zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-16 05:41:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

Change to expandable switch-based firewall detection.

Browse Source
This commit is contained in:
cameronts
2022-08-03 12:18:04 -07:00
parent eab23b7022
commit 7c2fce3a55
4 changed files with 64 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
logic/gateway.go
View File

@@ -33,8 +33,9 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postUpCmd := "" postUpCmd := ""
postDownCmd := "" postDownCmd := ""
if node.OS == "linux" { if node.OS == "linux" {
// nftables only supported on Linux switch node.FirewallInUse {
if node.IsNFTablesPresent == "yes" { case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating egress gateway using nftables") logger.Log(3, "creating egress gateway using nftables")
postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -46,7 +47,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;" postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
} }
} else { default: // iptables assumed
logger.Log(3, "creating egress gateway using iptables") logger.Log(3, "creating egress gateway using iptables")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; " postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT" postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
@@ -136,8 +137,9 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules
// still have an ingress gateway so preserve it // still have an ingress gateway so preserve it
if node.OS == "linux" { if node.OS == "linux" {
// nftables only supported on Linux switch node.FirewallInUse {
if node.IsNFTablesPresent == "yes" { case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting egress gateway using nftables") logger.Log(3, "deleting egress gateway using nftables")
node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -146,7 +148,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;" node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;" node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade " node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade "
} else { default:
logger.Log(3, "deleting egress gateway using iptables") logger.Log(3, "deleting egress gateway using iptables")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
@@ -192,7 +194,9 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
} }
node.IsIngressGateway = "yes" node.IsIngressGateway = "yes"
node.IngressGatewayRange = network.AddressRange node.IngressGatewayRange = network.AddressRange
if node.IsNFTablesPresent == "yes" { switch node.FirewallInUse {
case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating ingress gateway using nftables") logger.Log(3, "creating ingress gateway using nftables")
postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -201,7 +205,7 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
} else { default:
logger.Log(3, "creating ingress gateway using iptables") logger.Log(3, "creating ingress gateway using iptables")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
@@ -262,33 +266,32 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
if node.IsEgressGateway == "yes" { // check if node is still an egress gateway before completely deleting postdown/up rules if node.IsEgressGateway == "yes" { // check if node is still an egress gateway before completely deleting postdown/up rules
// still have an egress gateway so preserve it // still have an egress gateway so preserve it
if node.OS == "linux" { switch node.FirewallInUse {
case models.FIREWALL_NFTABLES:
// nftables only supported on Linux // nftables only supported on Linux
if node.IsNFTablesPresent == "yes" { // preserve egress gateway via the setup that createegressgateway used
// preserve egress gateway via the setup that createegressgateway used // assumes chains eg FORWARD and POSTROUTING already exist
// assumes chains eg FORWARD and POSTROUTING already exist logger.Log(3, "deleting ingress gateway: nftables in use")
logger.Log(3, "deleting ingress gateway: nftables in use") node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " node.PostDown += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
node.PostDown += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
if node.EgressGatewayNatEnabled == "yes" { if node.EgressGatewayNatEnabled == "yes" {
node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;" node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;" node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
} }
} else { default:
// preserve egress gateway via the setup that createegressgateway used // preserve egress gateway via the setup that createegressgateway used
logger.Log(3, "deleting ingress gateway: iptables in use") logger.Log(3, "deleting ingress gateway: iptables in use")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; " node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT" node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; " node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; "
node.PostDown += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT" node.PostDown += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT"
if node.EgressGatewayNatEnabled == "yes" { if node.EgressGatewayNatEnabled == "yes" {
node.PostUp += "; iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" node.PostUp += "; iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
node.PostDown += "; iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE" node.PostDown += "; iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE"
}
} }
} }
// preserve egress gateway via the setup that createegressgateway used // preserve egress gateway via the setup that createegressgateway used

36
models/node.go
View File

@@ -28,6 +28,10 @@ const (
NODE_NOOP = "noop" NODE_NOOP = "noop"
// NODE_FORCE_UPDATE - indicates a node should pull all changes // NODE_FORCE_UPDATE - indicates a node should pull all changes
NODE_FORCE_UPDATE = "force" NODE_FORCE_UPDATE = "force"
// FIREWALL_IPTABLES - indicates that iptables is the firewall in use
FIREWALL_IPTABLES = "iptables"
// FIREWALL_NFTABLES - indicates nftables is in use (Linux only)
FIREWALL_NFTABLES = "nftables"
) )
var seededRand *rand.Rand = rand.New( var seededRand *rand.Rand = rand.New(
@@ -71,20 +75,20 @@ type Node struct {
RelayAddrs []string `json:"relayaddrs" bson:"relayaddrs" yaml:"relayaddrs"` RelayAddrs []string `json:"relayaddrs" bson:"relayaddrs" yaml:"relayaddrs"`
IngressGatewayRange string `json:"ingressgatewayrange" bson:"ingressgatewayrange" yaml:"ingressgatewayrange"` IngressGatewayRange string `json:"ingressgatewayrange" bson:"ingressgatewayrange" yaml:"ingressgatewayrange"`
// IsStatic - refers to if the Endpoint is set manually or dynamically // IsStatic - refers to if the Endpoint is set manually or dynamically
IsStatic string `json:"isstatic" bson:"isstatic" yaml:"isstatic" validate:"checkyesorno"` IsStatic string `json:"isstatic" bson:"isstatic" yaml:"isstatic" validate:"checkyesorno"`
UDPHolePunch string `json:"udpholepunch" bson:"udpholepunch" yaml:"udpholepunch" validate:"checkyesorno"` UDPHolePunch string `json:"udpholepunch" bson:"udpholepunch" yaml:"udpholepunch" validate:"checkyesorno"`
DNSOn string `json:"dnson" bson:"dnson" yaml:"dnson" validate:"checkyesorno"` DNSOn string `json:"dnson" bson:"dnson" yaml:"dnson" validate:"checkyesorno"`
IsServer string `json:"isserver" bson:"isserver" yaml:"isserver" validate:"checkyesorno"` IsServer string `json:"isserver" bson:"isserver" yaml:"isserver" validate:"checkyesorno"`
Action string `json:"action" bson:"action" yaml:"action"` Action string `json:"action" bson:"action" yaml:"action"`
IsLocal string `json:"islocal" bson:"islocal" yaml:"islocal" validate:"checkyesorno"` IsLocal string `json:"islocal" bson:"islocal" yaml:"islocal" validate:"checkyesorno"`
LocalRange string `json:"localrange" bson:"localrange" yaml:"localrange"` LocalRange string `json:"localrange" bson:"localrange" yaml:"localrange"`
IPForwarding string `json:"ipforwarding" bson:"ipforwarding" yaml:"ipforwarding" validate:"checkyesorno"` IPForwarding string `json:"ipforwarding" bson:"ipforwarding" yaml:"ipforwarding" validate:"checkyesorno"`
OS string `json:"os" bson:"os" yaml:"os"` OS string `json:"os" bson:"os" yaml:"os"`
MTU int32 `json:"mtu" bson:"mtu" yaml:"mtu"` MTU int32 `json:"mtu" bson:"mtu" yaml:"mtu"`
Version string `json:"version" bson:"version" yaml:"version"` Version string `json:"version" bson:"version" yaml:"version"`
Server string `json:"server" bson:"server" yaml:"server"` Server string `json:"server" bson:"server" yaml:"server"`
TrafficKeys TrafficKeys `json:"traffickeys" bson:"traffickeys" yaml:"traffickeys"` TrafficKeys TrafficKeys `json:"traffickeys" bson:"traffickeys" yaml:"traffickeys"`
IsNFTablesPresent string `json:"isnftablespresent" bson:"isnftablespresent" yaml:"isnftablespresent"` FirewallInUse string `json:"firewallinuse" bson:"firewallinuse" yaml:"firewallinuse"`
} }
// NodesArray - used for node sorting // NodesArray - used for node sorting
@@ -122,8 +126,8 @@ func (node *Node) SetDefaultMTU() {
// Node.SetDefaultNFTablesPresent - sets default for nftables check // Node.SetDefaultNFTablesPresent - sets default for nftables check
func (node *Node) SetDefaultNFTablesPresent() { func (node *Node) SetDefaultNFTablesPresent() {
if node.IsNFTablesPresent == "" { if node.FirewallInUse == "" {
node.IsNFTablesPresent = "no" node.FirewallInUse = FIREWALL_IPTABLES // default to iptables
} }
} }

8
netclient/functions/join.go
View File

@@ -114,14 +114,14 @@ func JoinNetwork(cfg *config.ClientConfig, privateKey string) error {
if ncutils.IsFreeBSD() { if ncutils.IsFreeBSD() {
cfg.Node.UDPHolePunch = "no" cfg.Node.UDPHolePunch = "no"
cfg.Node.IsNFTablesPresent = "no" // nftables not supported by FreeBSD cfg.Node.FirewallInUse = models.FIREWALL_IPTABLES // nftables not supported by FreeBSD
} }
if cfg.Node.IsNFTablesPresent == "" { if cfg.Node.FirewallInUse == "" {
if ncutils.IsNFTablesPresent() { if ncutils.IsNFTablesPresent() {
cfg.Node.IsNFTablesPresent = "yes" cfg.Node.FirewallInUse = models.FIREWALL_NFTABLES
} else { } else {
cfg.Node.IsNFTablesPresent = "no" cfg.Node.FirewallInUse = models.FIREWALL_IPTABLES
} }
} }

8
netclient/functions/mqpublish.go
View File

@@ -5,6 +5,7 @@ import (
"encoding/json" "encoding/json"
"errors" "errors"
"fmt" "fmt"
"github.com/gravitl/netmaker/models"
"net" "net"
"os" "os"
"strconv" "strconv"
@@ -46,12 +47,13 @@ func checkin() {
// check for nftables present if on Linux // check for nftables present if on Linux
if ncutils.IsLinux() { if ncutils.IsLinux() {
if ncutils.IsNFTablesPresent() { if ncutils.IsNFTablesPresent() {
nodeCfg.Node.IsNFTablesPresent = "yes" nodeCfg.Node.FirewallInUse = models.FIREWALL_NFTABLES
} else { } else {
nodeCfg.Node.IsNFTablesPresent = "no" nodeCfg.Node.FirewallInUse = models.FIREWALL_IPTABLES
} }
} else { } else {
nodeCfg.Node.IsNFTablesPresent = "no" // defaults to iptables for now, may need another default for non-Linux OSes
nodeCfg.Node.FirewallInUse = models.FIREWALL_IPTABLES
} }
if nodeCfg.Node.IsStatic != "yes" { if nodeCfg.Node.IsStatic != "yes" {
extIP, err := ncutils.GetPublicIP() extIP, err := ncutils.GetPublicIP()