summaryrefslogtreecommitdiff
path: root/edgemesh
diff options
context:
space:
mode:
authorXiang Dai <long0dai@foxmail.com>2020-05-11 10:37:33 +0800
committerXiang Dai <long0dai@foxmail.com>2020-06-04 10:27:54 +0800
commit1d770c11d03ea1985e61575cba5c83d2a9ca5623 (patch)
tree9743e2159d6cbf68e3f1203e1a5e6bf5e9ed91dd /edgemesh
parentMerge pull request #1746 from daixiang0/cache (diff)
downloadkubeedge-1d770c11d03ea1985e61575cba5c83d2a9ca5623.tar.gz
Lint: cleanup white noise
Signed-off-by: Xiang Dai <long0dai@foxmail.com>
Diffstat (limited to 'edgemesh')
-rw-r--r--edgemesh/tools/initContainer/createImg.sh2
-rw-r--r--edgemesh/tools/initContainer/rpm/Dockerfile2
-rw-r--r--edgemesh/tools/initContainer/script/edgemesh-iptables.sh60
3 files changed, 32 insertions, 32 deletions
diff --git a/edgemesh/tools/initContainer/createImg.sh b/edgemesh/tools/initContainer/createImg.sh
index eb1676cff..8b7c485be 100644
--- a/edgemesh/tools/initContainer/createImg.sh
+++ b/edgemesh/tools/initContainer/createImg.sh
@@ -26,7 +26,7 @@ if command -v docker > /dev/null 2>&1 ; then
#docker build
docker build -t edgemesh_init .
# delete iptables script
- rm ./edgemesh-iptables.sh
+ rm ./edgemesh-iptables.sh
else
echo 'the docker command is no found!!'
exit 1
diff --git a/edgemesh/tools/initContainer/rpm/Dockerfile b/edgemesh/tools/initContainer/rpm/Dockerfile
index 2fbf21657..2f3122c7d 100644
--- a/edgemesh/tools/initContainer/rpm/Dockerfile
+++ b/edgemesh/tools/initContainer/rpm/Dockerfile
@@ -3,5 +3,5 @@ FROM centos:latest
ADD edgemesh-iptables.sh /usr/local/bin
RUN yum -y update && yum install -y iproute iptables
-
+
ENTRYPOINT ["/usr/local/bin/edgemesh-iptables.sh"]
diff --git a/edgemesh/tools/initContainer/script/edgemesh-iptables.sh b/edgemesh/tools/initContainer/script/edgemesh-iptables.sh
index 1447ef7fb..86a7dc582 100644
--- a/edgemesh/tools/initContainer/script/edgemesh-iptables.sh
+++ b/edgemesh/tools/initContainer/script/edgemesh-iptables.sh
@@ -16,10 +16,10 @@ function usage() {
echo ' -h: for some help'
}
-# network namespace
+# network namespace
NETMODE=
-# get the container network mode
+# get the container network mode
function getContainerNetMode() {
if ip link |grep docker0 > /dev/null; then
echo 'this is the host mode,share with net namespace with host'
@@ -38,7 +38,7 @@ function isValidIP() {
true
else
false
- fi
+ fi
}
function isIPv4() {
@@ -68,34 +68,34 @@ function bridgeNetMode() {
echo 'this func used for bridge net mode'
# get default route
default_route=$(ip route show |grep default |awk '{print $3}')
-
+
#clear EDGEMESH chain and rule,if exist
iptables -t nat -D OUTPUT -p tcp -j EDGEMESH_OUTBOUND 2>/dev/null
iptables -t nat -D OUTPUT -p udp --dport "53" -j EDGEMESH_OUTBOUND_DNS 2>/dev/null
iptables -t nat -F EDGEMESH_OUTBOUND 2>/dev/null
iptables -t nat -X EDGEMESH_OUTBOUND 2>/dev/null
-
+
iptables -t nat -F EDGEMESH_OUTBOUND_REDIRECT 2>/dev/null
iptables -t nat -X EDGEMESH_OUTBOUND_REDIRECT 2>/dev/null
-
+
iptables -t nat -F EDGEMESH_OUTBOUND_DNS 2>/dev/null
iptables -t nat -X EDGEMESH_OUTBOUND_DNS 2>/dev/null
-
+
# make chain for edgemesh hijacking
iptables -t nat -N EDGEMESH_OUTBOUND_REDIRECT
iptables -t nat -A EDGEMESH_OUTBOUND_REDIRECT -p tcp -j DNAT --to-destination "${default_route}:${EDGEMESH_PROXY_PORT}"
iptables -t nat -N EDGEMESH_OUTBOUND
iptables -t nat -A OUTPUT -p tcp -j EDGEMESH_OUTBOUND
-
+
# support dns use udp for dest port 53
iptables -t nat -N EDGEMESH_OUTBOUND_DNS
iptables -t nat -A EDGEMESH_OUTBOUND_DNS -j DNAT --to-destination "${default_route}"
iptables -t nat -A OUTPUT -p udp --dport "53" -j EDGEMESH_OUTBOUND_DNS
-
+
# excluded traffic for some port incloude some special port,such as 22
iptables -t nat -A EDGEMESH_OUTBOUND -p tcp --dport "22" -j RETURN
- if [ -n "${EDGEMESH_EXCLUDE_PORT}" ]; then
- for port in "${port_exclude_list[@]}"; do
+ if [ -n "${EDGEMESH_EXCLUDE_PORT}" ]; then
+ for port in "${port_exclude_list[@]}"; do
iptables -t nat -A EDGEMESH_OUTBOUND -p tcp --dport "${port}" -j RETURN
done
fi
@@ -105,10 +105,10 @@ function bridgeNetMode() {
iptables -t nat -A EDGEMESH_OUTBOUND -d "${ip}" -j RETURN
done
fi
-
+
# Redirect app callback to itself via Service IP (default not redirected)
get_local_IP=$(ip addr |grep inet|grep -v inet6|awk '{print $2}'|tr -d "addr:")
-
+
for LOCAL_IP in $get_local_IP; do
ele=${LOCAL_IP%$splt}
echo "LOCAL_IP: $LOCAL_IP , $ele"
@@ -118,7 +118,7 @@ function bridgeNetMode() {
done
# loopback traffic
iptables -t nat -A EDGEMESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
-
+
# hijacking
if [ ${#ipv4_include_list[@]} -gt 0 ]; then
# include Ips and ports are *
@@ -131,11 +131,11 @@ function bridgeNetMode() {
done
fi
if [ "${EDGEMESH_HIJACK_PORT}" != "*" ]; then
- for port in "${port_include_list[@]}"; do
+ for port in "${port_include_list[@]}"; do
iptables -t nat -A EDGEMESH_OUTBOUND -p tcp --dport "${port}" -j EDGEMESH_OUTBOUND_REDIRECT
done
fi
-
+
iptables -t nat -A EDGEMESH_OUTBOUND -j RETURN
fi
fi
@@ -158,7 +158,7 @@ EDGEMESH_EXCLUDE_PORT=${EXCLUDE_PORT-}
function main() {
getContainerNetMode
-
+
while getopts ":p:i:t:b:c:h" opt; do
case ${opt} in
p)
@@ -167,13 +167,13 @@ function main() {
i)
EDGEMESH_HIJACK_IP=${OPTARG}
;;
- t)
+ t)
EDGEMESH_HIJACK_PORT=${OPTARG}
;;
b)
EDGEMESH_EXCLUDE_IP=${OPTARG}
;;
- c)
+ c)
EDGEMESH_EXCLUDE_PORT=${OPTARG}
;;
h)
@@ -187,7 +187,7 @@ function main() {
;;
esac
done
-
+
echo "EdgeMesh iptables configration:"
echo "====================================="
echo "Container Network mode is: ${NETMODE}"
@@ -197,7 +197,7 @@ function main() {
echo "EDGEMESH_HIJACK_PORT=${EDGEMESH_HIJACK_PORT-"*"}"
echo "EDGEMESH_EXCLUDE_IP=${EDGEMESH_EXCLUDE_IP-}"
echo "EDGEMESH_EXCLUDE_PORT=${EDGEMESH_EXCLUDE_PORT-}"
-
+
# parse parameter
IFS=',' read -ra EXCLUDE_IP <<< "${EDGEMESH_EXCLUDE_IP}"
IFS=',' read -ra INCLUDE_IP <<< "${EDGEMESH_HIJACK_IP}"
@@ -212,7 +212,7 @@ function main() {
fi
fi
done
-
+
if [ "${EDGEMESH_HIJACK_IP}" == "*" ]; then
ipv4_include_list=("*")
ipv6_include_list=("*")
@@ -225,10 +225,10 @@ function main() {
elif isIPv6 "$r"; then
ipv6_include_list+=("$range")
fi
- fi
+ fi
done
fi
-
+
IFS=',' read -ra INCLUDE_PORT <<< "${EDGEMESH_HIJACK_PORT}"
IFS=',' read -ra EXCLUDE_PORT <<< "${EDGEMESH_EXCLUDE_PORT}"
if [ "${EDGEMESH_HIJACK_PORT}" != "*" ]; then
@@ -236,20 +236,20 @@ function main() {
port_include_list+=("$port")
done
fi
-
- if [ -n "${EDGEMESH_EXCLUDE_PORT}" ]; then
- for port in "${EXCLUDE_PORT[@]}"; do
+
+ if [ -n "${EDGEMESH_EXCLUDE_PORT}" ]; then
+ for port in "${EXCLUDE_PORT[@]}"; do
port_exclude_list+=("$port")
done
fi
-
+
echo "ipv4_include_list : ${ipv4_include_list[@]}"
echo "ipv4_exclude_list : ${ipv4_exclude_list[@]}"
echo "port_include_list : ${port_include_list[@]}"
echo "port_exclude_list : ${port_exclude_list[@]}"
-
+
# bridge mode(port map) container network
- if [ "${NETMODE}" = "OTHER" ]; then
+ if [ "${NETMODE}" = "OTHER" ]; then
echo " ${NETMODE} iptables configration"
bridgeNetMode
# if set ipv6 option