Skip to content
This repository was archived by the owner on Jan 6, 2023. It is now read-only.

Commit 75e2388

Browse files
feiskyerfeiskyer
committed
Setup port mapping for containers
1 parent 95394c8 commit 75e2388

File tree

8 files changed

+220
-68
lines changed

8 files changed

+220
-68
lines changed

‎src/Makefile.am‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
AM_CFLAGS = -Wall
22
bin_PROGRAMS=init
3-
init_SOURCES=init.c jsmn.c net.c util.c parse.c container.c exec.c event.c
3+
init_SOURCES=init.c jsmn.c net.c util.c parse.c container.c exec.c event.c portmapping.c

‎src/container.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ struct port {
2828
int host_port;
2929
int container_port;
3030
char *protocol;
31-
}
31+
};
3232

3333
struct hyper_container {
3434
char *id;

‎src/init.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1293,6 +1293,10 @@ int main(int argc, char *argv[])
12931293
symlink("/busybox", "/sh");
12941294
symlink("/busybox", "/tar");
12951295
symlink("/busybox", "/sbin/modprobe");
1296+
symlink("/busybox", "/sbin/depmod");
1297+
symlink("/iptables", "/sbin/iptables");
1298+
symlink("/iptables", "/sbin/iptables-restore");
1299+
symlink("/iptables", "/sbin/iptables-save");
12961300

12971301
cmdline = read_cmdline();
12981302

‎src/parse.c‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -540,8 +540,12 @@ static int container_parse_ports(struct hyper_container *c, char *json, jsmntok_
540540
{
541541
int i = 0, j;
542542

543+
if (toks[i].size == 0) {
544+
return 0;
545+
}
546+
543547
if (toks[i].type != JSMN_ARRAY) {
544-
fprintf(stdout, "ports need array\n");
548+
fprintf(stdout, "ports format error\n");
545549
return -1;
546550
}
547551

@@ -1003,13 +1007,17 @@ static int hyper_parse_white_cidrs(struct hyper_pod *pod, char *json, jsmntok_t
10031007
{
10041008
int i = 0, j;
10051009

1010+
if (toks[i].size == 0) {
1011+
return 0;
1012+
}
1013+
10061014
if (toks[i].type != JSMN_ARRAY) {
1007-
fprintf(stdout, "Dns format incorrect\n");
1015+
fprintf(stdout, "white CIDRs format incorrect\n");
10081016
return -1;
10091017
}
10101018

10111019
pod->w_num = toks[i].size;
1012-
fprintf(stdout, "white cidr count %d\n", pod->w_num);
1020+
fprintf(stdout, "white CIDRs count %d\n", pod->w_num);
10131021

10141022
pod->white_cidrs = calloc(pod->w_num, sizeof(*pod->white_cidrs));
10151023
if (pod->white_cidrs == NULL) {

‎src/portmapping.c‎

Lines changed: 175 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -5,76 +5,79 @@
55
#include <limits.h>
66
#include <errno.h>
77
#include <unistd.h>
8+
#include <sys/wait.h>
9+
#include <sys/utsname.h>
810
#include <arpa/inet.h>
911
#include <fcntl.h>
1012

1113
#include "hyper.h"
1214
#include "util.h"
1315
#include "../config.h"
1416

15-
int hyper_init_iptables()
17+
int hyper_init_modules()
1618
{
17-
const char *cmd = "/sbin/modprobe iptable_filter iptable_nat xt_multiport xt_REDIRECT";
18-
fprintf(stdout, "command for init iptables is %s\n", cmd);
19-
20-
int status = hyper_cmd(cmd);
21-
if (status < 0) {
22-
fprintf(stderr, "modprobe iptables exit unexpectedly, status %d\n", status);
19+
int status = hyper_cmd("/sbin/depmod");
20+
if (status != 0) {
21+
fprintf(stderr, "depmod failed, status: %d\n", status);
22+
return -1;
2323
}
2424

25-
return status
25+
return 0;
2626
}
2727

28-
int hyper_insert_rule(struct ipt_rule rule)
28+
int hyper_setup_iptables_rule(struct ipt_rule rule)
2929
{
3030
char check_cmd[512] = {0};
3131
char cmd[512] = {0};
3232
int check = -1;
3333

34-
if rule.rule != NULL {
35-
sprintf(check_cmd, "/iptables -t %s -C %s %s", rule.table, rule.chain, rule.rule);
36-
sprintf(cmd, "/iptables -t %s %s %s %s", rule.table, rule.op, rule.chain, rule.rule);
34+
if (rule.rule != NULL) {
35+
sprintf(check_cmd, "/sbin/iptables -t %s -C %s %s", rule.table, rule.chain, rule.rule);
36+
sprintf(cmd, "/sbin/iptables -t %s %s %s %s", rule.table, rule.op, rule.chain, rule.rule);
3737
} else {
38-
sprintf(cmd, "/iptables -t %s %s %s", rule.table, rule.op, rule.chain);
38+
sprintf(cmd, "/sbin/iptables -t %s %s %s", rule.table, rule.op, rule.chain);
3939
}
4040

4141
if (strlen(check_cmd) > 0) {
42-
check = hyper_cmd(check_cmd);
43-
fprintf(stdout, "check iptables '%s' status %d\n", check_cmd, status);
42+
check = hyper_cmd(check_cmd);
43+
fprintf(stdout, "check iptables '%s', ret: %d\n", check_cmd, check);
4444
}
45-
46-
if check == 0 {
47-
fprintf(stdout, "iptables rule '%s' already exist\n", rule.rule);
48-
return 0;
45+
46+
if (check == 0) {
47+
// iptables rule already exist, do not insert it again
48+
if (rule.op == "-A" || rule.op == "-I" || rule.op == "-N") {
49+
fprintf(stdout, "iptables rule '%s' already exist\n", rule.rule);
50+
return 0;
51+
}
4952
}
5053

5154
int status = hyper_cmd(cmd);
52-
fprintf(stdout, "insert iptables '%s' status %d\n", cmd, status);
53-
if (status < 0) {
54-
fprintf(stderr, "insert iptables rule failed, status %d\n", status);
55+
fprintf(stdout, "insert iptables '%s', ret: %d\n", cmd, status);
56+
if (status != 0) {
57+
fprintf(stderr, "insert iptables rule failed, ret: %d\n", status);
58+
return -1;
5559
}
5660

57-
return status
61+
return 0;
5862
}
5963

60-
// load iptables modules and initialize iptables chain
64+
// initialize modules and iptables chains
6165
int hyper_setup_portmapping(struct hyper_pod *pod)
6266
{
63-
if pod->w_num == 0 {
67+
if (pod->w_num == 0) {
6468
return 0;
6569
}
6670

67-
if (hyper_init_iptables() < 0) {
68-
fprintf(stderr, "modprobe iptables modules failed\n");
71+
if (hyper_init_modules() < 0) {
6972
return -1;
7073
}
7174

72-
// "/iptables -t filter -N hyperstart-INPUT",
73-
// "/iptables -t nat -N hyperstart-PREROUTING",
74-
// "/iptables -t filter -I INPUT -j hyperstart-INPUT",
75-
// "/iptables -t nat -I PREROUTING -j hyperstart-PREROUTING",
76-
// "/iptables -t filter -A hyperstart-INPUT -j DROP ",
77-
// "/iptables -t nat -A hyperstart-PREROUTING -j RETURN"};
75+
// iptables -t filter -N hyperstart-INPUT
76+
// iptables -t nat -N hyperstart-PREROUTING
77+
// iptables -t filter -I INPUT -j hyperstart-INPUT
78+
// iptables -t nat -I PREROUTING -j hyperstart-PREROUTING
79+
// iptables -t filter -A hyperstart-INPUT -j DROP
80+
// iptables -t nat -A hyperstart-PREROUTING -j RETURN
7881
const struct ipt_rule rules[] = {
7982
{
8083
.table = "filter",
@@ -112,11 +115,11 @@ int hyper_setup_portmapping(struct hyper_pod *pod)
112115
.chain = "hyperstart-PREROUTING",
113116
.rule = "-j RETURN",
114117
},
115-
}
118+
};
116119

117-
for(int i=0; i< sizeof(rules)/sizeof(struct ipt_rule); i++) {
118-
if (hyper_insert_rule(rules[i])<0) {
119-
fprintf(stderr, "insert iptables rule '%s' failed\n", rules[i].rule);
120+
int i = 0;
121+
for(i=0; i< sizeof(rules)/sizeof(struct ipt_rule); i++) {
122+
if (hyper_setup_iptables_rule(rules[i])<0) {
120123
return -1;
121124
}
122125
}
@@ -126,47 +129,160 @@ int hyper_setup_portmapping(struct hyper_pod *pod)
126129

127130
void hyper_cleanup_portmapping(struct hyper_pod *pod)
128131
{
129-
int status = 0;
130-
131-
if pod->w_num == 0 {
132-
return 0;
132+
if (pod->w_num == 0) {
133+
return;
133134
}
134135

135-
// const char* rules[] = {"/iptables -t filter -D hyperstart-INPUT -j DROP ",
136-
// "/iptables -t nat -D hyperstart-PREROUTING -j RETURN",
137-
// "/iptables -t filter -D INPUT -j hyperstart-DNPUT",
138-
// "/iptables -t nat -D PREROUTING -j hyperstart-PREROUTING",
139-
// "/iptables -t filter -F hyperstart-INPUT",
140-
// "/iptables -t nat -F hyperstart-PREROUTING",
141-
// "/iptables -t filter -X hyperstart-INPUT",
142-
// "/iptables -t nat -X hyperstart-PREROUTING",};
136+
// iptables -t filter -D hyperstart-INPUT -j DROP
137+
// iptables -t nat -D hyperstart-PREROUTING -j RETURN
138+
// iptables -t filter -D INPUT -j hyperstart-DNPUT
139+
// iptables -t nat -D PREROUTING -j hyperstart-PREROUTING
140+
// iptables -t filter -F hyperstart-INPUT
141+
// iptables -t nat -F hyperstart-PREROUTING
142+
// iptables -t filter -X hyperstart-INPUT
143+
// iptables -t nat -X hyperstart-PREROUTING
144+
const struct ipt_rule rules[] = {
145+
{
146+
.table = "nat",
147+
.op = "-D",
148+
.chain = "hyperstart-PREROUTING",
149+
.rule = "-j RETURN",
150+
},
151+
{
152+
.table = "filter",
153+
.op = "-D",
154+
.chain = "hyperstart-INPUT",
155+
.rule = "-j DROP",
156+
},
157+
{
158+
.table = "nat",
159+
.op = "-D",
160+
.chain = "PREROUTING",
161+
.rule = "-j hyperstart-PREROUTING",
162+
},
163+
{
164+
.table = "filter",
165+
.op = "-D",
166+
.chain = "INPUT",
167+
.rule = "-j hyperstart-INPUT",
168+
},
169+
{
170+
.table = "nat",
171+
.op = "-F",
172+
.chain = "hyperstart-PREROUTING",
173+
.rule = NULL,
174+
},
175+
{
176+
.table = "nat",
177+
.op = "-X",
178+
.chain = "hyperstart-PREROUTING",
179+
.rule = NULL,
180+
},
181+
{
182+
.table = "filter",
183+
.op = "-F",
184+
.chain = "hyperstart-INPUT",
185+
.rule = NULL,
186+
},
187+
{
188+
.table = "filter",
189+
.op = "-X",
190+
.chain = "hyperstart-INPUT",
191+
.rule = NULL,
192+
},
193+
};
143194

195+
int i = 0;
196+
for(i=0; i< sizeof(rules)/sizeof(struct ipt_rule); i++) {
197+
if (hyper_setup_iptables_rule(rules[i])<0) {
198+
return -1;
199+
}
200+
}
144201
}
145202

146-
// iptables -t filter -I hyperstart-INPUT -s 0.0.0.0/0 -p tcp -m multiport --dports 80 -j ACCEPT
147-
// iptables -t nat -I hyperstart-PREROUTING -p tcp -m tcp --dport 8080 -j REDIRECT --to-ports 80
148203
int hyper_setup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod)
149204
{
150-
if pod->w_num == 0 {
205+
if (pod->w_num == 0) {
151206
return 0;
152207
}
153208

154-
if c->ports_num == 0 {
209+
if (c->ports_num == 0) {
155210
return 0;
156211
}
157212

213+
int i = 0, j = 0;
214+
char rule[128] = {0};
215+
216+
for (i=0; i<c->ports_num; i++) {
217+
sprintf(rule, "-p tcp -m tcp --dport %d -j REDIRECT --to-ports %d", c->ports[i].host_port, c->ports[i].container_port);
218+
struct ipt_rule rediect_rule = {
219+
.table = "nat",
220+
.op = "-I",
221+
.chain = "hyperstart-PREROUTING",
222+
.rule = rule,
223+
};
224+
if (hyper_setup_iptables_rule(rediect_rule)<0) {
225+
fprintf(stderr, "setup rediect_rule '%s' failed\n", rule);
226+
return -1;
227+
}
228+
229+
for (j=0; j<pod->w_num; j++) {
230+
sprintf(rule, "-s %s -p %s -m multiport --dports %d -j ACCEPT", pod->white_cidrs[j], c->ports[i].protocol, c->ports[i].container_port);
231+
struct ipt_rule accept_rule = {
232+
.table = "filter",
233+
.op = "-I",
234+
.chain = "hyperstart-INPUT",
235+
.rule = rule,
236+
};
237+
if (hyper_setup_iptables_rule(accept_rule)<0) {
238+
fprintf(stderr, "setup accept_rule '%s' failed\n", rule);
239+
return -1;
240+
}
241+
}
242+
243+
}
244+
158245
return 0;
159246
}
160247

161-
int hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod)
248+
void hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod)
162249
{
163-
if pod->w_num == 0 {
164-
return 0;
250+
if (pod->w_num == 0) {
251+
return;
165252
}
166253

167-
if c->ports_num == 0 {
168-
return 0;
254+
if (c->ports_num == 0) {
255+
return;
169256
}
170257

171-
return 0;
258+
259+
int i = 0, j = 0;
260+
char rule[128] = {0};
261+
262+
for (i=0; i<c->ports_num; i++) {
263+
sprintf(rule, "-p tcp -m tcp --dport %d -j REDIRECT --to-ports %d", c->ports[i].host_port, c->ports[i].container_port);
264+
struct ipt_rule rediect_rule = {
265+
.table = "nat",
266+
.op = "-D",
267+
.chain = "hyperstart-PREROUTING",
268+
.rule = rule,
269+
};
270+
if (hyper_setup_iptables_rule(rediect_rule)<0) {
271+
fprintf(stderr, "setup rediect_rule '%s' failed\n", rule);
272+
}
273+
274+
for (j=0; j<pod->w_num; j++) {
275+
sprintf(rule, "-s %s -p %s -m multiport --dports %d -j ACCEPT", pod->white_cidrs[j], c->ports[i].protocol, c->ports[i].container_port);
276+
struct ipt_rule accept_rule = {
277+
.table = "filter",
278+
.op = "-D",
279+
.chain = "hyperstart-INPUT",
280+
.rule = rule,
281+
};
282+
if (hyper_setup_iptables_rule(accept_rule)<0) {
283+
fprintf(stderr, "setup accept_rule '%s' failed\n", rule);
284+
}
285+
}
286+
287+
}
172288
}

‎src/portmapping.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ struct hyper_container;
1818
int hyper_setup_portmapping(struct hyper_pod *pod);
1919
void hyper_cleanup_portmapping(struct hyper_pod *pod);
2020
int hyper_setup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod);
21-
int hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod);
21+
void hyper_cleanup_container_portmapping(struct hyper_container *c, struct hyper_pod *pod);
2222

2323
#endif

0 commit comments

Comments
 (0)