k8snetworkplumbingwg / multi-networkpolicy-iptables

MultiNetworkPolicy iptable based implementation
Apache License 2.0
13 stars 19 forks source link

Support for IPv6 #22

Closed zeeke closed 1 year ago

zeeke commented 2 years ago

The iptables implementation of multi-networkpolicy does not support pods with IPv6 addresses on multus interfaces, giving the following error in such case:

I0610 13:43:14.709071       1 iptables.go:337] running iptables-save [-t mangle]
I0610 13:43:14.709873       1 iptables.go:337] running iptables-save [-t filter]
I0610 13:43:14.710601       1 iptables.go:337] running iptables-save [-t nat]
I0610 13:43:14.711482       1 iptables.go:442] running iptables: iptables [-w -N MULTI-INGRESS -t filter]
I0610 13:43:14.712217       1 iptables.go:442] running iptables: iptables [-w -N MULTI-EGRESS -t filter]
I0610 13:43:14.712951       1 iptables.go:442] running iptables: iptables [-w -C INPUT -t filter -i net1 -j MULTI-INGRESS]
I0610 13:43:14.796884       1 iptables.go:442] running iptables: iptables [-w -C OUTPUT -t filter -o net1 -j MULTI-EGRESS]
I0610 13:43:14.797721       1 iptables.go:442] running iptables: iptables [-w -C PREROUTING -t nat -i net1 -j RETURN]
I0610 13:43:14.798446       1 iptables.go:337] running iptables-save [-t filter]
I0610 13:43:14.799776       1 iptables.go:402] running iptables-restore [-w --noflush --counters]
E0610 13:43:14.800993       1 server.go:610] sync rules failed: exit status 2 (iptables-restore v1.4.21: host/network `3ffe:ffff:0:1ff::4e' not foundError occurred at line: 14Try `iptables-restore -h' or 'iptables-restore --help' for more information.)
I0610 13:43:14.801038       1 iptables.go:337] running iptables-save [-t mangle]
I0610 13:43:14.801838       1 iptables.go:337] running iptables-save [-t filter]
I0610 13:43:14.802697       1 iptables.go:337] running iptables-save [-t nat] 

A possible solution can be leveraging the Server.ipv6Tables field to issue the same iptables commands as IPv4, in case the involved pods have v6 addresses.

WDYT? Is it a viable way?