ITQC/containernetworking-plugins
24
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

*: add comment to iptables rules for ipmasq

Browse Source
This commit is contained in:
Stefan Junker 2016-03-31 15:44:54 +02:00
parent bcef17daac
commit 6aad63055c
4 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/ip/ipmasq.go
View File

@ -23,7 +23,7 @@ import (
// SetupIPMasq installs iptables rules to masquerade traffic // SetupIPMasq installs iptables rules to masquerade traffic
// coming from ipn and going outside of it // coming from ipn and going outside of it
func SetupIPMasq(ipn *net.IPNet, chain string) error { func SetupIPMasq(ipn *net.IPNet, chain string, comment string) error {
ipt, err := iptables.New() ipt, err := iptables.New()
if err != nil { if err != nil {
return fmt.Errorf("failed to locate iptables: %v", err) return fmt.Errorf("failed to locate iptables: %v", err)
@ -36,25 +36,25 @@ func SetupIPMasq(ipn *net.IPNet, chain string) error {
} }
} }
if err = ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT"); err != nil { if err = ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT", "-m", "comment", "--comment", comment); err != nil {
return err return err
} }
if err = ipt.AppendUnique("nat", chain, "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE"); err != nil { if err = ipt.AppendUnique("nat", chain, "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE", "-m", "comment", "--comment", comment); err != nil {
return err return err
} }
return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain) return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment)
} }
// TeardownIPMasq undoes the effects of SetupIPMasq // TeardownIPMasq undoes the effects of SetupIPMasq
func TeardownIPMasq(ipn *net.IPNet, chain string) error { func TeardownIPMasq(ipn *net.IPNet, chain string, comment string) error {
ipt, err := iptables.New() ipt, err := iptables.New()
if err != nil { if err != nil {
return fmt.Errorf("failed to locate iptables: %v", err) return fmt.Errorf("failed to locate iptables: %v", err)
} }
if err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain); err != nil { if err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment); err != nil {
return err return err
} }

6
pkg/utils/utils.go
View File

@ -19,3 +19,9 @@ func FormatChainName(name string, id string) string {
chain := fmt.Sprintf("%s%x", chainPrefix, chainBytes) chain := fmt.Sprintf("%s%x", chainPrefix, chainBytes)
return chain[:maxChainLength] return chain[:maxChainLength]
} }
// FormatComment returns a comment used for easier
// rule identification within iptables.
func FormatComment(name string, id string) string {
return fmt.Sprintf("name: %q id: %q", name, id)
}

3
plugins/main/bridge/bridge.go
View File

@ -222,7 +222,8 @@ func cmdAdd(args *skel.CmdArgs) error {
if n.IPMasq { if n.IPMasq {
chain := utils.FormatChainName(n.Name, args.ContainerID) chain := utils.FormatChainName(n.Name, args.ContainerID)
if err = ip.SetupIPMasq(ip.Network(&result.IP4.IP), chain); err != nil { comment := utils.FormatComment(n.Name, args.ContainerID)
if err = ip.SetupIPMasq(ip.Network(&result.IP4.IP), chain, comment); err != nil {
return err return err
} }
} }

6
plugins/main/ptp/ptp.go
View File

@ -179,7 +179,8 @@ func cmdAdd(args *skel.CmdArgs) error {
if conf.IPMasq { if conf.IPMasq {
chain := utils.FormatChainName(conf.Name, args.ContainerID) chain := utils.FormatChainName(conf.Name, args.ContainerID)
if err = ip.SetupIPMasq(&result.IP4.IP, chain); err != nil { comment := utils.FormatComment(conf.Name, args.ContainerID)
if err = ip.SetupIPMasq(&result.IP4.IP, chain, comment); err != nil {
return err return err
} }
} }
@ -206,7 +207,8 @@ func cmdDel(args *skel.CmdArgs) error {
if conf.IPMasq { if conf.IPMasq {
chain := utils.FormatChainName(conf.Name, args.ContainerID) chain := utils.FormatChainName(conf.Name, args.ContainerID)
if err = ip.TeardownIPMasq(ipn, chain); err != nil { comment := utils.FormatComment(conf.Name, args.ContainerID)
if err = ip.TeardownIPMasq(ipn, chain, comment); err != nil {
return err return err
} }
} }