func (e *podEnv) unforwardPorts() error {
ipt, err := iptables.New()
if err != nil {
return err
}
chain := e.portFwdChain()
rule := e.portFwdRuleSpec(chain)
// There's no clean way now to test if a chain exists or
// even if a rule exists if the chain is not present.
// So we swallow the errors for now :(
// TODO(eyakubovich): move to using libiptc for iptable
// manipulation
// outside traffic hitting this hot
ipt.Delete("nat", "PREROUTING", rule...)
// traffic originating on this host
ipt.Delete("nat", "OUTPUT", rule...)
// there should be no references, delete the chain
ipt.ClearChain("nat", chain)
ipt.DeleteChain("nat", chain)
return nil
}
func UnBlockIP(ip string) bool {
// Some default chain names
sChain := "INPUT"
dChain := "LOGGING"
// Get a new iptables interface
ipt, err := iptables.New()
if err != nil {
log(fmt.Sprintf("Failed to new up an IPtables intance. ERROR: %v", err))
return false
}
// Build out the ipstring(add /32 to the end)
ipstr := fmt.Sprintf("%s%s", ip, "/32")
// Use the appendUnique method to put this in iptables, but only once
err = ipt.Delete("filter", sChain, "-s", ipstr, "-j", dChain)
if err != nil {
log(fmt.Sprintf("Failed to ban an ip(%v). ERROR: %v", ipstr, err))
return false
}
// Since we made it here, we won
return true
}
func (e *podEnv) unforwardPorts() error {
ipt, err := iptables.New()
if err != nil {
return err
}
chainDNAT := e.portFwdChain("DNAT")
chainSNAT := e.portFwdChain("SNAT")
chainRuleDNAT := e.portFwdChainRuleSpec(chainDNAT, "DNAT")
chainRuleSNAT := e.portFwdChainRuleSpec(chainSNAT, "SNAT")
// There's no clean way now to test if a chain exists or
// even if a rule exists if the chain is not present.
// So we swallow the errors for now :(
// TODO(eyakubovich): move to using libiptc for iptable
// manipulation
for _, entry := range []struct {
chain string
customChainRule []string
}{
{"POSTROUTING", chainRuleSNAT}, // traffic originating on this host
{"PREROUTING", chainRuleDNAT}, // outside traffic hitting this host
{"OUTPUT", chainRuleDNAT}, // traffic originating on this host
} {
ipt.Delete("nat", entry.chain, entry.customChainRule...)
}
for _, entry := range []string{chainDNAT, chainSNAT} {
ipt.ClearChain("nat", entry)
ipt.DeleteChain("nat", entry)
}
return nil
}
func init() {
tunnels = make(map[string]*TunnelInfo)
ip2tunnel = make(map[string]string)
ipt, _ = iptables.New()
pin = fastping.NewPinger()
initConfig()
readConfig()
initLogger()
}
func Init() error {
if config.JustProxy {
Balancer = nil
return nil
}
// decide which balancer to use
switch config.Balancer {
case "lvs":
Balancer = &Lvs{}
case "nginx":
Balancer = &Nginx{}
default:
Balancer = &Lvs{} // faster
}
var err error
tab, err = iptables.New()
if err != nil {
tab = nil
}
// don't break if we can't use iptables
if _, err = tab.List("filter", "INPUT"); err != nil {
config.Log.Error("Could not use iptables, continuing without - %v", err)
tab = nil
}
if tab != nil {
tab.Delete("filter", "INPUT", "-j", "portal")
tab.ClearChain("filter", "portal")
tab.DeleteChain("filter", "portal")
err = tab.NewChain("filter", "portal")
if err != nil {
return fmt.Errorf("Failed to create new chain - %v", err)
}
err = tab.AppendUnique("filter", "portal", "-j", "RETURN")
if err != nil {
return fmt.Errorf("Failed to append to portal chain - %v", err)
}
err = tab.AppendUnique("filter", "INPUT", "-j", "portal")
if err != nil {
return fmt.Errorf("Failed to append to INPUT chain - %v", err)
}
// Allow router through by default (ports 80/443)
err = tab.Insert("filter", "portal", 1, "-p", "tcp", "--dport", "80", "-j", "ACCEPT")
if err != nil {
return err
}
err = tab.Insert("filter", "portal", 1, "-p", "tcp", "--dport", "443", "-j", "ACCEPT")
if err != nil {
return err
}
}
return Balancer.Init()
}
func DetachContainer(ns netns.NsHandle, id, ifName string, cidrs []*net.IPNet) error {
ipt, err := iptables.New()
if err != nil {
return err
}
return WithNetNSLinkUnsafe(ns, ifName, func(veth netlink.Link) error {
existingAddrs, err := netlink.AddrList(veth, netlink.FAMILY_V4)
if err != nil {
return fmt.Errorf("failed to get IP address for %q: %v", veth.Attrs().Name, err)
}
for _, ipnet := range cidrs {
if !contains(existingAddrs, ipnet) {
continue
}
if err := netlink.AddrDel(veth, &netlink.Addr{IPNet: ipnet}); err != nil {
return fmt.Errorf("failed to remove IP address from %q: %v", veth.Attrs().Name, err)
}
}
addrs, err := netlink.AddrList(veth, netlink.FAMILY_V4)
if err != nil {
return fmt.Errorf("failed to get IP address for %q: %v", veth.Attrs().Name, err)
}
// Remove multicast ACCEPT rules for subnets we no longer have addresses in
subnets := subnets(addrs)
rules, err := ipt.List("filter", "INPUT")
if err != nil {
return err
}
for _, rule := range rules {
ps := strings.Split(rule, " ")
if len(ps) == 10 &&
ps[0] == "-A" && ps[2] == "-s" && ps[4] == "-d" && ps[5] == "224.0.0.0/4" &&
ps[6] == "-i" && ps[7] == ifName && ps[8] == "-j" && ps[9] == "ACCEPT" {
if _, found := subnets[ps[3]]; !found {
if err := ipt.Delete("filter", "INPUT", ps[2:]...); err != nil {
return err
}
}
}
}
if len(addrs) == 0 { // all addresses gone: remove the interface
if err := ipt.Delete("filter", "INPUT", "-i", ifName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil {
return err
}
if err := netlink.LinkDel(veth); err != nil {
return err
}
}
return nil
})
}
// Test the blocking of ips
func TestBlockAndUnblock(t *testing.T) {
// Make sure we are the root user.
u, _ := user.Current()
if u.Uid != "0" {
log("You must be root to run this. Try again.")
os.Exit(1)
}
// Block an ip
ok := BlockIP("1.2.3.4")
if ok == false {
t.Error("Failed to block IP")
}
// make sure this block is in this chain
sChain := "INPUT"
//dChain := "LOGGING"
// Get a new iptables interface
ipt, err := iptables.New()
if err != nil {
t.Error("Failed to new up an IPtables intance:", err)
}
rules, err := ipt.List("filter", sChain)
if err != nil {
t.Fatalf("List failed: %v", err)
}
// Test to see if the ip we banned was in that slice
found := false
for _, rule := range rules {
if strings.Contains(rule, "1.2.3.4") {
found = true
}
}
if found == false {
t.Error("Didn't find the ip that we tried to block.")
}
// Now that we found it, lets delete it
ok = UnBlockIP("1.2.3.4")
if ok == false {
t.Error("Failed to un block IP")
}
// Now that we are done testing, lets call the clean up method
cleanIPTables()
}
func teardownIPMasq(ipn ip.IP4Net) error {
ipt, err := iptables.New()
if err != nil {
return fmt.Errorf("failed to teardown IP Masquerade. iptables was not found")
}
for _, rule := range rules(ipn) {
log.Info("Deleting iptables rule: ", strings.Join(rule, " "))
err = ipt.Delete("nat", "POSTROUTING", rule...)
if err != nil {
return fmt.Errorf("failed to delete IP masquerade rule: %v", err)
}
}
return nil
}
func setupIPMasq(ipn ip.IP4Net) error {
ipt, err := iptables.New()
if err != nil {
return fmt.Errorf("failed to set up IP Masquerade. iptables was not found")
}
for _, rule := range rules(ipn) {
log.Info("Adding iptables rule: ", strings.Join(rule, " "))
err = ipt.AppendUnique("nat", "POSTROUTING", rule...)
if err != nil {
return fmt.Errorf("failed to insert IP masquerade rule: %v", err)
}
}
return nil
}
// Check for the existance of the LOGGING iptables base chain
func checkIPTablesBaseConfig() bool {
ipt, err := iptables.New()
if err != nil {
log("Some stuff is broken yo.")
}
chain := "LOGGING"
_, err = ipt.List("filter", chain)
if err != nil {
log(fmt.Sprintf("%v doesn't exist. It needs to be created.", chain))
return false
} else {
return true
}
}
// TeardownIPMasq undoes the effects of SetupIPMasq
func TeardownIPMasq(ipn *net.IPNet, chain string) error {
ipt, err := iptables.New()
if err != nil {
return fmt.Errorf("failed to locate iptabes: %v", err)
}
if err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain); err != nil {
return err
}
if err = ipt.ClearChain("nat", chain); err != nil {
return err
}
return ipt.DeleteChain("nat", chain)
}
func main() {
accessToken := os.Getenv(`DO_KEY`)
if accessToken == `` {
log.Fatal(`Usage: DO_KEY environment variable must be set.`)
}
// setup dependencies
oauthClient := oauth2.NewClient(oauth2.NoContext, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken}))
apiClient := godo.NewClient(oauthClient)
metaClient := metadata.NewClient()
ipt, err := iptables.New()
failIfErr(err)
// collect needed metadata from metadata service
region, err := metaClient.Region()
failIfErr(err)
mData, err := metaClient.Metadata()
failIfErr(err)
// collect list of all droplets
drops, err := DropletList(apiClient.Droplets)
failIfErr(err)
allowed, ok := SortDroplets(drops)[region]
if !ok {
log.Fatalf(`No droplets listed in region [%s]`, region)
}
// collect local network interface information
local, err := LocalAddress(mData)
failIfErr(err)
ifaces, err := net.Interfaces()
failIfErr(err)
iface, err := PrivateInterface(ifaces, local)
failIfErr(err)
// setup dolan-peers chain for local interface
err = Setup(ipt, iface)
failIfErr(err)
// update dolan-peers
err = UpdatePeers(ipt, allowed)
failIfErr(err)
log.Printf(`Added %d peers to dolan-peers`, len(allowed))
}
func (e *podEnv) forwardPorts(fps []ForwardedPort, defIP net.IP) error {
if len(fps) == 0 {
return nil
}
ipt, err := iptables.New()
if err != nil {
return err
}
// Create a separate chain for this pod. This helps with debugging
// and makes it easier to cleanup
chain := e.portFwdChain()
if err = ipt.NewChain("nat", chain); err != nil {
return err
}
rule := e.portFwdRuleSpec(chain)
for _, entry := range [][]string{
{"nat", "PREROUTING"}, // outside traffic hitting this host
{"nat", "OUTPUT"}, // traffic originating on this host
} {
exists, err := ipt.Exists(entry[0], entry[1], rule...)
if err != nil {
return err
}
if !exists {
err = ipt.Insert(entry[0], entry[1], 1, rule...)
if err != nil {
return err
}
}
}
for _, p := range fps {
if err = forwardPort(ipt, chain, &p, defIP); err != nil {
return err
}
}
return nil
}
// setupForwarding creates the iptables chains
func (e *podEnv) setupForwarding() error {
ipt, err := iptables.New()
if err != nil {
return err
}
// Create a separate chain for this pod. This helps with debugging
// and makes it easier to cleanup
chainDNAT := e.portFwdChain("DNAT")
chainSNAT := e.portFwdChain("SNAT")
if err = ipt.NewChain("nat", chainDNAT); err != nil {
return err
}
if err = ipt.NewChain("nat", chainSNAT); err != nil {
return err
}
chainRuleDNAT := e.portFwdChainRuleSpec(chainDNAT, "DNAT")
chainRuleSNAT := e.portFwdChainRuleSpec(chainSNAT, "SNAT")
for _, entry := range []struct {
chain string
customChainRule []string
}{
{"POSTROUTING", chainRuleSNAT}, // traffic originating from this host from loopback
{"PREROUTING", chainRuleDNAT}, // outside traffic hitting this host
{"OUTPUT", chainRuleDNAT}, // traffic originating from this host on non-loopback
} {
exists, err := ipt.Exists("nat", entry.chain, entry.customChainRule...)
if err != nil {
return err
}
if !exists {
err = ipt.Insert("nat", entry.chain, 1, entry.customChainRule...)
if err != nil {
return err
}
}
}
return nil
}
func (e *podEnv) forwardPorts(fps []commonnet.ForwardedPort, podIP net.IP) error {
if len(fps) == 0 {
return nil
}
ipt, err := iptables.New()
if err != nil {
return err
}
chainDNAT := e.portFwdChain("DNAT")
chainSNAT := e.portFwdChain("SNAT")
for _, fp := range fps {
for _, r := range portRules(fp, podIP, chainDNAT, chainSNAT) {
if err := ipt.AppendUnique("nat", r.Chain, r.Rule...); err != nil {
return err
}
}
}
return nil
}
func cleanIPTables() {
// Do an iptables flush to clean out all the rules.
// chain now exists
ipt, err := iptables.New()
if err != nil {
log(fmt.Sprintf("Failed to new up an IPtables intance: %v", err))
}
err = ipt.ClearChain("filter", "LOGGING")
if err != nil {
log("ClearChain of LOGGING failed.")
}
err = ipt.ClearChain("filter", "INPUT")
if err != nil {
log("ClearChain of INPUT failed.")
}
err = ipt.DeleteChain("filter", "LOGGING")
if err != nil {
log("DeleteChain of LOGGING failed")
}
}
// SetupIPMasq installs iptables rules to masquerade traffic
// coming from ipn and going outside of it
func SetupIPMasq(ipn *net.IPNet, chain string) error {
ipt, err := iptables.New()
if err != nil {
return fmt.Errorf("failed to locate iptabes: %v", err)
}
if err = ipt.NewChain("nat", chain); err != nil {
if err.(*iptables.Error).ExitStatus() != 1 {
// TODO(eyakubovich): assumes exit status 1 implies chain exists
return err
}
}
if err = ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT"); err != nil {
return err
}
if err = ipt.AppendUnique("nat", chain, "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE"); err != nil {
return err
}
return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain)
}
func setupBaseIPTables() {
i, err := iptables.New()
if err != nil {
log("Some stuff is broken yo.")
}
// The table that we are going to use(the default is filter)
table := "filter"
// The rule that we will add first will be for the logging chain
chain := "LOGGING"
// Create the chain(We don't care about errors becuase it throws one if the
// chain already exists)
i.NewChain(table, chain)
// Setup the logging rule so we can log the failed attempts
err = i.AppendUnique(table, chain, "-m", "limit", "--limit", "5/min", "--limit-burst", "10",
"-j", "LOG", "--log-prefix", "Drop it like its hot:", "--log-level", "7")
if err != nil {
fmt.Printf("ERROR YO:\n%v", err)
}
// Setup the drop rule. This will drop all packets that make it to this chain.
err = i.AppendUnique(table, chain, "-j", "DROP")
if err != nil {
log(fmt.Sprintf("ERROR YO:\n%v", err))
}
log("Done adding the logging chain.")
// Add the icmp block to the input chain
chain = "INPUT"
err = i.AppendUnique(table, chain, "-p", "icmp", "-m", "icmp",
"--icmp-type", "8", "-j", "LOGGING")
if err != nil {
log(fmt.Sprintf("ERROR YO:\n%v", err))
}
}
func (e *podEnv) forwardPorts(fps []ForwardedPort, podIP net.IP) error {
if len(fps) == 0 {
return nil
}
ipt, err := iptables.New()
if err != nil {
return err
}
// Create a separate chain for this pod. This helps with debugging
// and makes it easier to cleanup
chainDNAT := e.portFwdChain("DNAT")
chainSNAT := e.portFwdChain("SNAT")
if err = ipt.NewChain("nat", chainDNAT); err != nil {
return err
}
if err = ipt.NewChain("nat", chainSNAT); err != nil {
return err
}
chainRuleDNAT := e.portFwdChainRuleSpec(chainDNAT, "DNAT")
chainRuleSNAT := e.portFwdChainRuleSpec(chainSNAT, "SNAT")
for _, entry := range []struct {
chain string
customChainRule []string
}{
{"POSTROUTING", chainRuleSNAT}, // traffic originating from this host
{"PREROUTING", chainRuleDNAT}, // outside traffic hitting this host
{"OUTPUT", chainRuleDNAT}, // traffic originating from this host
} {
exists, err := ipt.Exists("nat", entry.chain, entry.customChainRule...)
if err != nil {
return err
}
if !exists {
err = ipt.Insert("nat", entry.chain, 1, entry.customChainRule...)
if err != nil {
return err
}
}
}
for _, p := range fps {
socketPod := fmt.Sprintf("%v:%v", podIP, p.PodPort)
dstPortHost := strconv.Itoa(int(p.HostPort))
dstPortPod := strconv.Itoa(int(p.PodPort))
for _, r := range []struct {
chain string
rule []string
}{
{ // Rewrite the destination
chainDNAT,
[]string{
"-p", p.Protocol,
"--dport", dstPortHost,
"-j", "DNAT",
"--to-destination", socketPod,
},
},
{ // Rewrite the source for connections to localhost on the host
chainSNAT,
[]string{
"-p", p.Protocol,
"-s", "127.0.0.1",
"-d", podIP.String(),
"--dport", dstPortPod,
"-j", "MASQUERADE",
},
},
} {
if err := ipt.AppendUnique("nat", r.chain, r.rule...); err != nil {
return err
}
}
}
return nil
}
func AttachContainer(ns netns.NsHandle, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool) error {
ipt, err := iptables.New()
if err != nil {
return err
}
if !interfaceExistsInNamespace(ns, ifName) {
maxIDLen := IFNAMSIZ - 1 - len(vethPrefix+"pl")
if len(id) > maxIDLen {
id = id[:maxIDLen] // trim passed ID if too long
}
name, peerName := vethPrefix+"pl"+id, vethPrefix+"pg"+id
_, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, func(veth netlink.Link) error {
if err := netlink.LinkSetNsFd(veth, int(ns)); err != nil {
return fmt.Errorf("failed to move veth to container netns: %s", err)
}
if err := WithNetNSUnsafe(ns, func() error {
if err := netlink.LinkSetName(veth, ifName); err != nil {
return err
}
if err := ConfigureARPCache(ifName); err != nil {
return err
}
if err := ipt.Append("filter", "INPUT", "-i", ifName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil {
return err
}
return nil
}); err != nil {
return fmt.Errorf("error setting up interface: %s", err)
}
return nil
})
if err != nil {
return err
}
}
if err := WithNetNSLinkUnsafe(ns, ifName, func(veth netlink.Link) error {
newAddresses, err := AddAddresses(veth, cidrs)
if err != nil {
return err
}
// Add multicast ACCEPT rules for new subnets
for _, ipnet := range newAddresses {
acceptRule := []string{"-i", ifName, "-s", subnet(ipnet), "-d", "224.0.0.0/4", "-j", "ACCEPT"}
exists, err := ipt.Exists("filter", "INPUT", acceptRule...)
if err != nil {
return err
}
if !exists {
if err := ipt.Insert("filter", "INPUT", 1, acceptRule...); err != nil {
return err
}
}
}
if err := netlink.LinkSetUp(veth); err != nil {
return err
}
for _, ipnet := range newAddresses {
// If we don't wait for a bit here, we see the arp fail to reach the bridge.
time.Sleep(1 * time.Millisecond)
arping.GratuitousArpOverIfaceByName(ipnet.IP, ifName)
}
if withMulticastRoute {
/* Route multicast packets across the weave network.
This must come last in 'attach'. If you change this, change weavewait to match.
TODO: Add the MTU lock to prevent PMTU discovery for multicast
destinations. Without that, the kernel sets the DF flag on
multicast packets. Since RFC1122 prohibits sending of ICMP
errors for packets with multicast destinations, that causes
packets larger than the PMTU to be dropped silently. */
_, multicast, _ := net.ParseCIDR("224.0.0.0/4")
if err := AddRoute(veth, netlink.SCOPE_LINK, multicast, nil); err != nil {
return err
}
}
return nil
}); err != nil {
return err
}
return nil
}
