mirror of
https://github.com/tailscale/tailscale.git
synced 2024-12-04 23:45:34 +00:00
096b090caf
* cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets This commit is first part of the work to allow running multiple replicas of the Kubernetes operator egress proxies per tailnet service + to allow exposing multiple tailnet services via each proxy replica. This expands the existing iptables/nftables-based proxy configuration mechanism. A proxy can now be configured to route to one or more tailnet targets via a (mounted) config file that, for each tailnet target, specifies: - the target's tailnet IP or FQDN - mappings of container ports to which cluster workloads will send traffic to tailnet target ports where the traffic should be forwarded. Example configfile contents: { "some-svc": {"tailnetTarget":{"fqdn":"foo.tailnetxyz.ts.net","ports"{"tcp:4006:80":{"protocol":"tcp","matchPort":4006,"targetPort":80},"tcp:4007:443":{"protocol":"tcp","matchPort":4007,"targetPort":443}}}} } A proxy that is configured with this config file will configure firewall rules to route cluster traffic to the tailnet targets. It will then watch the config file for updates as well as monitor relevant netmap updates and reconfigure firewall as needed. This adds a bunch of new iptables/nftables functionality to make it easier to dynamically update the firewall rules without needing to restart the proxy Pod as well as to make it easier to debug/understand the rules: - for iptables, each portmapping is a DNAT rule with a comment pointing at the 'service',i.e: -A PREROUTING ! -i tailscale0 -p tcp -m tcp --dport 4006 -m comment --comment "some-svc:tcp:4006 -> tcp:80" -j DNAT --to-destination 100.64.1.18:80 Additionally there is a SNAT rule for each tailnet target, to mask the source address. - for nftables, a separate prerouting chain is created for each tailnet target and all the portmapping rules are placed in that chain. This makes it easier to look up rules and delete services when no longer needed. (nftables allows hooking a custom chain to a prerouting hook, so no extra work is needed to ensure that the rules in the service chains are evaluated). The next steps will be to get the Kubernetes Operator to generate the configfile and ensure it is mounted to the relevant proxy nodes. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
197 lines
6.2 KiB
Go
197 lines
6.2 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build linux
|
|
|
|
package linuxfw
|
|
|
|
import (
|
|
"net/netip"
|
|
"testing"
|
|
)
|
|
|
|
func Test_iptablesRunner_EnsurePortMapRuleForSvc(t *testing.T) {
|
|
v4Addr := netip.MustParseAddr("10.0.0.4")
|
|
v6Addr := netip.MustParseAddr("fd7a:115c:a1e0::701:b62a")
|
|
testPM := PortMap{Protocol: "tcp", MatchPort: 4003, TargetPort: 80}
|
|
testPM2 := PortMap{Protocol: "udp", MatchPort: 4004, TargetPort: 53}
|
|
v4Rule := argsForPortMapRule("test-svc", "tailscale0", v4Addr, testPM)
|
|
tests := []struct {
|
|
name string
|
|
targetIP netip.Addr
|
|
svc string
|
|
pm PortMap
|
|
precreateSvcRules [][]string
|
|
}{
|
|
{
|
|
name: "pm_for_ipv4",
|
|
targetIP: v4Addr,
|
|
svc: "test-svc",
|
|
pm: testPM,
|
|
},
|
|
{
|
|
name: "pm_for_ipv6",
|
|
targetIP: v6Addr,
|
|
svc: "test-svc-2",
|
|
pm: testPM2,
|
|
},
|
|
{
|
|
name: "add_existing_rule",
|
|
targetIP: v4Addr,
|
|
svc: "test-svc",
|
|
pm: testPM,
|
|
precreateSvcRules: [][]string{v4Rule},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
iptr := NewFakeIPTablesRunner()
|
|
table := iptr.getIPTByAddr(tt.targetIP)
|
|
for _, ruleset := range tt.precreateSvcRules {
|
|
mustPrecreatePortMapRule(t, ruleset, table)
|
|
}
|
|
if err := iptr.EnsurePortMapRuleForSvc(tt.svc, "tailscale0", tt.targetIP, tt.pm); err != nil {
|
|
t.Errorf("[unexpected error] iptablesRunner.EnsurePortMapRuleForSvc() = %v", err)
|
|
}
|
|
args := argsForPortMapRule(tt.svc, "tailscale0", tt.targetIP, tt.pm)
|
|
exists, err := table.Exists("nat", "PREROUTING", args...)
|
|
if err != nil {
|
|
t.Fatalf("error checking if rule exists: %v", err)
|
|
}
|
|
if !exists {
|
|
t.Errorf("expected rule was not created")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_iptablesRunner_DeletePortMapRuleForSvc(t *testing.T) {
|
|
v4Addr := netip.MustParseAddr("10.0.0.4")
|
|
v6Addr := netip.MustParseAddr("fd7a:115c:a1e0::701:b62a")
|
|
testPM := PortMap{Protocol: "tcp", MatchPort: 4003, TargetPort: 80}
|
|
v4Rule := argsForPortMapRule("test", "tailscale0", v4Addr, testPM)
|
|
v6Rule := argsForPortMapRule("test", "tailscale0", v6Addr, testPM)
|
|
|
|
tests := []struct {
|
|
name string
|
|
targetIP netip.Addr
|
|
svc string
|
|
pm PortMap
|
|
precreateSvcRules [][]string
|
|
}{
|
|
{
|
|
name: "multiple_rules_ipv4_deleted",
|
|
targetIP: v4Addr,
|
|
svc: "test",
|
|
pm: testPM,
|
|
precreateSvcRules: [][]string{v4Rule, v6Rule},
|
|
},
|
|
{
|
|
name: "multiple_rules_ipv6_deleted",
|
|
targetIP: v6Addr,
|
|
svc: "test",
|
|
pm: testPM,
|
|
precreateSvcRules: [][]string{v4Rule, v6Rule},
|
|
},
|
|
{
|
|
name: "non-existent_rule_deleted",
|
|
targetIP: v4Addr,
|
|
svc: "test",
|
|
pm: testPM,
|
|
precreateSvcRules: [][]string{v6Rule},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
iptr := NewFakeIPTablesRunner()
|
|
table := iptr.getIPTByAddr(tt.targetIP)
|
|
for _, ruleset := range tt.precreateSvcRules {
|
|
mustPrecreatePortMapRule(t, ruleset, table)
|
|
}
|
|
if err := iptr.DeletePortMapRuleForSvc(tt.svc, "tailscale0", tt.targetIP, tt.pm); err != nil {
|
|
t.Errorf("iptablesRunner.DeletePortMapRuleForSvc() errored: %v ", err)
|
|
}
|
|
deletedRule := argsForPortMapRule(tt.svc, "tailscale0", tt.targetIP, tt.pm)
|
|
exists, err := table.Exists("nat", "PREROUTING", deletedRule...)
|
|
if err != nil {
|
|
t.Fatalf("error verifying that rule does not exist after deletion: %v", err)
|
|
}
|
|
if exists {
|
|
t.Errorf("portmap rule exists after deletion")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_iptablesRunner_DeleteSvc(t *testing.T) {
|
|
v4Addr := netip.MustParseAddr("10.0.0.4")
|
|
v6Addr := netip.MustParseAddr("fd7a:115c:a1e0::701:b62a")
|
|
testPM := PortMap{Protocol: "tcp", MatchPort: 4003, TargetPort: 80}
|
|
iptr := NewFakeIPTablesRunner()
|
|
|
|
// create two rules that will consitute svc1
|
|
s1R1 := argsForPortMapRule("svc1", "tailscale0", v4Addr, testPM)
|
|
mustPrecreatePortMapRule(t, s1R1, iptr.getIPTByAddr(v4Addr))
|
|
s1R2 := argsForPortMapRule("svc1", "tailscale0", v6Addr, testPM)
|
|
mustPrecreatePortMapRule(t, s1R2, iptr.getIPTByAddr(v6Addr))
|
|
|
|
// create two rules that will consitute svc2
|
|
s2R1 := argsForPortMapRule("svc2", "tailscale0", v4Addr, testPM)
|
|
mustPrecreatePortMapRule(t, s2R1, iptr.getIPTByAddr(v4Addr))
|
|
s2R2 := argsForPortMapRule("svc2", "tailscale0", v6Addr, testPM)
|
|
mustPrecreatePortMapRule(t, s2R2, iptr.getIPTByAddr(v6Addr))
|
|
|
|
// delete svc1
|
|
if err := iptr.DeleteSvc("svc1", "tailscale0", []netip.Addr{v4Addr, v6Addr}, []PortMap{testPM}); err != nil {
|
|
t.Fatalf("error deleting service: %v", err)
|
|
}
|
|
|
|
// validate that svc1 no longer exists
|
|
svcMustNotExist(t, "svc1", map[string][]string{v4Addr.String(): s1R1, v6Addr.String(): s1R2}, iptr)
|
|
|
|
// validate that svc2 still exists
|
|
svcMustExist(t, "svc2", map[string][]string{v4Addr.String(): s2R1, v6Addr.String(): s2R2}, iptr)
|
|
}
|
|
|
|
func svcMustExist(t *testing.T, svcName string, rules map[string][]string, iptr *iptablesRunner) {
|
|
t.Helper()
|
|
for dst, ruleset := range rules {
|
|
tip := netip.MustParseAddr(dst)
|
|
exists, err := iptr.getIPTByAddr(tip).Exists("nat", "PREROUTING", ruleset...)
|
|
if err != nil {
|
|
t.Fatalf("error checking whether %s exists: %v", svcName, err)
|
|
}
|
|
if !exists {
|
|
t.Fatalf("service %s should be deleted,but found rule for %s", svcName, dst)
|
|
}
|
|
}
|
|
}
|
|
|
|
func svcMustNotExist(t *testing.T, svcName string, rules map[string][]string, iptr *iptablesRunner) {
|
|
t.Helper()
|
|
for dst, ruleset := range rules {
|
|
tip := netip.MustParseAddr(dst)
|
|
exists, err := iptr.getIPTByAddr(tip).Exists("nat", "PREROUTING", ruleset...)
|
|
if err != nil {
|
|
t.Fatalf("error checking whether %s exists: %v", svcName, err)
|
|
}
|
|
if exists {
|
|
t.Fatalf("service %s should exist, but rule for %s is missing", svcName, dst)
|
|
}
|
|
}
|
|
}
|
|
|
|
func mustPrecreatePortMapRule(t *testing.T, rules []string, table iptablesInterface) {
|
|
t.Helper()
|
|
exists, err := table.Exists("nat", "PREROUTING", rules...)
|
|
if err != nil {
|
|
t.Fatalf("error ensuring that nat PREROUTING table exists: %v", err)
|
|
}
|
|
if exists {
|
|
return
|
|
}
|
|
if err := table.Append("nat", "PREROUTING", rules...); err != nil {
|
|
t.Fatalf("error precreating portmap rule: %v", err)
|
|
}
|
|
}
|