adding iptables functionality

serverctl/iptables.go

@@ -1,60 +1,130 @@
 package serverctl
 
 import (
+	"errors"
 	"net"
+	"os"
 	"os/exec"
 	"strings"
+	"time"
 
+	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/netclient/ncutils"
 	"github.com/gravitl/netmaker/servercfg"
 )
 
+const NETMAKER_PROCESS_NAME = "netmaker"
+
 // InitServerNetclient - intializes the server netclient
 func InitIPTables() error {
 	_, err := exec.LookPath("iptables")
 	if err != nil {
 		return err
 	}
-	setForwardPolicy()
-	portForwardServices()
-	return nil
+	err = setForwardPolicy()
+	if err != nil {
+		logger.Log(0, "error setting iptables forward policy: "+err.Error())
+	}
+
+	err = portForwardServices()
+	if err != nil {
+		return err
+	}
+	if isContainerized() && servercfg.IsHostNetwork() {
+		err = setHostCoreDNSMapping()
+	}
+	return err
 }
 
-func portForwardServices() {
+// set up port forwarding for services listed in config
+func portForwardServices() error {
+	var err error
 	services := servercfg.GetPortForwardServiceList()
-
+	if len(services) == 0 || services[0] == "" {
+		return nil
+	}
 	for _, service := range services {
 		switch service {
 		case "mq":
-			iptablesPortForward("mq", "1883", false)
+			err = iptablesPortForward("mq", "1883", "1883", false)
 		case "dns":
-			iptablesPortForward("mq", "1883", false)
+			err = iptablesPortForward("coredns", "53", "53", false)
 		case "ssh":
-			iptablesPortForward("127.0.0.1", "22", true)
+			err = iptablesPortForward("127.0.0.1", "22", "22", true)
 		default:
 			params := strings.Split(service, ":")
-			iptablesPortForward(params[0], params[1], true)
+			err = iptablesPortForward(params[0], params[1], params[2], true)
+		}
+		if err != nil {
+			return err
 		}
 	}
+	return nil
 }
 
-func setForwardPolicy() {
-	ncutils.RunCmd("iptables --policy FORWARD ACCEPT", true)
+// determine if process is running in container
+func isContainerized() bool {
+	fileBytes, err := os.ReadFile("/proc/1/sched")
+	if err != nil {
+		logger.Log(1, "error determining containerization: "+err.Error())
+		return false
+	}
+	fileString := string(fileBytes)
+	return strings.Contains(fileString, NETMAKER_PROCESS_NAME)
 }
 
-func iptablesPortForward(entry string, port string, isIP bool) {
+// make sure host allows forwarding
+func setForwardPolicy() error {
+	logger.Log(1, "setting iptables forward policy")
+	_, err := ncutils.RunCmd("iptables --policy FORWARD ACCEPT", false)
+	return err
+}
+
+// port forward from an entry, can contain a dns name for lookup
+func iptablesPortForward(entry string, inport string, outport string, isIP bool) error {
+	logger.Log(1, "forwarding "+entry+" traffic from host port "+inport+" to container port "+outport)
+
 	var address string
 	if !isIP {
-		ips, _ := net.LookupIP(entry)
-		for _, ip := range ips {
-			if ipv4 := ip.To4(); ipv4 != nil {
-				address = ip.String()
-				break
+	out:
+		for i := 1; i < 4; i++ {
+			ips, err := net.LookupIP(entry)
+			if err != nil && i > 2 {
+				return err
 			}
+			for _, ip := range ips {
+				if ipv4 := ip.To4(); ipv4 != nil {
+					address = ipv4.String()
+				}
+			}
+			if address != "" {
+				break out
+			}
+			time.Sleep(time.Second)
 		}
 	} else {
 		address = entry
 	}
-	ncutils.RunCmd("iptables -t nat -A PREROUTING -p tcp --dport "+port+" -j DNAT --to-destination "+address+":"+port, true)
-	ncutils.RunCmd("iptables -t nat -A POSTROUTING -j MASQUERADE", true)
+	if address == "" {
+		return errors.New("could not locate ip for " + entry)
+	}
+
+	_, err := ncutils.RunCmd("iptables -t nat -A PREROUTING -p tcp --dport "+inport+" -j DNAT --to-destination "+address+":"+outport, false)
+	if err != nil {
+		return err
+	}
+	_, err = ncutils.RunCmd("iptables -t nat -A PREROUTING -p udp --dport "+inport+" -j DNAT --to-destination "+address+":"+outport, false)
+	if err != nil {
+		return err
+	}
+	_, err = ncutils.RunCmd("iptables -t nat -A POSTROUTING -j MASQUERADE", false)
+	return err
+}
+
+// if running in host networking mode, run iptables to map to CoreDNS container
+func setHostCoreDNSMapping() error {
+	logger.Log(1, "forwarding dns traffic on host from netmaker interfaces to 53053")
+	ncutils.RunCmd("iptables -t nat -A PREROUTING -i nm-+ -p tcp --match tcp --dport 53 --jump REDIRECT --to-ports 53053", true)
+	_, err := ncutils.RunCmd("iptables -t nat -A PREROUTING -i nm-+ -p udp --match udp --dport 53 --jump REDIRECT --to-ports 53053", true)
+	return err
 }