Skip to content

Commit

Permalink
add host level iptables rule to block pod egress traffic between pods
Browse files Browse the repository at this point in the history
  • Loading branch information
@wanyufe
wanyufe committed May 2, 2023
1 parent b570dec commit 4aa76c0
Show file tree
Hide file tree
Showing 2 changed files with 96 additions and 15 deletions.
47 changes: 32 additions & 15 deletions pkg/networkutils/network.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -224,41 +224,54 @@ func findPrimaryInterfaceName(primaryMAC string) (string, error) {
}

func (n *linuxNetwork) enableIPv6() (err error) {
if err = n.setupRuleToBlockNodeLocalV4Access(); err != nil {
if err = n.setupRuleToBlockNodeLocalAccess(iptables.ProtocolIPv4); err != nil {
return errors.Wrapf(err, "setupVeth network: failed to setup route to block pod access via IPv4 address")
}
return nil
}

func (n *linuxNetwork) SetupRuleToBlockNodeLocalV4Access() error {
return n.setupRuleToBlockNodeLocalV4Access()
return n.setupRuleToBlockNodeLocalAccess(iptables.ProtocolIPv4)
}

// Setup a rule to block traffic directed to v4 interface of the Pod
func (n *linuxNetwork) setupRuleToBlockNodeLocalV4Access() error {
ipt, err := n.newIptables(iptables.ProtocolIPv4)
func (n *linuxNetwork) SetupRuleToBlockNodeLocalV6Access() error {
return n.setupRuleToBlockNodeLocalAccess(iptables.ProtocolIPv6)
}

// Set up a rule to block traffic directed to v4/v6 egress interface of the Pod
func (n *linuxNetwork) setupRuleToBlockNodeLocalAccess(protocol iptables.Protocol) error {
ipVersion := "v4"
localIpCidr := "169.254.172.0/22"
iptableCmd := "iptables"
if protocol == iptables.ProtocolIPv6 {
ipVersion = "v6"
localIpCidr = "fd00::/8"
iptableCmd = "ip6tables"
}

ipt, err := n.newIptables(protocol)
if err != nil {
return errors.Wrap(err, "failed to create iptables")
return errors.Wrap(err, fmt.Sprintf("failed to create %s", iptableCmd))
}

v4DenyRule := iptablesRule{
name: "Block Node Local Pod access via IPv4",
denyRule := iptablesRule{
name: fmt.Sprintf("Block Node Local Pod access via IP%s", ipVersion),
table: "filter",
chain: "FORWARD",
rule: []string{
"-d", "169.254.172.0/22", "-m", "conntrack",
"--ctstate", "NEW", "-m", "comment", "--comment", "Block Node Local Pod access via IPv4", "-j", "REJECT",
"-d", localIpCidr, "-m", "conntrack",
"--ctstate", "NEW", "-m", "comment", "--comment", fmt.Sprintf("Block Node Local Pod access via IP%s", ipVersion), "-j", "REJECT",
},
}

if exists, err := ipt.Exists(v4DenyRule.table, v4DenyRule.chain, v4DenyRule.rule...); exists && err == nil {
log.Info("Rule to block Node Local Pod access via IPv4 is already present. Moving on.. ")
if exists, err := ipt.Exists(denyRule.table, denyRule.chain, denyRule.rule...); exists && err == nil {
log.Info(fmt.Sprintf("Rule to block Node Local Pod access via IP%s is already present. Moving on.. ", ipVersion))
return nil
}

//Let's add the rule. Rule is either missing (or) we're not able to validate it's presence.
if err := ipt.Insert(v4DenyRule.table, v4DenyRule.chain, 1, v4DenyRule.rule...); err != nil {
return fmt.Errorf("failed adding v4 drop route: %v", err)
//Let's add the rule. Rule is either missing (or) we're not able to validate its presence.
if err := ipt.Insert(denyRule.table, denyRule.chain, 1, denyRule.rule...); err != nil {
return fmt.Errorf("failed adding %s drop route: %v", ipVersion, err)
}
return nil
}
Expand All @@ -283,6 +296,10 @@ func (n *linuxNetwork) SetupHostNetwork(vpcv4CIDRs []string, primaryMAC string,
if err := n.enableIPv6(); err != nil {
return errors.Wrapf(err, "failed to enable IPv6")
}
} else {
if err := n.setupRuleToBlockNodeLocalAccess(iptables.ProtocolIPv6); err != nil {
return errors.Wrapf(err, "failed to block node local v6 access")
}
}

// If node port support is enabled, add a rule that will force force marked traffic out of the main ENI. We then
Expand Down
64 changes: 64 additions & 0 deletions pkg/networkutils/network_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,14 @@ func TestSetupHostNetworkNodePortEnabledAndSNATDisabled(t *testing.T) {
assert.NoError(t, err)

assert.Equal(t, map[string]map[string][][]string{
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{
Expand Down Expand Up @@ -295,6 +303,14 @@ func TestSetupHostNetworkNodePortDisabledAndSNATEnabled(t *testing.T) {
assert.NoError(t, err)

assert.Equal(t, map[string]map[string][][]string{
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"nat": {
"AWS-SNAT-CHAIN-0": [][]string{{"!", "-o", "vlan+", "-m", "comment", "--comment", "AWS, SNAT", "-m", "addrtype", "!", "--dst-type", "LOCAL", "-j", "SNAT", "--to-source", "10.10.10.20"}},
"POSTROUTING": [][]string{{"-m", "comment", "--comment", "AWS SNAT CHAIN", "-j", "AWS-SNAT-CHAIN-0"}},
Expand Down Expand Up @@ -380,6 +396,14 @@ func TestSetupHostNetworkWithExcludeSNATCIDRs(t *testing.T) {
{"-m", "comment", "--comment", "AWS, CONNMARK", "-j", "CONNMARK", "--restore-mark", "--mask", "0x80"},
},
},
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{"-m", "comment", "--comment", "AWS, primary ENI", "-i", "lo", "-m", "addrtype", "--dst-type", "LOCAL", "--limit-iface-in", "-j", "CONNMARK", "--set-mark", "0x80/0x80"},
Expand Down Expand Up @@ -448,6 +472,14 @@ func TestSetupHostNetworkCleansUpStaleSNATRules(t *testing.T) {
{"-m", "comment", "--comment", "AWS, CONNMARK", "-j", "CONNMARK", "--restore-mark", "--mask", "0x80"},
},
},
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{"-m", "comment", "--comment", "AWS, primary ENI", "-i", "lo", "-m", "addrtype", "--dst-type", "LOCAL", "--limit-iface-in", "-j", "CONNMARK", "--set-mark", "0x80/0x80"},
Expand Down Expand Up @@ -516,6 +548,14 @@ func TestSetupHostNetworkWithDifferentVethPrefix(t *testing.T) {
{"-m", "comment", "--comment", "AWS, CONNMARK", "-j", "CONNMARK", "--restore-mark", "--mask", "0x80"},
},
},
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{"-m", "comment", "--comment", "AWS, primary ENI", "-i", "lo", "-m", "addrtype", "--dst-type", "LOCAL", "--limit-iface-in", "-j", "CONNMARK", "--set-mark", "0x80/0x80"},
Expand Down Expand Up @@ -580,6 +620,14 @@ func TestSetupHostNetworkExternalNATCleanupConnmark(t *testing.T) {
"AWS-CONNMARK-CHAIN-4": [][]string{},
"PREROUTING": [][]string{},
},
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{"-m", "comment", "--comment", "AWS, primary ENI", "-i", "lo", "-m", "addrtype", "--dst-type", "LOCAL", "--limit-iface-in", "-j", "CONNMARK", "--set-mark", "0x80/0x80"},
Expand Down Expand Up @@ -647,6 +695,14 @@ func TestSetupHostNetworkExcludedSNATCIDRsIdempotent(t *testing.T) {
{"-m", "comment", "--comment", "AWS, CONNMARK", "-j", "CONNMARK", "--restore-mark", "--mask", "0x80"},
},
},
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{"-m", "comment", "--comment", "AWS, primary ENI", "-i", "lo", "-m", "addrtype", "--dst-type", "LOCAL", "--limit-iface-in", "-j", "CONNMARK", "--set-mark", "0x80/0x80"},
Expand Down Expand Up @@ -706,6 +762,14 @@ func TestUpdateHostIptablesRules(t *testing.T) {
{"-m", "comment", "--comment", "AWS, CONNMARK", "-j", "CONNMARK", "--restore-mark", "--mask", "0x80"},
},
},
"filter": {
"FORWARD": [][]string{
{
"-d", "fd00::/8", "-m", "conntrack", "--ctstate", "NEW", "-m", "comment",
"--comment", "Block Node Local Pod access via IPv6", "-j", "REJECT",
},
},
},
"mangle": {
"PREROUTING": [][]string{
{"-m", "comment", "--comment", "AWS, primary ENI", "-i", "lo", "-m", "addrtype", "--dst-type", "LOCAL", "--limit-iface-in", "-j", "CONNMARK", "--set-mark", "0x80/0x80"},
Expand Down

0 comments on commit 4aa76c0

Please sign in to comment.