|
| 1 | +#!/bin/sh |
| 2 | + |
| 3 | +# Copyright 2020 The Kubernetes Authors. |
| 4 | +# |
| 5 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | +# you may not use this file except in compliance with the License. |
| 7 | +# You may obtain a copy of the License at |
| 8 | +# |
| 9 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +# |
| 11 | +# Unless required by applicable law or agreed to in writing, software |
| 12 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | +# See the License for the specific language governing permissions and |
| 15 | +# limitations under the License. |
| 16 | + |
| 17 | +# Usage: |
| 18 | +# |
| 19 | +# iptables-wrapper-installer.sh [--no-sanity-check] |
| 20 | +# |
| 21 | +# Installs a wrapper iptables script in a container that will figure out |
| 22 | +# whether iptables-legacy or iptables-nft is in use on the host and then |
| 23 | +# replaces itself with the correct underlying iptables version. |
| 24 | +# |
| 25 | +# Unless "--no-sanity-check" is passed, it will first verify that the |
| 26 | +# container already contains a suitable version of iptables. |
| 27 | + |
| 28 | +# NOTE: This can only use POSIX /bin/sh features; the build container |
| 29 | +# might not contain bash. |
| 30 | + |
| 31 | +# original source: |
| 32 | +# https://github.com/kubernetes-sigs/iptables-wrappers/blob/master/iptables-wrapper-installer.sh |
| 33 | + |
| 34 | +set -eu |
| 35 | + |
| 36 | +# Find iptables binary location |
| 37 | +if [ -d /usr/sbin -a -e /usr/sbin/iptables ]; then |
| 38 | + sbin="/usr/sbin" |
| 39 | +elif [ -d /sbin -a -e /sbin/iptables ]; then |
| 40 | + sbin="/sbin" |
| 41 | +else |
| 42 | + echo "ERROR: iptables is not present in either /usr/sbin or /sbin" 1>&2 |
| 43 | + exit 1 |
| 44 | +fi |
| 45 | + |
| 46 | +# Determine how the system selects between iptables-legacy and iptables-nft |
| 47 | +if [ -x /usr/sbin/alternatives ]; then |
| 48 | + # Fedora/SUSE style alternatives |
| 49 | + altstyle="fedora" |
| 50 | +elif [ -x /usr/sbin/update-alternatives ]; then |
| 51 | + # Debian style alternatives |
| 52 | + altstyle="debian" |
| 53 | +else |
| 54 | + # No alternatives system |
| 55 | + altstyle="none" |
| 56 | +fi |
| 57 | + |
| 58 | +if [ "${1:-}" != "--no-sanity-check" ]; then |
| 59 | + # Ensure dependencies are installed |
| 60 | + if ! version=$("${sbin}/iptables-nft" --version 2> /dev/null); then |
| 61 | + echo "ERROR: iptables-nft is not installed" 1>&2 |
| 62 | + exit 1 |
| 63 | + fi |
| 64 | + if ! "${sbin}/iptables-legacy" --version > /dev/null 2>&1; then |
| 65 | + echo "ERROR: iptables-legacy is not installed" 1>&2 |
| 66 | + exit 1 |
| 67 | + fi |
| 68 | + |
| 69 | + case "${version}" in |
| 70 | + *v1.8.[0123]\ *) |
| 71 | + echo "ERROR: iptables 1.8.0 - 1.8.3 have compatibility bugs." 1>&2 |
| 72 | + echo " Upgrade to 1.8.4 or newer." 1>&2 |
| 73 | + exit 1 |
| 74 | + ;; |
| 75 | + *) |
| 76 | + # 1.8.4+ are OK |
| 77 | + ;; |
| 78 | + esac |
| 79 | +fi |
| 80 | + |
| 81 | +# Start creating the wrapper... |
| 82 | +rm -f "${sbin}/iptables-wrapper" |
| 83 | +cat > "${sbin}/iptables-wrapper" <<EOF |
| 84 | +#!/bin/sh |
| 85 | +
|
| 86 | +# Copyright 2020 The Kubernetes Authors. |
| 87 | +# |
| 88 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 89 | +# you may not use this file except in compliance with the License. |
| 90 | +# You may obtain a copy of the License at |
| 91 | +# |
| 92 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 93 | +# |
| 94 | +# Unless required by applicable law or agreed to in writing, software |
| 95 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 96 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 97 | +# See the License for the specific language governing permissions and |
| 98 | +# limitations under the License. |
| 99 | +
|
| 100 | +# NOTE: This can only use POSIX /bin/sh features; the container image |
| 101 | +# might not contain bash. |
| 102 | +
|
| 103 | +set -eu |
| 104 | +
|
| 105 | +# In kubernetes 1.17 and later, kubelet will have created at least |
| 106 | +# one chain in the "mangle" table (either "KUBE-IPTABLES-HINT" or |
| 107 | +# "KUBE-KUBELET-CANARY"), so check that first, against |
| 108 | +# iptables-nft, because we can check that more efficiently and |
| 109 | +# it's more common these days. |
| 110 | +nft_kubelet_rules=\$( (iptables-nft-save -t mangle || true; ip6tables-nft-save -t mangle || true) 2>/dev/null | grep -E '^:(KUBE-IPTABLES-HINT|KUBE-KUBELET-CANARY)' | wc -l) |
| 111 | +if [ "\${nft_kubelet_rules}" -ne 0 ]; then |
| 112 | + mode=nft |
| 113 | +else |
| 114 | + # Check for kubernetes 1.17-or-later with iptables-legacy. We |
| 115 | + # can't pass "-t mangle" to iptables-legacy-save because it would |
| 116 | + # cause the kernel to create that table if it didn't already |
| 117 | + # exist, which we don't want. So we have to grab all the rules |
| 118 | + legacy_kubelet_rules=\$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep -E '^:(KUBE-IPTABLES-HINT|KUBE-KUBELET-CANARY)' | wc -l) |
| 119 | + if [ "\${legacy_kubelet_rules}" -ne 0 ]; then |
| 120 | + mode=legacy |
| 121 | + else |
| 122 | + # With older kubernetes releases there may not be any _specific_ |
| 123 | + # rules we can look for, but we assume that some non-containerized process |
| 124 | + # (possibly kubelet) will have created _some_ iptables rules. |
| 125 | + num_legacy_lines=\$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l) |
| 126 | + num_nft_lines=\$( (iptables-nft-save || true; ip6tables-nft-save || true) 2>/dev/null | grep '^-' | wc -l) |
| 127 | + if [ "\${num_legacy_lines}" -gt "\${num_nft_lines}" ]; then |
| 128 | + mode=legacy |
| 129 | + else |
| 130 | + mode=nft |
| 131 | + fi |
| 132 | + fi |
| 133 | +fi |
| 134 | +
|
| 135 | +EOF |
| 136 | + |
| 137 | +# Write out the appropriate alternatives-selection commands |
| 138 | +case "${altstyle}" in |
| 139 | + fedora) |
| 140 | +cat >> "${sbin}/iptables-wrapper" <<EOF |
| 141 | +# Update links to point to the selected binaries |
| 142 | +alternatives --set iptables "/usr/sbin/iptables-\${mode}" > /dev/null || failed=1 |
| 143 | +EOF |
| 144 | + ;; |
| 145 | + |
| 146 | + debian) |
| 147 | +cat >> "${sbin}/iptables-wrapper" <<EOF |
| 148 | +# Update links to point to the selected binaries |
| 149 | +update-alternatives --set iptables "/usr/sbin/iptables-\${mode}" > /dev/null || failed=1 |
| 150 | +update-alternatives --set ip6tables "/usr/sbin/ip6tables-\${mode}" > /dev/null || failed=1 |
| 151 | +EOF |
| 152 | + ;; |
| 153 | + |
| 154 | + *) |
| 155 | +cat >> "${sbin}/iptables-wrapper" <<EOF |
| 156 | +# Update links to point to the selected binaries |
| 157 | +for cmd in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do |
| 158 | + rm -f "${sbin}/\${cmd}" |
| 159 | + ln -s "${sbin}/xtables-\${mode}-multi" "${sbin}/\${cmd}" |
| 160 | +done 2>/dev/null || failed=1 |
| 161 | +EOF |
| 162 | + ;; |
| 163 | +esac |
| 164 | + |
| 165 | +# Write out the post-alternatives-selection error checking and final wrap-up |
| 166 | +cat >> "${sbin}/iptables-wrapper" <<EOF |
| 167 | +if [ "\${failed:-0}" = 1 ]; then |
| 168 | + echo "Unable to redirect iptables binaries. (Are you running in an unprivileged pod?)" 1>&2 |
| 169 | + # fake it, though this will probably also fail if they aren't root |
| 170 | + exec "${sbin}/xtables-\${mode}-multi" "\$0" "\$@" |
| 171 | +fi |
| 172 | +
|
| 173 | +# Now re-exec the original command with the newly-selected alternative |
| 174 | +exec "\$0" "\$@" |
| 175 | +EOF |
| 176 | +chmod +x "${sbin}/iptables-wrapper" |
| 177 | + |
| 178 | +# Now back in the installer script, point the iptables binaries at our |
| 179 | +# wrapper |
| 180 | +case "${altstyle}" in |
| 181 | + fedora) |
| 182 | + alternatives \ |
| 183 | + --install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \ |
| 184 | + --slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \ |
| 185 | + --slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper \ |
| 186 | + --slave /usr/sbin/ip6tables iptables /usr/sbin/iptables-wrapper \ |
| 187 | + --slave /usr/sbin/ip6tables-restore iptables-restore /usr/sbin/iptables-wrapper \ |
| 188 | + --slave /usr/sbin/ip6tables-save iptables-save /usr/sbin/iptables-wrapper |
| 189 | + ;; |
| 190 | + |
| 191 | + debian) |
| 192 | + update-alternatives \ |
| 193 | + --install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \ |
| 194 | + --slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \ |
| 195 | + --slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper |
| 196 | + update-alternatives \ |
| 197 | + --install /usr/sbin/ip6tables ip6tables /usr/sbin/iptables-wrapper 100 \ |
| 198 | + --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/iptables-wrapper \ |
| 199 | + --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/iptables-wrapper |
| 200 | + ;; |
| 201 | + |
| 202 | + *) |
| 203 | + for cmd in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do |
| 204 | + rm -f "${sbin}/${cmd}" |
| 205 | + ln -s "${sbin}/iptables-wrapper" "${sbin}/${cmd}" |
| 206 | + done |
| 207 | + ;; |
| 208 | +esac |
| 209 | + |
| 210 | +# Cleanup |
| 211 | +rm -f "$0" |
0 commit comments