iptables.go 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142
  1. // Copyright 2015 flannel authors
  2. //
  3. // Licensed under the Apache License, Version 2.0 (the "License");
  4. // you may not use this file except in compliance with the License.
  5. // You may obtain a copy of the License at
  6. //
  7. // http://www.apache.org/licenses/LICENSE-2.0
  8. //
  9. // Unless required by applicable law or agreed to in writing, software
  10. // distributed under the License is distributed on an "AS IS" BASIS,
  11. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. // See the License for the specific language governing permissions and
  13. // limitations under the License.
  14. // +build !windows
  15. package network
  16. import (
  17. "fmt"
  18. "strings"
  19. log "github.com/golang/glog"
  20. "time"
  21. "github.com/coreos/flannel/pkg/ip"
  22. "github.com/coreos/flannel/subnet"
  23. "github.com/coreos/go-iptables/iptables"
  24. )
  25. type IPTables interface {
  26. AppendUnique(table string, chain string, rulespec ...string) error
  27. Delete(table string, chain string, rulespec ...string) error
  28. Exists(table string, chain string, rulespec ...string) (bool, error)
  29. }
  30. type IPTablesRule struct {
  31. table string
  32. chain string
  33. rulespec []string
  34. }
  35. func MasqRules(ipn ip.IP4Net, lease *subnet.Lease) []IPTablesRule {
  36. n := ipn.String()
  37. sn := lease.Subnet.String()
  38. return []IPTablesRule{
  39. // This rule makes sure we don't NAT traffic within overlay network (e.g. coming out of docker0)
  40. {"nat", "POSTROUTING", []string{"-s", n, "-d", n, "-j", "RETURN"}},
  41. // NAT if it's not multicast traffic
  42. {"nat", "POSTROUTING", []string{"-s", n, "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE"}},
  43. // Prevent performing Masquerade on external traffic which arrives from a Node that owns the container/pod IP address
  44. {"nat", "POSTROUTING", []string{"!", "-s", n, "-d", sn, "-j", "RETURN"}},
  45. // Masquerade anything headed towards flannel from the host
  46. {"nat", "POSTROUTING", []string{"!", "-s", n, "-d", n, "-j", "MASQUERADE"}},
  47. }
  48. }
  49. func ForwardRules(flannelNetwork string) []IPTablesRule {
  50. return []IPTablesRule{
  51. // These rules allow traffic to be forwarded if it is to or from the flannel network range.
  52. {"filter", "FORWARD", []string{"-s", flannelNetwork, "-j", "ACCEPT"}},
  53. {"filter", "FORWARD", []string{"-d", flannelNetwork, "-j", "ACCEPT"}},
  54. }
  55. }
  56. func ipTablesRulesExist(ipt IPTables, rules []IPTablesRule) (bool, error) {
  57. for _, rule := range rules {
  58. exists, err := ipt.Exists(rule.table, rule.chain, rule.rulespec...)
  59. if err != nil {
  60. // this shouldn't ever happen
  61. return false, fmt.Errorf("failed to check rule existence: %v", err)
  62. }
  63. if !exists {
  64. return false, nil
  65. }
  66. }
  67. return true, nil
  68. }
  69. func SetupAndEnsureIPTables(rules []IPTablesRule) {
  70. ipt, err := iptables.New()
  71. if err != nil {
  72. // if we can't find iptables, give up and return
  73. log.Errorf("Failed to setup IPTables. iptables binary was not found: %v", err)
  74. return
  75. }
  76. defer func() {
  77. teardownIPTables(ipt, rules)
  78. }()
  79. for {
  80. // Ensure that all the iptables rules exist every 5 seconds
  81. if err := ensureIPTables(ipt, rules); err != nil {
  82. log.Errorf("Failed to ensure iptables rules: %v", err)
  83. }
  84. time.Sleep(5 * time.Second)
  85. }
  86. }
  87. func ensureIPTables(ipt IPTables, rules []IPTablesRule) error {
  88. exists, err := ipTablesRulesExist(ipt, rules)
  89. if err != nil {
  90. return fmt.Errorf("Error checking rule existence: %v", err)
  91. }
  92. if exists {
  93. // if all the rules already exist, no need to do anything
  94. return nil
  95. }
  96. // Otherwise, teardown all the rules and set them up again
  97. // We do this because the order of the rules is important
  98. log.Info("Some iptables rules are missing; deleting and recreating rules")
  99. teardownIPTables(ipt, rules)
  100. if err = setupIPTables(ipt, rules); err != nil {
  101. return fmt.Errorf("Error setting up rules: %v", err)
  102. }
  103. return nil
  104. }
  105. func setupIPTables(ipt IPTables, rules []IPTablesRule) error {
  106. for _, rule := range rules {
  107. log.Info("Adding iptables rule: ", strings.Join(rule.rulespec, " "))
  108. err := ipt.AppendUnique(rule.table, rule.chain, rule.rulespec...)
  109. if err != nil {
  110. return fmt.Errorf("failed to insert IPTables rule: %v", err)
  111. }
  112. }
  113. return nil
  114. }
  115. func teardownIPTables(ipt IPTables, rules []IPTablesRule) {
  116. for _, rule := range rules {
  117. log.Info("Deleting iptables rule: ", strings.Join(rule.rulespec, " "))
  118. // We ignore errors here because if there's an error it's almost certainly because the rule
  119. // doesn't exist, which is fine (we don't need to delete rules that don't exist)
  120. ipt.Delete(rule.table, rule.chain, rule.rulespec...)
  121. }
  122. }