@@ -61,20 +61,20 @@ type FirewallConfiguration struct {
61
61
// the pod to join the service mesh. A lot of this logic was based on
62
62
// https://github.com/istio/istio/blob/e83411e/pilot/docker/prepare_proxy.sh
63
63
func ConfigureFirewall (firewallConfiguration FirewallConfiguration ) error {
64
- log .Debugf ("Tracing this script execution as [%s]" , ExecutionTraceID )
64
+ log .Debugf ("tracing script execution as [%s]" , ExecutionTraceID )
65
65
66
66
b := bytes.Buffer {}
67
67
if err := executeCommand (firewallConfiguration , makeShowAllRules (), & b ); err != nil {
68
- log .Error ("Aborting firewall configuration" )
68
+ log .Error ("aborting firewall configuration" )
69
69
return err
70
70
}
71
71
72
72
commands := make ([]* exec.Cmd , 0 )
73
73
74
74
matches := chainRegex .FindAllString (b .String (), 1 )
75
75
if len (matches ) > 0 {
76
- log .Infof ("Found %d existing chains. Skipping iptables setup. " , len (matches ))
77
- log .Debugf ("Chains : %v" , matches )
76
+ log .Infof ("skipping iptables setup: found %d existing chains" , len (matches ))
77
+ log .Debugf ("matching chains : %v" , matches )
78
78
return nil
79
79
}
80
80
@@ -84,7 +84,6 @@ func ConfigureFirewall(firewallConfiguration FirewallConfiguration) error {
84
84
85
85
for _ , cmd := range commands {
86
86
if err := executeCommand (firewallConfiguration , cmd , nil ); err != nil {
87
- log .Error ("Aborting firewall configuration" )
88
87
return err
89
88
}
90
89
}
@@ -105,18 +104,14 @@ func addOutgoingTrafficRules(commands []*exec.Cmd, firewallConfiguration Firewal
105
104
106
105
// Ignore traffic from the proxy
107
106
if firewallConfiguration .ProxyUID > 0 {
108
- log .Infof ("Ignoring uid %d" , firewallConfiguration .ProxyUID )
109
107
commands = append (commands , makeIgnoreUserID (outputChainName , firewallConfiguration .ProxyUID , "ignore-proxy-user-id" ))
110
- } else {
111
- log .Info ("Not ignoring any uid" )
112
108
}
113
109
114
110
// Ignore loopback
115
111
commands = append (commands , makeIgnoreLoopback (outputChainName , "ignore-loopback" ))
116
112
// Ignore ports
117
113
commands = addRulesForIgnoredPorts (firewallConfiguration .OutboundPortsToIgnore , outputChainName , commands )
118
114
119
- log .Infof ("Redirecting all OUTPUT to %d" , firewallConfiguration .ProxyOutgoingPort )
120
115
commands = append (commands , makeRedirectChainToPort (outputChainName , firewallConfiguration .ProxyOutgoingPort , "redirect-all-outgoing-to-proxy-port" ))
121
116
122
117
// Redirect all remaining outbound traffic to the proxy.
@@ -151,14 +146,12 @@ func addIncomingTrafficRules(commands []*exec.Cmd, firewallConfiguration Firewal
151
146
152
147
func addRulesForInboundPortRedirect (firewallConfiguration FirewallConfiguration , chainName string , commands []* exec.Cmd ) []* exec.Cmd {
153
148
if firewallConfiguration .Mode == RedirectAllMode {
154
- log .Info ("Will redirect all INPUT ports to proxy" )
155
149
// Create a new chain for redirecting inbound and outbound traffic to the proxy port.
156
150
commands = append (commands , makeRedirectChainToPort (chainName ,
157
151
firewallConfiguration .ProxyInboundPort ,
158
152
"redirect-all-incoming-to-proxy-port" ))
159
153
160
154
} else if firewallConfiguration .Mode == RedirectListedMode {
161
- log .Infof ("Will redirect some INPUT ports to proxy: %v" , firewallConfiguration .PortsToRedirectInbound )
162
155
for _ , port := range firewallConfiguration .PortsToRedirectInbound {
163
156
commands = append (
164
157
commands ,
@@ -174,17 +167,13 @@ func addRulesForInboundPortRedirect(firewallConfiguration FirewallConfiguration,
174
167
175
168
func addRulesForIgnoredPorts (portsToIgnore []string , chainName string , commands []* exec.Cmd ) []* exec.Cmd {
176
169
for _ , destinations := range makeMultiportDestinations (portsToIgnore ) {
177
- log .Infof ("Will ignore port %s on chain %s" , destinations , chainName )
178
-
179
170
commands = append (commands , makeIgnorePorts (chainName , destinations , fmt .Sprintf ("ignore-port-%s" , strings .Join (destinations , "," ))))
180
171
}
181
172
return commands
182
173
}
183
174
184
175
func addRulesForIgnoredSubnets (subnetsToIgnore []string , chainName string , commands []* exec.Cmd ) []* exec.Cmd {
185
176
for _ , subnet := range subnetsToIgnore {
186
- log .Infof ("Will ignore subnet %s on chain %s" , subnet , chainName )
187
-
188
177
commands = append (commands , makeIgnoreSubnet (chainName , subnet , fmt .Sprintf ("ignore-subnet-%s" , subnet )))
189
178
}
190
179
return commands
@@ -214,15 +203,15 @@ func makeMultiportDestinations(portsToIgnore []string) [][]string {
214
203
destinations = append (destinations , asDestination (portRange ))
215
204
destinationPortCount += portCount
216
205
} else {
217
- log .Errorf ("Invalid port configuration of \" %s\" : %s" , portOrRange , err .Error ())
206
+ log .Errorf ("invalid port configuration of \" %s\" : %s" , portOrRange , err .Error ())
218
207
}
219
208
}
220
209
return append (destinationSlices , destinations )
221
210
}
222
211
223
212
func executeCommand (firewallConfiguration FirewallConfiguration , cmd * exec.Cmd , cmdOut io.Writer ) error {
224
213
if strings .HasSuffix (cmd .Path , "iptables" ) && firewallConfiguration .UseWaitFlag {
225
- log .Info ("Setting UseWaitFlag : iptables will wait for xtables to become available" )
214
+ log .Info ("'useWaitFlag' set : iptables will wait for xtables to become available" )
226
215
cmd .Args = append (cmd .Args , "-w" )
227
216
}
228
217
0 commit comments