220
klog.V(4).Infof("Port %s was open before and is still needed", lp.String())
12211221
replacementPortsMap[lp] = proxier.portsMap[lp]
12221222
} else if svcInfo.Protocol() != v1.ProtocolSCTP {
1223-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1223+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
12241224
if err != nil {
12251225
klog.Errorf("can't open %s, skipping this nodePort: %v", lp.String(), err)
12261226
continue
@@ -1620,7 +1620,7 @@ func writeBytesLine(buf *bytes.Buffer, bytes []byte) {
16201620
buf.WriteByte('\n')
16211621
}
16221622

1623-
func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
1623+
func openLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
16241624
// For ports on node IPs, open the actual port and hold it, even though we
16251625
// use iptables to redirect traffic.
16261626
// This ensures a) that it's safe to use that port and b) that (a) stays
@@ -1636,17 +1636,25 @@ func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
16361636
var socket utilproxy.Closeable
16371637
switch lp.Protocol {
16381638
case "tcp":
1639-
listener, err := net.Listen("tcp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
1639+
network := "tcp4"
1640+
if isIPv6 {
1641+
network = "tcp6"
1642+
}
1643+
listener, err := net.Listen(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
16401644
if err != nil {
16411645
return nil, err
16421646
}
16431647
socket = listener
16441648
case "udp":
1645-
addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
1649+
network := "udp4"
1650+
if isIPv6 {
1651+
network = "udp6"
1652+
}
1653+
addr, err := net.ResolveUDPAddr(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
16461654
if err != nil {
16471655
return nil, err
16481656
}
1649-
conn, err := net.ListenUDP("udp", addr)
1657+
conn, err := net.ListenUDP(network, addr)
16501658
if err != nil {
16511659
return nil, err
16521660
}

‎pkg/proxy/iptables/proxier_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ type fakePortOpener struct {
335335

336336
// OpenLocalPort fakes out the listen() and bind() used by syncProxyRules
337337
// to lock a local port.
338-
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
338+
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
339339
f.openPorts = append(f.openPorts, lp)
340340
return nil, nil
341341
}

‎pkg/proxy/ipvs/proxier.go‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1123,6 +1123,7 @@ func (proxier *Proxier) syncProxyRules() {
11231123
klog.Errorf("Failed to cast serviceInfo %q", svcName.String())
11241124
continue
11251125
}
1126+
isIPv6 := utilnet.IsIPv6(svcInfo.ClusterIP())
11261127
protocol := strings.ToLower(string(svcInfo.Protocol()))
11271128
// Precompute svcNameString; with many services the many calls
11281129
// to ServicePortName.String() show up in CPU profiles.
@@ -1215,7 +1216,7 @@ func (proxier *Proxier) syncProxyRules() {
12151216
klog.V(4).Infof("Port %s was open before and is still needed", lp.String())
12161217
replacementPortsMap[lp] = proxier.portsMap[lp]
12171218
} else {
1218-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1219+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
12191220
if err != nil {
12201221
msg := fmt.Sprintf("can't open %s, skipping this externalIP: %v", lp.String(), err)
12211222

@@ -1404,13 +1405,12 @@ func (proxier *Proxier) syncProxyRules() {
14041405
// We do not start listening on SCTP ports, according to our agreement in the
14051406
// SCTP support KEP
14061407
} else if svcInfo.Protocol() != v1.ProtocolSCTP {
1407-
socket, err := proxier.portMapper.OpenLocalPort(&lp)
1408+
socket, err := proxier.portMapper.OpenLocalPort(&lp, isIPv6)
14081409
if err != nil {
14091410
klog.Errorf("can't open %s, skipping this nodePort: %v", lp.String(), err)
14101411
continue
14111412
}
14121413
if lp.Protocol == "udp" {
1413-
isIPv6 := utilnet.IsIPv6(svcInfo.ClusterIP())
14141414
conntrack.ClearEntriesForPort(proxier.exec, lp.Port, isIPv6, v1.ProtocolUDP)
14151415
}
14161416
replacementPortsMap[lp] = socket
@@ -2101,11 +2101,11 @@ func writeBytesLine(buf *bytes.Buffer, bytes []byte) {
21012101
type listenPortOpener struct{}
21022102

21032103
// OpenLocalPort holds the given local port open.
2104-
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
2105-
return openLocalPort(lp)
2104+
func (l *listenPortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
2105+
return openLocalPort(lp, isIPv6)
21062106
}
21072107

2108-
func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
2108+
func openLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
21092109
// For ports on node IPs, open the actual port and hold it, even though we
21102110
// use ipvs to redirect traffic.
21112111
// This ensures a) that it's safe to use that port and b) that (a) stays
@@ -2121,17 +2121,25 @@ func openLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
21212121
var socket utilproxy.Closeable
21222122
switch lp.Protocol {
21232123
case "tcp":
2124-
listener, err := net.Listen("tcp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
2124+
network := "tcp4"
2125+
if isIPv6 {
2126+
network = "tcp6"
2127+
}
2128+
listener, err := net.Listen(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
21252129
if err != nil {
21262130
return nil, err
21272131
}
21282132
socket = listener
21292133
case "udp":
2130-
addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
2134+
network := "udp4"
2135+
if isIPv6 {
2136+
network = "udp6"
2137+
}
2138+
addr, err := net.ResolveUDPAddr(network, net.JoinHostPort(lp.IP, strconv.Itoa(lp.Port)))
21312139
if err != nil {
21322140
return nil, err
21332141
}
2134-
conn, err := net.ListenUDP("udp", addr)
2142+
conn, err := net.ListenUDP(network, addr)
21352143
if err != nil {
21362144
return nil, err
21372145
}

‎pkg/proxy/ipvs/proxier_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ type fakePortOpener struct {
6767

6868
// OpenLocalPort fakes out the listen() and bind() used by syncProxyRules
6969
// to lock a local port.
70-
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort) (utilproxy.Closeable, error) {
70+
func (f *fakePortOpener) OpenLocalPort(lp *utilproxy.LocalPort, isIPv6 bool) (utilproxy.Closeable, error) {
7171
f.openPorts = append(f.openPorts, lp)
7272
return nil, nil
7373
}

‎pkg/proxy/util/port.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ type Closeable interface {
5151
// PortOpener is an interface around port opening/closing.
5252
// Abstracted out for testing.
5353
type PortOpener interface {
54-
OpenLocalPort(lp *LocalPort) (Closeable, error)
54+
OpenLocalPort(lp *LocalPort, isIPv6 bool) (Closeable, error)
5555
}
5656

5757
// RevertPorts is closing ports in replacementPortsMap but not in originalPortsMap. In other words, it only

0 commit comments

Comments
 (0)