ateomnet: restrict actor masquerade to cluster DNS resolver - #985
Open
SURAJ KUMAR (krsnaSuraj) wants to merge 2 commits into
Open
ateomnet: restrict actor masquerade to cluster DNS resolver#985SURAJ KUMAR (krsnaSuraj) wants to merge 2 commits into
SURAJ KUMAR (krsnaSuraj) wants to merge 2 commits into
Conversation
The postrouting masquerade in InstallActorNftablesRules previously masqueraded all traffic from the actor veth IP. Restrict it to UDP DNS traffic (port 53) destined for the cluster resolver read from the pod's /etc/resolv.conf. When no IPv4 resolver is available the legacy broad masquerade is preserved for backward compatibility. New helpers: UDPProtocol(), IPDestEqual(), readDNSResolver(). Fixes: agent-substrate#960
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ateomnet: restrict actor masquerade to cluster DNS resolver
Fixes: #960
Problem
InstallActorNftablesRulesinstalls a postrouting masquerade that matchesall traffic from the actor veth IP — effectively NATting every packet the
actor sends, including traffic that should be dropped by policy.
Fix
When a cluster DNS resolver IP is available (read from the pod's
/etc/resolv.conf), the postrouting masquerade is now restricted to a single
nftables rule matching all four conditions:
All other non-tunneled actor egress is no longer masqueraded and will be
dropped by the kernel's default forward policy.
When no IPv4 resolver is available (empty /etc/resolv.conf, IPv6-only
resolver, or missing file), the legacy broad masquerade is preserved for
backward compatibility.
New helpers
readDNSResolver()— parses /etc/resolv.conf, returns first IPv4 nameserverUDPProtocol()— nftables L4 proto match for UDP (IPPROTO_UDP = 17)IPDestEqual(ip)— IPv4 destination address match (header offset 16)Files changed
internal/ateomnet/net.go— signature extended, restricted masquerade, helpersVerification
gofmt -lcleango build ./internal/ateomnet/passesgo test ./internal/ateomnet/ -count=1passes (all tests)