zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-05 08:47:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Change to expandable switch-based firewall detection.

Browse Source
This commit is contained in:
cameronts
2022-08-03 12:18:04 -07:00
parent eab23b7022
commit 7c2fce3a55
4 changed files with 64 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
logic/gateway.go
View File

@@ -33,8 +33,9 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postUpCmd := ""
postDownCmd := ""
if node.OS == "linux" {
switch node.FirewallInUse {
case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
if node.IsNFTablesPresent == "yes" {
// assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating egress gateway using nftables")
postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -46,7 +47,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
}
} else {
default: // iptables assumed
logger.Log(3, "creating egress gateway using iptables")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
@@ -136,8 +137,9 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules
// still have an ingress gateway so preserve it
if node.OS == "linux" {
switch node.FirewallInUse {
case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
if node.IsNFTablesPresent == "yes" {
// assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting egress gateway using nftables")
node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -146,7 +148,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade "
} else {
default:
logger.Log(3, "deleting egress gateway using iptables")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
@@ -192,7 +194,9 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
}
node.IsIngressGateway = "yes"
node.IngressGatewayRange = network.AddressRange
if node.IsNFTablesPresent == "yes" {
switch node.FirewallInUse {
case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating ingress gateway using nftables")
postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
@@ -201,7 +205,7 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
} else {
default:
logger.Log(3, "creating ingress gateway using iptables")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
@@ -262,9 +266,9 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
if node.IsEgressGateway == "yes" { // check if node is still an egress gateway before completely deleting postdown/up rules
// still have an egress gateway so preserve it
if node.OS == "linux" {
switch node.FirewallInUse {
case models.FIREWALL_NFTABLES:
// nftables only supported on Linux
if node.IsNFTablesPresent == "yes" {
// preserve egress gateway via the setup that createegressgateway used
// assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting ingress gateway: nftables in use")
@@ -277,7 +281,7 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
}
} else {
default:
// preserve egress gateway via the setup that createegressgateway used
logger.Log(3, "deleting ingress gateway: iptables in use")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
@@ -290,7 +294,6 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
node.PostDown += "; iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE"
}
}
}
// preserve egress gateway via the setup that createegressgateway used
if node.OS == "freebsd" {
node.PostUp = "kldload ipfw ipfw_nat ; "

10
models/node.go
View File

@@ -28,6 +28,10 @@ const (
NODE_NOOP = "noop"
// NODE_FORCE_UPDATE - indicates a node should pull all changes
NODE_FORCE_UPDATE = "force"
// FIREWALL_IPTABLES - indicates that iptables is the firewall in use
FIREWALL_IPTABLES = "iptables"
// FIREWALL_NFTABLES - indicates nftables is in use (Linux only)
FIREWALL_NFTABLES = "nftables"
)
var seededRand *rand.Rand = rand.New(
@@ -84,7 +88,7 @@ type Node struct {
Version string `json:"version" bson:"version" yaml:"version"`
Server string `json:"server" bson:"server" yaml:"server"`
TrafficKeys TrafficKeys `json:"traffickeys" bson:"traffickeys" yaml:"traffickeys"`
IsNFTablesPresent string `json:"isnftablespresent" bson:"isnftablespresent" yaml:"isnftablespresent"`
FirewallInUse string `json:"firewallinuse" bson:"firewallinuse" yaml:"firewallinuse"`
}
// NodesArray - used for node sorting
@@ -122,8 +126,8 @@ func (node *Node) SetDefaultMTU() {
// Node.SetDefaultNFTablesPresent - sets default for nftables check
func (node *Node) SetDefaultNFTablesPresent() {
if node.IsNFTablesPresent == "" {
node.IsNFTablesPresent = "no"
if node.FirewallInUse == "" {
node.FirewallInUse = FIREWALL_IPTABLES // default to iptables
}
}

8
netclient/functions/join.go
View File

@@ -114,14 +114,14 @@ func JoinNetwork(cfg *config.ClientConfig, privateKey string) error {
if ncutils.IsFreeBSD() {
cfg.Node.UDPHolePunch = "no"
cfg.Node.IsNFTablesPresent = "no" // nftables not supported by FreeBSD
cfg.Node.FirewallInUse = models.FIREWALL_IPTABLES // nftables not supported by FreeBSD
}
if cfg.Node.IsNFTablesPresent == "" {
if cfg.Node.FirewallInUse == "" {
if ncutils.IsNFTablesPresent() {
cfg.Node.IsNFTablesPresent = "yes"
cfg.Node.FirewallInUse = models.FIREWALL_NFTABLES
} else {
cfg.Node.IsNFTablesPresent = "no"
cfg.Node.FirewallInUse = models.FIREWALL_IPTABLES
}
}

8
netclient/functions/mqpublish.go
View File

@@ -5,6 +5,7 @@ import (
"encoding/json"
"errors"
"fmt"
"github.com/gravitl/netmaker/models"
"net"
"os"
"strconv"
@@ -46,12 +47,13 @@ func checkin() {
// check for nftables present if on Linux
if ncutils.IsLinux() {
if ncutils.IsNFTablesPresent() {
nodeCfg.Node.IsNFTablesPresent = "yes"
nodeCfg.Node.FirewallInUse = models.FIREWALL_NFTABLES
} else {
nodeCfg.Node.IsNFTablesPresent = "no"
nodeCfg.Node.FirewallInUse = models.FIREWALL_IPTABLES
}
} else {
nodeCfg.Node.IsNFTablesPresent = "no"
// defaults to iptables for now, may need another default for non-Linux OSes
nodeCfg.Node.FirewallInUse = models.FIREWALL_IPTABLES
}
if nodeCfg.Node.IsStatic != "yes" {
extIP, err := ncutils.GetPublicIP()