Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Linkerd without CNI as non-root #49

Merged
merged 2 commits into from
Nov 2, 2021
Merged

Linkerd without CNI as non-root #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2ca71a9
Default image to run as non-root
chrischdi Oct 23, 2021
099dd70
iptables: fix comments
chrischdi Oct 27, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 6 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,12 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /out/linkerd2-proxy-

## package runtime
FROM --platform=$TARGETPLATFORM alpine:20210212
RUN apk add iptables
RUN apk add iptables libcap
RUN touch /run/xtables.lock && chmod 0666 /run/xtables.lock
RUN setcap cap_net_raw,cap_net_admin+eip /sbin/xtables-legacy-multi
COPY LICENSE /linkerd/LICENSE
COPY --from=golang /out/linkerd2-proxy-init /usr/local/bin/proxy-init
RUN setcap cap_net_raw,cap_net_admin+eip /usr/local/bin/proxy-init
ENTRYPOINT ["/usr/local/bin/proxy-init"]

USER 65534
13 changes: 6 additions & 7 deletions iptables/iptables.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,11 +56,10 @@ type FirewallConfiguration struct {
UseWaitFlag bool
}

//ConfigureFirewall configures a pod's internal iptables to redirect all desired traffic through the proxy, allowing for
// ConfigureFirewall configures a pod's internal iptables to redirect all desired traffic through the proxy, allowing for
// the pod to join the service mesh. A lot of this logic was based on
// https://github.com/istio/istio/blob/e83411e/pilot/docker/prepare_proxy.sh
func ConfigureFirewall(firewallConfiguration FirewallConfiguration) error {

log.Debugf("Tracing this script execution as [%s]", ExecutionTraceID)

b := bytes.Buffer{}
Expand Down Expand Up @@ -94,7 +93,7 @@ func ConfigureFirewall(firewallConfiguration FirewallConfiguration) error {
return nil
}

//formatComment is used to format iptables comments in such way that it is possible to identify when the rules were added.
// formatComment is used to format iptables comments in such way that it is possible to identify when the rules were added.
// This helps debug when iptables has some stale rules from previous runs, something that can happen frequently on minikube.
func formatComment(text string) string {
return fmt.Sprintf("proxy-init/%s/%s", text, ExecutionTraceID)
Expand All @@ -119,7 +118,7 @@ func addOutgoingTrafficRules(commands []*exec.Cmd, firewallConfiguration Firewal
log.Infof("Redirecting all OUTPUT to %d", firewallConfiguration.ProxyOutgoingPort)
commands = append(commands, makeRedirectChainToPort(outputChainName, firewallConfiguration.ProxyOutgoingPort, "redirect-all-outgoing-to-proxy-port"))

//Redirect all remaining outbound traffic to the proxy.
// Redirect all remaining outbound traffic to the proxy.
commands = append(
commands,
makeJumpFromChainToAnotherForAllProtocols(
Expand All @@ -136,7 +135,7 @@ func addIncomingTrafficRules(commands []*exec.Cmd, firewallConfiguration Firewal
commands = addRulesForIgnoredPorts(firewallConfiguration.InboundPortsToIgnore, redirectChainName, commands)
commands = addRulesForInboundPortRedirect(firewallConfiguration, redirectChainName, commands)

//Redirect all remaining inbound traffic to the proxy.
// Redirect all remaining inbound traffic to the proxy.
commands = append(
commands,
makeJumpFromChainToAnotherForAllProtocols(
Expand All @@ -151,7 +150,7 @@ func addIncomingTrafficRules(commands []*exec.Cmd, firewallConfiguration Firewal
func addRulesForInboundPortRedirect(firewallConfiguration FirewallConfiguration, chainName string, commands []*exec.Cmd) []*exec.Cmd {
if firewallConfiguration.Mode == RedirectAllMode {
log.Info("Will redirect all INPUT ports to proxy")
//Create a new chain for redirecting inbound and outbound traffic to the proxy port.
// Create a new chain for redirecting inbound and outbound traffic to the proxy port.
commands = append(commands, makeRedirectChainToPort(chainName,
firewallConfiguration.ProxyInboundPort,
"redirect-all-incoming-to-proxy-port"))
Expand Down Expand Up @@ -336,7 +335,7 @@ func makeJumpFromChainToAnotherForAllProtocols(
}

func makeShowAllRules() *exec.Cmd {
return exec.Command("iptables-save")
return exec.Command("iptables-save", "-t", "nat")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reverted to iptables-save, however I had add -t nat as arguments to iptables-save.
Otherwise it tries to read the wanted table from /proc/net/ip_tables_names which is only readable by root:

We might be looking at operating on the mangle table to add support for tproxy in the coming weeks. Do you anticipate this getting more complicated? How would our ability to add rules in different tables be affected by this change?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

adding rules is just as easy as iptabels -t mangle ... However the makeShowAllRules should then also include the output of iptables-save -t mangle.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, sounds good!

}

// asDestination formats the provided `PortRange` for output in commands.
Expand Down