func setupIPMasq(ipn ip.IP4Net) error {
ipt, err := iptables.New()
if err != nil {
return fmt.Errorf("failed to setup IP Masquerade. iptables was not found")
}
err = ipt.ClearChain("nat", "FLANNEL")
if err != nil {
return fmt.Errorf("Failed to create/clear FLANNEL chain in NAT table: %v", err)
}
rules := [][]string{
// This rule makes sure we don't NAT traffic within overlay network (e.g. coming out of docker0)
{"FLANNEL", "-d", ipn.String(), "-j", "ACCEPT"},
// NAT if it's not multicast traffic
{"FLANNEL", "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE"},
// This rule will take everything coming from overlay and sent it to FLANNEL chain
{"POSTROUTING", "-s", ipn.String(), "-j", "FLANNEL"},
}
for _, rule := range rules {
log.Info("Adding iptables rule: ", strings.Join(rule, " "))
chain := rule[0]
args := rule[1:len(rule)]
err = ipt.AppendUnique("nat", chain, args...)
if err != nil {
return fmt.Errorf("Failed to insert IP masquerade rule: %v", err)
}
}
return nil
}
func rules(ipn ip.IP4Net) [][]string {
n := ipn.String()
return [][]string{
// This rule makes sure we don't NAT traffic within overlay network (e.g. coming out of docker0)
{"-s", n, "-d", n, "-j", "RETURN"},
// NAT if it's not multicast traffic
{"-s", n, "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE"},
// Masquerade anything headed towards flannel from the host
{"!", "-s", n, "-d", n, "-j", "MASQUERADE"},
}
}
func configureIface(ifname string, ipn ip.IP4Net, mtu int) error {
iface, err := netlink.LinkByName(ifname)
if err != nil {
return fmt.Errorf("failed to lookup interface %v", ifname)
}
err = netlink.AddrAdd(iface, &netlink.Addr{ipn.ToIPNet(), ""})
if err != nil {
return fmt.Errorf("failed to add IP address %v to %v: %v", ipn.String(), ifname, err)
}
err = netlink.LinkSetMTU(iface, mtu)
if err != nil {
return fmt.Errorf("failed to set MTU for %v: %v", ifname, err)
}
err = netlink.LinkSetUp(iface)
if err != nil {
return fmt.Errorf("failed to set interface %v to UP state: %v", ifname, err)
}
// explicitly add a route since there might be a route for a subnet already
// installed by Docker and then it won't get auto added
err = netlink.RouteAdd(&netlink.Route{
LinkIndex: iface.Attrs().Index,
Scope: netlink.SCOPE_UNIVERSE,
Dst: ipn.Network().ToIPNet(),
})
if err != nil && err != syscall.EEXIST {
return fmt.Errorf("Failed to add route (%v -> %v): %v", ipn.Network().String(), ifname, err)
}
return nil
}
func (esr *etcdSubnetRegistry) updateSubnet(ctx context.Context, network string, sn ip.IP4Net, attrs *LeaseAttrs, ttl time.Duration, asof uint64) (time.Time, error) {
key := path.Join(esr.etcdCfg.Prefix, network, "subnets", sn.StringSep(".", "-"))
value, err := json.Marshal(attrs)
if err != nil {
return time.Time{}, err
}
resp, err := esr.client().Set(ctx, key, string(value), &etcd.SetOptions{
PrevIndex: asof,
TTL: ttl,
})
if err != nil {
return time.Time{}, err
}
ensureExpiration(resp, ttl)
return *resp.Node.Expiration, nil
}
func configureIface(ifname string, ipn ip.IP4Net, mtu int) error {
iface, err := net.InterfaceByName(ifname)
if err != nil {
return fmt.Errorf("failed to lookup interface %v", ifname)
}
n := ipn.ToIPNet()
err = netlink.NetworkLinkAddIp(iface, n.IP, n)
if err != nil {
return fmt.Errorf("failed to add IP address %v to %v: %v", n.IP, ifname, err)
}
err = netlink.NetworkSetMTU(iface, mtu)
if err != nil {
return fmt.Errorf("failed to set MTU for %v: %v", ifname, err)
}
err = netlink.NetworkLinkUp(iface)
if err != nil {
return fmt.Errorf("failed to set interface %v to UP state: %v", ifname, err)
}
// explicitly add a route since there might be a route for a subnet already
// installed by Docker and then it won't get auto added
err = netlink.AddRoute(ipn.Network().String(), "", "", ifname)
if err != nil && err != syscall.EEXIST {
return fmt.Errorf("Failed to add route (%v -> %v): %v", ipn.Network().String(), ifname, err)
}
return nil
}
func (m *EtcdManager) allocateSubnet(config *Config, leases []Lease) (ip.IP4Net, error) {
log.Infof("Picking subnet in range %s ... %s", config.SubnetMin, config.SubnetMax)
var bag []ip.IP4
sn := ip.IP4Net{IP: config.SubnetMin, PrefixLen: config.SubnetLen}
OuterLoop:
for ; sn.IP <= config.SubnetMax && len(bag) < 100; sn = sn.Next() {
for _, l := range leases {
if sn.Overlaps(l.Subnet) {
continue OuterLoop
}
}
bag = append(bag, sn.IP)
}
if len(bag) == 0 {
return ip.IP4Net{}, errors.New("out of subnets")
} else {
i := randInt(0, len(bag))
return ip.IP4Net{IP: bag[i], PrefixLen: config.SubnetLen}, nil
}
}
func (dev *vxlanDevice) Configure(ipn ip.IP4Net) error {
setAddr4(dev.link, ipn.ToIPNet())
if err := netlink.LinkSetUp(dev.link); err != nil {
return fmt.Errorf("failed to set interface %s to UP state: %s", dev.link.Attrs().Name, err)
}
// explicitly add a route since there might be a route for a subnet already
// installed by Docker and then it won't get auto added
route := netlink.Route{
LinkIndex: dev.link.Attrs().Index,
Scope: netlink.SCOPE_UNIVERSE,
Dst: ipn.Network().ToIPNet(),
}
if err := netlink.RouteAdd(&route); err != nil && err != syscall.EEXIST {
return fmt.Errorf("failed to add route (%s -> %s): %v", ipn.Network().String(), dev.link.Attrs().Name, err)
}
return nil
}
func (esr *etcdSubnetRegistry) deleteSubnet(ctx context.Context, network string, sn ip.IP4Net) error {
key := path.Join(esr.etcdCfg.Prefix, network, "subnets", sn.StringSep(".", "-"))
_, err := esr.client().Delete(ctx, key, nil)
return err
}
func MakeSubnetKey(sn ip.IP4Net) string {
return sn.StringSep(".", "-")
}