-
Notifications
You must be signed in to change notification settings - Fork 24
Description
Thanks for this great project, really useful ... I'm happily using it for two kubernetes projects
https://github.com/kubernetes-sigs/kube-network-policies/
https://github.com/aojea/kindnet
The later project also vendors the forme.
I have an issue that I'm puzzled with trying to solve, I've implemented a dnscache using nfqueue , basically I send the packet to userspace and if it is cached it drops the packet and I spoof the answer, and if there is any error or not cached, the packet is accepted and it goes through.
The problem is that I started to see errors where the packets are dropped, aojea/kindnet#158 , no such file or directory
that IIUIC is ENOENT , but I would not expect to have data loss
The nftables rules are very simple, it just matches dns packets sent to some specific ips from some predetermined range
table inet kindnet-dnscache {
set set-v4-nameservers {
type ipv4_addr
elements = { 1.1.1.1 }
}
set set-v6-nameservers {
type ipv6_addr
elements = { fd00::1 }
}
chain prerouting {
type filter hook prerouting priority raw; policy accept;
ip saddr 10.0.0.0/24 ip daddr @set-v4-nameservers udp dport 53 queue flags bypass to 103
ip6 saddr 2001:db8::/112 ip6 daddr @set-v6-nameservers udp dport 53 queue flags bypass to 103
}
chain output {
type filter hook output priority raw; policy accept;
meta mark 0x0000006e udp sport 53 notrack
}
}
Appreciate If you have any thoughts or hints to try to solve that problem