|
| 1 | +package portmapping |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "strconv" |
| 6 | + "strings" |
| 7 | +) |
| 8 | + |
| 9 | +/* Inside hyperstart, there are iptables init job should be done before configure in sandbox rules. |
| 10 | +
|
| 11 | + // iptables -t filter -N hyperstart-INPUT |
| 12 | + // iptables -t nat -N hyperstart-PREROUTING |
| 13 | + // iptables -t filter -I INPUT -j hyperstart-INPUT |
| 14 | + // iptables -t nat -I PREROUTING -j hyperstart-PREROUTING |
| 15 | + // iptables -t filter -A hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT |
| 16 | + // iptables -t filter -A hyperstart-INPUT -p icmp -j ACCEPT |
| 17 | + // iptables -t filter -A hyperstart-INPUT -i lo -j ACCEPT |
| 18 | + // iptables -t filter -A hyperstart-INPUT -j DROP |
| 19 | + // iptables -t nat -A hyperstart-PREROUTING -j RETURN |
| 20 | + // sh -c "echo 10485760 > /proc/sys/net/nf_conntrack_max" |
| 21 | + // sh -c "echo 300 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established" |
| 22 | +
|
| 23 | + // lan |
| 24 | + // iptables -t filter -I hyperstart-INPUT -s %s -j ACCEPT |
| 25 | +
|
| 26 | + These job has been done by hyperstart during initSandbox. |
| 27 | +*/ |
| 28 | + |
| 29 | +func generateRedirectArgs(prefix string, m *PortMapping, insert bool) ([]string, []string, error) { |
| 30 | + // outside |
| 31 | + //iptables -t nat -I hyperstart-PREROUTING -s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d" |
| 32 | + //iptables -t filter -I hyperstart-INPUT -s %s -p %s -m %s --dport %d -j ACCEPT |
| 33 | + var ( |
| 34 | + action = "-I" |
| 35 | + proto string |
| 36 | + dest string |
| 37 | + to string |
| 38 | + ) |
| 39 | + |
| 40 | + if !insert { |
| 41 | + action = "-D" |
| 42 | + } |
| 43 | + |
| 44 | + if strings.EqualFold(m.Protocol, "udp") { |
| 45 | + proto = "udp" |
| 46 | + } else { |
| 47 | + proto = "tcp" |
| 48 | + } |
| 49 | + |
| 50 | + if m.FromPorts.End == 0 || m.FromPorts.End == m.FromPorts.Begin { |
| 51 | + dest = strconv.Itoa(m.FromPorts.Begin) |
| 52 | + m.FromPorts.End = m.FromPorts.Begin |
| 53 | + } else if m.FromPorts.End > m.FromPorts.Begin { |
| 54 | + dest = fmt.Sprintf("%d:%d", m.FromPorts.Begin, m.FromPorts.End) |
| 55 | + } else { |
| 56 | + return []string{}, []string{}, fmt.Errorf("invalid from port range %d-%d", m.FromPorts.Begin, m.FromPorts.End) |
| 57 | + } |
| 58 | + |
| 59 | + if m.ToPorts.End == 0 || m.ToPorts.End == m.ToPorts.Begin { |
| 60 | + to = strconv.Itoa(m.ToPorts.Begin) |
| 61 | + m.ToPorts.End = m.ToPorts.Begin |
| 62 | + } else if m.ToPorts.End > m.ToPorts.Begin { |
| 63 | + to = fmt.Sprintf("%d-%d", m.ToPorts.Begin, m.ToPorts.End) |
| 64 | + } else { |
| 65 | + return []string{}, []string{}, fmt.Errorf("invalid to port range %d-%d", m.ToPorts.Begin, m.ToPorts.End) |
| 66 | + } |
| 67 | + |
| 68 | + //we may map ports 1:N or N:N, but not M:N (M!=1, M!=N) |
| 69 | + hostRange := m.FromPorts.End - m.FromPorts.Begin |
| 70 | + containerRange := m.ToPorts.End - m.ToPorts.Begin |
| 71 | + if hostRange != 0 && hostRange != containerRange { |
| 72 | + return []string{}, []string{}, fmt.Errorf("range mismatch, cannot map ports %s to %s", dest, to) |
| 73 | + } |
| 74 | + |
| 75 | + filterArgs := []string{"iptables", "-t", "filter", action, "hyperstart-INPUT", "-s", prefix, "-p", proto, "-m", proto, "--dport", dest, "-j", "ACCEPT"} |
| 76 | + redirectArgs := []string{"iptables", "-t", "nat", action, "hyperstart-PREROUTING", "-s", prefix, "-p", proto, "-m", proto, "--dport", dest, "-j", "REDIRECT", "--to-port", to} |
| 77 | + |
| 78 | + return redirectArgs, filterArgs, nil |
| 79 | +} |
| 80 | + |
| 81 | +func setupInSandboxMappings(extPrefix []string, maps []*PortMapping) ([][]string, error) { |
| 82 | + res := [][]string{} |
| 83 | + for _, prefix := range extPrefix { |
| 84 | + for _, m := range maps { |
| 85 | + redirect, filter, err := generateRedirectArgs(prefix, m, true) |
| 86 | + if err != nil { |
| 87 | + return nil, err |
| 88 | + } |
| 89 | + res = append(res, redirect, filter) |
| 90 | + } |
| 91 | + } |
| 92 | + return res, nil |
| 93 | +} |
| 94 | + |
| 95 | +func releaseInSandboxMappings(extPrefix []string, maps []*PortMapping) ([][]string, error) { |
| 96 | + res := [][]string{} |
| 97 | + for _, prefix := range extPrefix { |
| 98 | + for _, m := range maps { |
| 99 | + redirect, filter, err := generateRedirectArgs(prefix, m, false) |
| 100 | + if err != nil { |
| 101 | + return nil, err |
| 102 | + } |
| 103 | + res = append(res, redirect, filter) |
| 104 | + } |
| 105 | + } |
| 106 | + return res, nil |
| 107 | +} |
0 commit comments