reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

npc: Create WEAVE-NPC-EGRESS chain with the base rules

Browse Source 
The following rules are provisioned by weave-npc:

-A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
-A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
-A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
-A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
-A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP

-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j RETURN

-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j RETURN

For each rule we create two (mark and return). We cannot just accept
a packet if it matches any rule, as a packet might need to traverse
the ingress npc as well which happens later in the chain (in some cases
we cannot detect whether packet is ingress or egress, so we need to
check both chains).
This commit is contained in:
Martynas Pumputis authored and Martynas Pumputis committed 2018-07-24 10:06:23 +02:00
1 parent 88616007b0
commit 89e820d62e
2 files changed
+67 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

npc/constants.go
+5
View File
@@ -7,6 +7,11 @@ const (
DefaultChain = "WEAVE-NPC-DEFAULT"
IngressChain = "WEAVE-NPC-INGRESS"
EgressChain = "WEAVE-NPC-EGRESS"
EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
EgressCustomChain = "WEAVE-NPC-EGRESS-CUSTOM"
EgressMark = "0x40000/0x40000"
IpsetNamePrefix = "weave-"
LocalIpset = IpsetNamePrefix + "local-pods"
prog/weave-npc/main.go
+62 -3
View File
@@ -53,7 +53,23 @@ func resetIPTables(ipt *iptables.IPTables) error {
return err
}
return ipt.ClearChain(npc.TableFilter, npc.MainChain)
if err := ipt.ClearChain(npc.TableFilter, npc.MainChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.EgressCustomChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.EgressDefaultChain); err != nil {
return err
}
if err := ipt.ClearChain(npc.TableFilter, npc.EgressChain); err != nil {
return err
}
return nil
}
func resetIPSets(ips ipset.Interface) error {
@@ -115,8 +131,51 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
return err
}
return ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT")
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"); err != nil {
return err
}
if allowMcast {
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-d", "224.0.0.0/4", "-j", "RETURN"); err != nil {
return err
}
}
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-m", "state", "--state", "NEW",
"-j", string(npc.EgressDefaultChain)); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-m", "state", "--state", "NEW",
"-m", "set", "!", "--match-set", npc.LocalIpset, "src",
"-j", "RETURN"); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-m", "state", "--state", "NEW",
"-m", "mark", "!", "--mark", npc.EgressMark,
"-j", string(npc.EgressCustomChain)); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-m", "state", "--state", "NEW",
"-m", "mark", "!", "--mark", npc.EgressMark,
"-j", "NFLOG", "--nflog-group", "86"); err != nil {
return err
}
if err := ipt.Append(npc.TableFilter, npc.EgressChain,
"-m", "mark", "!", "--mark", npc.EgressMark,
"-j", "DROP"); err != nil {
return err
}
return nil
}
func root(cmd *cobra.Command, args []string) {