You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/util/linuxfw
Irbe Krumina 6b97e615d6
cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897)
cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services

This PR is part of the work to implement HA for Kubernetes Operator's
network layer proxy.
Adds logic to containerboot to monitor mounted ingress firewall configuration rules
and update iptables/nftables rules as the config changes.
Also adds new shared types for the ingress configuration.
The implementation is intentionally similar to that for HA for egress proxy.

Updates tailscale/tailscale#15895

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
7 months ago
..
linuxfwtest util/linuxfw: initial implementation of package 3 years ago
detector.go util/linuxfw: fall back to nftables when iptables not found 1 year ago
fake.go cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577) 1 year ago
fake_netfilter.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 7 months ago
helpers.go util/slicesx: add FirstElementEqual and LastElementEqual 1 year ago
iptables.go util/linuxfw: fall back to nftables when iptables not found 1 year ago
iptables_for_svcs.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 7 months ago
iptables_for_svcs_test.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 7 months ago
iptables_runner.go cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) 1 year ago
iptables_runner_test.go cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) 1 year ago
linuxfw.go all: add test for package comments, fix, add comments as needed 1 year ago
linuxfw_unsupported.go all: cleanup unused code, part 2 (#10670) 2 years ago
nftables.go all: use Go 1.21's binary.NativeEndian 11 months ago
nftables_for_svcs.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 7 months ago
nftables_for_svcs_test.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 7 months ago
nftables_runner.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 7 months ago
nftables_runner_test.go util/linuxfw: fix delete snat rule (#15763) 7 months ago
nftables_types.go util/linuxfw: add new arch build constraints 2 years ago