package iptables import ( "errors" "fmt" "net" "os/exec" "regexp" "strconv" "strings" log "github.com/Sirupsen/logrus" ) type Action string const ( Add Action = "-A" Delete Action = "-D" ) var ( nat = []string{"-t", "nat"} supportsXlock = false ErrIptablesNotFound = errors.New("Iptables not found") ) type Chain struct { Name string Bridge string } type ChainError struct { Chain string Output []byte } func (e *ChainError) Error() string { return fmt.Sprintf("Error iptables %s: %s", e.Chain, string(e.Output)) } func init() { supportsXlock = exec.Command("iptables", "--wait", "-L", "-n").Run() == nil } func NewChain(name, bridge string) (*Chain, error) { if output, err := Raw("-t", "nat", "-N", name); err != nil { return nil, err } else if len(output) != 0 { return nil, fmt.Errorf("Error creating new iptables chain: %s", output) } chain := &Chain{ Name: name, Bridge: bridge, } if err := chain.Prerouting(Add, "-m", "addrtype", "--dst-type", "LOCAL"); err != nil { return nil, fmt.Errorf("Failed to inject docker in PREROUTING chain: %s", err) } if err := chain.Output(Add, "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", "127.0.0.0/8"); err != nil { return nil, fmt.Errorf("Failed to inject docker in OUTPUT chain: %s", err) } return chain, nil } func RemoveExistingChain(name string) error { chain := &Chain{ Name: name, } return chain.Remove() } func (c *Chain) Forward(action Action, ip net.IP, port int, proto, dest_addr string, dest_port int) error { daddr := ip.String() if ip.IsUnspecified() { // iptables interprets "0.0.0.0" as "0.0.0.0/32", whereas we // want "0.0.0.0/0". "0/0" is correctly interpreted as "any // value" by both iptables and ip6tables. daddr = "0/0" } if output, err := Raw("-t", "nat", fmt.Sprint(action), c.Name, "-p", proto, "-d", daddr, "--dport", strconv.Itoa(port), "!", "-i", c.Bridge, "-j", "DNAT", "--to-destination", net.JoinHostPort(dest_addr, strconv.Itoa(dest_port))); err != nil { return err } else if len(output) != 0 { return &ChainError{Chain: "FORWARD", Output: output} } fAction := action if fAction == Add { fAction = "-I" } if output, err := Raw(string(fAction), "FORWARD", "!", "-i", c.Bridge, "-o", c.Bridge, "-p", proto, "-d", dest_addr, "--dport", strconv.Itoa(dest_port), "-j", "ACCEPT"); err != nil { return err } else if len(output) != 0 { return &ChainError{Chain: "FORWARD", Output: output} } return nil } func (c *Chain) Prerouting(action Action, args ...string) error { a := append(nat, fmt.Sprint(action), "PREROUTING") if len(args) > 0 { a = append(a, args...) } if output, err := Raw(append(a, "-j", c.Name)...); err != nil { return err } else if len(output) != 0 { return &ChainError{Chain: "PREROUTING", Output: output} } return nil } func (c *Chain) Output(action Action, args ...string) error { a := append(nat, fmt.Sprint(action), "OUTPUT") if len(args) > 0 { a = append(a, args...) } if output, err := Raw(append(a, "-j", c.Name)...); err != nil { return err } else if len(output) != 0 { return &ChainError{Chain: "OUTPUT", Output: output} } return nil } func (c *Chain) Remove() error { // Ignore errors - This could mean the chains were never set up c.Prerouting(Delete, "-m", "addrtype", "--dst-type", "LOCAL") c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", "127.0.0.0/8") c.Output(Delete, "-m", "addrtype", "--dst-type", "LOCAL") // Created in versions <= 0.1.6 c.Prerouting(Delete) c.Output(Delete) Raw("-t", "nat", "-F", c.Name) Raw("-t", "nat", "-X", c.Name) return nil } // Check if an existing rule exists func Exists(args ...string) bool { // iptables -C, --check option was added in v.1.4.11 // http://ftp.netfilter.org/pub/iptables/changes-iptables-1.4.11.txt // try -C // if exit status is 0 then return true, the rule exists if _, err := Raw(append([]string{"-C"}, args...)...); err == nil { return true } // parse iptables-save for the rule rule := strings.Replace(strings.Join(args, " "), "-t nat ", "", -1) existingRules, _ := exec.Command("iptables-save").Output() // regex to replace ips in rule // because MASQUERADE rule will not be exactly what was passed re := regexp.MustCompile(`[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,2}`) return strings.Contains( re.ReplaceAllString(string(existingRules), "?"), re.ReplaceAllString(rule, "?"), ) } func Raw(args ...string) ([]byte, error) { path, err := exec.LookPath("iptables") if err != nil { return nil, ErrIptablesNotFound } if supportsXlock { args = append([]string{"--wait"}, args...) } log.Debugf("%s, %v", path, args) output, err := exec.Command(path, args...).CombinedOutput() if err != nil { return nil, fmt.Errorf("iptables failed: iptables %v: %s (%s)", strings.Join(args, " "), output, err) } // ignore iptables' message about xtables lock if strings.Contains(string(output), "waiting for it to exit") { output = []byte("") } return output, err }