Skip to content

Commit 7e0ecd4

Browse files
EikykunEikykun
committed
fix init.sh
1 parent 3bc3457 commit 7e0ecd4

File tree

1 file changed

+42
-42
lines changed

1 file changed

+42
-42
lines changed

‎artifacts/scripts/proxy-init.sh

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,27 @@ if [ ! -f "${SA_DIR}/token" ]; then
1414
fi
1515

1616
# Remove the old chains, to generate new configs.
17-
iptables -t nat -D PREROUTING -p tcp -j ctrlmesh_PROXY_INBOUND 2>/dev/null
18-
iptables -t mangle -D PREROUTING -p tcp -j ctrlmesh_PROXY_INBOUND 2>/dev/null
19-
iptables -t nat -D OUTPUT -p tcp -j ctrlmesh_PROXY_OUTPUT 2>/dev/null
17+
iptables -t nat -D PREROUTING -p tcp -j CTRLMESH_INBOUND 2>/dev/null
18+
iptables -t mangle -D PREROUTING -p tcp -j CTRLMESH_INBOUND 2>/dev/null
19+
iptables -t nat -D OUTPUT -p tcp -j CTRLMESH_OUTPUT 2>/dev/null
2020

2121
# Flush and delete the ctrlmesh chains.
22-
iptables -t nat -F ctrlmesh_PROXY_OUTPUT 2>/dev/null
23-
iptables -t nat -X ctrlmesh_PROXY_OUTPUT 2>/dev/null
24-
iptables -t nat -F ctrlmesh_PROXY_INBOUND 2>/dev/null
25-
iptables -t nat -X ctrlmesh_PROXY_INBOUND 2>/dev/null
26-
iptables -t mangle -F ctrlmesh_PROXY_INBOUND 2>/dev/null
27-
iptables -t mangle -X ctrlmesh_PROXY_INBOUND 2>/dev/null
28-
iptables -t mangle -F ctrlmesh_PROXY_DIVERT 2>/dev/null
29-
iptables -t mangle -X ctrlmesh_PROXY_DIVERT 2>/dev/null
30-
iptables -t mangle -F ctrlmesh_PROXY_TPROXY 2>/dev/null
31-
iptables -t mangle -X ctrlmesh_PROXY_TPROXY 2>/dev/null
22+
iptables -t nat -F CTRLMESH_OUTPUT 2>/dev/null
23+
iptables -t nat -X CTRLMESH_OUTPUT 2>/dev/null
24+
iptables -t nat -F CTRLMESH_INBOUND 2>/dev/null
25+
iptables -t nat -X CTRLMESH_INBOUND 2>/dev/null
26+
iptables -t mangle -F CTRLMESH_INBOUND 2>/dev/null
27+
iptables -t mangle -X CTRLMESH_INBOUND 2>/dev/null
28+
iptables -t mangle -F CTRLMESH_DIVERT 2>/dev/null
29+
iptables -t mangle -X CTRLMESH_DIVERT 2>/dev/null
30+
iptables -t mangle -F CTRLMESH_TPROXY 2>/dev/null
31+
iptables -t mangle -X CTRLMESH_TPROXY 2>/dev/null
3232

3333
# Must be last, the others refer to it
34-
iptables -t nat -F ctrlmesh_PROXY_REDIRECT 2>/dev/null
35-
iptables -t nat -X ctrlmesh_PROXY_REDIRECT 2>/dev/null
36-
iptables -t nat -F ctrlmesh_PROXY_IN_REDIRECT 2>/dev/null
37-
iptables -t nat -X ctrlmesh_PROXY_IN_REDIRECT 2>/dev/null
34+
iptables -t nat -F CTRLMESH_REDIRECT 2>/dev/null
35+
iptables -t nat -X CTRLMESH_REDIRECT 2>/dev/null
36+
iptables -t nat -F CTRLMESH_IN_REDIRECT 2>/dev/null
37+
iptables -t nat -X CTRLMESH_IN_REDIRECT 2>/dev/null
3838

3939
if [ "${1:-}" = "clean" ]; then
4040
echo "Only cleaning, no new rules added"
@@ -70,13 +70,13 @@ set -o pipefail
7070
set -x # echo on
7171

7272
# Create a new chain for redirecting outbound traffic to the apiserver port.
73-
# In both chains, '-j RETURN' bypasses Proxy and '-j ctrlmesh_PROXY_REDIRECT' redirects to Proxy.
74-
iptables -t nat -N ctrlmesh_PROXY_REDIRECT
75-
iptables -t nat -A ctrlmesh_PROXY_REDIRECT -p tcp -j REDIRECT --to-port "${PROXY_APISERVER_PORT}"
73+
# In both chains, '-j RETURN' bypasses Proxy and '-j CTRLMESH_REDIRECT' redirects to Proxy.
74+
iptables -t nat -N CTRLMESH_REDIRECT
75+
iptables -t nat -A CTRLMESH_REDIRECT -p tcp -j REDIRECT --to-port "${PROXY_APISERVER_PORT}"
7676

7777
# Use this chain also for redirecting inbound traffic to the webhook port when not using TPROXY.
78-
iptables -t nat -N ctrlmesh_PROXY_IN_REDIRECT
79-
iptables -t nat -A ctrlmesh_PROXY_IN_REDIRECT -p tcp -j REDIRECT --to-port "${PROXY_WEBHOOK_PORT}"
78+
iptables -t nat -N CTRLMESH_IN_REDIRECT
79+
iptables -t nat -A CTRLMESH_IN_REDIRECT -p tcp -j REDIRECT --to-port "${PROXY_WEBHOOK_PORT}"
8080

8181
# Handling of inbound ports. Traffic will be redirected to Proxy, which will process and forward
8282
# to the local webhook. If not set, no inbound port will be intercepted by the iptables.
@@ -85,56 +85,56 @@ if [ -n "${INBOUND_WEBHOOK_PORT}" ]; then
8585
# When using TPROXY, create a new chain for routing all inbound traffic to
8686
# Proxy. Any packet entering this chain gets marked with the ${INBOUND_TPROXY_MARK} mark,
8787
# so that they get routed to the loopback interface in order to get redirected to Proxy.
88-
# In the ctrlmesh_PROXY_INBOUND chain, '-j ctrlmesh_PROXY_DIVERT' reroutes to the loopback
88+
# In the CTRLMESH_INBOUND chain, '-j CTRLMESH_DIVERT' reroutes to the loopback
8989
# interface.
9090
# Mark all inbound packets.
91-
iptables -t mangle -N ctrlmesh_PROXY_DIVERT
92-
iptables -t mangle -A ctrlmesh_PROXY_DIVERT -j MARK --set-mark "${INBOUND_TPROXY_MARK}"
93-
iptables -t mangle -A ctrlmesh_PROXY_DIVERT -j ACCEPT
91+
iptables -t mangle -N CTRLMESH_DIVERT
92+
iptables -t mangle -A CTRLMESH_DIVERT -j MARK --set-mark "${INBOUND_TPROXY_MARK}"
93+
iptables -t mangle -A CTRLMESH_DIVERT -j ACCEPT
9494

95-
# Route all packets marked in chain ctrlmesh_PROXY_DIVERT using routing table ${INBOUND_TPROXY_ROUTE_TABLE}.
95+
# Route all packets marked in chain CTRLMESH_DIVERT using routing table ${INBOUND_TPROXY_ROUTE_TABLE}.
9696
ip -f inet rule add fwmark "${INBOUND_TPROXY_MARK}" lookup "${INBOUND_TPROXY_ROUTE_TABLE}"
9797
# In routing table ${INBOUND_TPROXY_ROUTE_TABLE}, create a single default rule to route all traffic to
9898
# the loopback interface.
9999
ip -f inet route add local default dev lo table "${INBOUND_TPROXY_ROUTE_TABLE}" || ip route show table all
100100

101101
# Create a new chain for redirecting inbound traffic to the common Envoy
102102
# port.
103-
# In the ctrlmesh_PROXY_INBOUND chain, '-j RETURN' bypasses Envoy and
104-
# '-j ctrlmesh_PROXY_TPROXY' redirects to Envoy.
105-
iptables -t mangle -N ctrlmesh_PROXY_TPROXY
106-
iptables -t mangle -A ctrlmesh_PROXY_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark "${INBOUND_TPROXY_MARK}"/0xffffffff --on-port "${PROXY_PORT}"
103+
# In the CTRLMESH_INBOUND chain, '-j RETURN' bypasses Envoy and
104+
# '-j CTRLMESH_TPROXY' redirects to Envoy.
105+
iptables -t mangle -N CTRLMESH_TPROXY
106+
iptables -t mangle -A CTRLMESH_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark "${INBOUND_TPROXY_MARK}"/0xffffffff --on-port "${PROXY_PORT}"
107107

108108
table=mangle
109109
else
110110
table=nat
111111
fi
112-
iptables -t "${table}" -N ctrlmesh_PROXY_INBOUND
113-
iptables -t "${table}" -A PREROUTING -p tcp -j ctrlmesh_PROXY_INBOUND
112+
iptables -t "${table}" -N CTRLMESH_INBOUND
113+
iptables -t "${table}" -A PREROUTING -p tcp -j CTRLMESH_INBOUND
114114

115115
if [ "${INBOUND_INTERCEPTION_MODE}" = "TPROXY" ]; then
116-
iptables -t mangle -A ctrlmesh_PROXY_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -m socket -j ctrlmesh_PROXY_DIVERT || echo "No socket match support"
117-
iptables -t mangle -A ctrlmesh_PROXY_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -m socket -j ctrlmesh_PROXY_DIVERT || echo "No socket match support"
118-
iptables -t mangle -A ctrlmesh_PROXY_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -j ctrlmesh_PROXY_TPROXY
116+
iptables -t mangle -A CTRLMESH_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -m socket -j CTRLMESH_DIVERT || echo "No socket match support"
117+
iptables -t mangle -A CTRLMESH_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -m socket -j CTRLMESH_DIVERT || echo "No socket match support"
118+
iptables -t mangle -A CTRLMESH_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -j CTRLMESH_TPROXY
119119
else
120-
iptables -t nat -A ctrlmesh_PROXY_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -j ctrlmesh_PROXY_IN_REDIRECT
120+
iptables -t nat -A CTRLMESH_INBOUND -p tcp --dport "${INBOUND_WEBHOOK_PORT}" -j CTRLMESH_IN_REDIRECT
121121
fi
122122
fi
123123

124124
# Create a new chain for selectively redirecting outbound packets to Proxy.
125-
iptables -t nat -N ctrlmesh_PROXY_OUTPUT
125+
iptables -t nat -N CTRLMESH_OUTPUT
126126

127-
# Jump to the ctrlmesh_PROXY_OUTPUT chain from OUTPUT chain for all tcp traffic.
128-
iptables -t nat -A OUTPUT -p tcp -j ctrlmesh_PROXY_OUTPUT
127+
# Jump to the CTRLMESH_OUTPUT chain from OUTPUT chain for all tcp traffic.
128+
iptables -t nat -A OUTPUT -p tcp -j CTRLMESH_OUTPUT
129129

130130
for uid in ${PROXY_UID}; do
131131
# Avoid infinite loops. Don't redirect Proxy traffic directly back to
132132
# Proxy for non-loopback traffic.
133-
iptables -t nat -A ctrlmesh_PROXY_OUTPUT -m owner --uid-owner "${uid}" -j RETURN
133+
iptables -t nat -A CTRLMESH_OUTPUT -m owner --uid-owner "${uid}" -j RETURN
134134
done
135135

136136
# Redirect all apiserver outbound traffic to Proxy.
137-
iptables -t nat -A ctrlmesh_PROXY_OUTPUT -d "${KUBERNETES_SERVICE_HOST}" -j ctrlmesh_PROXY_REDIRECT
137+
iptables -t nat -A CTRLMESH_OUTPUT -d "${KUBERNETES_SERVICE_HOST}" -j CTRLMESH_REDIRECT
138138

139139
# Generate certs
140140
mount -o remount,rw "${SA_DIR}"

0 commit comments

Comments
 (0)