tailscale/util/linuxfw
Irbe Krumina 6b97e615d6
cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897)
cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services

This PR is part of the work to implement HA for Kubernetes Operator's
network layer proxy.
Adds logic to containerboot to monitor mounted ingress firewall configuration rules
and update iptables/nftables rules as the config changes.
Also adds new shared types for the ingress configuration.
The implementation is intentionally similar to that for HA for egress proxy.

Updates tailscale/tailscale#15895

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-05-19 10:42:03 +01:00
..
linuxfwtest util/linuxfw: initial implementation of package 2023-02-09 14:20:24 -05:00
detector.go util/linuxfw: fall back to nftables when iptables not found 2024-09-11 14:36:17 -07:00
fake_netfilter.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
fake.go cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577) 2024-07-05 12:21:48 +01:00
helpers.go util/slicesx: add FirstElementEqual and LastElementEqual 2024-09-11 18:36:00 -07:00
iptables_for_svcs_test.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 2025-05-12 17:26:23 +01:00
iptables_for_svcs.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 2025-05-12 17:26:23 +01:00
iptables_runner_test.go cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) 2024-10-03 20:15:00 +01:00
iptables_runner.go cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) 2024-10-03 20:15:00 +01:00
iptables.go util/linuxfw: fall back to nftables when iptables not found 2024-09-11 14:36:17 -07:00
linuxfw_unsupported.go all: cleanup unused code, part 2 (#10670) 2023-12-21 17:40:03 -08:00
linuxfw.go all: add test for package comments, fix, add comments as needed 2024-07-10 09:57:00 -07:00
nftables_for_svcs_test.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 2025-05-12 17:26:23 +01:00
nftables_for_svcs.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 2025-05-12 17:26:23 +01:00
nftables_runner_test.go util/linuxfw: fix delete snat rule (#15763) 2025-05-01 12:12:36 -04:00
nftables_runner.go util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896) 2025-05-12 17:26:23 +01:00
nftables_types.go util/linuxfw: add new arch build constraints 2023-06-30 18:22:15 -04:00
nftables.go all: use Go 1.21's binary.NativeEndian 2025-01-13 08:31:00 -08:00