Skip to content

Commit

Permalink
Fix iptables option (#47)
Browse files Browse the repository at this point in the history 
* use iptables --match-set instead of deprecated --set option

Signed-off-by: lyyao09 <lyyao09@163.com>

* fix wrong spelling

Signed-off-by: lyyao09 <lyyao09@163.com>
  • Loading branch information
@lyyao09
lyyao09 authored Jul 14, 2020
1 parent 73e0eef commit 60bd207
Show file tree
Hide file tree
Showing 4 changed files with 12 additions and 11 deletions.
1 change: 1 addition & 0 deletions .gitignore
View file
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
egressip-controller
.idea
2 changes: 1 addition & 1 deletion pkg/controller/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -437,7 +437,7 @@ func (c *Controller) updateStaticEgressIP(old, current interface{}) {
}
}
if isGateway {
err = c.trafficDirector.ClaerStaleRouteToGateway(generateRuleId(oldStaticEgressIPObj.Namespace, oldStaticEgressIPObj.Name, i), rule.Cidr, rule.EgressIP)
err = c.trafficDirector.ClearStaleRouteToGateway(generateRuleId(oldStaticEgressIPObj.Namespace, oldStaticEgressIPObj.Name, i), rule.Cidr, rule.EgressIP)
if err != nil {
glog.Errorf("Failed to cleanup old rules configured for gateway", err.Error())
}
Expand Down
14 changes: 7 additions & 7 deletions pkg/director/director.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ func (d *EgressDirector) AddRouteToGateway(setName string, sourceIPs []string, d

// create iptables rule in mangle table PREROUTING chain to match src to ipset created and destination
// matching destinationIP then fwmark the packets
ruleSpec := []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "MARK", "--set-mark", staticEgressIPFWMARK}
ruleSpec := []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "MARK", "--set-mark", staticEgressIPFWMARK}
hasRule, err := d.ipt.Exists("mangle", "PREROUTING", ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in PREROUTING chain of mangle table to fwmark egress traffic that needs static egress IP" + err.Error())
Expand All @@ -138,7 +138,7 @@ func (d *EgressDirector) AddRouteToGateway(setName string, sourceIPs []string, d
}
glog.Infof("iptables rule in mangle table PREROUTING chain to match src to ipset")

ruleSpec = []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
ruleSpec = []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
hasRule, err = d.ipt.Exists("nat", bypassCNIMasquradeChainName, ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in BYPASS_CNI_MASQURADE chain of nat table to bypass the CNI masqurade" + err.Error())
Expand Down Expand Up @@ -200,7 +200,7 @@ func (d *EgressDirector) DeleteRouteToGateway(setName string, destinationIP, egr

// create iptables rule in mangle table PREROUTING chain to match src to ipset created and destination
// matching destinationIP then fwmark the packets
ruleSpec := []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "MARK", "--set-mark", staticEgressIPFWMARK}
ruleSpec := []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "MARK", "--set-mark", staticEgressIPFWMARK}
hasRule, err := d.ipt.Exists("mangle", "PREROUTING", ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in PREROUTING chain of mangle table to fwmark egress traffic that needs static egress IP" + err.Error())
Expand All @@ -213,7 +213,7 @@ func (d *EgressDirector) DeleteRouteToGateway(setName string, destinationIP, egr
glog.Infof("deleted rule in PREROUTING chain of mangle table to fwmark egress traffic that needs static egress IP")
}

ruleSpec = []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
ruleSpec = []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
hasRule, err = d.ipt.Exists("nat", bypassCNIMasquradeChainName, ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in BYPASS_CNI_MASQURADE chain of nat table to bypass the CNI masqurade" + err.Error())
Expand Down Expand Up @@ -245,11 +245,11 @@ func (d *EgressDirector) DeleteRouteToGateway(setName string, destinationIP, egr
return nil
}

func (d *EgressDirector) ClaerStaleRouteToGateway(setName string, destinationIP, egressGateway string) error {
func (d *EgressDirector) ClearStaleRouteToGateway(setName string, destinationIP, egressGateway string) error {

// create iptables rule in mangle table PREROUTING chain to match src to ipset created and destination
// matching destinationIP then fwmark the packets
ruleSpec := []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "MARK", "--set-mark", staticEgressIPFWMARK}
ruleSpec := []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "MARK", "--set-mark", staticEgressIPFWMARK}
hasRule, err := d.ipt.Exists("mangle", "PREROUTING", ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in PREROUTING chain of mangle table to fwmark egress traffic that needs static egress IP" + err.Error())
Expand All @@ -262,7 +262,7 @@ func (d *EgressDirector) ClaerStaleRouteToGateway(setName string, destinationIP,
glog.Infof("deleted rule in PREROUTING chain of mangle table to fwmark egress traffic that needs static egress IP")
}

ruleSpec = []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
ruleSpec = []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
hasRule, err = d.ipt.Exists("nat", bypassCNIMasquradeChainName, ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in BYPASS_CNI_MASQURADE chain of nat table to bypass the CNI masqurade" + err.Error())
Expand Down
6 changes: 3 additions & 3 deletions pkg/gateway/gateway.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ func (gateway *EgressGateway) AddStaticIptablesRule(setName string, sourceIPs []
}
glog.Infof("Added ips %v to the ipset name: %s", sourceIPs, setName)

ruleSpec := []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
ruleSpec := []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
hasRule, err := gateway.ipt.Exists("filter", egressGatewayFWChainName, ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in " + egressGatewayFWChainName + " chain of filter table" + err.Error())
Expand Down Expand Up @@ -142,7 +142,7 @@ func (gateway *EgressGateway) DeleteStaticIptablesRule(setName string, destinati
}

// delete rule in FORWARD chain of filter table
ruleSpec = []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
ruleSpec = []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
hasRule, err := gateway.ipt.Exists("filter", egressGatewayFWChainName, ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in " + egressGatewayFWChainName + " chain of filter table" + err.Error())
Expand Down Expand Up @@ -176,7 +176,7 @@ func (gateway *EgressGateway) ClearStaticIptablesRule(setName string, destinatio
}

// delete rule in FORWARD chain of filter table
ruleSpec = []string{"-m", "set", "--set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
ruleSpec = []string{"-m", "set", "--match-set", setName, "src", "-d", destinationIP, "-j", "ACCEPT"}
hasRule, err := gateway.ipt.Exists("filter", egressGatewayFWChainName, ruleSpec...)
if err != nil {
return errors.New("Failed to verify rule exists in " + egressGatewayFWChainName + " chain of filter table" + err.Error())
Expand Down

0 comments on commit 60bd207

Please sign in to comment.