Repository navigation
8000
Expand file tree
/
Copy pathops_linux.go
More file actions
61 lines (52 loc) · 2.06 KB
/
Copy pathops_linux.go
File metadata and controls
61 lines (52 loc) · 2.06 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
// Copyright 2016-2017 VMware, Inc. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package main
import (
"context"
"fmt"
"io/ioutil"
log "github.com/Sirupsen/logrus"
"github.com/docker/libnetwork/iptables"
"github.com/vishvananda/netlink"
"github.com/vmware/vic/lib/tether"
)
const (
publicIfaceName = "public"
)
func (t *operations) SetupFirewall(ctx context.Context, config *tether.ExecutorConfig) error {
// get the public interface name
l, err := netlink.LinkByName(publicIfaceName)
if l == nil {
l, err = netlink.LinkByAlias(publicIfaceName)
if l == nil {
return fmt.Errorf("could not find interface: %s", publicIfaceName)
}
}
if _, err = iptables.Raw(string(iptables.Append), "FORWARD", "-i", "bridge", "-o", l.Attrs().Name, "-j", "ACCEPT"); err != nil {
return err
}
if config.AsymmetricRouting {
// set rp_filter to "loose" mode; see https://en.wikipedia.org/wiki/Reverse_path_forwarding#Loose_mode
//
// this is so the kernel will not drop packets sent to the public interface from an
// address that is reachable by other interfaces on the VCH. specifically, when
// packets from the bridge network are directed to another network (say, management),
// the incoming reply to the VCH can be dropped if rp_filter is set to the default 1
if err = ioutil.WriteFile(fmt.Sprintf("/proc/sys/net/ipv4/conf/%s/rp_filter", l.Attrs().Name), []byte("2"), 0644); err != nil {
// not a fatal error, so just log it here
log.Warnf("error while setting rp_filter for interface %s: %s", l.Attrs().Name, err)
}
}
return nil
}