gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2024-09-20 23:36:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

Modified ingress deletion handling to preserve egress gateway if present. Removed ingress from FreeBSD as not supported.

Browse source
This commit is contained in:
cameronts 2022-08-03 11:36:16 -07:00
parent 766084d6a3
commit eab23b7022
1 changed files with 50 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

56
logic/gateway.go
View file

@ -134,6 +134,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostUp = ""
node.PostDown = ""
if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules
// still have an ingress gateway so preserve it
if node.OS == "linux" {
// nftables only supported on Linux
if node.IsNFTablesPresent == "yes" {
@ -155,12 +156,7 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
node.PostDown += "iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE"
}
}
if node.OS == "freebsd" {
node.PostUp = ""
node.PostDown = "ipfw delete 64000 ; "
node.PostDown += "ipfw delete 65534 ; "
node.PostDown += "kldunload ipfw_nat ipfw"
}
// no need to preserve ingress gateway on FreeBSD as ingress is not supported on that OS
}
node.SetLastModified()
@ -257,12 +253,60 @@ func DeleteIngressGateway(networkName string, nodeid string) (models.Node, error
if err = DeleteGatewayExtClients(node.ID, networkName); err != nil {
return models.Node{}, err
}
logger.Log(3, "deleting ingress gateway")
node.UDPHolePunch = network.DefaultUDPHolePunch
node.LastModified = time.Now().Unix()
node.IsIngressGateway = "no"
node.IngressGatewayRange = ""
if node.IsEgressGateway == "yes" { // check if node is still an egress gateway before completely deleting postdown/up rules
// still have an egress gateway so preserve it
if node.OS == "linux" {
// nftables only supported on Linux
if node.IsNFTablesPresent == "yes" {
// preserve egress gateway via the setup that createegressgateway used
// assumes chains eg FORWARD and POSTROUTING already exist
logger.Log(3, "deleting ingress gateway: nftables in use")
node.PostUp = "nft add rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostUp += "nft add rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
node.PostDown = "nft delete rule ip filter FORWARD iifname " + node.Interface + " counter accept ; "
node.PostDown += "nft delete rule ip filter FORWARD oifname " + node.Interface + " counter accept ; "
if node.EgressGatewayNatEnabled == "yes" {
node.PostUp += "nft add rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
node.PostDown += "nft delete rule ip nat POSTROUTING oifname " + node.Interface + " counter masquerade ;"
}
} else {
// preserve egress gateway via the setup that createegressgateway used
logger.Log(3, "deleting ingress gateway: iptables in use")
node.PostUp = "iptables -A FORWARD -i " + node.Interface + " -j ACCEPT; "
node.PostUp += "iptables -A FORWARD -o " + node.Interface + " -j ACCEPT"
node.PostDown = "iptables -D FORWARD -i " + node.Interface + " -j ACCEPT; "
node.PostDown += "iptables -D FORWARD -o " + node.Interface + " -j ACCEPT"
if node.EgressGatewayNatEnabled == "yes" {
node.PostUp += "; iptables -t nat -A POSTROUTING -o " + node.Interface + " -j MASQUERADE"
node.PostDown += "; iptables -t nat -D POSTROUTING -o " + node.Interface + " -j MASQUERADE"
}
}
}
// preserve egress gateway via the setup that createegressgateway used
if node.OS == "freebsd" {
node.PostUp = "kldload ipfw ipfw_nat ; "
node.PostUp += "ipfw disable one_pass ; "
node.PostUp += "ipfw nat 1 config if " + node.Interface + " same_ports unreg_only reset ; "
node.PostUp += "ipfw add 64000 reass all from any to any in ; "
node.PostUp += "ipfw add 64000 nat 1 ip from any to any in via " + node.Interface + " ; "
node.PostUp += "ipfw add 64000 check-state ; "
node.PostUp += "ipfw add 64000 nat 1 ip from any to any out via " + node.Interface + " ; "
node.PostUp += "ipfw add 65534 allow ip from any to any ; "
node.PostDown = "ipfw delete 64000 ; "
node.PostDown += "ipfw delete 65534 ; "
node.PostDown += "kldunload ipfw_nat ipfw"
}
}
data, err := json.Marshal(&node)
if err != nil {
return models.Node{}, err