zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-06 09:22:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added logging for nftables handling.

Browse Source
This commit is contained in:
cameronts
2022-08-01 15:52:49 -07:00
parent 81c896b22a
commit 1b01914c52
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
logic/gateway.go
View File

@@ -36,6 +36,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
// nftables only supported on Linux // nftables only supported on Linux
if IsNFTablesPresent() { if IsNFTablesPresent() {
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating egress gateway using nftables")
postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -46,6 +47,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
} }
} else { } else {
logger.Log(3, "creating egress gateway using iptables")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; " postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT" postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; " postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; "
@@ -136,6 +138,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
// nftables only supported on Linux // nftables only supported on Linux
if IsNFTablesPresent() { if IsNFTablesPresent() {
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting egress gateway using nftables")
node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ; " node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ; "
@@ -143,6 +146,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;" node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade " node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade "
} else { } else {
logger.Log(3, "deleting egress gateway using iptables")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" node.PostUp += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
@@ -194,6 +198,7 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
node.IngressGatewayRange = network.AddressRange node.IngressGatewayRange = network.AddressRange
if IsNFTablesPresent() { if IsNFTablesPresent() {
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating ingress gateway using nftables")
postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade" postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
@@ -201,6 +206,7 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
} else { } else {
logger.Log(3, "creating ingress gateway using iptables")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" postUpCmd += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"

6
logic/util.go
View File

@@ -21,7 +21,11 @@ import (
// nfTablesPresent - returns true if nftables is present, false otherwise // nfTablesPresent - returns true if nftables is present, false otherwise
func IsNFTablesPresent() bool { func IsNFTablesPresent() bool {
return FileExists("/etc/nftables.conf") var nftFound bool
nftFound = FileExists("/etc/nftables.conf")
logger.Log(3, "nftables found:", nftFound)
return nftFound
} }
// IsBase64 - checks if a string is in base64 format // IsBase64 - checks if a string is in base64 format