Skip to content

Commit 74f60df

Browse files
remibergsmaremibergsma
committed
Revert "Merge pull request #1482 from remibergsma/iptables-fix"
Seems to have a license issue so reverting for now. This reverts commit 9a20ab8, reversing changes made to 7a0b37a.
1 parent 06e52e4 commit 74f60df

6 files changed

Lines changed: 69 additions & 312 deletions

File tree

‎systemvm/patches/debian/config/opt/cloud/bin/configure.py‎

Lines changed: 17 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,27 @@
1717
# specific language governing permissions and limitations
1818
# under the License.
1919
import sys
20+
import os
2021
import base64
2122

23+
from merge import DataBag
24+
from pprint import pprint
25+
import subprocess
26+
import logging
2227
import re
28+
import time
29+
import shutil
30+
import os.path
31+
import os
2332
from fcntl import flock, LOCK_EX, LOCK_UN
2433

25-
from cs.CsDatabag import CsDataBag
34+
from cs.CsDatabag import CsDataBag, CsCmdLine
35+
import cs.CsHelper
2636
from cs.CsNetfilter import CsNetfilters
2737
from cs.CsDhcp import CsDhcp
2838
from cs.CsRedundant import *
2939
from cs.CsFile import CsFile
40+
from cs.CsApp import CsApache, CsDnsmasq
3041
from cs.CsMonitor import CsMonitor
3142
from cs.CsLoadBalancer import CsLoadBalancer
3243
from cs.CsConfig import CsConfig
@@ -197,23 +208,7 @@ def create(self):
197208

198209
def process(self, direction, rule_list, base):
199210
count = base
200-
rule_list_splitted = []
201-
for rule in rule_list:
202-
if ',' in rule['cidr']:
203-
cidrs = rule['cidr'].split(',')
204-
for cidr in cidrs:
205-
new_rule = {
206-
'cidr': cidr,
207-
'last_port': rule['last_port'],
208-
'type': rule['type'],
209-
'first_port': rule['first_port'],
210-
'allowed': rule['allowed']
211-
}
212-
rule_list_splitted.append(new_rule)
213-
else:
214-
rule_list_splitted.append(rule)
215-
216-
for i in rule_list_splitted:
211+
for i in rule_list:
217212
r = self.AclRule(direction, self, i, self.config, count)
218213
r.create()
219214
count += 1
@@ -266,7 +261,7 @@ def create(self):
266261
rstr = "%s -m icmp --icmp-type %s" % (rstr, self.icmp_type)
267262
rstr = "%s %s -j %s" % (rstr, self.dport, self.action)
268263
rstr = rstr.replace(" ", " ").lstrip()
269-
self.fw.append([self.table, "", rstr])
264+
self.fw.append([self.table, self.count, rstr])
270265

271266
def process(self):
272267
for item in self.dbag:
@@ -480,7 +475,7 @@ def configure_iptables(self, dev, obj):
480475
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
481476
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
482477
self.fw.append(["", "front", "-A INPUT -i %s -p esp -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
483-
self.fw.append(["nat", "front", "-A POSTROUTING -o %s -m mark --mark 0x525 -j ACCEPT" % dev])
478+
self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s -m mark --mark 0x525 -j ACCEPT" % dev])
484479
for net in obj['peer_guest_cidr_list'].lstrip().rstrip().split(','):
485480
self.fw.append(["mangle", "front",
486481
"-A FORWARD -s %s -d %s -j MARK --set-xmark 0x525/0xffffffff" % (obj['local_guest_cidr'], net)])
@@ -796,7 +791,7 @@ def forward_vr(self, rule):
796791
rule['internal_ip'],
797792
internal_fwports
798793
)
799-
fw4 = "-A POSTROUTING -j SNAT --to-source %s -s %s -d %s/32 -o %s -p %s -m %s --dport %s" % \
794+
fw4 = "-j SNAT --to-source %s -A POSTROUTING -s %s -d %s/32 -o %s -p %s -m %s --dport %s" % \
800795
(
801796
self.getGuestIp(),
802797
self.getNetworkByIp(rule['internal_ip']),
@@ -991,7 +986,7 @@ def main(argv):
991986
lb.process()
992987

993988
logging.debug("Configuring iptables rules")
994-
nf = CsNetfilters(False)
989+
nf = CsNetfilters()
995990
nf.compare(config.get_fw())
996991

997992
logging.debug("Configuring iptables rules done ...saving rules")

‎systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@
1515
# KIND, either express or implied. See the License for the
1616
# specific language governing permissions and limitations
1717
# under the License.
18-
from CsDatabag import CsDataBag
18+
from CsDatabag import CsDataBag, CsCmdLine
1919
from CsApp import CsApache, CsDnsmasq, CsPasswdSvc
20+
import CsHelper
2021
import logging
2122
from netaddr import IPAddress, IPNetwork
2223
import CsHelper
@@ -197,7 +198,7 @@ def is_added(self):
197198
return self.get_attr("add")
198199

199200
def to_str(self):
200-
print(self.address)
201+
pprint(self.address)
201202

202203

203204
class CsDevice:
@@ -370,6 +371,8 @@ def fw_router(self):
370371
self.fw.append(["mangle", "front",
371372
"-A FIREWALL_%s " % self.address['public_ip'] +
372373
"-m state --state RELATED,ESTABLISHED -j ACCEPT"])
374+
self.fw.append(["mangle", "",
375+
"-A FIREWALL_%s DROP" % self.address['public_ip']])
373376
self.fw.append(["mangle", "",
374377
"-A VPN_%s -m state --state RELATED,ESTABLISHED -j ACCEPT" % self.address['public_ip']])
375378
self.fw.append(["mangle", "",
@@ -387,7 +390,8 @@ def fw_router(self):
387390

388391
self.fw.append(["filter", "", "-A INPUT -d 224.0.0.18/32 -j ACCEPT"])
389392
self.fw.append(["filter", "", "-A INPUT -d 225.0.0.50/32 -j ACCEPT"])
390-
self.fw.append(["filter", "", "-A INPUT -i %s -m state --state RELATED,ESTABLISHED -j ACCEPT" % self.dev])
393+
self.fw.append(["filter", "", "-A INPUT -i %s -m state --state RELATED,ESTABLISHED -j ACCEPT" %
394+
self.dev])
391395
self.fw.append(["filter", "", "-A INPUT -p icmp -j ACCEPT"])
392396
self.fw.append(["filter", "", "-A INPUT -i lo -j ACCEPT"])
393397

@@ -430,13 +434,6 @@ def fw_vpcrouter(self):
430434
self.fw.append(["mangle", "front", "-A PREROUTING " +
431435
"-m state --state RELATED,ESTABLISHED " +
432436
"-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"])
433-
434-
self.fw.append(["", "front", "-A FORWARD -j NETWORK_STATS"])
435-
self.fw.append(["", "front", "-A INPUT -j NETWORK_STATS"])
436-
self.fw.append(["", "front", "-A OUTPUT -j NETWORK_STATS"])
437-
438-
self.fw.append(["filter", "", "-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT"])
439-
440437
if self.get_type() in ["guest"]:
441438
self.fw.append(["filter", "", "-A FORWARD -d %s -o %s -j ACL_INBOUND_%s" %
442439
(self.address['network'], self.dev, self.dev)])
@@ -475,14 +472,22 @@ def fw_vpcrouter(self):
475472
])
476473

477474
if self.get_type() in ["public"]:
475+
self.fw.append(["", "front",
476+
"-A FORWARD -o %s -d %s -j ACL_INBOUND_%s" % (
477+
self.dev, self.address['network'], self.dev)
478+
])
478479
self.fw.append(
479480
["mangle", "", "-A FORWARD -j VPN_STATS_%s" % self.dev])
480481
self.fw.append(
481482
["mangle", "", "-A VPN_STATS_%s -o %s -m mark --mark 0x525/0xffffffff" % (self.dev, self.dev)])
482483
self.fw.append(
483484
["mangle", "", "-A VPN_STATS_%s -i %s -m mark --mark 0x524/0xffffffff" % (self.dev, self.dev)])
484485
self.fw.append(
485-
["", "front", "-A FORWARD -j NETWORK_STATS_eth1"])
486+
["", "front", "-A FORWARD -j NETWORK_STATS_%s" % self.dev])
487+
488+
self.fw.append(["", "front", "-A FORWARD -j NETWORK_STATS"])
489+
self.fw.append(["", "front", "-A INPUT -j NETWORK_STATS"])
490+
self.fw.append(["", "front", "-A OUTPUT -j NETWORK_STATS"])
486491

487492
self.fw.append(["", "", "-A NETWORK_STATS -i eth0 -o eth2 -p tcp"])
488493
self.fw.append(["", "", "-A NETWORK_STATS -i eth2 -o eth0 -p tcp"])
@@ -491,11 +496,9 @@ def fw_vpcrouter(self):
491496

492497
self.fw.append(["filter", "", "-A INPUT -d 224.0.0.18/32 -j ACCEPT"])
493498
self.fw.append(["filter", "", "-A INPUT -d 225.0.0.50/32 -j ACCEPT"])
494-
self.fw.append(["filter", "", "-A INPUT -i %s -m state --state RELATED,ESTABLISHED -j ACCEPT" % self.dev])
495-
self.fw.append(["filter", "", "-A INPUT -i lo -j ACCEPT"])
499+
496500
self.fw.append(["filter", "", "-A INPUT -p icmp -j ACCEPT"])
497501
self.fw.append(["filter", "", "-A INPUT -i eth0 -p tcp -m tcp --dport 3922 -m state --state NEW,ESTABLISHED -j ACCEPT"])
498-
self.fw.append(["filter", "", "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT"])
499502

500503
self.fw.append(["filter", "", "-P INPUT DROP"])
501504
self.fw.append(["filter", "", "-P FORWARD DROP"])

‎systemvm/patches/debian/config/opt/cloud/bin/cs/CsDhcp.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ def process(self):
5454
self.cloud.commit()
5555

5656
# We restart DNSMASQ every time the configure.py is called in order to avoid lease problems.
57-
CsHelper.execute2("service dnsmasq restart")
57+
CsHelper.service("dnsmasq", "restart")
5858

5959
def configure_server(self):
6060
# self.conf.addeq("dhcp-hostsfile=%s" % DHCP_HOSTS)

‎systemvm/patches/debian/config/opt/cloud/bin/cs/CsLoadBalancer.py‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,16 +71,14 @@ def _configure_firewall(self, add_rules, remove_rules, stat_rules):
7171
port = path[1]
7272
firewall.append(["filter", "", "-A INPUT -p tcp -m tcp -d %s --dport %s -m state --state NEW -j ACCEPT" % (ip, port)])
7373

74-
for rules in stat_rules:
74+
for rules in remove_rules:
7575
path = rules.split(':')
7676
ip = path[0]
7777
port = path[1]
78-
firewall.append(["filter", "", "-A INPUT -p tcp -m tcp -d %s --dport %s -m state --state NEW -j ACCEPT" % (ip, port)])
78+
firewall.append(["filter", "", "-D INPUT -p tcp -m tcp -d %s --dport %s -m state --state NEW -j ACCEPT" % (ip, port)])
7979

80-
for rules in remove_rules:
80+
for rules in stat_rules:
8181
path = rules.split(':')
8282
ip = path[0]
8383
port = path[1]
84-
if ["filter", "", "-A INPUT -p tcp -m tcp -d %s --dport %s -m state --state NEW -j ACCEPT" % (ip, port)] in firewall:
85-
firewall.remove(["filter", "", "-A INPUT -p tcp -m tcp -d %s --dport %s -m state --state NEW -j ACCEPT" % (ip, port)])
86-
84+
firewall.append(["filter", "", "-A INPUT -p tcp -m tcp -d %s --dport %s -m state --state NEW -j ACCEPT" % (ip, port)])

‎systemvm/patches/debian/config/opt/cloud/bin/cs/CsNetfilter.py‎

Lines changed: 30 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,10 @@
1515
# KIND, either express or implied. See the License for the
1616
# specific language governing permissions and limitations
1717
# under the License.
18-
from __future__ import print_function
19-
2018
import CsHelper
21-
from CsDatabag import CsCmdLine
19+
from pprint import pprint
20+
from CsDatabag import CsDataBag, CsCmdLine
2221
import logging
23-
from cs_iptables_save import Tables
2422

2523

2624
class CsChain(object):
@@ -83,7 +81,6 @@ class CsNetfilters(object):
8381

8482
def __init__(self, load=True):
8583
self.rules = []
86-
self.iptablerules = []
8784
self.table = CsTable()
8885
self.chain = CsChain()
8986
if load:
@@ -94,10 +91,7 @@ def get_all_rules(self):
9491
if i.startswith('*'): # Table
9592
self.table.add(i[1:])
9693
if i.startswith(':'): # Chain
97-
string = i[1:].split(' ')[0]
98-
cmd = "iptables -t %s -N %s" % (self.table.last(), string)
99-
self.iptablerules.append(cmd)
100-
self.chain.add(self.table.last(), string)
94+
self.chain.add(self.table.last(), i[1:].split(' ')[0])
10195
if i.startswith('-A'): # Rule
10296
self.chain.add_rule(i.split()[1])
10397
rule = CsNetfilter()
@@ -131,7 +125,10 @@ def has_rule(self, new_rule):
131125
def get_unseen(self):
132126
del_list = [x for x in self.rules if x.unseen()]
133127
for r in del_list:
134-
self.delete(r)
128+
cmd = "iptables -t %s %s" % (r.get_table(), r.to_str(True))
129+
logging.debug("unseen cmd: %s ", cmd)
130+
CsHelper.execute(cmd)
131+
# print "Delete rule %s from table %s" % (r.to_str(True), r.get_table())
135132
logging.info("Delete rule %s from table %s", r.to_str(True), r.get_table())
136133

137134
def compare(self, list):
@@ -140,16 +137,12 @@ def compare(self, list):
140137
# Ensure all inbound/outbound chains have a default drop rule
141138
if c.startswith("ACL_INBOUND") or c.startswith("ACL_OUTBOUND"):
142139
list.append(["filter", "", "-A %s -j DROP" % c])
143-
# PASS 1: Ensure all chains are present and cleanup unused rules.
140+
# PASS 1: Ensure all chains are present
144141
for fw in list:
145142
new_rule = CsNetfilter()
146143
new_rule.parse(fw[2])
147144
new_rule.set_table(fw[0])
148-
self.has_rule(new_rule)
149-
150-
self.del_standard()
151-
self.get_unseen()
152-
145+
self.add_chain(new_rule)
153146
# PASS 2: Create rules
154147
for fw in list:
155148
new_rule = CsNetfilter()
@@ -158,33 +151,28 @@ def compare(self, list):
158151
if isinstance(fw[1], int):
159152
new_rule.set_count(fw[1])
160153

161-
logging.info("Add: rule=%s table=%s", fw[2], new_rule.get_table())
162-
# front means insert instead of append
163-
cpy = fw[2]
164-
if fw[1] == "front":
165-
cpy = cpy.replace('-A', '-I')
166-
if isinstance(fw[1], int):
167-
cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), fw[1]))
168-
169-
self.iptablerules.append("iptables -t %s %s" % (new_rule.get_table(), cpy))
170-
self.apply_rules()
171-
172-
def apply_rules(self):
173-
s = []
174-
for r in self.iptablerules:
175-
r.replace(' ', ' ') # Remove duplicate spaces
176-
if r not in s:
177-
s.append(r)
178-
179-
chains = Tables(s)
180-
chains.table_printout()
154+
logging.debug("Checking if the rule already exists: rule=%s table=%s chain=%s", new_rule.get_rule(), new_rule.get_table(), new_rule.get_chain())
155+
if self.has_rule(new_rule):
156+
logging.debug("Exists: rule=%s table=%s", fw[2], new_rule.get_table())
157+
else:
158+
# print "Add rule %s in table %s" % ( fw[2], new_rule.get_table())
159+
logging.info("Add: rule=%s table=%s", fw[2], new_rule.get_table())
160+
# front means insert instead of append
161+
cpy = fw[2]
162+
if fw[1] == "front":
163+
cpy = cpy.replace('-A', '-I')
164+
if isinstance(fw[1], int):
165+
cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), fw[1]))
166+
167+
CsHelper.execute("iptables -t %s %s" % (new_rule.get_table(), cpy))
168+
self.del_standard()
169+
self.get_unseen()
181170

182-
# COMMIT all rules.
183-
result = CsHelper.execute("iptables-restore < /tmp/rules.save")
184-
if result:
185-
logging.info("iptables-restore result: %s", result)
186-
else:
187-
logging.info("iptables-restore result: success!")
171+
def add_chain(self, rule):
172+
""" Add the given chain if it is not already present """
173+
if not self.has_chain(rule.get_table(), rule.get_chain()):
174+
CsHelper.execute("iptables -t %s -N %s" % (rule.get_table(), rule.get_chain()))
175+
self.chain.add(rule.get_table(), rule.get_chain())
188176

189177
def del_standard(self):
190178
""" Del rules that are there but should not be deleted

0 commit comments

Comments
 (0)