ERROR: table `nat' is incompatible, use 'nft' tool. #461
Comments
|
It seems that ping to go-iptables owner @squeed |
Research notesThe func (network *cniNetwork) addToNetwork(rt *libcni.RuntimeConf, cni *libcni.CNIConfig) (cnitypes.Result, error) {
logrus.Infof("About to add CNI network %s (type=%v)", network.name, network.config.Plugins[0].Network.Type)
res, err := cni.AddNetworkList(context.Background(), network.config, rt)
if err != nil {
logrus.Errorf("Error adding network: %v", err)
return nil, err
}
return res, nil
}Here, the The (*libcni.RuntimeConf)(0xc0004e29c0)({
ContainerID: (string) (len=64) "ba494ee826f97131fa4a2adb4b2e0c048fa3c4c337b2975b9727d8afe5840b1f",
NetNS: (string) (len=55) "/var/run/netns/cni-55772b7c-7eaf-353e-dd04-c78d96262650",
IfName: (string) (len=4) "eth0",
Args: ([][2]string) (len=4 cap=4) {
([2]string) (len=2 cap=2) {
(string) (len=13) "IgnoreUnknown",
(string) (len=1) "1"
},
([2]string) (len=2 cap=2) {
(string) (len=17) "K8S_POD_NAMESPACE",
(string) (len=15) "sleepy_jennings"
},
([2]string) (len=2 cap=2) {
(string) (len=12) "K8S_POD_NAME",
(string) (len=15) "sleepy_jennings"
},
([2]string) (len=2 cap=2) {
(string) (len=26) "K8S_POD_INFRA_CONTAINER_ID",
(string) (len=64) "ba494ee826f97131fa4a2adb4b2e0c048fa3c4c337b2975b9727d8afe5840b1f"
}
},
CapabilityArgs: (map[string]interface {}) {
},
CacheDir: (string) ""
})The (*ocicni.cniNetwork)(0xc0005d2180)({
name: (string) (len=6) "podman",
filePath: (string) (len=30) "/etc/cni/net.d/podman.conflist",
config: (*libcni.NetworkConfigList)(0xc000505860)({
Name: (string) (len=6) "podman",
CNIVersion: (string) (len=5) "0.4.0",
DisableCheck: (bool) false,
Plugins: ([]*libcni.NetworkConfig) (len=3 cap=4) {
(*libcni.NetworkConfig)(0xc0005c2900)({
Network: (*types.NetConf)(0xc0003e4c00)({
CNIVersion: (string) "",
Name: (string) "",
Type: (string) (len=6) "bridge",
Capabilities: (map[string]bool) <nil>,
IPAM: (types.IPAM) {
Type: (string) (len=10) "host-local"
},
DNS: (types.DNS) {
Nameservers: ([]string) <nil>,
Domain: (string) "",
Search: ([]string) <nil>,
Options: ([]string) <nil>
},
}),
(*libcni.NetworkConfig)(0xc0005c29a0)({
Network: (*types.NetConf)(0xc0003e4cc0)({
CNIVersion: (string) "",
Name: (string) "",
Type: (string) (len=7) "portmap",
Capabilities: (map[string]bool) (len=1) {
(string) (len=12) "portMappings": (bool) true
},
IPAM: (types.IPAM) {
Type: (string) ""
},
DNS: (types.DNS) {
Nameservers: ([]string) <nil>,
Domain: (string) "",
Search: ([]string) <nil>,
Options: ([]string) <nil>
},
}),
(*libcni.NetworkConfig)(0xc0005c2a00)({
Network: (*types.NetConf)(0xc0003e4d80)({
CNIVersion: (string) "",
Name: (string) "",
Type: (string) (len=8) "firewall",
Capabilities: (map[string]bool) <nil>,
IPAM: (types.IPAM) {
Type: (string) ""
},
DNS: (types.DNS) {
Nameservers: ([]string) <nil>,
Domain: (string) "",
Search: ([]string) <nil>,
Options: ([]string) <nil>
},
})
})
})
}) |
@mars1024, I tracked it down. As you said, |
Research NotesThe error comes from The key to distinguish between This structure gets created by func newIptablesBackend(conf *FirewallNetConf) (FirewallBackend, error) {
adminChainName := conf.IptablesAdminChainName
if adminChainName == "" {
adminChainName = "CNI-ADMIN"
}
backend := &iptablesBackend{
privChainName: "CNI-FORWARD",
adminChainName: adminChainName,
protos: make(map[iptables.Protocol]*iptables.IPTables),
}
for _, proto := range []iptables.Protocol{iptables.ProtocolIPv4, iptables.ProtocolIPv6} {
ipt, err := iptables.NewWithProtocol(proto)
if err != nil {
return nil, fmt.Errorf("could not initialize iptables protocol %v: %v", proto, err)
}
backend.protos[proto] = ipt
}
return backend, nil
}The Luckily, here is another clue: There is either On one hand we could add The next step is |
|
As my first step, I implemented "donothing" firewall backend: https://github.com/greenpau/origin_containernetworking_plugins/blob/1dde487bf69f688e932ca04fc47fa55b502a45e6/plugins/meta/firewall/nftables.go The next step is going through iptables/firewalld backends and figuring out what is necessary. |
Research NotesInvoked the following command to start a container: The newly added The IP addressing (removed references to IPv6) inside the container looks like this: The main network namespace looks like this: Inside the container, I issue My NFT config ( The next step is figuring out which rules to we need. The FORWARD chain is a good start ... to be continued .. |
Research NotesThe following commands would be sufficient to make the containers talk to the outside world: This is what the FORWARD chain looks like after the change: A container on The thing necessary to complete The first interface in the list of the The logic should be:
|
Research NotesTo implement the above logic, let's start working on the func (nb *nftBackend) Add(conf *FirewallNetConf, result *current.Result) error {
logrus.Errorf("nftBackend.Add() conf: %s", spew.Sdump(conf))
logrus.Errorf("nftBackend.Add() result: %s", spew.Sdump(result))
tables, err := nb.conn.ListTables()
if err != nil {
return fmt.Errorf("nftBackend.Add() error: %s", err)
}
logrus.Errorf("nftBackend.Add() result: %s", spew.Sdump(tables))
return fmt.Errorf("nftBackend.Add is not supported")
//return nil
}The tables look like this. The
First, step is our validation that IPv4 "filter" table exists. |
Research NotesThe each individual rule in the What I hoped for was that there is an easy way to convert that struct to a string for comparison, but there isn't. Working on the comparison right now. |
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
|
|
Research NotesJust for my records. I am leaving some nftables functions here: |
Research NotesNoticed a lot of Upon review the This basically means that if a packet came from IP |
|
Chain priorities explained: https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_priority |
When I removec containers, the chains stayed ... |
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
|
Hey @greenpau |
|
@xtreme-sameer-vohra , yes. Wanted to resume my PR it next week. Are you using nft? |
|
Great. |
|
I would suggest updating iptables-nft to at least 1.8.3 or 1.8.4. There were known bugs in 1.8.2 that this may be fixed already. Does a later iptables-nft help your original issue? |
@dcbw , I think there is still an issue. I also think that NAT is being impacted too, not just filter table. |
|
@dcbw , just for the reference: |
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
Resolves: containernetworking#461 Signed-off-by: Paul Greenberg <greenpau@outlook.com>
|
Any plans on picking this back up. I am kinda surprised to find out nftables isn't supported on centos 9 with podman. |
@nemith , i did. See https://github.com/greenpau/cni-plugins |
|
To get rid of that libvirt error, my permanent workaround in Debian 11 (as a host) with libvirtd daemon is to block the loading of iptables-related modules: Create a file in
Post-analysis: Apparently, I had |
|
Any chance to reopen this issue? @greenpau Do you plan to submit a PR to merge https://github.com/greenpau/cni-plugins to the upstream plugins? |
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind feature
Description
I use nftables; when starting a container I get:
Steps to reproduce the issue:
Describe the results you received:
Describe the results you expected:
No errors.
Additional information you deem important (e.g. issue happens only occasionally):
Output of
podman version:Output of
podman info --debug:Package info (e.g. output of
rpm -q podmanorapt list podman):Additional environment details (AWS, VirtualBox, physical, etc.):
Physical.
Reference: containers/podman#5446
The text was updated successfully, but these errors were encountered: