Repository navigation
diag: report the guest firewall's drops in status - #221
Merged
Merged
Conversation
A job over its connection limit or rate, or sending to a non-public address, sees only connect timeouts, with nothing saying the firewall dropped it. status now reads the firewall's named drop counters, from the main table and the <table>_conns limit table, and reports them by reason (spoof, nonpublic, conn_limit, conn_rate) as network.drops in --json and a "guest drops" line in text. When they cannot be read (they need root) network.drops_error says why; a limit table that does not exist adds nothing. Signed-off-by: Yi-Ru Lin <deduce@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a job goes over its connection limit (#208), or sends to a non-public address (#218), it only sees connect timeouts. Nothing tells it that the firewall dropped those connections.
firerunner statusnow reads the firewall's named drop counters. It reads them from the main table and from the<table>_connslimit table, and reports them by reason:--json:network.dropswithspoof,nonpublic,conn_limitandconn_rate.guest dropsline.The counters need root to read. When they cannot be read,
network.drops_errorsays why. If the limit table does not exist, for example because the limits are off, it adds nothing.Tests:
TestFirewallDropscovers both tables, a missing limit table, and a run without root. I checked thenft -j list counters table ip <table>syntax, its JSON, and the error for a missing table against nft 1.1.7 in a throwaway network namespace.