{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/17306","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/17306/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/17306/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/17306/events","html_url":"https://github.com/openshift/origin/issues/17306","id":273881904,"number":17306,"title":"SYN drop during HAproxy router reload does not apply when using IPv6","user":{"login":"alexcern","id":2931658,"avatar_url":"https://avatars3.githubusercontent.com/u/2931658?v=4","gravatar_id":"","url":"https://api.github.com/users/alexcern","html_url":"https://github.com/alexcern","followers_url":"https://api.github.com/users/alexcern/followers","following_url":"https://api.github.com/users/alexcern/following{/other_user}","gists_url":"https://api.github.com/users/alexcern/gists{/gist_id}","starred_url":"https://api.github.com/users/alexcern/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexcern/subscriptions","organizations_url":"https://api.github.com/users/alexcern/orgs","repos_url":"https://api.github.com/users/alexcern/repos","events_url":"https://api.github.com/users/alexcern/events{/privacy}","received_events_url":"https://api.github.com/users/alexcern/received_events","type":"User","site_admin":false},"labels":[{"id":210156239,"url":"https://api.github.com/repos/openshift/origin/labels/component/routing","name":"component/routing","color":"0052cc","default":false},{"id":118251699,"url":"https://api.github.com/repos/openshift/origin/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":858447969,"url":"https://api.github.com/repos/openshift/origin/labels/lifecycle/rotten","name":"lifecycle/rotten","color":"604460","default":false},{"id":210151912,"url":"https://api.github.com/repos/openshift/origin/labels/priority/P2","name":"priority/P2","color":"fbca04","default":false}],"state":"closed","locked":false,"assignee":{"login":"knobunc","id":10033853,"avatar_url":"https://avatars1.githubusercontent.com/u/10033853?v=4","gravatar_id":"","url":"https://api.github.com/users/knobunc","html_url":"https://github.com/knobunc","followers_url":"https://api.github.com/users/knobunc/followers","following_url":"https://api.github.com/users/knobunc/following{/other_user}","gists_url":"https://api.github.com/users/knobunc/gists{/gist_id}","starred_url":"https://api.github.com/users/knobunc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knobunc/subscriptions","organizations_url":"https://api.github.com/users/knobunc/orgs","repos_url":"https://api.github.com/users/knobunc/repos","events_url":"https://api.github.com/users/knobunc/events{/privacy}","received_events_url":"https://api.github.com/users/knobunc/received_events","type":"User","site_admin":false},"assignees":[{"login":"knobunc","id":10033853,"avatar_url":"https://avatars1.githubusercontent.com/u/10033853?v=4","gravatar_id":"","url":"https://api.github.com/users/knobunc","html_url":"https://github.com/knobunc","followers_url":"https://api.github.com/users/knobunc/followers","following_url":"https://api.github.com/users/knobunc/following{/other_user}","gists_url":"https://api.github.com/users/knobunc/gists{/gist_id}","starred_url":"https://api.github.com/users/knobunc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knobunc/subscriptions","organizations_url":"https://api.github.com/users/knobunc/orgs","repos_url":"https://api.github.com/users/knobunc/repos","events_url":"https://api.github.com/users/knobunc/events{/privacy}","received_events_url":"https://api.github.com/users/knobunc/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2017-11-14T17:42:32Z","updated_at":"2018-04-26T12:52:51Z","closed_at":"2018-04-26T11:38:28Z","author_association":"CONTRIBUTOR","body":"Hello\r\n\r\nWhen applying https://docs.openshift.org/latest/install_config/router/default_haproxy_router.html#preventing-connection-failures-during-restarts nothing happens if the router binds on IPv6 addresses (including dual-stack)\r\n\r\n##### Version\r\n\r\n```\r\noc v3.6.1+008f2d5\r\nkubernetes v1.6.1+5115d708d7\r\nfeatures: Basic-Auth GSSAPI Kerberos SPNEGO\r\n```\r\n\r\n##### Steps To Reproduce\r\n1. `oc env dc/router ROUTER_IP_V4_V6_MODE=v4v6` (or `v6`)\r\n2. Apply https://docs.openshift.org/latest/install_config/router/default_haproxy_router.html#preventing-connection-failures-during-restarts\r\n\r\nIt is not necessary to actually have an IPv6 stack, just setting the mode to v4v6 on an IP4-only node will reproduce the issue.\r\n\r\n##### Current Result\r\nIptables is not modified during config reloads, SYNs are not dropped\r\n\r\n##### Expected Result\r\nIPtables is modified to drop SYNs during config reloads to prevent connection failures\r\n\r\n##### Additional Information\r\nIt seems https://github.com/openshift/origin/blob/release-3.6/images/router/haproxy/reload-haproxy#L88  only matches IPv4 bindings.\r\n\r\nSomething like this appears to work with both IPv4 and IPv6 on the generated haproxy config file:\r\n```\r\ngrep -E --only-matching '^\\s*bind\\s+:(::)?[[:digit:]]+\\w' \"$config_file\" | sed -e 's/:::/:/' | cut …\r\n```\r\n\r\nThough this would still only drop SYNs for TCP4. It may be needed to explicitly drop TCP6 SYNs as well."},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/384630134","html_url":"https://github.com/openshift/origin/issues/17306#issuecomment-384630134","issue_url":"https://api.github.com/repos/openshift/origin/issues/17306","id":384630134,"user":{"login":"knobunc","id":10033853,"avatar_url":"https://avatars1.githubusercontent.com/u/10033853?v=4","gravatar_id":"","url":"https://api.github.com/users/knobunc","html_url":"https://github.com/knobunc","followers_url":"https://api.github.com/users/knobunc/followers","following_url":"https://api.github.com/users/knobunc/following{/other_user}","gists_url":"https://api.github.com/users/knobunc/gists{/gist_id}","starred_url":"https://api.github.com/users/knobunc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knobunc/subscriptions","organizations_url":"https://api.github.com/users/knobunc/orgs","repos_url":"https://api.github.com/users/knobunc/repos","events_url":"https://api.github.com/users/knobunc/events{/privacy}","received_events_url":"https://api.github.com/users/knobunc/received_events","type":"User","site_admin":false},"created_at":"2018-04-26T12:52:51Z","updated_at":"2018-04-26T12:52:51Z","author_association":"CONTRIBUTOR","body":"This is obsolete with OpenShift 3.9.  There we have haproxy 1.8 and take advantage of the seamless reloads."}}
{"actor":{"display_login":"knobunc"}}