-
Notifications
You must be signed in to change notification settings - Fork 70
/
enforcer.go
153 lines (125 loc) · 3.75 KB
/
enforcer.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
package rules
import (
"fmt"
"regexp"
"strconv"
"strings"
"time"
"code.cloudfoundry.org/lager"
)
type Timestamper struct{}
func (_ Timestamper) CurrentTime() int {
return int(time.Now().Unix())
}
//go:generate counterfeiter -o ../fakes/iptables.go --fake-name IPTables . IPTables
type IPTables interface {
Exists(table, chain string, rulespec ...string) (bool, error)
Insert(table, chain string, pos int, rulespec ...string) error
AppendUnique(table, chain string, rulespec ...string) error
Delete(table, chain string, rulespec ...string) error
List(table, chain string) ([]string, error)
NewChain(table, chain string) error
ClearChain(table, chain string) error
DeleteChain(table, chain string) error
}
//go:generate counterfeiter -o ../fakes/rule_enforcer.go --fake-name RuleEnforcer . RuleEnforcer
type RuleEnforcer interface {
EnforceRulesAndChain(RulesWithChain) error
EnforceOnChain(chain Chain, r []Rule) error
Enforce(table, parentChain, chain string, r []Rule) error
}
//go:generate counterfeiter -o ../fakes/timestamper.go --fake-name TimeStamper . TimeStamper
type TimeStamper interface {
CurrentTime() int
}
type Enforcer struct {
Logger lager.Logger
timestamper TimeStamper
iptables IPTables
}
func NewEnforcer(logger lager.Logger, timestamper TimeStamper, ipt IPTables) *Enforcer {
return &Enforcer{
Logger: logger,
timestamper: timestamper,
iptables: ipt,
}
}
type Chain struct {
Table string
ParentChain string
Prefix string
}
type RulesWithChain struct {
Chain Chain
Rules []Rule
}
func (e *Enforcer) EnforceRulesAndChain(rulesAndChain RulesWithChain) error {
return e.EnforceOnChain(rulesAndChain.Chain, rulesAndChain.Rules)
}
func (e *Enforcer) EnforceOnChain(c Chain, rules []Rule) error {
return e.Enforce(c.Table, c.ParentChain, c.Prefix, rules)
}
func (e *Enforcer) Enforce(table, parentChain, chainPrefix string, rules []Rule) error {
newTime := e.timestamper.CurrentTime()
chain := fmt.Sprintf("%s%d", chainPrefix, newTime)
err := e.iptables.NewChain(table, chain)
if err != nil {
e.Logger.Error("create-chain", err)
return fmt.Errorf("creating chain: %s", err)
}
for _, rule := range rules {
err = rule.Enforce(table, chain, e.iptables, e.Logger)
if err != nil {
return err
}
}
err = e.iptables.Insert(table, parentChain, 1, []string{"-j", chain}...)
if err != nil {
e.Logger.Error("insert-chain", err)
return fmt.Errorf("inserting chain: %s", err)
}
err = e.cleanupOldRules(table, parentChain, chainPrefix, int(newTime))
if err != nil {
e.Logger.Error("cleanup-rules", err)
return err
}
return nil
}
func (e *Enforcer) cleanupOldRules(table, parentChain, chainPrefix string, newTime int) error {
chainList, err := e.iptables.List(table, parentChain)
if err != nil {
return fmt.Errorf("listing forward rules: %s", err)
}
re := regexp.MustCompile(chainPrefix + "[0-9]{10}")
for _, c := range chainList {
timeStampedChain := string(re.Find([]byte(c)))
if timeStampedChain != "" {
oldTime, err := strconv.Atoi(strings.TrimPrefix(timeStampedChain, chainPrefix))
if err != nil {
return err // not tested
}
if oldTime < newTime {
err = e.cleanupOldChain(table, parentChain, timeStampedChain)
if err != nil {
return err
}
}
}
}
return nil
}
func (e *Enforcer) cleanupOldChain(table, parentChain, timeStampedChain string) error {
err := e.iptables.Delete(table, parentChain, []string{"-j", timeStampedChain}...)
if err != nil {
return fmt.Errorf("cleanup old chain: %s", err)
}
err = e.iptables.ClearChain(table, timeStampedChain)
if err != nil {
return fmt.Errorf("cleanup old chain: %s", err)
}
err = e.iptables.DeleteChain(table, timeStampedChain)
if err != nil {
return fmt.Errorf("cleanup old chain: %s", err)
}
return nil
}