From a46d18da0cf91d1c38d7bd68a6e4b7764cfd616f Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 29 May 2020 15:43:35 +0000 Subject: [PATCH 1/3] Use a more targeted iptables rule to block access to control port Only block the specific port Weave Net is listening on. Add a comment so users know what the rule is for. Remove the rule added in v2.6.3 because it was too coarse. --- net/bridge.go | 14 +++++++++++--- prog/weaver/main.go | 5 +++++ weave | 2 +- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/net/bridge.go b/net/bridge.go index f27e3175..8283e645 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -221,6 +221,7 @@ type BridgeConfig struct { MTU int Mac string Port int + ControlPort string NoMasqLocal bool } @@ -469,10 +470,17 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error { } } - // Block non-local traffic to the Weave control port - if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil { - return err + if config.ControlPort != "" { + if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "--dport", config.ControlPort, + "-m", "addrtype", "!", "--src-type", "LOCAL", + "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", + "-m", "comment", "--comment", "Block non-local access to Weave Net control port", + "-j", "DROP"); err != nil { + return err + } } + // Remove the rule from Weave Net 2.6.3 which dropped too much. + _ = ipt.Delete("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP") if config.NPC { // Steer traffic via the NPC. diff --git a/prog/weaver/main.go b/prog/weaver/main.go index ca89c642..3edaed16 100644 --- a/prog/weaver/main.go +++ b/prog/weaver/main.go @@ -307,6 +307,11 @@ func main() { bridgeConfig.Mac = name.String() bridgeConfig.Port = config.Port + if httpAddr != "" { + if _, port, err := net.SplitHostPort(httpAddr); err == nil { + bridgeConfig.ControlPort = port + } + } ips := ipset.New(common.LogLogger(), 0) bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig, Log, ips) checkFatal(err) diff --git a/weave b/weave index b824d008..a8e6fb06 100755 --- a/weave +++ b/weave @@ -483,7 +483,7 @@ destroy_bridge() { [ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE) - run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true + run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp --dport 6784 -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -m comment --comment "Block non-local access to Weave Net control port" -j DROP >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53 -j ACCEPT >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1 || true From d45579bf82f497b5f0fefe1ba8c3a0c36d1e4f1d Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 29 May 2020 14:08:54 +0000 Subject: [PATCH 2/3] Allow time for network policy changes to take effect Also change from waiting longer to polling until connections are established after restarting Weave Net. --- test/840_weave_kube_3_test.sh | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh index 0d8cdcc9..d67ab196 100755 --- a/test/840_weave_kube_3_test.sh +++ b/test/840_weave_kube_3_test.sh @@ -54,7 +54,7 @@ sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \ -e "s%env:%$WEAVE_ENV_VARS%" \ "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.9.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -" -sleep 5 +sleep 2 check_connections() { run_on $HOST1 "curl -sS http://127.0.0.1:6784/status | grep \"$SUCCESS\"" @@ -247,6 +247,9 @@ spec: - namespaceSelector: {} EOF +# Allow some time for the policy change to take effect +sleep 2 + # Should be able to access from the "deny" pod now assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null" @@ -270,6 +273,7 @@ spec: cidr: $HOST1EXPIP/32 EOF +# Allow some time for the policy change to take effect sleep 2 assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null" @@ -289,6 +293,9 @@ spec: - {} EOF +# Allow some time for the policy change to take effect +sleep 2 + # Virtual IP and NodePort should now work assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null" assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null" @@ -314,6 +321,9 @@ spec: - 8.8.8.4/32 EOF +# Allow some time for the policy change to take effect +sleep 2 + assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null" assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- dig @8.8.8.4 google.com >/dev/null" assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- dig @8.8.8.8 google.com >/dev/null" @@ -346,6 +356,9 @@ spec: name: kube-system EOF +# Allow some time for the policy change to take effect +sleep 2 + assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null" # Passing --no-masq-local and setting externalTrafficPolicy to Local must preserve @@ -359,10 +372,12 @@ sed -e "s%imagePullPolicy: Always%imagePullPolicy: Never%" \ -e "s%env:%$WEAVE_ENV_VARS%" \ "$(dirname "$0")/../prog/weave-kube/weave-daemonset-k8s-1.9.yaml" | run_on "$HOST1" "$KUBECTL apply -n kube-system -f -" -sleep 5 +sleep 2 +assert_raises 'wait_for_x check_connections "connections to establish"' run_on $HOST1 "$KUBECTL patch svc netvirt -p '{\"spec\":{\"externalTrafficPolicy\":\"Local\"}}'" +sleep 2 CLIENT_IP_NO_MASQ="$($SSH $HOST1 curl -sS http://$HOST2:31138/client_ip)" assert_raises "[ $CLIENT_IP_NO_MASQ != $CLIENT_IP_MASQ ]" From c7a235a54a1b674daa5c3ed14f86cb87f2254a0c Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Sat, 30 May 2020 10:11:08 +0000 Subject: [PATCH 3/3] Add release v2.6.4 --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 33a29538..463d7365 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +## Release 2.6.4 + +Improves the iptables rule added in 2.6.3 to block just the Weave Net +control port and avoid blocking other uses of 127.0.0.1. #3811 + + ## Release 2.6.3 This release has a couple of security improvements, and some other fixes.