forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.go
152 lines (130 loc) · 4.02 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
/*
Copyright 2017 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package main
import (
"fmt"
"io/ioutil"
"net"
"net/http"
"os"
"strings"
"github.com/spf13/pflag"
"k8s.io/apiserver/pkg/util/flag"
"k8s.io/apiserver/pkg/util/logs"
)
// ip = target for /whoami query
// rip = returned ip
// pip = this pod's ip
// nip = this node's ip
type masqTester struct {
Port string
}
func newMasqTester() *masqTester {
return &masqTester{
Port: "8080",
}
}
func (m *masqTester) AddFlags(fs *pflag.FlagSet) {
fs.StringVar(&m.Port, "port", m.Port, "The port to serve /checknosnat and /whoami endpoints on.")
}
func main() {
m := newMasqTester()
m.AddFlags(pflag.CommandLine)
flag.InitFlags()
logs.InitLogs()
defer logs.FlushLogs()
if err := m.Run(); err != nil {
fmt.Fprintf(os.Stderr, "%v\n", err)
os.Exit(1)
}
}
func (m *masqTester) Run() error {
// pip is the current pod's IP and nip is the current node's IP
// pull the pip and nip out of the env
pip, ok := os.LookupEnv("POD_IP")
if !ok {
return fmt.Errorf("POD_IP env var was not present in the environment")
}
nip, ok := os.LookupEnv("NODE_IP")
if !ok {
return fmt.Errorf("NODE_IP env var was not present in the environment")
}
// validate that pip and nip are ip addresses.
if net.ParseIP(pip) == nil {
return fmt.Errorf("POD_IP env var contained %q, which is not an IP address", pip)
}
if net.ParseIP(nip) == nil {
return fmt.Errorf("NODE_IP env var contained %q, which is not an IP address", nip)
}
// register handlers
http.HandleFunc("/whoami", whoami)
http.HandleFunc("/checknosnat", mkChecknosnat(pip, nip))
// spin up the server
return http.ListenAndServe(":"+m.Port, nil)
}
type handler func(http.ResponseWriter, *http.Request)
func joinErrors(errs []error, sep string) string {
strs := make([]string, len(errs))
for i, err := range errs {
strs[i] = err.Error()
}
return strings.Join(strs, sep)
}
// Builds checknosnat handler, using pod and node ip of current location
func mkChecknosnat(pip string, nip string) handler {
// Queries /whoami for each provided ip, resp 200 if all resp bodies match this Pod's ip, 500 otherwise
return func(w http.ResponseWriter, req *http.Request) {
errs := []error{}
ips := strings.Split(req.URL.Query().Get("ips"), ",")
for _, ip := range ips {
if err := check(ip, pip, nip); err != nil {
errs = append(errs, err)
}
}
if len(errs) > 0 {
w.WriteHeader(500)
fmt.Fprintf(w, "%s", joinErrors(errs, ", "))
return
}
w.WriteHeader(200)
}
}
// Writes the req.RemoteAddr into the response, req.RemoteAddr is the address of the incoming connection
func whoami(w http.ResponseWriter, req *http.Request) {
fmt.Fprintf(w, "%s", req.RemoteAddr)
}
// Queries ip/whoami and compares response to pip, uses nip to differentiate SNAT from other potential failure modes
func check(ip string, pip string, nip string) error {
url := fmt.Sprintf("http://%s/whoami", ip)
resp, err := http.Get(url)
if err != nil {
return err
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
return err
}
rips := strings.Split(string(body), ":")
if rips == nil || len(rips) == 0 {
return fmt.Errorf("Invalid returned ip %q from %q", string(body), url)
}
rip := rips[0]
if rip != pip {
if rip == nip {
return fmt.Errorf("Returned ip %q != my Pod ip %q, == my Node ip %q - SNAT", rip, pip, nip)
}
return fmt.Errorf("Returned ip %q != my Pod ip %q or my Node ip %q - SNAT to unexpected ip (possible SNAT through unexpected interface on the way into another node)", rip, pip, nip)
}
return nil
}