zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-06 01:07:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update code handling of firewall commands and add more logging.

Browse Source
This commit is contained in:
cameronts
2022-08-06 15:00:20 -07:00
parent 9f92b20a15
commit aeca559a8a
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
logic/gateway.go
View File

@@ -32,12 +32,13 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
node.EgressGatewayNatEnabled = gateway.NatEnabled node.EgressGatewayNatEnabled = gateway.NatEnabled
postUpCmd := "" postUpCmd := ""
postDownCmd := "" postDownCmd := ""
logger.Log(3, "creating egress gateway firewall in use is '", node.FirewallInUse, "'")
if node.OS == "linux" { if node.OS == "linux" {
switch node.FirewallInUse { switch node.FirewallInUse {
case models.FIREWALL_NFTABLES: case models.FIREWALL_NFTABLES:
// nftables only supported on Linux // nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating egress gateway using nftables") logger.Log(3, "creating egress gateway nftables is present")
// down commands don't remove as removal of the rules leaves an empty chain while // down commands don't remove as removal of the rules leaves an empty chain while
// removing the chain with rules in it would remove all rules in that section (not safe // removing the chain with rules in it would remove all rules in that section (not safe
// if there are remaining rules on the host that need to stay). In practice the chain is removed // if there are remaining rules on the host that need to stay). In practice the chain is removed
@@ -54,7 +55,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
} }
default: // iptables assumed default: // iptables assumed
logger.Log(3, "creating egress gateway using iptables") logger.Log(3, "creating egress gateway nftables is not present")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; " postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT" postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; " postDownCmd = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; "
@@ -140,6 +141,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.EgressGatewayRanges = []string{} node.EgressGatewayRanges = []string{}
node.PostUp = "" node.PostUp = ""
node.PostDown = "" node.PostDown = ""
logger.Log(3, "deleting egress gateway firewall in use is '", node.FirewallInUse, "'")
if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules
// still have an ingress gateway so preserve it // still have an ingress gateway so preserve it
if node.OS == "linux" { if node.OS == "linux" {
@@ -147,7 +149,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
case models.FIREWALL_NFTABLES: case models.FIREWALL_NFTABLES:
// nftables only supported on Linux // nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting egress gateway using nftables") logger.Log(3, "deleting egress gateway nftables is present")
node.PostUp = "nft add chain filter FORWARD ; " node.PostUp = "nft add chain filter FORWARD ; "
node.PostUp += "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " node.PostUp += "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
@@ -157,7 +159,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;" node.PostDown += "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade " node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade "
default: default:
logger.Log(3, "deleting egress gateway using iptables") logger.Log(3, "deleting egress gateway nftables is not present")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
node.PostUp += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" node.PostUp += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
@@ -202,11 +204,12 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
} }
node.IsIngressGateway = "yes" node.IsIngressGateway = "yes"
node.IngressGatewayRange = network.AddressRange node.IngressGatewayRange = network.AddressRange
logger.Log(3, "creating ingress gateway firewall in use is '", node.FirewallInUse, "'")
switch node.FirewallInUse { switch node.FirewallInUse {
case models.FIREWALL_NFTABLES: case models.FIREWALL_NFTABLES:
// nftables only supported on Linux // nftables only supported on Linux
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "creating ingress gateway using nftables") logger.Log(3, "creating ingress gateway nftables is present")
postUpCmd = "nft add chain filter FORWARD ; " postUpCmd = "nft add chain filter FORWARD ; "
postUpCmd += "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " postUpCmd += "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " postUpCmd += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
@@ -216,7 +219,7 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " postDownCmd += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade" postDownCmd += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade"
default: default:
logger.Log(3, "creating ingress gateway using iptables") logger.Log(3, "creating ingress gateway using nftables is not present")
postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; " postUpCmd = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; " postUpCmd += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT ; "
postUpCmd += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE" postUpCmd += "iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
@@ -274,6 +277,10 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
node.IsIngressGateway = "no" node.IsIngressGateway = "no"
node.IngressGatewayRange = "" node.IngressGatewayRange = ""
// default to removing postup and postdown
node.PostUp = ""
node.PostDown = ""
logger.Log(3, "deleting ingress gateway firewall in use is '", node.FirewallInUse, "' and isEgressGatway is", node.IsEgressGateway)
if node.IsEgressGateway == "yes" { // check if node is still an egress gateway before completely deleting postdown/up rules if node.IsEgressGateway == "yes" { // check if node is still an egress gateway before completely deleting postdown/up rules
// still have an egress gateway so preserve it // still have an egress gateway so preserve it
switch node.FirewallInUse { switch node.FirewallInUse {
@@ -281,7 +288,7 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
// nftables only supported on Linux // nftables only supported on Linux
// preserve egress gateway via the setup that createegressgateway used // preserve egress gateway via the setup that createegressgateway used
// assumes chains eg FORWARD and POSTROUTING already exist // assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting ingress gateway: nftables in use") logger.Log(3, "deleting ingress gateway: nftables is in use")
node.PostUp = "nft add chain filter FORWARD ; " node.PostUp = "nft add chain filter FORWARD ; "
node.PostUp += "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; " node.PostUp += "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; " node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
@@ -295,7 +302,7 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
} }
default: default:
// preserve egress gateway via the setup that createegressgateway used // preserve egress gateway via the setup that createegressgateway used
logger.Log(3, "deleting ingress gateway: iptables in use") logger.Log(3, "deleting ingress gateway: nftables is not in use")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; " node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT" node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; " node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; "