zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-16 22:01:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add nftables support.

Browse Source
This commit is contained in:
cameronts
2022-08-01 11:12:25 -07:00
parent c702afb329
commit 81c896b22a
2 changed files with 61 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
logic/gateway.go
View File

@@ -33,14 +33,28 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postUpCmd := "" postUpCmd := ""
postDownCmd := "" postDownCmd := ""
if node.OS == "linux" { if node.OS == "linux" {
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; " // nftables only supported on Linux
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT" if IsNFTablesPresent() {
postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; " // assumes chains eg FORWARD and POSTROUTING already exist
postDownCmd += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT" postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
if node.EgressGatewayNatEnabled == "yes" { if node.EgressGatewayNatEnabled == "yes" {
postUpCmd += "; iptables -t nat -A POSTROUTING -o " + gateway.Interface + " -j MASQUERADE" postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
postDownCmd += "; iptables -t nat -D POSTROUTING -o " + gateway.Interface + " -j MASQUERADE" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
}
} else {
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; "
postDownCmd += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT"
if node.EgressGatewayNatEnabled == "yes" {
postUpCmd += "; iptables -t nat -A POSTROUTING -o " + gateway.Interface + " -j MASQUERADE"
postDownCmd += "; iptables -t nat -D POSTROUTING -o " + gateway.Interface + " -j MASQUERADE"
}
} }
} }
if node.OS == "freebsd" { if node.OS == "freebsd" {
@@ -119,12 +133,23 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostDown = "" node.PostDown = ""
if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules
if node.OS == "linux" { if node.OS == "linux" {
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " // nftables only supported on Linux
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " if IsNFTablesPresent() {
node.PostUp += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" // assumes chains eg FORWARD and POSTROUTING already exist
node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT ; " node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostDown += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT ; " node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
node.PostDown += "iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE" node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ; "
node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade "
} else {
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT ; "
node.PostDown += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT ; "
node.PostDown += "iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE"
}
} }
if node.OS == "freebsd" { if node.OS == "freebsd" {
node.PostUp = "" node.PostUp = ""
@@ -151,6 +176,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
// CreateIngressGateway - creates an ingress gateway // CreateIngressGateway - creates an ingress gateway
func CreateIngressGateway(netid string, nodeid string) (models.Node, error) { func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
var postUpCmd, postDownCmd string
node, err := GetNodeByID(nodeid) node, err := GetNodeByID(nodeid)
if node.OS != "linux" { // add in darwin later if node.OS != "linux" { // add in darwin later
return models.Node{}, errors.New(node.OS + " is unsupported for ingress gateways") return models.Node{}, errors.New(node.OS + " is unsupported for ingress gateways")
@@ -166,12 +192,23 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
} }
node.IsIngressGateway = "yes" node.IsIngressGateway = "yes"
node.IngressGatewayRange = network.AddressRange node.IngressGatewayRange = network.AddressRange
postUpCmd := "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " if IsNFTablesPresent() {
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " // assumes chains eg FORWARD and POSTROUTING already exist
postUpCmd += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" postUpCmd = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postDownCmd := "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT ; " postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT ; " postUpCmd += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
postDownCmd += "iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE" postDownCmd = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
} else {
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT ; "
postDownCmd += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT ; "
postDownCmd += "iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE"
}
if node.PostUp != "" { if node.PostUp != "" {
if !strings.Contains(node.PostUp, postUpCmd) { if !strings.Contains(node.PostUp, postUpCmd) {
postUpCmd = node.PostUp + "; " + postUpCmd postUpCmd = node.PostUp + "; " + postUpCmd

5
logic/util.go
View File

@@ -19,6 +19,11 @@ import (
"github.com/gravitl/netmaker/netclient/ncutils" "github.com/gravitl/netmaker/netclient/ncutils"
) )
// nfTablesPresent - returns true if nftables is present, false otherwise
func IsNFTablesPresent() bool {
return FileExists("/etc/nftables.conf")
}
// IsBase64 - checks if a string is in base64 format // IsBase64 - checks if a string is in base64 format
// This is used to validate public keys (make sure they're base64 encoded like all public keys should be). // This is used to validate public keys (make sure they're base64 encoded like all public keys should be).
func IsBase64(s string) bool { func IsBase64(s string) bool {