sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-04-18 08:16:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove default protocol for migrated rules policy

Browse Source
This commit is contained in:
Givi Khojanashvili
2023-03-24 14:59:34 +04:00
parent 27e4fb686f
commit 7474432bea
4 changed files with 16 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
client/firewall/iptables/manager_linux.go
View File

@@ -27,6 +27,9 @@ var pingSupportDefaultRule = []string{
"-p", "icmp", "--icmp-type", "echo-request", "-j", "-p", "icmp", "--icmp-type", "echo-request", "-j",
"ACCEPT", "-m", "comment", "--comment", "Allow pings from the Netbird Devices"} "ACCEPT", "-m", "comment", "--comment", "Allow pings from the Netbird Devices"}
// dropAllDefaultRule in the Netbird chain
var dropAllDefaultRule = []string{"-j", "DROP"}
// Manager of iptables firewall // Manager of iptables firewall
type Manager struct { type Manager struct {
mutex sync.Mutex mutex sync.Mutex
@@ -184,7 +187,9 @@ func (m *Manager) filterRuleSpecs(
case fw.DirectionDst: case fw.DirectionDst:
specs = append(specs, "-d", ip.String()) specs = append(specs, "-d", ip.String())
} }
specs = append(specs, "-p", protocol) if protocol != "" {
specs = append(specs, "-p", protocol)
}
if port != "" { if port != "" {
specs = append(specs, "--dport", port) specs = append(specs, "--dport", port)
} }
@@ -224,6 +229,10 @@ func (m *Manager) client(ip net.IP) (*iptables.IPTables, error) {
return nil, fmt.Errorf("failed to create default ping allow rule: %w", err) return nil, fmt.Errorf("failed to create default ping allow rule: %w", err)
} }
if err := client.AppendUnique("filter", ChainFilterName, dropAllDefaultRule...); err != nil {
return nil, fmt.Errorf("failed to create default drop all in netbird chain: %w", err)
}
specs := append([]string{"-i", m.wgIfaceName}, jumpNetbirdDefaultRule...) specs := append([]string{"-i", m.wgIfaceName}, jumpNetbirdDefaultRule...)
if err := client.AppendUnique("filter", "INPUT", specs...); err != nil { if err := client.AppendUnique("filter", "INPUT", specs...); err != nil {
return nil, fmt.Errorf("failed to create chain: %w", err) return nil, fmt.Errorf("failed to create chain: %w", err)

3
client/internal/engine.go
View File

@@ -1098,9 +1098,6 @@ func (e *Engine) protoRuleToFirewallRule(r *mgmProto.FirewallRule) firewall.Rule
protocol = firewall.ProtocolUDP protocol = firewall.ProtocolUDP
case "icmp": case "icmp":
protocol = firewall.ProtocolICMP protocol = firewall.ProtocolICMP
default:
log.Errorf("invalid protocol, skipping firewall rule: %q", r.Protocol)
return nil
} }
var direction firewall.Direction var direction firewall.Direction

7
management/server/policy.go
View File

@@ -228,13 +228,6 @@ func (f *FirewallRule) parseFromRegoResult(value interface{}) error {
f.Direction = direction f.Direction = direction
f.Action = action f.Action = action
// TODO: remove this after migration from rules
//
// by default if protocol not present use TCP
if f.Protocol == "" {
f.Protocol = "tcp"
}
return nil return nil
} }

12
management/server/policy_test.go
View File

@@ -53,12 +53,12 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
assert.Contains(t, peers, account.Peers["peer3"]) assert.Contains(t, peers, account.Peers["peer3"])
epectedFirewallRules := []*FirewallRule{ epectedFirewallRules := []*FirewallRule{
{PeerID: "peer1", PeerIP: "10.20.0.1", Direction: "dst", Action: "accept", Protocol: "tcp", Port: ""}, {PeerID: "peer1", PeerIP: "10.20.0.1", Direction: "dst", Action: "accept", Port: ""},
{PeerID: "peer2", PeerIP: "10.20.0.2", Direction: "dst", Action: "accept", Protocol: "tcp", Port: ""}, {PeerID: "peer2", PeerIP: "10.20.0.2", Direction: "dst", Action: "accept", Port: ""},
{PeerID: "peer3", PeerIP: "10.20.0.3", Direction: "dst", Action: "accept", Protocol: "tcp", Port: ""}, {PeerID: "peer3", PeerIP: "10.20.0.3", Direction: "dst", Action: "accept", Port: ""},
{PeerID: "peer1", PeerIP: "10.20.0.1", Direction: "src", Action: "accept", Protocol: "tcp", Port: ""}, {PeerID: "peer1", PeerIP: "10.20.0.1", Direction: "src", Action: "accept", Port: ""},
{PeerID: "peer2", PeerIP: "10.20.0.2", Direction: "src", Action: "accept", Protocol: "tcp", Port: ""}, {PeerID: "peer2", PeerIP: "10.20.0.2", Direction: "src", Action: "accept", Port: ""},
{PeerID: "peer3", PeerIP: "10.20.0.3", Direction: "src", Action: "accept", Protocol: "tcp", Port: ""}, {PeerID: "peer3", PeerIP: "10.20.0.3", Direction: "src", Action: "accept", Port: ""},
} }
assert.Len(t, firewallRules, len(epectedFirewallRules)) assert.Len(t, firewallRules, len(epectedFirewallRules))
for i := range firewallRules { for i := range firewallRules {