mirror of https://github.com/tailscale/tailscale/
util/linuxfw: decoupling IPTables logic from linux router
This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>pull/8471/head
KevinLiang10
12 months ago
committed by
KevinLiang10
parent
9c64e015e5
commit
243ce6ccc1
@ -0,0 +1,475 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
//go:build linux
|
||||||
|
|
||||||
|
package linuxfw
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"net/netip"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/coreos/go-iptables/iptables"
|
||||||
|
"tailscale.com/net/tsaddr"
|
||||||
|
"tailscale.com/types/logger"
|
||||||
|
"tailscale.com/util/multierr"
|
||||||
|
)
|
||||||
|
|
||||||
|
type iptablesInterface interface {
|
||||||
|
// Adding this interface for testing purposes so we can mock out
|
||||||
|
// the iptables library, in reality this is a wrapper to *iptables.IPTables.
|
||||||
|
Insert(table, chain string, pos int, args ...string) error
|
||||||
|
Append(table, chain string, args ...string) error
|
||||||
|
Exists(table, chain string, args ...string) (bool, error)
|
||||||
|
Delete(table, chain string, args ...string) error
|
||||||
|
ClearChain(table, chain string) error
|
||||||
|
NewChain(table, chain string) error
|
||||||
|
DeleteChain(table, chain string) error
|
||||||
|
}
|
||||||
|
|
||||||
|
type iptablesRunner struct {
|
||||||
|
ipt4 iptablesInterface
|
||||||
|
ipt6 iptablesInterface
|
||||||
|
|
||||||
|
v6Available bool
|
||||||
|
v6NATAvailable bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewIPTablesRunner constructs a NetfilterRunner that programs iptables rules.
|
||||||
|
// If the underlying iptables library fails to initialize, that error is
|
||||||
|
// returned. The runner probes for IPv6 support once at initialization time and
|
||||||
|
// if not found, no IPv6 rules will be modified for the lifetime of the runner.
|
||||||
|
func NewIPTablesRunner(logf logger.Logf) (*iptablesRunner, error) {
|
||||||
|
ipt4, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
supportsV6, supportsV6NAT := false, false
|
||||||
|
v6err := checkIPv6(logf)
|
||||||
|
if v6err != nil {
|
||||||
|
logf("disabling tunneled IPv6 due to system IPv6 config: %v", v6err)
|
||||||
|
} else {
|
||||||
|
supportsV6 = true
|
||||||
|
supportsV6NAT = supportsV6 && checkSupportsV6NAT()
|
||||||
|
logf("v6nat = %v", supportsV6NAT)
|
||||||
|
}
|
||||||
|
|
||||||
|
var ipt6 *iptables.IPTables
|
||||||
|
if supportsV6 {
|
||||||
|
ipt6, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return &iptablesRunner{ipt4, ipt6, supportsV6, supportsV6NAT}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// HasIPV6 returns true if the system supports IPv6.
|
||||||
|
func (i *iptablesRunner) HasIPV6() bool {
|
||||||
|
return i.v6Available
|
||||||
|
}
|
||||||
|
|
||||||
|
// HasIPV6NAT returns true if the system supports IPv6 NAT.
|
||||||
|
func (i *iptablesRunner) HasIPV6NAT() bool {
|
||||||
|
return i.v6NATAvailable
|
||||||
|
}
|
||||||
|
|
||||||
|
func isErrChainNotExist(err error) bool {
|
||||||
|
return errCode(err) == 1
|
||||||
|
}
|
||||||
|
|
||||||
|
// getIPTByAddr returns the iptablesInterface with correct IP family
|
||||||
|
// that we will be using for the given address.
|
||||||
|
func (i *iptablesRunner) getIPTByAddr(addr netip.Addr) iptablesInterface {
|
||||||
|
nf := i.ipt4
|
||||||
|
if addr.Is6() {
|
||||||
|
nf = i.ipt6
|
||||||
|
}
|
||||||
|
return nf
|
||||||
|
}
|
||||||
|
|
||||||
|
// AddLoopbackRule adds an iptables rule to permit loopback traffic to
|
||||||
|
// a local Tailscale IP.
|
||||||
|
func (i *iptablesRunner) AddLoopbackRule(addr netip.Addr) error {
|
||||||
|
if err := i.getIPTByAddr(addr).Insert("filter", "ts-input", 1, "-i", "lo", "-s", addr.String(), "-j", "ACCEPT"); err != nil {
|
||||||
|
return fmt.Errorf("adding loopback allow rule for %q: %w", addr, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// tsChain returns the name of the tailscale sub-chain corresponding
|
||||||
|
// to the given "parent" chain (e.g. INPUT, FORWARD, ...).
|
||||||
|
func tsChain(chain string) string {
|
||||||
|
return "ts-" + strings.ToLower(chain)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DelLoopbackRule removes the iptables rule permitting loopback
|
||||||
|
// traffic to a Tailscale IP.
|
||||||
|
func (i *iptablesRunner) DelLoopbackRule(addr netip.Addr) error {
|
||||||
|
if err := i.getIPTByAddr(addr).Delete("filter", "ts-input", "-i", "lo", "-s", addr.String(), "-j", "ACCEPT"); err != nil {
|
||||||
|
return fmt.Errorf("deleting loopback allow rule for %q: %w", addr, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// getTables gets the available iptablesInterface in iptables runner.
|
||||||
|
func (i *iptablesRunner) getTables() []iptablesInterface {
|
||||||
|
if i.HasIPV6() {
|
||||||
|
return []iptablesInterface{i.ipt4, i.ipt6}
|
||||||
|
}
|
||||||
|
return []iptablesInterface{i.ipt4}
|
||||||
|
}
|
||||||
|
|
||||||
|
// getNATTables gets the available iptablesInterface in iptables runner.
|
||||||
|
// If the system does not support IPv6 NAT, only the IPv4 iptablesInterface
|
||||||
|
// is returned.
|
||||||
|
func (i *iptablesRunner) getNATTables() []iptablesInterface {
|
||||||
|
if i.HasIPV6NAT() {
|
||||||
|
return i.getTables()
|
||||||
|
}
|
||||||
|
return []iptablesInterface{i.ipt4}
|
||||||
|
}
|
||||||
|
|
||||||
|
// AddHooks inserts calls to tailscale's netfilter chains in
|
||||||
|
// the relevant main netfilter chains. The tailscale chains must
|
||||||
|
// already exist. If they do not, an error is returned.
|
||||||
|
func (i *iptablesRunner) AddHooks() error {
|
||||||
|
// divert inserts a jump to the tailscale chain in the given table/chain.
|
||||||
|
// If the jump already exists, it is a no-op.
|
||||||
|
divert := func(ipt iptablesInterface, table, chain string) error {
|
||||||
|
tsChain := tsChain(chain)
|
||||||
|
|
||||||
|
args := []string{"-j", tsChain}
|
||||||
|
exists, err := ipt.Exists(table, chain, args...)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("checking for %v in %s/%s: %w", args, table, chain, err)
|
||||||
|
}
|
||||||
|
if exists {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if err := ipt.Insert(table, chain, 1, args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in %s/%s: %w", args, table, chain, err)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ipt := range i.getTables() {
|
||||||
|
if err := divert(ipt, "filter", "INPUT"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := divert(ipt, "filter", "FORWARD"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := divert(ipt, "nat", "POSTROUTING"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// AddChains creates custom Tailscale chains in netfilter via iptables
|
||||||
|
// if the ts-chain doesn't already exist.
|
||||||
|
func (i *iptablesRunner) AddChains() error {
|
||||||
|
// create creates a chain in the given table if it doesn't already exist.
|
||||||
|
// If the chain already exists, it is a no-op.
|
||||||
|
create := func(ipt iptablesInterface, table, chain string) error {
|
||||||
|
err := ipt.ClearChain(table, chain)
|
||||||
|
if isErrChainNotExist(err) {
|
||||||
|
// nonexistent chain. let's create it!
|
||||||
|
return ipt.NewChain(table, chain)
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("setting up %s/%s: %w", table, chain, err)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ipt := range i.getTables() {
|
||||||
|
if err := create(ipt, "filter", "ts-input"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := create(ipt, "filter", "ts-forward"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := create(ipt, "nat", "ts-postrouting"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// AddBase adds some basic processing rules to be supplemented by
|
||||||
|
// later calls to other helpers.
|
||||||
|
func (i *iptablesRunner) AddBase(tunname string) error {
|
||||||
|
if err := i.addBase4(tunname); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if i.HasIPV6() {
|
||||||
|
if err := i.addBase6(tunname); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// addBase4 adds some basic IPv6 processing rules to be
|
||||||
|
// supplemented by later calls to other helpers.
|
||||||
|
func (i *iptablesRunner) addBase4(tunname string) error {
|
||||||
|
// Only allow CGNAT range traffic to come from tailscale0. There
|
||||||
|
// is an exception carved out for ranges used by ChromeOS, for
|
||||||
|
// which we fall out of the Tailscale chain.
|
||||||
|
//
|
||||||
|
// Note, this will definitely break nodes that end up using the
|
||||||
|
// CGNAT range for other purposes :(.
|
||||||
|
args := []string{"!", "-i", tunname, "-s", tsaddr.ChromeOSVMRange().String(), "-j", "RETURN"}
|
||||||
|
if err := i.ipt4.Append("filter", "ts-input", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v4/filter/ts-input: %w", args, err)
|
||||||
|
}
|
||||||
|
args = []string{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}
|
||||||
|
if err := i.ipt4.Append("filter", "ts-input", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v4/filter/ts-input: %w", args, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Forward all traffic from the Tailscale interface, and drop
|
||||||
|
// traffic to the tailscale interface by default. We use packet
|
||||||
|
// marks here so both filter/FORWARD and nat/POSTROUTING can match
|
||||||
|
// on these packets of interest.
|
||||||
|
//
|
||||||
|
// In particular, we only want to apply SNAT rules in
|
||||||
|
// nat/POSTROUTING to packets that originated from the Tailscale
|
||||||
|
// interface, but we can't match on the inbound interface in
|
||||||
|
// POSTROUTING. So instead, we match on the inbound interface in
|
||||||
|
// filter/FORWARD, and set a packet mark that nat/POSTROUTING can
|
||||||
|
// use to effectively run that same test again.
|
||||||
|
args = []string{"-i", tunname, "-j", "MARK", "--set-mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask}
|
||||||
|
if err := i.ipt4.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v4/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
args = []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "ACCEPT"}
|
||||||
|
if err := i.ipt4.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v4/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
args = []string{"-o", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}
|
||||||
|
if err := i.ipt4.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v4/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
args = []string{"-o", tunname, "-j", "ACCEPT"}
|
||||||
|
if err := i.ipt4.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v4/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// addBase6 adds some basic IPv4 processing rules to be
|
||||||
|
// supplemented by later calls to other helpers.
|
||||||
|
func (i *iptablesRunner) addBase6(tunname string) error {
|
||||||
|
// TODO: only allow traffic from Tailscale's ULA range to come
|
||||||
|
// from tailscale0.
|
||||||
|
|
||||||
|
args := []string{"-i", tunname, "-j", "MARK", "--set-mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask}
|
||||||
|
if err := i.ipt6.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v6/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
args = []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "ACCEPT"}
|
||||||
|
if err := i.ipt6.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v6/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
// TODO: drop forwarded traffic to tailscale0 from tailscale's ULA
|
||||||
|
// (see corresponding IPv4 CGNAT rule).
|
||||||
|
args = []string{"-o", tunname, "-j", "ACCEPT"}
|
||||||
|
if err := i.ipt6.Append("filter", "ts-forward", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in v6/filter/ts-forward: %w", args, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DelChains removes the custom Tailscale chains from netfilter via iptables.
|
||||||
|
func (i *iptablesRunner) DelChains() error {
|
||||||
|
for _, ipt := range i.getTables() {
|
||||||
|
if err := delChain(ipt, "filter", "ts-input"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := delChain(ipt, "filter", "ts-forward"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := delChain(ipt, "nat", "ts-postrouting"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DelBase empties but does not remove custom Tailscale chains from
|
||||||
|
// netfilter via iptables.
|
||||||
|
func (i *iptablesRunner) DelBase() error {
|
||||||
|
del := func(ipt iptablesInterface, table, chain string) error {
|
||||||
|
if err := ipt.ClearChain(table, chain); err != nil {
|
||||||
|
if isErrChainNotExist(err) {
|
||||||
|
// nonexistent chain. That's fine, since it's
|
||||||
|
// the desired state anyway.
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return fmt.Errorf("flushing %s/%s: %w", table, chain, err)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ipt := range i.getTables() {
|
||||||
|
if err := del(ipt, "filter", "ts-input"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := del(ipt, "filter", "ts-forward"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := del(ipt, "nat", "ts-postrouting"); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DelHooks deletes the calls to tailscale's netfilter chains
|
||||||
|
// in the relevant main netfilter chains.
|
||||||
|
func (i *iptablesRunner) DelHooks(logf logger.Logf) error {
|
||||||
|
for _, ipt := range i.getTables() {
|
||||||
|
if err := delTSHook(ipt, "filter", "INPUT", logf); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := delTSHook(ipt, "filter", "FORWARD", logf); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := delTSHook(ipt, "nat", "POSTROUTING", logf); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// AddSNATRule adds a netfilter rule to SNAT traffic destined for
|
||||||
|
// local subnets.
|
||||||
|
func (i *iptablesRunner) AddSNATRule() error {
|
||||||
|
args := []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "MASQUERADE"}
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := ipt.Append("nat", "ts-postrouting", args...); err != nil {
|
||||||
|
return fmt.Errorf("adding %v in nat/ts-postrouting: %w", args, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DelSNATRule removes the netfilter rule to SNAT traffic destined for
|
||||||
|
// local subnets. An error is returned if the rule does not exist.
|
||||||
|
func (i *iptablesRunner) DelSNATRule() error {
|
||||||
|
args := []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "MASQUERADE"}
|
||||||
|
for _, ipt := range i.getNATTables() {
|
||||||
|
if err := ipt.Delete("nat", "ts-postrouting", args...); err != nil {
|
||||||
|
return fmt.Errorf("deleting %v in nat/ts-postrouting: %w", args, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// IPTablesCleanup removes all Tailscale added iptables rules.
|
||||||
|
// Any errors that occur are logged to the provided logf.
|
||||||
|
func IPTablesCleanup(logf logger.Logf) {
|
||||||
|
err := clearRules(iptables.ProtocolIPv4, logf)
|
||||||
|
if err != nil {
|
||||||
|
logf("linuxfw: clear iptables: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
err = clearRules(iptables.ProtocolIPv6, logf)
|
||||||
|
if err != nil {
|
||||||
|
logf("linuxfw: clear ip6tables: %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// delTSHook deletes hook in a chain that jumps to a ts-chain. If the hook does not
|
||||||
|
// exist, it's a no-op since the desired state is already achieved but we log the
|
||||||
|
// error because error code from the iptables module resists unwrapping.
|
||||||
|
func delTSHook(ipt iptablesInterface, table, chain string, logf logger.Logf) error {
|
||||||
|
tsChain := tsChain(chain)
|
||||||
|
args := []string{"-j", tsChain}
|
||||||
|
if err := ipt.Delete(table, chain, args...); err != nil {
|
||||||
|
// TODO(apenwarr): check for errCode(1) here.
|
||||||
|
// Unfortunately the error code from the iptables
|
||||||
|
// module resists unwrapping, unlike with other
|
||||||
|
// calls. So we have to assume if Delete fails,
|
||||||
|
// it's because there is no such rule.
|
||||||
|
logf("deleting %v in %s/%s: %v", args, table, chain, err)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// delChain flushs and deletes a chain. If the chain does not exist, it's a no-op
|
||||||
|
// since the desired state is already achieved. otherwise, it returns an error.
|
||||||
|
func delChain(ipt iptablesInterface, table, chain string) error {
|
||||||
|
if err := ipt.ClearChain(table, chain); err != nil {
|
||||||
|
if isErrChainNotExist(err) {
|
||||||
|
// nonexistent chain. nothing to do.
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return fmt.Errorf("flushing %s/%s: %w", table, chain, err)
|
||||||
|
}
|
||||||
|
if err := ipt.DeleteChain(table, chain); err != nil {
|
||||||
|
return fmt.Errorf("deleting %s/%s: %w", table, chain, err)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// clearRules clears all the iptables rules created by Tailscale
|
||||||
|
// for the given protocol. If error occurs, it's logged but not returned.
|
||||||
|
func clearRules(proto iptables.Protocol, logf logger.Logf) error {
|
||||||
|
ipt, err := iptables.NewWithProtocol(proto)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
var errs []error
|
||||||
|
|
||||||
|
if err := delTSHook(ipt, "filter", "INPUT", logf); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
if err := delTSHook(ipt, "filter", "FORWARD", logf); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
if err := delTSHook(ipt, "nat", "POSTROUTING", logf); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := delChain(ipt, "filter", "ts-input"); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
if err := delChain(ipt, "filter", "ts-forward"); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := delChain(ipt, "nat", "ts-postrouting"); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return multierr.New(errs...)
|
||||||
|
}
|
||||||
@ -0,0 +1,420 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
//go:build linux
|
||||||
|
|
||||||
|
package linuxfw
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"net/netip"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"tailscale.com/net/tsaddr"
|
||||||
|
)
|
||||||
|
|
||||||
|
var errExec = errors.New("execution failed")
|
||||||
|
|
||||||
|
type fakeIPTables struct {
|
||||||
|
t *testing.T
|
||||||
|
n map[string][]string
|
||||||
|
}
|
||||||
|
|
||||||
|
type fakeRule struct {
|
||||||
|
table, chain string
|
||||||
|
args []string
|
||||||
|
}
|
||||||
|
|
||||||
|
func newIPTables(t *testing.T) *fakeIPTables {
|
||||||
|
return &fakeIPTables{
|
||||||
|
t: t,
|
||||||
|
n: map[string][]string{
|
||||||
|
"filter/INPUT": nil,
|
||||||
|
"filter/OUTPUT": nil,
|
||||||
|
"filter/FORWARD": nil,
|
||||||
|
"nat/PREROUTING": nil,
|
||||||
|
"nat/OUTPUT": nil,
|
||||||
|
"nat/POSTROUTING": nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) Insert(table, chain string, pos int, args ...string) error {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if rules, ok := n.n[k]; ok {
|
||||||
|
if pos > len(rules)+1 {
|
||||||
|
n.t.Errorf("bad position %d in %s", pos, k)
|
||||||
|
return errExec
|
||||||
|
}
|
||||||
|
rules = append(rules, "")
|
||||||
|
copy(rules[pos:], rules[pos-1:])
|
||||||
|
rules[pos-1] = strings.Join(args, " ")
|
||||||
|
n.n[k] = rules
|
||||||
|
} else {
|
||||||
|
n.t.Errorf("unknown table/chain %s", k)
|
||||||
|
return errExec
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) Append(table, chain string, args ...string) error {
|
||||||
|
k := table + "/" + chain
|
||||||
|
return n.Insert(table, chain, len(n.n[k])+1, args...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) Exists(table, chain string, args ...string) (bool, error) {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if rules, ok := n.n[k]; ok {
|
||||||
|
for _, rule := range rules {
|
||||||
|
if rule == strings.Join(args, " ") {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false, nil
|
||||||
|
} else {
|
||||||
|
n.t.Logf("unknown table/chain %s", k)
|
||||||
|
return false, errExec
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func hasChain(n *fakeIPTables, table, chain string) bool {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if _, ok := n.n[k]; ok {
|
||||||
|
return true
|
||||||
|
} else {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) Delete(table, chain string, args ...string) error {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if rules, ok := n.n[k]; ok {
|
||||||
|
for i, rule := range rules {
|
||||||
|
if rule == strings.Join(args, " ") {
|
||||||
|
rules = append(rules[:i], rules[i+1:]...)
|
||||||
|
n.n[k] = rules
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
n.t.Errorf("delete of unknown rule %q from %s", strings.Join(args, " "), k)
|
||||||
|
return errExec
|
||||||
|
} else {
|
||||||
|
n.t.Errorf("unknown table/chain %s", k)
|
||||||
|
return errExec
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) ClearChain(table, chain string) error {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if _, ok := n.n[k]; ok {
|
||||||
|
n.n[k] = nil
|
||||||
|
return nil
|
||||||
|
} else {
|
||||||
|
n.t.Logf("note: ClearChain: unknown table/chain %s", k)
|
||||||
|
return errors.New("exitcode:1")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) NewChain(table, chain string) error {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if _, ok := n.n[k]; ok {
|
||||||
|
n.t.Errorf("table/chain %s already exists", k)
|
||||||
|
return errExec
|
||||||
|
}
|
||||||
|
n.n[k] = nil
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *fakeIPTables) DeleteChain(table, chain string) error {
|
||||||
|
k := table + "/" + chain
|
||||||
|
if rules, ok := n.n[k]; ok {
|
||||||
|
if len(rules) != 0 {
|
||||||
|
n.t.Errorf("%s is not empty", k)
|
||||||
|
return errExec
|
||||||
|
}
|
||||||
|
delete(n.n, k)
|
||||||
|
return nil
|
||||||
|
} else {
|
||||||
|
n.t.Errorf("%s does not exist", k)
|
||||||
|
return errExec
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func newFakeIPTablesRunner(t *testing.T) *iptablesRunner {
|
||||||
|
ipt4 := newIPTables(t)
|
||||||
|
ipt6 := newIPTables(t)
|
||||||
|
|
||||||
|
iptr := &iptablesRunner{ipt4, ipt6, true, true}
|
||||||
|
return iptr
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAddAndDeleteChains(t *testing.T) {
|
||||||
|
iptr := newFakeIPTablesRunner(t)
|
||||||
|
err := iptr.AddChains()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the chains were created.
|
||||||
|
tsChains := []struct{ table, chain string }{ // table/chain
|
||||||
|
{"filter", "ts-input"},
|
||||||
|
{"filter", "ts-forward"},
|
||||||
|
{"nat", "ts-postrouting"},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
for _, tc := range tsChains {
|
||||||
|
// Exists returns error if the chain doesn't exist.
|
||||||
|
if _, err := proto.Exists(tc.table, tc.chain); err != nil {
|
||||||
|
t.Errorf("chain %s/%s doesn't exist", tc.table, tc.chain)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
err = iptr.DelChains()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the chains were deleted.
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
for _, tc := range tsChains {
|
||||||
|
if _, err = proto.Exists(tc.table, tc.chain); err == nil {
|
||||||
|
t.Errorf("chain %s/%s still exists", tc.table, tc.chain)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAddAndDeleteHooks(t *testing.T) {
|
||||||
|
iptr := newFakeIPTablesRunner(t)
|
||||||
|
// don't need to test what happens if the chains don't exist, because
|
||||||
|
// this is handled by fake iptables, in realife iptables would return error.
|
||||||
|
if err := iptr.AddChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
defer iptr.DelChains()
|
||||||
|
|
||||||
|
if err := iptr.AddHooks(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rules were created.
|
||||||
|
tsRules := []fakeRule{ // table/chain/rule
|
||||||
|
{"filter", "INPUT", []string{"-j", "ts-input"}},
|
||||||
|
{"filter", "FORWARD", []string{"-j", "ts-forward"}},
|
||||||
|
{"nat", "POSTROUTING", []string{"-j", "ts-postrouting"}},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
for _, tr := range tsRules {
|
||||||
|
if exists, err := proto.Exists(tr.table, tr.chain, tr.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if !exists {
|
||||||
|
t.Errorf("rule %s/%s/%s doesn't exist", tr.table, tr.chain, strings.Join(tr.args, " "))
|
||||||
|
}
|
||||||
|
// check if the rule is at front of the chain
|
||||||
|
if proto.(*fakeIPTables).n[tr.table+"/"+tr.chain][0] != strings.Join(tr.args, " ") {
|
||||||
|
t.Errorf("v4 rule %s/%s/%s is not at the top", tr.table, tr.chain, strings.Join(tr.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.DelHooks(t.Logf); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rules were deleted.
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
for _, tr := range tsRules {
|
||||||
|
if exists, err := proto.Exists(tr.table, tr.chain, tr.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if exists {
|
||||||
|
t.Errorf("rule %s/%s/%s still exists", tr.table, tr.chain, strings.Join(tr.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.AddHooks(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAddAndDeleteBase(t *testing.T) {
|
||||||
|
iptr := newFakeIPTablesRunner(t)
|
||||||
|
tunname := "tun0"
|
||||||
|
if err := iptr.AddChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.AddBase(tunname); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rules were created.
|
||||||
|
tsRulesV4 := []fakeRule{ // table/chain/rule
|
||||||
|
{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.ChromeOSVMRange().String(), "-j", "RETURN"}},
|
||||||
|
{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}},
|
||||||
|
{"filter", "ts-forward", []string{"-o", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}},
|
||||||
|
}
|
||||||
|
|
||||||
|
tsRulesCommon := []fakeRule{ // table/chain/rule
|
||||||
|
{"filter", "ts-forward", []string{"-i", tunname, "-j", "MARK", "--set-mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask}},
|
||||||
|
{"filter", "ts-forward", []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "ACCEPT"}},
|
||||||
|
{"filter", "ts-forward", []string{"-o", tunname, "-j", "ACCEPT"}},
|
||||||
|
}
|
||||||
|
|
||||||
|
// check that the rules were created for ipt4
|
||||||
|
for _, tr := range append(tsRulesV4, tsRulesCommon...) {
|
||||||
|
if exists, err := iptr.ipt4.Exists(tr.table, tr.chain, tr.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if !exists {
|
||||||
|
t.Errorf("rule %s/%s/%s doesn't exist", tr.table, tr.chain, strings.Join(tr.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// check that the rules were created for ipt6
|
||||||
|
for _, tr := range tsRulesCommon {
|
||||||
|
if exists, err := iptr.ipt6.Exists(tr.table, tr.chain, tr.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if !exists {
|
||||||
|
t.Errorf("rule %s/%s/%s doesn't exist", tr.table, tr.chain, strings.Join(tr.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.DelBase(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rules were deleted.
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
for _, tr := range append(tsRulesV4, tsRulesCommon...) {
|
||||||
|
if exists, err := proto.Exists(tr.table, tr.chain, tr.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if exists {
|
||||||
|
t.Errorf("rule %s/%s/%s still exists", tr.table, tr.chain, strings.Join(tr.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.DelChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAddAndDelLoopbackRule(t *testing.T) {
|
||||||
|
iptr := newFakeIPTablesRunner(t)
|
||||||
|
// We don't need to test for malformed addresses, AddLoopbackRule
|
||||||
|
// takes in a netip.Addr, which is already valid.
|
||||||
|
fakeAddrV4 := netip.MustParseAddr("192.168.0.2")
|
||||||
|
fakeAddrV6 := netip.MustParseAddr("2001:db8::2")
|
||||||
|
|
||||||
|
if err := iptr.AddChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if err := iptr.AddLoopbackRule(fakeAddrV4); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if err := iptr.AddLoopbackRule(fakeAddrV6); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rules were created.
|
||||||
|
tsRulesV4 := fakeRule{ // table/chain/rule
|
||||||
|
"filter", "ts-input", []string{"-i", "lo", "-s", fakeAddrV4.String(), "-j", "ACCEPT"}}
|
||||||
|
|
||||||
|
tsRulesV6 := fakeRule{ // table/chain/rule
|
||||||
|
"filter", "ts-input", []string{"-i", "lo", "-s", fakeAddrV6.String(), "-j", "ACCEPT"}}
|
||||||
|
|
||||||
|
// check that the rules were created for ipt4 and ipt6
|
||||||
|
if exist, err := iptr.ipt4.Exists(tsRulesV4.table, tsRulesV4.chain, tsRulesV4.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if !exist {
|
||||||
|
t.Errorf("rule %s/%s/%s doesn't exist", tsRulesV4.table, tsRulesV4.chain, strings.Join(tsRulesV4.args, " "))
|
||||||
|
}
|
||||||
|
if exist, err := iptr.ipt6.Exists(tsRulesV6.table, tsRulesV6.chain, tsRulesV6.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if !exist {
|
||||||
|
t.Errorf("rule %s/%s/%s doesn't exist", tsRulesV6.table, tsRulesV6.chain, strings.Join(tsRulesV6.args, " "))
|
||||||
|
}
|
||||||
|
|
||||||
|
// check that the rule is at the top
|
||||||
|
chain := "filter/ts-input"
|
||||||
|
if iptr.ipt4.(*fakeIPTables).n[chain][0] != strings.Join(tsRulesV4.args, " ") {
|
||||||
|
t.Errorf("v4 rule %s/%s/%s is not at the top", tsRulesV4.table, tsRulesV4.chain, strings.Join(tsRulesV4.args, " "))
|
||||||
|
}
|
||||||
|
if iptr.ipt6.(*fakeIPTables).n[chain][0] != strings.Join(tsRulesV6.args, " ") {
|
||||||
|
t.Errorf("v6 rule %s/%s/%s is not at the top", tsRulesV6.table, tsRulesV6.chain, strings.Join(tsRulesV6.args, " "))
|
||||||
|
}
|
||||||
|
|
||||||
|
// delete the rules
|
||||||
|
if err := iptr.DelLoopbackRule(fakeAddrV4); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if err := iptr.DelLoopbackRule(fakeAddrV6); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rules were deleted.
|
||||||
|
if exist, err := iptr.ipt4.Exists(tsRulesV4.table, tsRulesV4.chain, tsRulesV4.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if exist {
|
||||||
|
t.Errorf("rule %s/%s/%s still exists", tsRulesV4.table, tsRulesV4.chain, strings.Join(tsRulesV4.args, " "))
|
||||||
|
}
|
||||||
|
|
||||||
|
if exist, err := iptr.ipt6.Exists(tsRulesV6.table, tsRulesV6.chain, tsRulesV6.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if exist {
|
||||||
|
t.Errorf("rule %s/%s/%s still exists", tsRulesV6.table, tsRulesV6.chain, strings.Join(tsRulesV6.args, " "))
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.DelChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAddAndDelSNATRule(t *testing.T) {
|
||||||
|
iptr := newFakeIPTablesRunner(t)
|
||||||
|
|
||||||
|
if err := iptr.AddChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
rule := fakeRule{ // table/chain/rule
|
||||||
|
"nat", "ts-postrouting", []string{"-m", "mark", "--mark", TailscaleSubnetRouteMark + "/" + TailscaleFwmarkMask, "-j", "MASQUERADE"},
|
||||||
|
}
|
||||||
|
|
||||||
|
// Add SNAT rule
|
||||||
|
if err := iptr.AddSNATRule(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rule was created for ipt4 and ipt6
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
if exist, err := proto.Exists(rule.table, rule.chain, rule.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if !exist {
|
||||||
|
t.Errorf("rule %s/%s/%s doesn't exist", rule.table, rule.chain, strings.Join(rule.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Delete SNAT rule
|
||||||
|
if err := iptr.DelSNATRule(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that the rule was deleted for ipt4 and ipt6
|
||||||
|
for _, proto := range []iptablesInterface{iptr.ipt4, iptr.ipt6} {
|
||||||
|
if exist, err := proto.Exists(rule.table, rule.chain, rule.args...); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
} else if exist {
|
||||||
|
t.Errorf("rule %s/%s/%s still exists", rule.table, rule.chain, strings.Join(rule.args, " "))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := iptr.DelChains(); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue