Irbe Krumina 9bd158cc09 cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) ... The AddSNATRuleForDst rule was adding a new rule each time it was called including: - if a rule already existed - if a rule matching the destination, but with different desired source already existed This was causing issues especially for the in-progress egress HA proxies work, where the rules are now refreshed more frequently, so more redundant rules were being created. This change: - only creates the rule if it doesn't already exist - if a rule for the same dst, but different source is found, delete it - also ensures that egress proxies refresh firewall rules if the node's tailnet IP changes Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		2024-10-03 20:15:00 +01:00
..
linuxfwtest	util/linuxfw: initial implementation of package	2023-02-09 14:20:24 -05:00
detector.go	util/linuxfw: fall back to nftables when iptables not found	2024-09-11 14:36:17 -07:00
fake.go	cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577)	2024-07-05 12:21:48 +01:00
helpers.go	util/slicesx: add FirstElementEqual and LastElementEqual	2024-09-11 18:36:00 -07:00
iptables_for_svcs_test.go	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	2024-09-29 16:30:53 +01:00
iptables_for_svcs.go	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	2024-09-29 16:30:53 +01:00
iptables_runner_test.go	cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658)	2024-10-03 20:15:00 +01:00
iptables_runner.go	cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658)	2024-10-03 20:15:00 +01:00
iptables.go	util/linuxfw: fall back to nftables when iptables not found	2024-09-11 14:36:17 -07:00
linuxfw_unsupported.go	all: cleanup unused code, part 2 (#10670)	2023-12-21 17:40:03 -08:00
linuxfw.go	all: add test for package comments, fix, add comments as needed	2024-07-10 09:57:00 -07:00
nftables_for_svcs_test.go	cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658)	2024-10-03 20:15:00 +01:00
nftables_for_svcs.go	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	2024-09-29 16:30:53 +01:00
nftables_runner_test.go	cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658)	2024-10-03 20:15:00 +01:00
nftables_runner.go	cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658)	2024-10-03 20:15:00 +01:00
nftables_types.go	util/linuxfw: add new arch build constraints	2023-06-30 18:22:15 -04:00
nftables.go	util/cmpx: delete now that we're using Go 1.22	2024-02-07 18:10:15 -08:00