11901197722

Committed 18 Nov 2024 09:12PM UTC coverage: 52.959%. First build

Build # 11901197722

Build Type

Pull #1120

github

Committed by

champtar

Commit Message

ipmasq: fix nftables backend

Add SetupIPMasqForNetworks and TeardownIPMasqForNetworks
functions that take []*net.IPNet instead of *net.IPNet.

This allow the nftables backend to cleanup stale rules and recreate all
needed rules in a single transaction, where previously the stale rules
cleanup was breaking all but the last IPNet.

Fixes 61d078645

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>

Pull Request Pull Request #1120: ipmasq: fix nftables backend

Run Details

28 of 60 new or added lines in 5 files covered. (46.67%)

4833 of 9126 relevant lines covered (52.96%)

26.39 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/pkg/ip/ipmasq_iptables_linux.go

// Copyright 2015 CNI authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package ip

import (
        "errors"
        "fmt"
        "net"
        "strings"

        "github.com/coreos/go-iptables/iptables"

        "github.com/containernetworking/cni/pkg/types"
        "github.com/containernetworking/plugins/pkg/utils"
)

// setupIPMasqIPTables is the iptables-based implementation of SetupIPMasqForNetworks
func setupIPMasqIPTables(ipns []*net.IPNet, network, _, containerID string) error {
        // Note: for historical reasons, the iptables implementation ignores ifname.
        chain := utils.FormatChainName(network, containerID)
        comment := utils.FormatComment(network, containerID)
        for _, ip := range ipns {
                if err := SetupIPMasq(ip, chain, comment); err != nil {
                        return err
                }
        }
        return nil
}

// SetupIPMasq installs iptables rules to masquerade traffic
// coming from ip of ipn and going outside of ipn.
// Deprecated: This function only supports iptables. Use SetupIPMasqForNetworks, which
// supports both iptables and nftables.
func SetupIPMasq(ipn *net.IPNet, chain string, comment string) error {
        isV6 := ipn.IP.To4() == nil

        var ipt *iptables.IPTables
        var err error
        var multicastNet string

        if isV6 {
                ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)
                multicastNet = "ff00::/8"
        } else {
                ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4)
                multicastNet = "224.0.0.0/4"
        }
        if err != nil {
                return fmt.Errorf("failed to locate iptables: %v", err)
        }

        // Create chain if doesn't exist
        exists := false
        chains, err := ipt.ListChains("nat")
        if err != nil {
                return fmt.Errorf("failed to list chains: %v", err)
        }
        for _, ch := range chains {
                if ch == chain {
                        exists = true
                        break
                }
        }
        if !exists {
                if err = ipt.NewChain("nat", chain); err != nil {
                        return err
                }
        }

        // Packets to this network should not be touched
        if err := ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT", "-m", "comment", "--comment", comment); err != nil {
                return err
        }

        // Don't masquerade multicast - pods should be able to talk to other pods
        // on the local network via multicast.
        if err := ipt.AppendUnique("nat", chain, "!", "-d", multicastNet, "-j", "MASQUERADE", "-m", "comment", "--comment", comment); err != nil {
                return err
        }

        // Packets from the specific IP of this network will hit the chain
        return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.IP.String(), "-j", chain, "-m", "comment", "--comment", comment)
}

// teardownIPMasqIPTables is the iptables-based implementation of TeardownIPMasqForNetworks
func teardownIPMasqIPTables(ipns []*net.IPNet, network, _, containerID string) error {
        // Note: for historical reasons, the iptables implementation ignores ifname.
        chain := utils.FormatChainName(network, containerID)
        comment := utils.FormatComment(network, containerID)

        var errs []string
        for _, ipn := range ipns {
                err := TeardownIPMasq(ipn, chain, comment)
                if err != nil {
                        errs = append(errs, err.Error())
                }
        }

        if errs == nil {
                return nil
        }
        return errors.New(strings.Join(errs, "\n"))
}

// TeardownIPMasq undoes the effects of SetupIPMasq.
// Deprecated: This function only supports iptables. Use TeardownIPMasqForNetworks, which
// supports both iptables and nftables.
func TeardownIPMasq(ipn *net.IPNet, chain string, comment string) error {
        isV6 := ipn.IP.To4() == nil

        var ipt *iptables.IPTables
        var err error

        if isV6 {
                ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)
        } else {
                ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4)
        }
        if err != nil {
                return fmt.Errorf("failed to locate iptables: %v", err)
        }

        err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.IP.String(), "-j", chain, "-m", "comment", "--comment", comment)
        if err != nil && !isNotExist(err) {
                return err
        }

        // for downward compatibility
        err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment)
        if err != nil && !isNotExist(err) {
                return err
        }

        err = ipt.ClearChain("nat", chain)
        if err != nil && !isNotExist(err) {
                return err
        }

        err = ipt.DeleteChain("nat", chain)
        if err != nil && !isNotExist(err) {
                return err
        }

        return nil
}

// gcIPMasqIPTables is the iptables-based implementation of GCIPMasqForNetwork
func gcIPMasqIPTables(_ string, _ []types.GCAttachment) error {
        // FIXME: The iptables implementation does not support GC.
        //
        // (In theory, it _could_ backward-compatibly support it, by adding a no-op rule
        // with a comment indicating the network to each chain it creates, so that it
        // could later figure out which chains corresponded to which networks; older
        // implementations would ignore the extra rule but would still correctly delete
        // the chain on teardown (because they ClearChain() before doing DeleteChain()).

        return nil
}

// isNotExist returnst true if the error is from iptables indicating
// that the target does not exist.
func isNotExist(err error) bool {
        e, ok := err.(*iptables.Error)
        if !ok {
                return false
        }
        return e.IsNotExist()
}

1	// Copyright 2015 CNI authors
2	//
3	// Licensed under the Apache License, Version 2.0 (the "License");
4	// you may not use this file except in compliance with the License.
5	// You may obtain a copy of the License at
6	//
7	// http://www.apache.org/licenses/LICENSE-2.0
8	//
9	// Unless required by applicable law or agreed to in writing, software
10	// distributed under the License is distributed on an "AS IS" BASIS,
11	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	// See the License for the specific language governing permissions and
13	// limitations under the License.
14
15	package ip
16
17	import (
18	"errors"
19	"fmt"
20	"net"
21	"strings"
22
23	"github.com/coreos/go-iptables/iptables"
24
25	"github.com/containernetworking/cni/pkg/types"
26	"github.com/containernetworking/plugins/pkg/utils"
27	)
28
29	// setupIPMasqIPTables is the iptables-based implementation of SetupIPMasqForNetworks
NEW 30	func setupIPMasqIPTables(ipns []*net.IPNet, network, _, containerID string) error {	×
31	// Note: for historical reasons, the iptables implementation ignores ifname.	×
32	chain := utils.FormatChainName(network, containerID)	×
33	comment := utils.FormatComment(network, containerID)	×
NEW 34	for _, ip := range ipns {	×
NEW 35	if err := SetupIPMasq(ip, chain, comment); err != nil {	×
NEW 36	return err	×
NEW 37	}	×
38	}
NEW 39	return nil	×
40	}
41
42	// SetupIPMasq installs iptables rules to masquerade traffic
43	// coming from ip of ipn and going outside of ipn.
44	// Deprecated: This function only supports iptables. Use SetupIPMasqForNetworks, which
45	// supports both iptables and nftables.
46	func SetupIPMasq(ipn *net.IPNet, chain string, comment string) error {	×
47	isV6 := ipn.IP.To4() == nil	×
48		×
49	var ipt *iptables.IPTables	×
50	var err error	×
51	var multicastNet string	×
52		×
53	if isV6 {	×
54	ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)	×
55	multicastNet = "ff00::/8"	×
56	} else {	×
57	ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4)	×
58	multicastNet = "224.0.0.0/4"	×
59	}	×
60	if err != nil {	×
61	return fmt.Errorf("failed to locate iptables: %v", err)	×
62	}	×
63
64	// Create chain if doesn't exist
65	exists := false	×
66	chains, err := ipt.ListChains("nat")	×
67	if err != nil {	×
68	return fmt.Errorf("failed to list chains: %v", err)	×
69	}	×
70	for _, ch := range chains {	×
71	if ch == chain {	×
72	exists = true	×
73	break	×
74	}
75	}
76	if !exists {	×
77	if err = ipt.NewChain("nat", chain); err != nil {	×
78	return err	×
79	}	×
80	}
81
82	// Packets to this network should not be touched
83	if err := ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT", "-m", "comment", "--comment", comment); err != nil {	×
84	return err	×
85	}	×
86
87	// Don't masquerade multicast - pods should be able to talk to other pods
88	// on the local network via multicast.
89	if err := ipt.AppendUnique("nat", chain, "!", "-d", multicastNet, "-j", "MASQUERADE", "-m", "comment", "--comment", comment); err != nil {	×
90	return err	×
91	}	×
92
93	// Packets from the specific IP of this network will hit the chain
94	return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.IP.String(), "-j", chain, "-m", "comment", "--comment", comment)	×
95	}
96
97	// teardownIPMasqIPTables is the iptables-based implementation of TeardownIPMasqForNetworks
NEW 98	func teardownIPMasqIPTables(ipns []*net.IPNet, network, _, containerID string) error {	×
99	// Note: for historical reasons, the iptables implementation ignores ifname.	×
100	chain := utils.FormatChainName(network, containerID)	×
101	comment := utils.FormatComment(network, containerID)	×
NEW 102		×
NEW 103	var errs []string	×
NEW 104	for _, ipn := range ipns {	×
NEW 105	err := TeardownIPMasq(ipn, chain, comment)	×
NEW 106	if err != nil {	×
NEW 107	errs = append(errs, err.Error())	×
NEW 108	}	×
109	}
110
NEW 111	if errs == nil {	×
NEW 112	return nil	×
NEW 113	}	×
NEW 114	return errors.New(strings.Join(errs, "\n"))	×
115	}
116
117	// TeardownIPMasq undoes the effects of SetupIPMasq.
118	// Deprecated: This function only supports iptables. Use TeardownIPMasqForNetworks, which
119	// supports both iptables and nftables.
120	func TeardownIPMasq(ipn *net.IPNet, chain string, comment string) error {	×
121	isV6 := ipn.IP.To4() == nil	×
122		×
123	var ipt *iptables.IPTables	×
124	var err error	×
125		×
126	if isV6 {	×
127	ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)	×
128	} else {	×
129	ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4)	×
130	}	×
131	if err != nil {	×
132	return fmt.Errorf("failed to locate iptables: %v", err)	×
133	}	×
134
135	err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.IP.String(), "-j", chain, "-m", "comment", "--comment", comment)	×
136	if err != nil && !isNotExist(err) {	×
137	return err	×
138	}	×
139
140	// for downward compatibility
141	err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment)	×
142	if err != nil && !isNotExist(err) {	×
143	return err	×
144	}	×
145
146	err = ipt.ClearChain("nat", chain)	×
147	if err != nil && !isNotExist(err) {	×
148	return err	×
149	}	×
150
151	err = ipt.DeleteChain("nat", chain)	×
152	if err != nil && !isNotExist(err) {	×
153	return err	×
154	}	×
155
156	return nil	×
157	}
158
159	// gcIPMasqIPTables is the iptables-based implementation of GCIPMasqForNetwork
160	func gcIPMasqIPTables(_ string, _ []types.GCAttachment) error {	×
161	// FIXME: The iptables implementation does not support GC.	×
162	//	×
163	// (In theory, it _could_ backward-compatibly support it, by adding a no-op rule	×
164	// with a comment indicating the network to each chain it creates, so that it	×
165	// could later figure out which chains corresponded to which networks; older	×
166	// implementations would ignore the extra rule but would still correctly delete	×
167	// the chain on teardown (because they ClearChain() before doing DeleteChain()).	×
168		×
169	return nil	×
170	}	×
171
172	// isNotExist returnst true if the error is from iptables indicating
173	// that the target does not exist.
174	func isNotExist(err error) bool {	×
175	e, ok := err.(*iptables.Error)	×
176	if !ok {	×
177	return false	×
178	}	×
179	return e.IsNotExist()	×
180	}

containernetworking / plugins / 11901197722

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous