mirror of
https://github.com/optim-enterprises-bv/kubernetes.git
synced 2025-11-02 03:08:15 +00:00
f21f8d9984
Previously, the firewall-check chain was run in input, forward, and output hook but not prerouting hook. When the LoadBalancer traffic arrived at input or forward hook, it had been DNATed to endpoint IP and port, so the firewall-check chain didn't take effect, traffic from out of LoadBalancerSourceRanges was not dropped. It was not detected by unit test because the chains were sorted by priority only, while hook should be taken into consideration. The commit links the firewall-check chain to prerouting hook and unlinks it from input and forward hook to ensure the traffic is filtered before DNAT. The priorities of filter chains are updated from "DNATPriority-1" to "DNATPriority-10" to allow third parties to insert something else between them. Signed-off-by: Quan Tian <qtian@vmware.com>