Hello,
Happy New Year!
I was wondering if there is a chance to fix the issue reported below. With this type of vmap, kube-proxy's rules could be grouped together to make them more efficient.
Thank you
Serguei
On 2019-12-19, 1:19 PM, "Serguei Bezverkhi (sbezverk)" <sbezverk@xxxxxxxxx> wrote:
While trying to add an element to the set, I am getting error:
sudo nft --debug all add element ipv4table no-endpoints-services { tcp . 192.168.80.104 . 8989 : goto do_reject }
Error: Could not process rule: Invalid argument
add element ipv4table no-endpoints-services { tcp . 192.168.80.104 . 8989 : goto do_reject }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Anything am I doing wrong?
Thank you
Serguei
On 2019-12-19, 11:00 AM, "Serguei Bezverkhi (sbezverk)" <sbezverk@xxxxxxxxx> wrote:
HI Phil,
I built 0.9.3 and now it recognizes "th", but there is I suspect a cosmetic issue in the output in nft cli. See below the command I used:
sudo nft --debug all add rule ipv4table k8s-filter-services ip protocol . ip daddr . th dport vmap @no-endpoints-services
It looks like correctly generating expressions:
ip ipv4table k8s-filter-services
[ payload load 1b @ network header + 9 => reg 1 ]
[ payload load 4b @ network header + 16 => reg 9 ]
[ payload load 2b @ transport header + 2 => reg 10 ]
[ lookup reg 1 set no-endpoints-services dreg 0 ]
But when I run "sudo nft list tables ipv4table" the rule is missing third parameter.
table ip ipv4table {
map no-endpoints-services {
type inet_proto . ipv4_addr . inet_service : verdict
}
chain k8s-filter-services {
ip protocol . ip daddr vmap @no-endpoints-services < ------------------- Missing " th dport"
}
}
It seems just a cosmetic thing, but eventually would be nice to have it fixed, if it has not been already in the master branch. I am using v0.9.3 branch.
Thank you
Serguei
On 2019-12-19, 10:46 AM, "n0-1@xxxxxxxxxxxxx on behalf of Phil Sutter" <n0-1@xxxxxxxxxxxxx on behalf of phil@xxxxxx> wrote:
Hi,
On Thu, Dec 19, 2019 at 02:59:01PM +0000, Serguei Bezverkhi (sbezverk) wrote:
> Not sure why, but even with 0.9.2 "th" expression is not recognized.
>
> error: syntax error, unexpected th
> add rule ipv4table k8s-filter-services ip protocol . ip daddr . th dport vmap @no-endpoints-services
> ^^
> sbezverk@dev-ubuntu-1:mimic-filter$ sudo nft -version
> nftables v0.9.2 (Scram)
> sbezverk@dev-ubuntu-1:mimic-filter$
>
> It seems 0.9.3 is out but still no Debian package. Is it possible it did not make it into 0.9.2?
Not sure what's missing on your end. I checked 0.9.2 tarball, at least
parser should understand the syntax.
Cheers, Phil
