From 12f8f60d8da3fba9a40fb04823353f3532944e09 Mon Sep 17 00:00:00 2001 From: Paulo Nascimento Date: Sat, 20 Mar 2021 17:40:14 -0300 Subject: [PATCH] Added more logs in when applied firewall rules --- .idea/.gitignore | 8 + .idea/aws.xml | 16 + .idea/codeStyles/Project.xml | 544 +++++++++++++++++++++++++++ .idea/codeStyles/codeStyleConfig.xml | 5 + .idea/kilo.iml | 14 + .idea/misc.xml | 6 + .idea/modules.xml | 8 + .idea/vcs.xml | 6 + pkg/mesh/mesh.go | 2 +- pkg/mesh/routes.go | 18 +- 10 files changed, 624 insertions(+), 3 deletions(-) create mode 100755 .idea/.gitignore create mode 100755 .idea/aws.xml create mode 100755 .idea/codeStyles/Project.xml create mode 100755 .idea/codeStyles/codeStyleConfig.xml create mode 100755 .idea/kilo.iml create mode 100755 .idea/misc.xml create mode 100755 .idea/modules.xml create mode 100755 .idea/vcs.xml diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100755 index 0000000..5ec7379 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Datasource local storage ignored files +/../../../../../../:\Users\Paulo\IdeaProjects\kilo\.idea/dataSources/ +/dataSources.local.xml +# Editor-based HTTP Client requests +/httpRequests/ diff --git a/.idea/aws.xml b/.idea/aws.xml new file mode 100755 index 0000000..8e17318 --- /dev/null +++ b/.idea/aws.xml @@ -0,0 +1,16 @@ + + + + + + + \ No newline at end of file diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml new file mode 100755 index 0000000..6b61059 --- /dev/null +++ b/.idea/codeStyles/Project.xml @@ -0,0 +1,544 @@ + + + + + \ No newline at end of file diff --git a/.idea/codeStyles/codeStyleConfig.xml b/.idea/codeStyles/codeStyleConfig.xml new file mode 100755 index 0000000..52b8918 --- /dev/null +++ b/.idea/codeStyles/codeStyleConfig.xml @@ -0,0 +1,5 @@ + + + + \ No newline at end of file diff --git a/.idea/kilo.iml b/.idea/kilo.iml new file mode 100755 index 0000000..06305a4 --- /dev/null +++ b/.idea/kilo.iml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100755 index 0000000..a994c69 --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100755 index 0000000..c294f54 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100755 index 0000000..c8397c9 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/pkg/mesh/mesh.go b/pkg/mesh/mesh.go index 64eec75..0ff1fd1 100644 --- a/pkg/mesh/mesh.go +++ b/pkg/mesh/mesh.go @@ -489,7 +489,7 @@ func (m *Mesh) applyTopology() { m.errorCounter.WithLabelValues("apply").Inc() return } - ipRules := t.Rules(m.cni) + ipRules := t.Rules(m.cni, m.logger) // If we are handling local routes, ensure the local // tunnel has an IP address and IPIP traffic is allowed. if m.enc.Strategy() != encapsulation.Never && m.local { diff --git a/pkg/mesh/routes.go b/pkg/mesh/routes.go index 04a7812..b7d0c7d 100644 --- a/pkg/mesh/routes.go +++ b/pkg/mesh/routes.go @@ -17,6 +17,8 @@ package mesh import ( + "github.com/go-kit/kit/log" + "github.com/go-kit/kit/log/level" "net" "github.com/vishvananda/netlink" @@ -220,7 +222,7 @@ func encapsulateRoute(route *netlink.Route, encapsulate encapsulation.Strategy, } // Rules returns the iptables rules required by the local node. -func (t *Topology) Rules(cni bool) []iptables.Rule { +func (t *Topology) Rules(cni bool, logger log.Logger) []iptables.Rule { var rules []iptables.Rule rules = append(rules, iptables.NewIPv4Chain("nat", "KILO-NAT")) rules = append(rules, iptables.NewIPv6Chain("nat", "KILO-NAT")) @@ -230,7 +232,19 @@ func (t *Topology) Rules(cni bool) []iptables.Rule { for _, s := range t.segments { rules = append(rules, iptables.NewRule(iptables.GetProtocol(len(s.wireGuardIP)), "nat", "KILO-NAT", "-d", oneAddressCIDR(s.wireGuardIP).String(), "-m", "comment", "--comment", "Kilo: do not NAT packets destined for WireGuared IPs", "-j", "RETURN")) for _, aip := range s.allowedIPs { - rules = append(rules, iptables.NewRule(iptables.GetProtocol(len(aip.IP)), "nat", "KILO-NAT", "-d", aip.String(), "-m", "comment", "--comment", "Kilo: do not NAT packets destined for known IPs", "-j", "RETURN")) + var proto = iptables.GetProtocol(len(aip.IP)) + + var protocolName = "ipv4" + + if proto == iptables.ProtocolIPv6 { + protocolName = "ipv6" + } + + level.Debug(logger).Log("msg", "Applying Firewall Rules...", "IP len", len(aip.IP), "AIP", aip, "Protocol", protocolName) + + rules = append(rules, iptables.NewRule(proto, "nat", "KILO-NAT", "-d", aip.String(), "-m", "comment", "--comment", "Kilo: do not NAT packets destined for known IPs", "-j", "RETURN")) + + level.Debug(logger).Log("msg", "Firewall Rules applied.", "AIP", aip, "Protocol", proto) } } for _, p := range t.peers {