From b25af8e3c9946ac9875e416fb270472ff3519a94 Mon Sep 17 00:00:00 2001 From: knight42 Date: Wed, 9 Sep 2020 18:12:16 +0800 Subject: [PATCH] feat(iptables): be able to override iptables-1.4-compatible lock path --- pkg/util/iptables/iptables.go | 24 +++++++++++++++-------- pkg/util/iptables/iptables_linux.go | 8 ++++---- pkg/util/iptables/iptables_unsupported.go | 2 +- 3 files changed, 21 insertions(+), 13 deletions(-) diff --git a/pkg/util/iptables/iptables.go b/pkg/util/iptables/iptables.go index 728d5b30c09..69c262bb345 100644 --- a/pkg/util/iptables/iptables.go +++ b/pkg/util/iptables/iptables.go @@ -186,9 +186,12 @@ const WaitIntervalString = "-W" // WaitIntervalUsecondsValue a constant for specifying the default wait interval useconds const WaitIntervalUsecondsValue = "100000" -// LockfilePath16x is the iptables lock file acquired by any process that's making any change in the iptable rule +// LockfilePath16x is the iptables 1.6.x lock file acquired by any process that's making any change in the iptable rule const LockfilePath16x = "/run/xtables.lock" +// LockfilePath14x is the iptables 1.4.x lock file acquired by any process that's making any change in the iptable rule +const LockfilePath14x = "@xtables" + // runner implements Interface in terms of exec("iptables"). type runner struct { mu sync.Mutex @@ -198,20 +201,24 @@ type runner struct { hasRandomFully bool waitFlag []string restoreWaitFlag []string - lockfilePath string + lockfilePath14x string + lockfilePath16x string } // newInternal returns a new Interface which will exec iptables, and allows the // caller to change the iptables-restore lockfile path -func newInternal(exec utilexec.Interface, protocol Protocol, lockfilePath string) Interface { +func newInternal(exec utilexec.Interface, protocol Protocol, lockfilePath14x, lockfilePath16x string) Interface { version, err := getIPTablesVersion(exec, protocol) if err != nil { klog.Warningf("Error checking iptables version, assuming version at least %s: %v", MinCheckVersion, err) version = MinCheckVersion } - if lockfilePath == "" { - lockfilePath = LockfilePath16x + if lockfilePath16x == "" { + lockfilePath16x = LockfilePath16x + } + if lockfilePath14x == "" { + lockfilePath14x = LockfilePath14x } runner := &runner{ @@ -221,14 +228,15 @@ func newInternal(exec utilexec.Interface, protocol Protocol, lockfilePath string hasRandomFully: version.AtLeast(RandomFullyMinVersion), waitFlag: getIPTablesWaitFlag(version), restoreWaitFlag: getIPTablesRestoreWaitFlag(version, exec, protocol), - lockfilePath: lockfilePath, + lockfilePath14x: lockfilePath14x, + lockfilePath16x: lockfilePath16x, } return runner } // New returns a new Interface which will exec iptables. func New(exec utilexec.Interface, protocol Protocol) Interface { - return newInternal(exec, protocol, "") + return newInternal(exec, protocol, "", "") } // EnsureChain is part of Interface. @@ -390,7 +398,7 @@ func (runner *runner) restoreInternal(args []string, data []byte, flush FlushFla // from stepping on each other. iptables-restore 1.6.2 will have // a --wait option like iptables itself, but that's not widely deployed. if len(runner.restoreWaitFlag) == 0 { - locker, err := grabIptablesLocks(runner.lockfilePath) + locker, err := grabIptablesLocks(runner.lockfilePath14x, runner.lockfilePath16x) if err != nil { return err } diff --git a/pkg/util/iptables/iptables_linux.go b/pkg/util/iptables/iptables_linux.go index c28fd62dda8..6ee6260305a 100644 --- a/pkg/util/iptables/iptables_linux.go +++ b/pkg/util/iptables/iptables_linux.go @@ -49,7 +49,7 @@ func (l *locker) Close() error { return utilerrors.NewAggregate(errList) } -func grabIptablesLocks(lockfilePath string) (iptablesLocker, error) { +func grabIptablesLocks(lockfilePath14x, lockfilePath16x string) (iptablesLocker, error) { var err error var success bool @@ -66,9 +66,9 @@ func grabIptablesLocks(lockfilePath string) (iptablesLocker, error) { // can't assume which lock method it'll use. // Roughly duplicate iptables 1.6.x xtables_lock() function. - l.lock16, err = os.OpenFile(lockfilePath, os.O_CREATE, 0600) + l.lock16, err = os.OpenFile(lockfilePath16x, os.O_CREATE, 0600) if err != nil { - return nil, fmt.Errorf("failed to open iptables lock %s: %v", lockfilePath, err) + return nil, fmt.Errorf("failed to open iptables lock %s: %v", lockfilePath16x, err) } if err := wait.PollImmediate(200*time.Millisecond, 2*time.Second, func() (bool, error) { @@ -82,7 +82,7 @@ func grabIptablesLocks(lockfilePath string) (iptablesLocker, error) { // Roughly duplicate iptables 1.4.x xtables_lock() function. if err := wait.PollImmediate(200*time.Millisecond, 2*time.Second, func() (bool, error) { - l.lock14, err = net.ListenUnix("unix", &net.UnixAddr{Name: "@xtables", Net: "unix"}) + l.lock14, err = net.ListenUnix("unix", &net.UnixAddr{Name: lockfilePath14x, Net: "unix"}) if err != nil { return false, nil } diff --git a/pkg/util/iptables/iptables_unsupported.go b/pkg/util/iptables/iptables_unsupported.go index c6a5f0d7dc6..17e61d762eb 100644 --- a/pkg/util/iptables/iptables_unsupported.go +++ b/pkg/util/iptables/iptables_unsupported.go @@ -23,7 +23,7 @@ import ( "os" ) -func grabIptablesLocks(lockfilePath string) (iptablesLocker, error) { +func grabIptablesLocks(lock14filePath, lock16filePath string) (iptablesLocker, error) { return nil, fmt.Errorf("iptables unsupported on this platform") }