|
| 1 | +// Copyright 2015 CNI authors |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package ip |
| 16 | + |
| 17 | +import ( |
| 18 | + "fmt" |
| 19 | + "net" |
| 20 | + |
| 21 | + "github.com/coreos/go-iptables/iptables" |
| 22 | + |
| 23 | + "github.com/containernetworking/cni/pkg/types" |
| 24 | + "github.com/containernetworking/plugins/pkg/utils" |
| 25 | +) |
| 26 | + |
| 27 | +// setupIPMasqIPTables is the iptables-based implementation of SetupIPMasqForNetwork |
| 28 | +func setupIPMasqIPTables(ipn *net.IPNet, network, _, containerID string) error { |
| 29 | + // Note: for historical reasons, the iptables implementation ignores ifname. |
| 30 | + chain := utils.FormatChainName(network, containerID) |
| 31 | + comment := utils.FormatComment(network, containerID) |
| 32 | + return SetupIPMasq(ipn, chain, comment) |
| 33 | +} |
| 34 | + |
| 35 | +// SetupIPMasq installs iptables rules to masquerade traffic |
| 36 | +// coming from ip of ipn and going outside of ipn. |
| 37 | +// Deprecated: This function only supports iptables. Use SetupIPMasqForNetwork, which |
| 38 | +// supports both iptables and nftables. |
| 39 | +func SetupIPMasq(ipn *net.IPNet, chain string, comment string) error { |
| 40 | + isV6 := ipn.IP.To4() == nil |
| 41 | + |
| 42 | + var ipt *iptables.IPTables |
| 43 | + var err error |
| 44 | + var multicastNet string |
| 45 | + |
| 46 | + if isV6 { |
| 47 | + ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv6) |
| 48 | + multicastNet = "ff00::/8" |
| 49 | + } else { |
| 50 | + ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4) |
| 51 | + multicastNet = "224.0.0.0/4" |
| 52 | + } |
| 53 | + if err != nil { |
| 54 | + return fmt.Errorf("failed to locate iptables: %v", err) |
| 55 | + } |
| 56 | + |
| 57 | + // Create chain if doesn't exist |
| 58 | + exists := false |
| 59 | + chains, err := ipt.ListChains("nat") |
| 60 | + if err != nil { |
| 61 | + return fmt.Errorf("failed to list chains: %v", err) |
| 62 | + } |
| 63 | + for _, ch := range chains { |
| 64 | + if ch == chain { |
| 65 | + exists = true |
| 66 | + break |
| 67 | + } |
| 68 | + } |
| 69 | + if !exists { |
| 70 | + if err = ipt.NewChain("nat", chain); err != nil { |
| 71 | + return err |
| 72 | + } |
| 73 | + } |
| 74 | + |
| 75 | + // Packets to this network should not be touched |
| 76 | + if err := ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT", "-m", "comment", "--comment", comment); err != nil { |
| 77 | + return err |
| 78 | + } |
| 79 | + |
| 80 | + // Don't masquerade multicast - pods should be able to talk to other pods |
| 81 | + // on the local network via multicast. |
| 82 | + if err := ipt.AppendUnique("nat", chain, "!", "-d", multicastNet, "-j", "MASQUERADE", "-m", "comment", "--comment", comment); err != nil { |
| 83 | + return err |
| 84 | + } |
| 85 | + |
| 86 | + // Packets from the specific IP of this network will hit the chain |
| 87 | + return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.IP.String(), "-j", chain, "-m", "comment", "--comment", comment) |
| 88 | +} |
| 89 | + |
| 90 | +// teardownIPMasqIPTables is the iptables-based implementation of TeardownIPMasqForNetwork |
| 91 | +func teardownIPMasqIPTables(ipn *net.IPNet, network, _, containerID string) error { |
| 92 | + // Note: for historical reasons, the iptables implementation ignores ifname. |
| 93 | + chain := utils.FormatChainName(network, containerID) |
| 94 | + comment := utils.FormatComment(network, containerID) |
| 95 | + return TeardownIPMasq(ipn, chain, comment) |
| 96 | +} |
| 97 | + |
| 98 | +// TeardownIPMasq undoes the effects of SetupIPMasq. |
| 99 | +// Deprecated: This function only supports iptables. Use TeardownIPMasqForNetwork, which |
| 100 | +// supports both iptables and nftables. |
| 101 | +func TeardownIPMasq(ipn *net.IPNet, chain string, comment string) error { |
| 102 | + isV6 := ipn.IP.To4() == nil |
| 103 | + |
| 104 | + var ipt *iptables.IPTables |
| 105 | + var err error |
| 106 | + |
| 107 | + if isV6 { |
| 108 | + ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv6) |
| 109 | + } else { |
| 110 | + ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4) |
| 111 | + } |
| 112 | + if err != nil { |
| 113 | + return fmt.Errorf("failed to locate iptables: %v", err) |
| 114 | + } |
| 115 | + |
| 116 | + err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.IP.String(), "-j", chain, "-m", "comment", "--comment", comment) |
| 117 | + if err != nil && !isNotExist(err) { |
| 118 | + return err |
| 119 | + } |
| 120 | + |
| 121 | + // for downward compatibility |
| 122 | + err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment) |
| 123 | + if err != nil && !isNotExist(err) { |
| 124 | + return err |
| 125 | + } |
| 126 | + |
| 127 | + err = ipt.ClearChain("nat", chain) |
| 128 | + if err != nil && !isNotExist(err) { |
| 129 | + return err |
| 130 | + } |
| 131 | + |
| 132 | + err = ipt.DeleteChain("nat", chain) |
| 133 | + if err != nil && !isNotExist(err) { |
| 134 | + return err |
| 135 | + } |
| 136 | + |
| 137 | + return nil |
| 138 | +} |
| 139 | + |
| 140 | +// gcIPMasqIPTables is the iptables-based implementation of GCIPMasqForNetwork |
| 141 | +func gcIPMasqIPTables(_ string, _ []types.GCAttachment) error { |
| 142 | + // FIXME: The iptables implementation does not support GC. |
| 143 | + // |
| 144 | + // (In theory, it _could_ backward-compatibly support it, by adding a no-op rule |
| 145 | + // with a comment indicating the network to each chain it creates, so that it |
| 146 | + // could later figure out which chains corresponded to which networks; older |
| 147 | + // implementations would ignore the extra rule but would still correctly delete |
| 148 | + // the chain on teardown (because they ClearChain() before doing DeleteChain()). |
| 149 | + |
| 150 | + return nil |
| 151 | +} |
| 152 | + |
| 153 | +// isNotExist returnst true if the error is from iptables indicating |
| 154 | +// that the target does not exist. |
| 155 | +func isNotExist(err error) bool { |
| 156 | + e, ok := err.(*iptables.Error) |
| 157 | + if !ok { |
| 158 | + return false |
| 159 | + } |
| 160 | + return e.IsNotExist() |
| 161 | +} |
0 commit comments