This repository has been archived by the owner on Feb 8, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 191
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
re-enable the in sandbox portmapping with exec in sandbox
make it more flexible, update without modify hyperstart protocol Signed-off-by: Wang Xu <[email protected]>
- Loading branch information
Showing
7 changed files
with
249 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| { | ||
| "id": "port-mapping-test", | ||
| "containers" : [{ | ||
| "name": "pmtest", | ||
| "image": "busybox:latest", | ||
| "command": ["/bin/nc", "-l", "-p", "1300"] | ||
| }], | ||
| "resource": { | ||
| "vcpu": 1, | ||
| "memory": 128 | ||
| }, | ||
| "portmappingWhiteLists":{ | ||
| "internalNetworks": ["127.0.0.1/32", "192.168.123.0/24"], | ||
| "externalNetworks": ["0.0.0.0/0"] | ||
| }, | ||
| "portmappings": [{ | ||
| "containerport": "1300-1310", | ||
| "hostport": "3000-3010", | ||
| "protocol": "tcp" | ||
| }] | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| package portmapping | ||
|
|
||
| func SetupPortMaps(containerip string, externalPrefix []string, maps []*PortMapping) (preExec [][]string, err error) { | ||
| if len(maps) == 0 { | ||
| return [][]string{}, nil | ||
| } | ||
| if len(externalPrefix) > 0 { | ||
| preExec, err = setupInSandboxMappings(externalPrefix, maps) | ||
| if err != nil { | ||
| return [][]string{}, err | ||
| } | ||
| defer func() { | ||
| if err != nil { | ||
| preExec, _ = releaseInSandboxMappings(externalPrefix, maps) | ||
| } | ||
| }() | ||
| } | ||
| if !disableIptables { | ||
| err = setupIptablesPortMaps(containerip, maps) | ||
| if err != nil { | ||
| return [][]string{}, err | ||
| } | ||
| } | ||
| return preExec, nil | ||
| } | ||
|
|
||
| func ReleasePortMaps(containerip string, externalPrefix []string, maps []*PortMapping) (postExec [][]string, err error) { | ||
| if len(maps) == 0 { | ||
| return [][]string{}, nil | ||
| } | ||
| if len(externalPrefix) > 0 { | ||
| postExec, err = releaseInSandboxMappings(externalPrefix, maps) | ||
| if err != nil { | ||
| return [][]string{}, err | ||
| } | ||
| } | ||
| if !disableIptables { | ||
| err = releaseIptablesPortMaps(containerip, maps) | ||
| if err != nil { | ||
| return [][]string{}, err | ||
| } | ||
| } | ||
| return postExec, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| package portmapping | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strconv" | ||
| "strings" | ||
| ) | ||
|
|
||
| /* Inside hyperstart, there are iptables init job should be done before configure in sandbox rules. | ||
| // iptables -t filter -N hyperstart-INPUT | ||
| // iptables -t nat -N hyperstart-PREROUTING | ||
| // iptables -t filter -I INPUT -j hyperstart-INPUT | ||
| // iptables -t nat -I PREROUTING -j hyperstart-PREROUTING | ||
| // iptables -t filter -A hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| // iptables -t filter -A hyperstart-INPUT -p icmp -j ACCEPT | ||
| // iptables -t filter -A hyperstart-INPUT -i lo -j ACCEPT | ||
| // iptables -t filter -A hyperstart-INPUT -j DROP | ||
| // iptables -t nat -A hyperstart-PREROUTING -j RETURN | ||
| // sh -c "echo 10485760 > /proc/sys/net/nf_conntrack_max" | ||
| // sh -c "echo 300 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established" | ||
| // lan | ||
| // iptables -t filter -I hyperstart-INPUT -s %s -j ACCEPT | ||
| These job has been done by hyperstart during initSandbox. | ||
| */ | ||
|
|
||
| func generateRedirectArgs(prefix string, m *PortMapping, insert bool) ([]string, []string, error) { | ||
| // outside | ||
| //iptables -t nat -I hyperstart-PREROUTING -s %s -p %s -m %s --dport %d -j REDIRECT --to-ports %d" | ||
| //iptables -t filter -I hyperstart-INPUT -s %s -p %s -m %s --dport %d -j ACCEPT | ||
| var ( | ||
| action = "-I" | ||
| proto string | ||
| dest string | ||
| to string | ||
| ) | ||
|
|
||
| if !insert { | ||
| action = "-D" | ||
| } | ||
|
|
||
| if strings.EqualFold(m.Protocol, "udp") { | ||
| proto = "udp" | ||
| } else { | ||
| proto = "tcp" | ||
| } | ||
|
|
||
| if m.FromPorts.End == 0 || m.FromPorts.End == m.FromPorts.Begin { | ||
| dest = strconv.Itoa(m.FromPorts.Begin) | ||
| m.FromPorts.End = m.FromPorts.Begin | ||
| } else if m.FromPorts.End > m.FromPorts.Begin { | ||
| dest = fmt.Sprintf("%d:%d", m.FromPorts.Begin, m.FromPorts.End) | ||
| } else { | ||
| return []string{}, []string{}, fmt.Errorf("invalid from port range %d-%d", m.FromPorts.Begin, m.FromPorts.End) | ||
| } | ||
|
|
||
| if m.ToPorts.End == 0 || m.ToPorts.End == m.ToPorts.Begin { | ||
| to = strconv.Itoa(m.ToPorts.Begin) | ||
| m.ToPorts.End = m.ToPorts.Begin | ||
| } else if m.ToPorts.End > m.ToPorts.Begin { | ||
| to = fmt.Sprintf("%d-%d", m.ToPorts.Begin, m.ToPorts.End) | ||
| } else { | ||
| return []string{}, []string{}, fmt.Errorf("invalid to port range %d-%d", m.ToPorts.Begin, m.ToPorts.End) | ||
| } | ||
|
|
||
| //we may map ports 1:N or N:N, but not M:N (M!=1, M!=N) | ||
| hostRange := m.FromPorts.End - m.FromPorts.Begin | ||
| containerRange := m.ToPorts.End - m.ToPorts.Begin | ||
| if hostRange != 0 && hostRange != containerRange { | ||
| return []string{}, []string{}, fmt.Errorf("range mismatch, cannot map ports %s to %s", dest, to) | ||
| } | ||
|
|
||
| filterArgs := []string{"iptables", "-t", "filter", action, "hyperstart-INPUT", "-s", prefix, "-p", proto, "-m", proto, "--dport", dest, "-j", "ACCEPT"} | ||
| redirectArgs := []string{"iptables", "-t", "nat", action, "hyperstart-PREROUTING", "-s", prefix, "-p", proto, "-m", proto, "--dport", dest, "-j", "REDIRECT", "--to-port", to} | ||
|
|
||
| return redirectArgs, filterArgs, nil | ||
| } | ||
|
|
||
| func setupInSandboxMappings(extPrefix []string, maps []*PortMapping) ([][]string, error) { | ||
| res := [][]string{} | ||
| for _, prefix := range extPrefix { | ||
| for _, m := range maps { | ||
| redirect, filter, err := generateRedirectArgs(prefix, m, true) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| res = append(res, redirect, filter) | ||
| } | ||
| } | ||
| return res, nil | ||
| } | ||
|
|
||
| func releaseInSandboxMappings(extPrefix []string, maps []*PortMapping) ([][]string, error) { | ||
| res := [][]string{} | ||
| for _, prefix := range extPrefix { | ||
| for _, m := range maps { | ||
| redirect, filter, err := generateRedirectArgs(prefix, m, false) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| res = append(res, redirect, filter) | ||
| } | ||
| } | ||
| return res, nil | ||
| } |