You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/util/linuxfw
Tom Proctor 01a7726cf7
cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577)
cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies

Don't skip installing egress forwarding rules for IPv6 (as long as the host
supports IPv6), and set headless services `ipFamilyPolicy` to
`PreferDualStack` to optionally enable both IP families when possible. Note
that even with `PreferDualStack` set, testing a dual-stack GKE cluster with
the default DNS setup of kube-dns did not correctly set both A and
AAAA records for the headless service, and instead only did so when
switching the cluster DNS to Cloud DNS. For both IPv4 and IPv6 to work
simultaneously in a dual-stack cluster, we require headless services to
return both A and AAAA records.

If the host doesn't support IPv6 but the FQDN specified only has IPv6
addresses available, containerboot will exit with error code 1 and an
error message because there is no viable egress route.

Fixes #12215

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
5 months ago
..
linuxfwtest util/linuxfw: initial implementation of package 2 years ago
detector.go linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter 12 months ago
fake.go cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577) 5 months ago
helpers.go all: cleanup unused code, part 2 (#10670) 11 months ago
iptables.go util/linuxfw: move detection logic 1 year ago
iptables_runner.go util/linuxfw: don't try cleaning iptables on gokrazy 6 months ago
iptables_runner_test.go util/linuxfw,go.{mod,sum}: don't log errors when deleting non-existant chains and rules (#11852) 7 months ago
linuxfw.go util/linuxfw: fix IPv6 availability check for nftables (#12009) 7 months ago
linuxfw_unsupported.go all: cleanup unused code, part 2 (#10670) 11 months ago
nftables.go util/cmpx: delete now that we're using Go 1.22 10 months ago
nftables_runner.go util/linuxfw: verify that IPv6 if available if (#12598) 5 months ago
nftables_runner_test.go util/linuxfw: fix IPv6 availability check for nftables (#12009) 7 months ago
nftables_types.go util/linuxfw: add new arch build constraints 1 year ago