mirror of
https://github.com/gravitl/netmaker.git
synced 2024-09-20 23:36:18 +08:00
Merge branch 'develop' into feature_v0.15.1_apidocs
This commit is contained in:
cameronts
GitHub
commit
ff21ef0995
10
go.mod
10
go.mod
|
|
@ -15,8 +15,8 @@ require (
|
|||
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
|
||||
github.com/stretchr/testify v1.8.0
|
||||
github.com/txn2/txeh v1.3.0
|
||||
github.com/urfave/cli/v2 v2.11.2
|
||||
golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
|
||||
github.com/urfave/cli/v2 v2.14.1
|
||||
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
|
||||
golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094
|
||||
golang.zx2c4.com/wireguard v0.0.0-20220318042302-193cf8d6a5d6 // indirect
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220324164955-056925b7df31
|
||||
|
|
@ -36,7 +36,7 @@ require (
|
|||
)
|
||||
|
||||
require (
|
||||
github.com/coreos/go-oidc/v3 v3.2.0
|
||||
github.com/coreos/go-oidc/v3 v3.3.0
|
||||
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e
|
||||
)
|
||||
|
||||
|
|
@ -92,8 +92,8 @@ require (
|
|||
golang.org/x/image v0.0.0-20220601225756-64ec528b34cd // indirect
|
||||
golang.org/x/mobile v0.0.0-20211207041440-4e6c2922fdee // indirect
|
||||
golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b // indirect
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
|
||||
golang.org/x/sys v0.0.0-20220829200755-d48e67d00261 // indirect
|
||||
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f // indirect
|
||||
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
|
||||
golang.org/x/text v0.3.7 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
|
||||
|
|
|
|||
19
go.sum
19
go.sum
|
|
@ -103,8 +103,8 @@ github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWH
|
|||
github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
|
||||
github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
|
||||
github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
|
||||
github.com/coreos/go-oidc/v3 v3.2.0 h1:2eR2MGR7thBXSQ2YbODlF0fcmgtliLCfr9iX6RW11fc=
|
||||
github.com/coreos/go-oidc/v3 v3.2.0/go.mod h1:rEJ/idjfUyfkBit1eI1fvyr+64/g9dcKpAm8MJMesvo=
|
||||
github.com/coreos/go-oidc/v3 v3.3.0 h1:Y1LV3mP+QT3MEycATZpAiwfyN+uxZLqVbAHJUuOJEe4=
|
||||
github.com/coreos/go-oidc/v3 v3.3.0/go.mod h1:eHUXhZtXPQLgEaDrOVTgwbgmz1xGOkJNye6h3zkD2Pw=
|
||||
github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
|
||||
github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
|
||||
github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
|
||||
|
|
@ -448,8 +448,8 @@ github.com/txn2/txeh v1.3.0/go.mod h1:O7M6gUTPeMF+vsa4c4Ipx3JDkOYrruB1Wry8QRsMcw
|
|||
github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
|
||||
github.com/urfave/cli v1.22.5/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
|
||||
github.com/urfave/cli/v2 v2.4.0/go.mod h1:NX9W0zmTvedE5oDoOMs2RTC8RvdK98NTYZE5LbaEYPg=
|
||||
github.com/urfave/cli/v2 v2.11.2 h1:FVfNg4m3vbjbBpLYxW//WjxUoHvJ9TlppXcqY9Q9ZfA=
|
||||
github.com/urfave/cli/v2 v2.11.2/go.mod h1:f8iq5LtQ/bLxafbdBSLPPNsgaW0l/2fYYEHhAyPlwvo=
|
||||
github.com/urfave/cli/v2 v2.14.1 h1:0Sx+C9404t2+DPuIJ3UpZFOEFhNG3wPxMj7uZHyZKFA=
|
||||
github.com/urfave/cli/v2 v2.14.1/go.mod h1:1CNUng3PtjQMtRzJO4FMXBQvkGtuYRxxiR9xMa7jMwI=
|
||||
github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
|
||||
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
|
||||
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
|
||||
|
|
@ -557,7 +557,6 @@ golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLL
|
|||
golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200425230154-ff2c4b7c35a0/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
|
|
@ -584,6 +583,7 @@ golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su
|
|||
golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
|
||||
golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
|
||||
golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b h1:ZmngSVLe/wycRns9MKikG9OWIEjGcGAkacif7oYQaUY=
|
||||
golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
|
|
@ -620,9 +620,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
|
|||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f h1:Ax0t5p6N38Ga0dThY21weqDEyz2oklo4IvDkpigvkD8=
|
||||
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
|
|
@ -697,8 +696,8 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220829200755-d48e67d00261 h1:v6hYoSR9T5oet+pMXwUWkbiVqx/63mlHjefrHmxwfeY=
|
||||
golang.org/x/sys v0.0.0-20220829200755-d48e67d00261/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
|
||||
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
|
|
@ -959,6 +958,7 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
|
|||
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
||||
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||
google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||
google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
|
||||
google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
||||
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||
|
|
@ -971,7 +971,6 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
|
|||
gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
|
||||
gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
|
||||
gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
|
||||
gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
|
||||
gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
|
||||
gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
|
||||
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
|
|
|
|||
151
logic/gateway.go
151
logic/gateway.go
|
|
@ -37,22 +37,23 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
|
|||
node.EgressGatewayRequest = gateway // store entire request for use when preserving the egress gateway
|
||||
postUpCmd := ""
|
||||
postDownCmd := ""
|
||||
ipv4, ipv6 := getNetworkProtocols(gateway.Ranges)
|
||||
logger.Log(3, "creating egress gateway firewall in use is '", node.FirewallInUse, "'")
|
||||
if node.OS == "linux" {
|
||||
switch node.FirewallInUse {
|
||||
case models.FIREWALL_NFTABLES:
|
||||
// nftables only supported on Linux
|
||||
// assumes chains eg FORWARD and POSTROUTING already exist
|
||||
// assumes chains eg FORWARD and postrouting already exist
|
||||
logger.Log(3, "creating egress gateway nftables is present")
|
||||
// down commands don't remove as removal of the rules leaves an empty chain while
|
||||
// removing the chain with rules in it would remove all rules in that section (not safe
|
||||
// if there are remaining rules on the host that need to stay). In practice the chain is removed
|
||||
// when non-empty even though the removal of a non-empty chain should not be possible per nftables wiki.
|
||||
postUpCmd, postDownCmd = firewallNFTCommandsCreateEgress(node.Interface, gateway.Interface, gateway.Ranges, node.EgressGatewayNatEnabled)
|
||||
postUpCmd, postDownCmd = firewallNFTCommandsCreateEgress(node.Interface, gateway.Interface, gateway.Ranges, node.EgressGatewayNatEnabled, ipv4, ipv6)
|
||||
|
||||
default: // iptables assumed
|
||||
logger.Log(3, "creating egress gateway nftables is not present")
|
||||
postUpCmd, postDownCmd = firewallIPTablesCommandsCreateEgress(node.Interface, gateway.Interface, node.EgressGatewayNatEnabled)
|
||||
postUpCmd, postDownCmd = firewallIPTablesCommandsCreateEgress(node.Interface, gateway.Interface, node.EgressGatewayNatEnabled, ipv4, ipv6)
|
||||
}
|
||||
}
|
||||
if node.OS == "freebsd" {
|
||||
|
|
@ -129,7 +130,10 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
|
|||
// needed in case we don't preserve a gateway (i.e., no ingress to preserve)
|
||||
node.PostUp = ""
|
||||
node.PostDown = ""
|
||||
|
||||
cidrs := []string{}
|
||||
cidrs = append(cidrs, node.IngressGatewayRange)
|
||||
cidrs = append(cidrs, node.IngressGatewayRange6)
|
||||
ipv4, ipv6 := getNetworkProtocols(cidrs)
|
||||
logger.Log(3, "deleting egress gateway firewall in use is '", node.FirewallInUse, "'")
|
||||
if node.IsIngressGateway == "yes" { // check if node is still an ingress gateway before completely deleting postdown/up rules
|
||||
// still have an ingress gateway so preserve it
|
||||
|
|
@ -137,12 +141,12 @@ func DeleteEgressGateway(network, nodeid string) (models.Node, error) {
|
|||
switch node.FirewallInUse {
|
||||
case models.FIREWALL_NFTABLES:
|
||||
// nftables only supported on Linux
|
||||
// assumes chains eg FORWARD and POSTROUTING already exist
|
||||
// assumes chains eg FORWARD and postrouting already exist
|
||||
logger.Log(3, "deleting egress gateway nftables is present")
|
||||
node.PostUp, node.PostDown = firewallNFTCommandsCreateIngress(node.Interface)
|
||||
default:
|
||||
logger.Log(3, "deleting egress gateway nftables is not present")
|
||||
node.PostUp, node.PostDown = firewallIPTablesCommandsCreateIngress(node.Interface)
|
||||
node.PostUp, node.PostDown = firewallIPTablesCommandsCreateIngress(node.Interface, ipv4, ipv6)
|
||||
}
|
||||
}
|
||||
// no need to preserve ingress gateway on FreeBSD as ingress is not supported on that OS
|
||||
|
|
@ -180,17 +184,22 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
|
|||
return models.Node{}, err
|
||||
}
|
||||
node.IsIngressGateway = "yes"
|
||||
cidrs := []string{}
|
||||
cidrs = append(cidrs, network.AddressRange)
|
||||
cidrs = append(cidrs, network.AddressRange6)
|
||||
node.IngressGatewayRange = network.AddressRange
|
||||
node.IngressGatewayRange6 = network.AddressRange6
|
||||
ipv4, ipv6 := getNetworkProtocols(cidrs)
|
||||
logger.Log(3, "creating ingress gateway firewall in use is '", node.FirewallInUse, "'")
|
||||
switch node.FirewallInUse {
|
||||
case models.FIREWALL_NFTABLES:
|
||||
// nftables only supported on Linux
|
||||
// assumes chains eg FORWARD and POSTROUTING already exist
|
||||
// assumes chains eg FORWARD and postrouting already exist
|
||||
logger.Log(3, "creating ingress gateway nftables is present")
|
||||
postUpCmd, postDownCmd = firewallNFTCommandsCreateIngress(node.Interface)
|
||||
default:
|
||||
logger.Log(3, "creating ingress gateway using nftables is not present")
|
||||
postUpCmd, postDownCmd = firewallIPTablesCommandsCreateIngress(node.Interface)
|
||||
postUpCmd, postDownCmd = firewallIPTablesCommandsCreateIngress(node.Interface, ipv4, ipv6)
|
||||
}
|
||||
|
||||
if node.PostUp != "" {
|
||||
|
|
@ -292,8 +301,8 @@ func firewallNFTCommandsCreateIngress(networkInterface string) (string, string)
|
|||
postUp += "nft add rule ip filter FORWARD iifname " + networkInterface + " counter accept ; "
|
||||
postUp += "nft add rule ip filter FORWARD oifname " + networkInterface + " counter accept ; "
|
||||
postUp += "nft add table nat ; "
|
||||
postUp += "nft add chain nat POSTROUTING ; "
|
||||
postUp += "nft add rule ip nat POSTROUTING oifname " + networkInterface + " counter masquerade"
|
||||
postUp += "nft add chain nat postrouting ; "
|
||||
postUp += "nft add rule ip nat postrouting oifname " + networkInterface + " counter masquerade"
|
||||
|
||||
// doesn't remove potentially empty tables or chains
|
||||
postDown := "nft flush table filter ; "
|
||||
|
|
@ -303,61 +312,111 @@ func firewallNFTCommandsCreateIngress(networkInterface string) (string, string)
|
|||
}
|
||||
|
||||
// firewallNFTCommandsCreateEgress - used to centralize firewall command maintenance for creating an egress gateway using the nftables firewall.
|
||||
func firewallNFTCommandsCreateEgress(networkInterface string, gatewayInterface string, gatewayranges []string, egressNatEnabled string) (string, string) {
|
||||
func firewallNFTCommandsCreateEgress(networkInterface string, gatewayInterface string, gatewayranges []string, egressNatEnabled string, ipv4, ipv6 bool) (string, string) {
|
||||
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
|
||||
postUp := "nft add table ip filter ; "
|
||||
postUp += "nft add chain ip filter forward ; "
|
||||
postUp += "nft add rule filter forward ct state related,established accept ; "
|
||||
postUp += "nft add rule ip filter forward iifname " + networkInterface + " accept ; "
|
||||
postUp += "nft add rule ip filter forward oifname " + networkInterface + " accept ; "
|
||||
postUp += "nft add table nat ; "
|
||||
postUp += "nft 'add chain ip nat prerouting { type nat hook prerouting priority 0 ;}' ; "
|
||||
postUp += "nft 'add chain ip nat postrouting { type nat hook postrouting priority 0 ;}' ; "
|
||||
for _, networkCIDR := range gatewayranges {
|
||||
postUp += "nft add rule nat postrouting iifname " + networkInterface + " oifname " + gatewayInterface + " ip saddr " + networkCIDR + " masquerade ; "
|
||||
}
|
||||
|
||||
postDown := "nft flush table filter ; "
|
||||
|
||||
if egressNatEnabled == "yes" {
|
||||
postUp := ""
|
||||
postDown := ""
|
||||
if ipv4 {
|
||||
postUp += "nft add table ip filter ; "
|
||||
postUp += "nft add chain ip filter forward ; "
|
||||
postUp += "nft add rule filter forward ct state related,established accept ; "
|
||||
postUp += "nft add rule ip filter forward iifname " + networkInterface + " accept ; "
|
||||
postUp += "nft add rule ip filter forward oifname " + networkInterface + " accept ; "
|
||||
postUp += "nft add table nat ; "
|
||||
postUp += "nft add chain nat POSTROUTING ; "
|
||||
postUp += "nft add rule ip nat POSTROUTING oifname " + gatewayInterface + " counter masquerade ; "
|
||||
postUp += "nft 'add chain ip nat prerouting { type nat hook prerouting priority 0 ;}' ; "
|
||||
postUp += "nft 'add chain ip nat postrouting { type nat hook postrouting priority 0 ;}' ; "
|
||||
for _, networkCIDR := range gatewayranges {
|
||||
postUp += "nft add rule nat postrouting iifname " + networkInterface + " oifname " + gatewayInterface + " ip saddr " + networkCIDR + " masquerade ; "
|
||||
}
|
||||
|
||||
postDown += "nft flush table nat ; "
|
||||
postDown += "nft flush table filter ; "
|
||||
|
||||
if egressNatEnabled == "yes" {
|
||||
postUp += "nft add table nat ; "
|
||||
postUp += "nft add chain nat postrouting ; "
|
||||
postUp += "nft add rule ip nat postrouting oifname " + gatewayInterface + " counter masquerade ; "
|
||||
|
||||
postDown += "nft flush table nat ; "
|
||||
}
|
||||
}
|
||||
if ipv6 {
|
||||
postUp += "nft add table ip6 filter ; "
|
||||
postUp += "nft add chain ip6 filter forward ; "
|
||||
postUp += "nft add rule ip6 filter forward ct state related,established accept ; "
|
||||
postUp += "nft add rule ip6 filter forward iifname " + networkInterface + " accept ; "
|
||||
postUp += "nft add rule ip6 filter forward oifname " + networkInterface + " accept ; "
|
||||
|
||||
postDown += "nft flush table ip6 filter ; "
|
||||
|
||||
if egressNatEnabled == "yes" {
|
||||
postUp += "nft add table ip6 nat ; "
|
||||
postUp += "nft 'add chain ip6 nat prerouting { type nat hook prerouting priority 0 ;}' ; "
|
||||
postUp += "nft 'add chain ip6 nat postrouting { type nat hook postrouting priority 0 ;}' ; "
|
||||
postUp += "nft add rule ip6 nat postrouting oifname " + gatewayInterface + " masquerade ; "
|
||||
|
||||
postDown += "nft flush table ip6 nat ; "
|
||||
}
|
||||
}
|
||||
|
||||
return postUp, postDown
|
||||
}
|
||||
|
||||
// firewallIPTablesCommandsCreateIngress - used to centralize firewall command maintenance for creating an ingress gateway using the iptables firewall.
|
||||
func firewallIPTablesCommandsCreateIngress(networkInterface string) (string, string) {
|
||||
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
|
||||
postUp := "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "iptables -t nat -A POSTROUTING -o " + networkInterface + " -j MASQUERADE"
|
||||
func firewallIPTablesCommandsCreateIngress(networkInterface string, ipv4, ipv6 bool) (string, string) {
|
||||
postUp := ""
|
||||
postDown := ""
|
||||
if ipv4 {
|
||||
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
|
||||
postUp += "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "iptables -t nat -A POSTROUTING -o " + networkInterface + " -j MASQUERADE ; "
|
||||
|
||||
// doesn't remove potentially empty tables or chains
|
||||
postDown := "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "iptables -t nat -D POSTROUTING -o " + networkInterface + " -j MASQUERADE"
|
||||
// doesn't remove potentially empty tables or chains
|
||||
postDown += "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "iptables -t nat -D POSTROUTING -o " + networkInterface + " -j MASQUERADE ; "
|
||||
}
|
||||
if ipv6 {
|
||||
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
|
||||
postUp += "ip6tables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "ip6tables -A FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "ip6tables -t nat -A POSTROUTING -o " + networkInterface + " -j MASQUERADE"
|
||||
|
||||
// doesn't remove potentially empty tables or chains
|
||||
postDown += "ip6tables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "ip6tables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "ip6tables -t nat -D POSTROUTING -o " + networkInterface + " -j MASQUERADE"
|
||||
}
|
||||
return postUp, postDown
|
||||
}
|
||||
|
||||
// firewallIPTablesCommandsCreateEgress - used to centralize firewall command maintenance for creating an egress gateway using the iptables firewall.
|
||||
func firewallIPTablesCommandsCreateEgress(networkInterface string, gatewayInterface string, egressNatEnabled string) (string, string) {
|
||||
func firewallIPTablesCommandsCreateEgress(networkInterface string, gatewayInterface string, egressNatEnabled string, ipv4, ipv6 bool) (string, string) {
|
||||
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
|
||||
postUp := "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT"
|
||||
postDown := "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT"
|
||||
postUp := ""
|
||||
postDown := ""
|
||||
if ipv4 {
|
||||
postUp += "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT"
|
||||
postDown += "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
|
||||
if egressNatEnabled == "yes" {
|
||||
postUp += " ; iptables -t nat -A POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
|
||||
postDown += " ; iptables -t nat -D POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
|
||||
if egressNatEnabled == "yes" {
|
||||
postUp += " ; iptables -t nat -A POSTROUTING -o " + gatewayInterface + " -j MASQUERADE ; "
|
||||
postDown += " ; iptables -t nat -D POSTROUTING -o " + gatewayInterface + " -j MASQUERADE ; "
|
||||
}
|
||||
}
|
||||
if ipv6 {
|
||||
postUp += "ip6tables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postUp += "ip6tables -A FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "ip6tables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
|
||||
postDown += "ip6tables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
|
||||
|
||||
if egressNatEnabled == "yes" {
|
||||
postUp += " ; ip6tables -t nat -A POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
|
||||
postDown += " ; ip6tables -t nat -D POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
|
||||
}
|
||||
}
|
||||
return postUp, postDown
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -169,3 +169,20 @@ func ShouldPublishPeerPorts(serverNode *models.Node) bool {
|
|||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func getNetworkProtocols(cidrs []string) (bool, bool) {
|
||||
ipv4 := false
|
||||
ipv6 := false
|
||||
for _, cidr := range cidrs {
|
||||
ip, _, err := net.ParseCIDR(cidr)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if ip.To4() == nil {
|
||||
ipv6 = true
|
||||
} else {
|
||||
ipv4 = true
|
||||
}
|
||||
}
|
||||
return ipv4, ipv6
|
||||
}
|
||||
|
|
|
|||
|
|
@ -77,6 +77,7 @@ type Node struct {
|
|||
EgressGatewayRequest EgressGatewayRequest `json:"egressgatewayrequest" bson:"egressgatewayrequest" yaml:"egressgatewayrequest"`
|
||||
RelayAddrs []string `json:"relayaddrs" bson:"relayaddrs" yaml:"relayaddrs"`
|
||||
IngressGatewayRange string `json:"ingressgatewayrange" bson:"ingressgatewayrange" yaml:"ingressgatewayrange"`
|
||||
IngressGatewayRange6 string `json:"ingressgatewayrange6" bson:"ingressgatewayrange6" yaml:"ingressgatewayrange6"`
|
||||
// IsStatic - refers to if the Endpoint is set manually or dynamically
|
||||
IsStatic string `json:"isstatic" bson:"isstatic" yaml:"isstatic" validate:"checkyesorno"`
|
||||
UDPHolePunch string `json:"udpholepunch" bson:"udpholepunch" yaml:"udpholepunch" validate:"checkyesorno"`
|
||||
|
|
@ -370,6 +371,9 @@ func (newNode *Node) Fill(currentNode *Node) { // TODO add new field for nftable
|
|||
if newNode.IngressGatewayRange == "" {
|
||||
newNode.IngressGatewayRange = currentNode.IngressGatewayRange
|
||||
}
|
||||
if newNode.IngressGatewayRange6 == "" {
|
||||
newNode.IngressGatewayRange6 = currentNode.IngressGatewayRange6
|
||||
}
|
||||
if newNode.IsStatic == "" {
|
||||
newNode.IsStatic = currentNode.IsStatic
|
||||
}
|
||||
|
|
|
|||
|
|
@ -151,14 +151,13 @@ type ExtPeersResponse struct {
|
|||
|
||||
// EgressGatewayRequest - egress gateway request
|
||||
type EgressGatewayRequest struct {
|
||||
NodeID string `json:"nodeid" bson:"nodeid"`
|
||||
NetID string `json:"netid" bson:"netid"`
|
||||
RangeString string `json:"rangestring" bson:"rangestring"`
|
||||
NatEnabled string `json:"natenabled" bson:"natenabled"`
|
||||
Ranges []string `json:"ranges" bson:"ranges"`
|
||||
Interface string `json:"interface" bson:"interface"`
|
||||
PostUp string `json:"postup" bson:"postup"`
|
||||
PostDown string `json:"postdown" bson:"postdown"`
|
||||
NodeID string `json:"nodeid" bson:"nodeid"`
|
||||
NetID string `json:"netid" bson:"netid"`
|
||||
NatEnabled string `json:"natenabled" bson:"natenabled"`
|
||||
Ranges []string `json:"ranges" bson:"ranges"`
|
||||
Interface string `json:"interface" bson:"interface"`
|
||||
PostUp string `json:"postup" bson:"postup"`
|
||||
PostDown string `json:"postdown" bson:"postdown"`
|
||||
}
|
||||
|
||||
// RelayRequest - relay request struct
|
||||
|
|
|
|||
Loading…
Reference in a new issue