Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: linkerd/linkerd2-proxy-init
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: linkerd/linkerd2-proxy-init
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: alpeb/nftables
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 3 files changed
  • 1 contributor

Commits on Mar 4, 2024

  1. Experiment: replace iptables with IPv4/IPv6 nftables 

    This creates the following rules (added in the file "nft-saved"):

```
table inet nat {
	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		counter packets 0 bytes 0 jump PROXY_INIT_REDIRECT comment "proxy-init/install-proxy-init-prerouting/xxxx"
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		counter packets 1 bytes 60 jump PROXY_INIT_OUTPUT comment "proxy-init/install-proxy-init-output/xxxx"
	}

	chain PROXY_INIT_OUTPUT {
		meta skuid 2102 counter packets 0 bytes 0 return comment "proxy-init/ignore-proxy-user-id/xxx"
		oifname "lo" counter packets 0 bytes 0 return comment "proxy-init/ignore-loopback/xxx"
		tcp dport { 443, 4567, 4568 } counter packets 0 bytes 0 return comment "proxy-init/ignore-port-4567,4568/xxx"
		ip protocol tcp counter packets 1 bytes 60 redirect to :4140 comment "proxy-init/redirect-all-outgoing-to-proxy-port/xxx"
		ip6 nexthdr tcp counter packets 1 bytes 60 redirect to :4140 comment "proxy-init/redirect-all-outgoing-to-proxy-port/xxx"
	}

	chain PROXY_INIT_REDIRECT {
		tcp dport { 4190, 4191, 4567, 4568 } counter packets 0 bytes 0 return comment "proxy-init/ignore-port-4190,4191,4567,4568/xxx"
		ip protocol tcp counter packets 0 bytes 0 redirect to :4143 comment "proxy-init/redirect-all-incoming-to-proxy-port/xxx"
		ip6 nexthdr tcp counter packets 0 bytes 0 redirect to :4143 comment "proxy-init/redirect-all-incoming-to-proxy-port/xxx"
	}
}
```
    @alpeb
    alpeb committed Mar 4, 2024
    Configuration menu
    Copy the full SHA
    02c62fc View commit details
    Browse the repository at this point in the history
Loading