refactor iptables handling for improved compatibility across operating systems

Added debug lines into files

.drone.yml

@@ -0,0 +1,48 @@
+kind: pipeline
+type: kubernetes
+name: default
+
+node_selector:
+  physical-node: dev2
+
+trigger:
+  branch:
+    - master
+  event:
+    - push
+workspace:
+  path: /drone/src
+
+steps:
+  - name: build multiarch from dev
+    image: docker.io/owncloudci/drone-docker-buildx:4
+    privileged: true
+    settings:
+      cache-from: [ "registry.dev.format.hu/firewall" ]
+      registry: registry.dev.format.hu
+      repo: registry.dev.format.hu/firewall
+      tags: latest
+      dockerfile: Dockerfile
+      username:
+        from_secret: dev-hu-registry-username
+      password: 
+        from_secret: dev-hu-registry-password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+    
+  - name: pull image to dockerhub
+    image: docker.io/owncloudci/drone-docker-buildx:4
+    privileged: true
+    settings:
+      cache-from: [ "safebox/firewall" ]
+      repo: safebox/firewall
+      tags: latest
+      username:
+        from_secret: dockerhub-username
+      password: 
+        from_secret: dockerhub-password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+

Dockerfile

@@ -1,4 +1,5 @@
-FROM firewall-base:1.8.7
-MAINTAINER gyurix
-COPY firewall /firewall
-ENTRYPOINT ["/firewall/firewall-add"]
+FROM alpine
+
+RUN apk add --update --no-cache iptables iptables-legacy openssl jq curl ca-certificates busybox-extras docker-cli
+COPY firewall/ /firewall/
+CMD firewall/iptables-wrapper-installer.sh && /firewall/firewall-add

firewall/firewall-add

@@ -3,11 +3,14 @@
 # Debugging function
 debug() {
     if [ $DEBUG -eq 1 ]; then
-                echo "DEBUG: "$1 $2 $3
-        fi; 
+        echo $(date)" DEBUG: "$1 $2 $3
+    else
+        echo $(date)" DEBUG: "$1 $2 $3 >>/var/log/iptables.log
+    fi
 }
 
 # Task type variables
+DEBUG=0
 ROUTE=$ROUTE
 HOST=$HOST
 PREROUTING=$PREROUTING
@@ -16,69 +19,303 @@ POSTROUTING=$POSTROUTING
 # Mandatory task variables
 CHAIN=$CHAIN
 NAME=$NAME
-COMMENT=$COMMENT
-NAME=$NAME-$COMMENT
+COMMENT="$COMMENT"
+NAME="$NAME-$COMMENT"
 PROTOCOL=$TYPE
+OPERATION=$OPERATION
 
 EXTRA_OPTIONS="$2 $3 $4"
 
+set | grep SOURCE
+set | grep TARGET
+set | grep ROLES
+
+SERVICE_FILES=$SERVICE_FILES
+HOST_FILE=$HOST_FILE
+if [ "$HOST_FILE" == "" ]; then
+    HOST_FILE="/etc/dns/hosts.local"
+fi
+
+RETRIES_NUMBER=$RETRIES_NUMBER
+
+if [ -z "$RETRIES_NUMBER" ]; then
+    RETRIES_NUMBER=2
+fi
+
 # turn on debug mode by extra option "debug"
 if [[ "$(echo "$EXTRA_OPTIONS" | grep debug)" != "" ]]; then
     DEBUG=1
-      fi;
+fi
 
+# finding IPv4 addresses from application names.
+name_resolver() {
+
+    local DNS_IP
+    local DNS=$1
+    APP_IP=""
+    UP_COUNT=0
+    SRV_COUNT=0
+
+    echo "DNS: "$DNS
+
+    for D in $(echo $DNS); do
+
+        if [ -z "$STRICK_CHECK" ]; then
+            # find $D as SELECTOR in hosts file
+            EXISTS=$(grep -w $D $HOST_FILE)
+            #EXISTS=$(grep -w "$D-" $HOST_FILE); # TODO?
+            if [ -n "$EXISTS" ]; then # selector exists in hosts file
+                # remove all matching selectors and all selctors followed by "-"
+                #APP_IP=$(echo $EXISTS | sed s/$D-.//g | sed s/$D//g);
+                APP_IP=$(echo "$EXISTS" | awk '{print $1}')
+                debug "APP_IP: "$APP_IP
+            else
+                debug "no matching APPLICATION NAME found in $HOST_FILE"
+            fi
+        else
+            D=$(echo $D | cut -d "-" -f1)
+            UP=$(docker ps --format '{{.Names}}\t{{.Status}}' | grep Up | awk '{print $1}' | grep $D"-")
+            # filtering for ROLES variables if exists.
+            if [[ "$ROLES" != "null" && ! -z "$ROLES" ]]; then
+                UPS=""
+                for U in $(echo $UP); do
+                    for ROLE in $(echo $ROLES); do
+                        FILTERED_BY_ROLE=$(docker inspect $U -f '{{.Config.Labels.roles}}' | uniq | grep $ROLE)
+                        if [[ "$(echo $FILTERED_BY_ROLE)" != "" ]]; then
+                            UPS="$UPS $U"
+                        fi
+                    done
+                done
+                UP=$UPS
+            fi
+
+            UP_COUNT=$((UP_COUNT + $(echo $UP | wc -w)))
+
+            for SRV_FILE in $(echo $SERVICE_FILES); do
+                CONTAINER_NAMES=$(jq -r .containers[].NAME $SRV_FILE)
+                for NAME in $(echo $CONTAINER_NAMES); do
+                    NEWNAME=$(echo $NAME | cut -d "-" -f1)
+                    if [ "$D" == "$NEWNAME" ]; then
+                        if [[ "$ROLES" != "null" && ! -z "$ROLES" ]]; then
+                            C_ROLES=$(jq -r --arg NAME "$NAME" '.containers[] | select(.NAME==$NAME)' $SRV_FILE | jq -r .ROLES)
+                            for ROLE in $(echo $ROLES); do
+                                # TODO, ha C_ROLES tobb erteket tartalmaz
+                                if [ "$ROLE" == "$C_ROLES" ]; then
+                                    SRV_COUNT=$((SRV_COUNT + 1))
+                                fi
+                            done
+                        else
+                            SRV_COUNT=$((SRV_COUNT + 1))
+                        fi
+                    fi
+
+                done
+            done
+
+            if [ ! -z "$UP" ]; then
+                for D_IP in $(echo $UP); do
+                    DNS_IP=$(docker inspect $D_IP -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')
+                    if [ "$APP_IP" == "" ]; then
+                        APP_IP="$DNS_IP"
+                    else
+                        APP_IP="$APP_IP $DNS_IP"
+                    fi
+                    echo "APP_IP: "$APP_IP
+                done
+            else
+                debug "no matching running process found"
+            fi
+        fi
+    done
+
+    if [[ ! -z "$STRICK_CHECK" && $UP_COUNT -lt $SRV_COUNT ]]; then
+        if [ "$2" == "" ]; then
+            RETRIES=0
+        else
+            RETRIES=$2
+        fi
+        if [ $RETRIES -le $RETRIES_NUMBER ]; then
+            debug "Try to reread container names at $RETRIES"
+            sleep 1
+            RETRIES=$((RETRIES + 1))
+            name_resolver $DNS $RETRIES
+        else
+            debug "Not enough running process found for executing firewall rules, exiting"
+            exit
+        fi
+    fi
+}
 
 if [[ -z "$TYPE" ]]; then
     TYPE="tcp"
-fi;
+fi
+
 if [[ -z "$SOURCE_IP" ]]; then
-	SOURCE_IP="0.0.0.0/0"
-fi;
+    if [[ -z "$SOURCE" ]]; then
+        #SOURCE_IP="0.0.0.0/0";
+        echo "No source IP added"
+    elif [ "$(set | grep -w SOURCE_IFACE)" != "" ]; then
+        SOURCE=$SOURCE_IFACE
+        echo "VPN interface added instead of IP or domain name"
+    else
+        IDX=0
+        for i in $(echo $SOURCE); do
+
+            if [[ "$i" != [0-9]*"."[0-9]*"."[0-9]*"."[0-9]* ]]; then
+                name_resolver $i
+                debug "source ip is $APP_IP"
+                if [[ -z "$APP_IP" ]]; then
+                    debug "No any IP address found for SOURCE: $SOURCE, try again to resolv"
+                    name_resolver $i
+                    debug "source ip is $APP_IP"
+
+                    if [[ -z "$APP_IP" ]]; then
+                        debug "No any IP address found for SOURCE: $SOURCE, giving up"
+                    fi
+                fi
+
+                for IP in $(echo $APP_IP); do
+                    IDX=$(expr 1 + $IDX)
+                    eval SOURCE_IP_$IDX=$IP
+                done
+
+            else
+                IDX=$(expr 1 + $IDX)
+                if [[ "$(echo $i | cut -d . -f4)" == "0" ]]; then
+                    SOURCE_IP="$i/24"
+                    eval SOURCE_IP_$IDX="$i/24"
+                    debug "source ip is $SOURCE_IP"
+                else
+                    eval SOURCE_IP_$IDX=$i
+                    IP=$i
+                    debug "source ip is $IP"
+                fi
+            fi
+        done
+
+        if [ $IDX = 1 ]; then
+            SOURCE_IP=$IP
+        fi
+
+    fi
+fi
+
 if [[ -z "$TARGET_IP" ]]; then
-	TARGET_IP="0.0.0.0/0"
-fi;
+    if [[ -z "$TARGET" ]]; then
+        #TARGET_IP="0.0.0.0/0";
+        echo "No target IP added"
+    else
+        IDX=0
+        for i in $(echo $TARGET); do
 
-##############################
+            if [[ "$i" != [0-9]*"."[0-9]*"."[0-9]*"."[0-9]* ]]; then
+                name_resolver $i
+                debug "target ip is $APP_IP"
 
-echo 1 > /proc/sys/net/ipv4/ip_forward
+                if [[ -z "$APP_IP" ]]; then
+                    debug "No any IP address found for TARGET: $TARGET, try again to resolv"
+                    name_resolver $i
+                    debug "target ip is $APP_IP"
 
-##############################
+                    if [[ -z "$APP_IP" ]]; then
+                        debug "No any IP address found for TARGET: $TARGET, giving up"
+                    fi
+                fi
 
-IPTABLES=/sbin/iptables-legacy
+                for IP in $(echo $APP_IP); do
+                    IDX=$(expr 1 + $IDX)
+                    eval TARGET_IP_$IDX=$IP
+                done
 
-###############################
+            else
+                IDX=$(expr 1 + $IDX)
+                if [[ "$(echo $i | cut -d . -f4)" == "0" ]]; then
+                    TARGET_IP="$i/24"
+                    eval TARGET_IP_$IDX="$i/24"
+                    debug "target ip is $TARGET_IP"
+                else
+                    eval TARGET_IP_$IDX=$i
+                    IP=$i
+                    debug "target ip is $IP"
+                fi
+            fi
+        done
+
+        if [ $IDX = 1 ]; then
+            TARGET_IP=$IP
+        fi
+
+    fi
+fi
+
+delete_lines() {
+
+    if [ "$1" != "" ]; then
+        CHAIN=$1
+    fi
 
-prerouting() {
-	LINES=$($IPTABLES --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac)
-	debug "Previous prerouting lines: "$LINES
-	# DELETE UNECESSARY LINES FROM PREVIOUS RULES
     if [ -n "$LINES" ]; then
         for i in $LINES; do
-			debug "$IPTABLES -D PREROUTING $i"
-			$IPTABLES -D PREROUTING $i
+            debug "$IPTABLES -D $CHAIN $i"
+            $IPTABLES -w -D $CHAIN $i
             sleep 0.1
         done
     fi
+}
 
-	debug "$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT"
-	$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
+prerouting() {
+    if [ "$(set | grep -w SOURCE_IFACE)" != "" ]; then
+        if [ "$TARGET_IP" != "" ] && [ "$TARGET_PORT" != "" ]; then
+            debug "$IPTABLES -I PREROUTING -i $SOURCE_IFACE -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment $COMMENT -j DNAT --to $TARGET_IP:$TARGET_PORT"
+            $IPTABLES -w -I PREROUTING -i $SOURCE_IFACE -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
+        fi
+    elif [ "$SOURCE_IP" != "" ]; then
+        if [ "$SOURCE_PORT" != "" ]; then
+            if [ "$TARGET_IP" != "" ]; then
+                if [ "$TARGET_PORT" != "" ]; then
+
+                    LINES=$($IPTABLES -w -L --line-number -n | grep DNAT | grep $SOURCE_PORT | grep $TARGET_IP | grep $TARGET_PORT | grep $COMMENT | awk '{print $1}' | tac)
+                    debug "Previous prerouting lines: "$LINES
+                    # DELETE UNECESSARY LINES FROM PREVIOUS RULES
+                    delete_lines "PREROUTING"
+
+                    debug "$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment $COMMENT -j DNAT --to $TARGET_IP:$TARGET_PORT"
+                    $IPTABLES -w -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
+                fi
+            fi
+        fi
+    fi
 }
 
 postrouting() {
-	LINES=$($IPTABLES --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac)
+
+    if [ -n "$SOURCE_IP" ]; then
+        SOURCE_IP_FOR_POSTROUTING="$(echo $SOURCE_IP | cut -d . -f1-3).0/24"
+        debug "source ip is $SOURCE_IP_FOR_POSTROUTING"
+
+        LINES=$($IPTABLES -w -L --line-number -n | grep MASQUERADE | grep $COMMENT | grep $SOURCE_IP_FOR_POSTROUTING | grep $SOURCE_PORT | awk '{print $1}' | tac)
         debug "Previous postrouting lines: "$LINES
 
         # DELETE UNECESSARY LINES FROM PREVIOUS RULES
-	if [ -n "$LINES" ] ; then
-		for i in $LINES; do 
-			debug "$IPTABLES -D POSTROUTING $i"
-			$IPTABLES -D POSTROUTING $i
-			sleep 0.1
-		done
+        delete_lines "POSTROUTING"
+
+        debug "$IPTABLES -I POSTROUTING -s $SOURCE_IP_FOR_POSTROUTING -p $PROTOCOL --sport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE"
+        $IPTABLES -w -I POSTROUTING -s $SOURCE_IP_FOR_POSTROUTING -p $PROTOCOL --sport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE
     fi
 
-	debug "$IPTABLES -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE"	
-	$IPTABLES -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE	
+    if [ -n "$TARGET_IP" ]; then
+        TARGET_IP_FOR_POSTROUTING="$(echo $TARGET_IP | cut -d . -f1-3).0/24"
+        debug "target ip is $TARGET_IP_FOR_POSTROUTING"
+
+        LINES=$($IPTABLES -w -L --line-number -n | grep $COMMENT | grep $TARGET_IP_FOR_POSTROUTING | grep $TARGET_PORT | awk '{print $1}' | tac)
+        debug "Previous postrouting lines: "$LINES
+
+        # DELETE UNECESSARY LINES FROM PREVIOUS RULES
+        delete_lines "POSTROUTING"
+
+        debug "$IPTABLES -I POSTROUTING -s $TARGET_IP_FOR_POSTROUTING -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE"
+        $IPTABLES -w -I POSTROUTING -d $TARGET_IP_FOR_POSTROUTING -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
+    fi
 }
 
 ip_route() {
@@ -95,11 +332,41 @@ ip_route() {
     done
 }
 
+if [[ "$ROUTE" == "true" ]]; then
+    IP_ROUTE="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route"
+
+    ip_route
+    exit
+fi
+
+##############################
+
+echo 1 >/proc/sys/net/ipv4/ip_forward
+
+##############################
+
+if /usr/sbin/iptables-legacy -L | grep DOCKER-USER; then
+
+    IPTABLES="/usr/sbin/iptables-legacy"
+else
+
+    IPTABLES="/usr/sbin/iptables"
+fi
+
+###############################
+
 COUNT_SOURCE_IP=$(set | grep SOURCE_IP | wc -l)
 COUNT_SOURCE_PORT=$(set | grep SOURCE_PORT | wc -l)
 COUNT_TARGET_IP=$(set | grep TARGET_IP | wc -l)
 COUNT_TARGET_PORT=$(set | grep TARGET_PORT | wc -l)
 
+# SOURCE AND TARGET PORTS ARE IN PAIRS
+if [ "$COUNT_SOURCE_PORT" == "$COUNT_TARGET_PORT" ]; then
+    PAIRS="1"
+else
+    PAIRS="0"
+fi
+
 if [ "$COUNT_SOURCE_IP" == 0 ]; then COUNT_SOURCE_IP=1; fi
 for source_ip_index in $(seq 1 $COUNT_SOURCE_IP); do
     if set | grep SOURCE_IP_; then
@@ -124,53 +391,101 @@ for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
                     TARGET_PORT=$(eval "echo \${"TARGET_PORT_$target_port_index"}")
                 fi
 
+                debug "PAIRS: $PAIRS"
+                debug "source_port_index: $source_port_index"
+                debug "target_port_index: $target_port_index"
+
+                # if case of pairs if indexes doesn't match then omit routing
+                if [ "$PAIRS" == "1" ] && [ "$source_port_index" != "$target_port_index" ]; then
+                    debug "OMIT ROUTING"
+                    continue
+                fi
+
                 #############################
                 # NSENTER Specific settings #
 
                 if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] || [[ "$HOST" == "true" ]]; then
 
                     if [ "$HOST" == "true" ]; then
-		IPTABLES="/sbin/iptables -t nat";
+                        IPTABLES="/sbin/iptables -t nat"
+                        debug "iptables: "$IPTABLES
                     else
-		IPTABLES="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
+                        IPTABLES="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- /sbin/iptables-legacy -t nat"
+                        debug "iptables: "$IPTABLES
                     fi
 
-	debug "iptables: "$IPTABLES;
-	
                     if [[ "$PREROUTING" == "true" ]]; then
-		prerouting;
+                        prerouting
+                    fi
 
-	elif [[ "$POSTROUTING" == "true" ]] ; then
-		postrouting;
-	
-	fi;
+                    if [[ "$POSTROUTING" == "true" ]]; then
+                        postrouting
+                    fi
 
                 else
 
                     ############################
                     # Host firewall settings ###
 
-	if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then 
-		echo "nothing to do";
+                    if $IPTABLES -w -n --list $CHAIN | grep ESTABLISHED | grep RELATED | grep ACCEPT; then
+                        echo "nothing to do"
                     else
-		$IPTABLES -I $CHAIN -m state --state established,related -j ACCEPT;
+                        $IPTABLES -w -I $CHAIN -m state --state established,related -j ACCEPT
                     fi
 
+                    IPTABLES_OPTIONS=""
+                    GREP_OPTIONS=""
+                    if [ "$SOURCE_IP" != "" ]; then
+
+                        if [ "$(echo $SOURCE_IP | cut -d . -f4)" == "0" ]; then
+                            SOURCE_IP="$(echo $SOURCE_IP | cut -d . -f1-3).0/24"
+                        fi
+
+                        IPTABLES_OPTIONS=$IPTABLES_OPTIONS" -s $SOURCE_IP"
+                        GREP_OPTIONS=$GREP_OPTIONS"|grep -e $SOURCE_IP"
+
+                        if [ "$SOURCE_PORT" != "" ]; then
+                            IPTABLES_OPTIONS=$IPTABLES_OPTIONS" --sport $SOURCE_PORT"
+                            GREP_OPTIONS=$GREP_OPTIONS"|grep -e $SOURCE_PORT"
+                        fi
+                    fi
+
+                    if [ "$TARGET_IP" != "" ]; then
+
+                        if [ "$(echo $TARGET_IP | cut -d . -f4)" == "0" ]; then
+                            TARGET_IP="$(echo $TARGET_IP | cut -d . -f1-3).0/24"
+                        fi
+
+                        IPTABLES_OPTIONS=$IPTABLES_OPTIONS" -d $TARGET_IP"
+                        GREP_OPTIONS=$GREP_OPTIONS"|grep -e $TARGET_IP"
+
+                        if [ "$TARGET_PORT" != "" ]; then
+                            IPTABLES_OPTIONS=$IPTABLES_OPTIONS" --dport $TARGET_PORT"
+                            GREP_OPTIONS=$GREP_OPTIONS"|grep -e $TARGET_PORT"
+                        fi
+                    fi
+
+                    if [[ "$SOURCE_IP" != "" && "$TARGET_IP" != "" ]]; then
+
                         #
                         # DELETE UNECESSARY LINES FROM PREVIOUS RULES
-	LINES=$($IPTABLES --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac)
+                        IPTABLES_COMMAND="$IPTABLES -w --line-number -n --list $CHAIN | grep $PROTOCOL $GREP_OPTIONS | awk '{print \$1}'| tac"
+                        debug "$IPTABLES_COMMAND"
+                        LINES=$(eval $IPTABLES_COMMAND)
+                        delete_lines
 
-	if [ -n "$LINES" ] ; then
-		for i in $LINES; do 
-			debug "$IPTABLES -D $CHAIN $i"
-			$IPTABLES -D $CHAIN $i
-			sleep 0.1
-		done
+                        if [ "$OPERATION" == "DELETE" ]; then
+
+                            IPTABLES_COMMAND="$IPTABLES -w --line-number -n --list $CHAIN | grep -w "$COMMENT" | awk '{print \$1}'| tac"
+                            debug "$IPTABLES_COMMAND"
+                            LINES=$(eval $IPTABLES_COMMAND)
+                            delete_lines
+
+                        else
+                            debug "$IPTABLES -I $CHAIN -p $PROTOCOL $IPTABLES_OPTIONS -m comment --comment "$COMMENT" -j ACCEPT"
+                            $IPTABLES -w -I $CHAIN -p $PROTOCOL $IPTABLES_OPTIONS -m comment --comment "$COMMENT" -j ACCEPT
+                        fi
                     fi
-
-	debug "$IPTABLES -I $CHAIN -p $PROTOCOL -s $SOURCE_IP --sport $SOURCE_PORT -d $TARGET_IP --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT"
-	$IPTABLES -I $CHAIN -p $PROTOCOL -s $SOURCE_IP --sport $SOURCE_PORT -d $TARGET_IP --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT
-
                     #############################
                 fi
 
@@ -178,11 +493,3 @@ fi
         done     # target_ip
     done         # source_port
 done             # source_ip
-
-
-if [[ "$ROUTE" == "true" ]] ; then
-	IP_ROUTE="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";
-
-	debug "ip_route: "$IP_ROUTE;
-	ip_route;
-fi

firewall/iptables-wrapper-installer.sh

@@ -0,0 +1,209 @@
+#!/bin/sh
+
+# Copyright 2020 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Usage:
+#
+#   iptables-wrapper-installer.sh [--no-sanity-check]
+#
+# Installs a wrapper iptables script in a container that will figure out
+# whether iptables-legacy or iptables-nft is in use on the host and then
+# replaces itself with the correct underlying iptables version.
+#
+# Unless "--no-sanity-check" is passed, it will first verify that the
+# container already contains a suitable version of iptables.
+
+# NOTE: This can only use POSIX /bin/sh features; the build container
+# might not contain bash.
+
+set -eu
+
+# Find iptables binary location
+if [ -d /usr/sbin -a -e /usr/sbin/iptables ]; then
+    sbin="/usr/sbin"
+elif [ -d /sbin -a -e /sbin/iptables ]; then
+    sbin="/sbin"
+else
+    echo "ERROR: iptables is not present in either /usr/sbin or /sbin" 1>&2
+    exit 1
+fi
+
+# Determine how the system selects between iptables-legacy and iptables-nft
+if [ -x /usr/sbin/alternatives ]; then
+    # Fedora/SUSE style alternatives
+    altstyle="fedora"
+elif [ -x /usr/sbin/update-alternatives ]; then
+    # Debian style alternatives
+    altstyle="debian"
+else
+    # No alternatives system
+    altstyle="none"
+fi
+
+if [ "${1:-}" != "--no-sanity-check" ]; then
+    # Ensure dependencies are installed
+    if ! version=$("${sbin}/iptables-nft" --version 2> /dev/null); then
+        echo "ERROR: iptables-nft is not installed" 1>&2
+        exit 1
+    fi
+    if ! "${sbin}/iptables-legacy" --version > /dev/null 2>&1; then
+        echo "ERROR: iptables-legacy is not installed" 1>&2
+        exit 1
+    fi
+
+    case "${version}" in
+    *v1.8.[0123]\ *)
+        echo "ERROR: iptables 1.8.0 - 1.8.3 have compatibility bugs." 1>&2
+        echo "       Upgrade to 1.8.4 or newer." 1>&2
+        exit 1
+        ;;
+    *)
+        # 1.8.4+ are OK
+        ;;
+    esac
+fi
+
+# Start creating the wrapper...
+rm -f "${sbin}/iptables-wrapper"
+cat > "${sbin}/iptables-wrapper" <<EOF
+#!/bin/sh
+
+# Copyright 2020 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTE: This can only use POSIX /bin/sh features; the container image
+# might not contain bash.
+
+set -eu
+
+# In kubernetes 1.17 and later, kubelet will have created at least
+# one chain in the "mangle" table (either "KUBE-IPTABLES-HINT" or
+# "KUBE-KUBELET-CANARY"), so check that first, against
+# iptables-nft, because we can check that more efficiently and
+# it's more common these days.
+nft_kubelet_rules=\$( (iptables-nft-save -t mangle || true; ip6tables-nft-save -t mangle || true) 2>/dev/null | grep -E '^:(KUBE-IPTABLES-HINT|KUBE-KUBELET-CANARY)' | wc -l)
+if [ "\${nft_kubelet_rules}" -ne 0 ]; then
+    mode=nft
+else
+    # Check for kubernetes 1.17-or-later with iptables-legacy. We
+    # can't pass "-t mangle" to iptables-legacy-save because it would
+    # cause the kernel to create that table if it didn't already
+    # exist, which we don't want. So we have to grab all the rules
+    legacy_kubelet_rules=\$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep -E '^:(KUBE-IPTABLES-HINT|KUBE-KUBELET-CANARY)' | wc -l)
+    if [ "\${legacy_kubelet_rules}" -ne 0 ]; then
+        mode=legacy
+    else
+        # With older kubernetes releases there may not be any _specific_
+        # rules we can look for, but we assume that some non-containerized process
+        # (possibly kubelet) will have created _some_ iptables rules.
+        num_legacy_lines=\$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
+        num_nft_lines=\$( (iptables-nft-save || true; ip6tables-nft-save || true) 2>/dev/null | grep '^-' | wc -l)
+        if [ "\${num_legacy_lines}" -gt "\${num_nft_lines}" ]; then
+            mode=legacy
+        else
+            mode=nft
+        fi
+    fi
+fi
+
+EOF
+
+# Write out the appropriate alternatives-selection commands
+case "${altstyle}" in
+    fedora)
+cat >> "${sbin}/iptables-wrapper" <<EOF
+# Update links to point to the selected binaries
+alternatives --set iptables "/usr/sbin/iptables-\${mode}" > /dev/null || failed=1
+EOF
+    ;;
+
+    debian)
+cat >> "${sbin}/iptables-wrapper" <<EOF
+# Update links to point to the selected binaries
+update-alternatives --set iptables "/usr/sbin/iptables-\${mode}" > /dev/null || failed=1
+update-alternatives --set ip6tables "/usr/sbin/ip6tables-\${mode}" > /dev/null || failed=1
+EOF
+    ;;
+
+    *)
+cat >> "${sbin}/iptables-wrapper" <<EOF
+# Update links to point to the selected binaries
+for cmd in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
+    rm -f "${sbin}/\${cmd}"
+    ln -s "${sbin}/xtables-\${mode}-multi" "${sbin}/\${cmd}"
+done 2>/dev/null || failed=1
+EOF
+    ;;
+esac
+
+# Write out the post-alternatives-selection error checking and final wrap-up
+cat >> "${sbin}/iptables-wrapper" <<EOF
+if [ "\${failed:-0}" = 1 ]; then
+    echo "Unable to redirect iptables binaries. (Are you running in an unprivileged pod?)" 1>&2
+    # fake it, though this will probably also fail if they aren't root
+    exec "${sbin}/xtables-\${mode}-multi" "\$0" "\$@"
+fi
+
+# Now re-exec the original command with the newly-selected alternative
+exec "\$0" "\$@"
+EOF
+chmod +x "${sbin}/iptables-wrapper"
+
+# Now back in the installer script, point the iptables binaries at our
+# wrapper
+case "${altstyle}" in
+    fedora)
+	alternatives \
+            --install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \
+            --slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \
+            --slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper \
+            --slave /usr/sbin/ip6tables iptables /usr/sbin/iptables-wrapper \
+            --slave /usr/sbin/ip6tables-restore iptables-restore /usr/sbin/iptables-wrapper \
+            --slave /usr/sbin/ip6tables-save iptables-save /usr/sbin/iptables-wrapper
+	;;
+
+    debian)
+	update-alternatives \
+            --install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \
+            --slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \
+            --slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper
+	update-alternatives \
+            --install /usr/sbin/ip6tables ip6tables /usr/sbin/iptables-wrapper 100 \
+            --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/iptables-wrapper \
+            --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/iptables-wrapper
+	;;
+
+    *)
+	for cmd in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
+            rm -f "${sbin}/${cmd}"
+            ln -s "${sbin}/iptables-wrapper" "${sbin}/${cmd}"
+	done
+	;;
+esac
+
+# Cleanup
+rm -f "$0"
+