Skip to content

Commit 3b306f9

Browse files
ssongliussongliu
authored
chore: Optimize iptables initial state loading speed (#11085)
1 parent 92fa655 commit 3b306f9

File tree

4 files changed

+118
-96
lines changed

4 files changed

+118
-96
lines changed

‎agent/app/service/firewall.go‎

Lines changed: 1 addition & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ func (u *FirewallService) LoadBaseInfo(tab string) (dto.FirewallBaseInfo, error)
6868
go func() {
6969
defer wg.Done()
7070
baseInfo.IsActive, _ = client.Status()
71-
baseInfo.IsInit, baseInfo.IsBind = loadInitStatus(baseInfo.Name, tab)
71+
baseInfo.IsInit, baseInfo.IsBind = iptables.LoadInitStatus(baseInfo.Name, tab)
7272
}()
7373
wg.Wait()
7474
return baseInfo, nil
@@ -826,96 +826,3 @@ func checkPortUsed(ports, proto string, apps []portOfApp) string {
826826
}
827827
return ""
828828
}
829-
830-
func loadInitStatus(clientName, tab string) (bool, bool) {
831-
if clientName == "firewalld" {
832-
return true, true
833-
}
834-
if clientName == "ufw" && tab != "forward" {
835-
return true, true
836-
}
837-
switch tab {
838-
case "base":
839-
if isExist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasicBefore); !isExist {
840-
return false, false
841-
}
842-
if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.IoRuleIn); !exist {
843-
return false, false
844-
}
845-
if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.EstablishedRule); !exist {
846-
return false, false
847-
}
848-
if exist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasic); !exist {
849-
return false, false
850-
}
851-
if exist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter); !exist {
852-
return false, false
853-
}
854-
if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllTcp); !exist {
855-
return false, false
856-
}
857-
if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllUdp); !exist {
858-
return false, false
859-
}
860-
if bind, _ := iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore); !bind {
861-
return true, false
862-
}
863-
if bind, _ := iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic); !bind {
864-
return true, false
865-
}
866-
if bind, _ := iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter); !bind {
867-
return true, false
868-
}
869-
return true, true
870-
case "advance":
871-
isExist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelInput)
872-
if !isExist {
873-
return false, false
874-
}
875-
isExist, _ = iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelOutput)
876-
if !isExist {
877-
return false, false
878-
}
879-
880-
isBind, _ := iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelInput)
881-
if !isBind {
882-
return true, false
883-
}
884-
isBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainOutput, iptables.Chain1PanelOutput)
885-
return true, isBind
886-
case "forward":
887-
stdout, err := cmd.RunDefaultWithStdoutBashC("cat /proc/sys/net/ipv4/ip_forward")
888-
if err != nil {
889-
global.LOG.Errorf("check /proc/sys/net/ipv4/ip_forward failed, err: %v", err)
890-
return false, false
891-
}
892-
if strings.TrimSpace(stdout) == "0" {
893-
return false, false
894-
}
895-
896-
exist, _ := iptables.CheckChainExist(iptables.NatTab, iptables.Chain1PanelPreRouting)
897-
if !exist {
898-
return false, false
899-
}
900-
exist, _ = iptables.CheckChainExist(iptables.NatTab, iptables.Chain1PanelPostRouting)
901-
if !exist {
902-
return false, false
903-
}
904-
exist, _ = iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelForward)
905-
if !exist {
906-
return false, false
907-
}
908-
isBind, _ := iptables.CheckChainBind(iptables.NatTab, "PREROUTING", iptables.Chain1PanelPreRouting)
909-
if !isBind {
910-
return false, false
911-
}
912-
isBind, _ = iptables.CheckChainBind(iptables.NatTab, "POSTROUTING", iptables.Chain1PanelPostRouting)
913-
if !isBind {
914-
return false, false
915-
}
916-
isBind, _ = iptables.CheckChainBind(iptables.FilterTab, "FORWARD", iptables.Chain1PanelForward)
917-
return true, isBind
918-
default:
919-
return false, false
920-
}
921-
}

‎agent/server/server.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,11 @@ func Start() {
4242
i18n.Init()
4343
cache.Init()
4444
app.Init()
45-
firewall.Init()
4645
lang.Init()
4746
validator.Init()
4847
cron.Run()
4948
hook.Init()
49+
go firewall.Init()
5050
InitOthers()
5151

5252
rootRouter := router.Routers()

‎agent/utils/firewall/client/iptables/common.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ const (
2424
)
2525

2626
const (
27-
EstablishedRule = "-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment 'ESTABLISHED Whitelist'"
27+
EstablishedRule = "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment 'ESTABLISHED Whitelist'"
2828
IoRuleIn = "-i lo -j ACCEPT -m comment --comment 'Loopback Whitelist'"
2929
DropAllTcp = "-p tcp -j DROP"
3030
DropAllUdp = "-p udp -j DROP"

‎agent/utils/firewall/client/iptables/filter.go‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"strings"
66
"time"
77

8+
"github.com/1Panel-dev/1Panel/agent/global"
89
"github.com/1Panel-dev/1Panel/agent/utils/cmd"
910
)
1011

@@ -117,6 +118,120 @@ func LoadDefaultStrategy(chain string) (string, error) {
117118
return ACCEPT, nil
118119
}
119120

121+
func LoadInitStatus(clientName, tab string) (bool, bool) {
122+
if clientName == "firewalld" {
123+
return true, true
124+
}
125+
if clientName == "ufw" && tab != "forward" {
126+
return true, true
127+
}
128+
switch tab {
129+
case "base":
130+
filterRules, err := RunWithStd(FilterTab, "-S")
131+
if err != nil {
132+
return false, false
133+
}
134+
lines := strings.Split(filterRules, "\n")
135+
initRules := []string{
136+
"-N " + Chain1PanelBasicBefore,
137+
"-N " + Chain1PanelBasic,
138+
"-N " + Chain1PanelBasicAfter,
139+
fmt.Sprintf("-A %s %s -j ACCEPT", Chain1PanelBasicBefore, strings.ReplaceAll(strings.ReplaceAll(IoRuleIn, "'", "\""), " -j ACCEPT", "")),
140+
fmt.Sprintf("-A %s %s -j ACCEPT", Chain1PanelBasicBefore, strings.ReplaceAll(strings.ReplaceAll(EstablishedRule, "'", "\""), " -j ACCEPT", "")),
141+
fmt.Sprintf("-A %s %s", Chain1PanelBasicAfter, DropAllTcp),
142+
fmt.Sprintf("-A %s %s", Chain1PanelBasicAfter, DropAllUdp),
143+
}
144+
bindRules := []string{
145+
fmt.Sprintf("-A %s -j %s", ChainInput, Chain1PanelBasicBefore),
146+
fmt.Sprintf("-A %s -j %s", ChainInput, Chain1PanelBasic),
147+
fmt.Sprintf("-A %s -j %s", ChainInput, Chain1PanelBasicAfter),
148+
}
149+
return checkWithInitAndBind(initRules, bindRules, lines)
150+
case "advance":
151+
filterRules, err := RunWithStd(FilterTab, "-S")
152+
if err != nil {
153+
return false, false
154+
}
155+
lines := strings.Split(filterRules, "\n")
156+
initRules := []string{
157+
"-N " + Chain1PanelInput,
158+
"-N " + Chain1PanelOutput,
159+
}
160+
bindRules := []string{
161+
fmt.Sprintf("-A %s -j %s", ChainInput, Chain1PanelInput),
162+
fmt.Sprintf("-A %s -j %s", ChainOutput, Chain1PanelOutput),
163+
}
164+
return checkWithInitAndBind(initRules, bindRules, lines)
165+
case "forward":
166+
stdout, err := cmd.RunDefaultWithStdoutBashC("cat /proc/sys/net/ipv4/ip_forward")
167+
if err != nil {
168+
global.LOG.Errorf("check /proc/sys/net/ipv4/ip_forward failed, err: %v", err)
169+
return false, false
170+
}
171+
if strings.TrimSpace(stdout) == "0" {
172+
return false, false
173+
}
174+
natRules, err := RunWithStd(NatTab, "-S")
175+
if err != nil {
176+
return false, false
177+
}
178+
lines := strings.Split(natRules, "\n")
179+
initRules := []string{
180+
"-N " + Chain1PanelPreRouting,
181+
"-N " + Chain1PanelPostRouting,
182+
}
183+
bindRules := []string{
184+
fmt.Sprintf("-A PREROUTING -j %s", Chain1PanelPreRouting),
185+
fmt.Sprintf("-A POSTROUTING -j %s", Chain1PanelPostRouting),
186+
}
187+
isNatInit, isNatBind := checkWithInitAndBind(initRules, bindRules, lines)
188+
if !isNatInit {
189+
return false, false
190+
}
191+
filterRules, err := RunWithStd(FilterTab, "-S")
192+
if err != nil {
193+
return false, false
194+
}
195+
filterLines := strings.Split(filterRules, "\n")
196+
filterInitRules := []string{"-N " + Chain1PanelForward}
197+
filterBindRules := []string{fmt.Sprintf("-A FORWARD -j %s", Chain1PanelForward)}
198+
isFilterInit, isFilterBind := checkWithInitAndBind(filterInitRules, filterBindRules, filterLines)
199+
return isNatInit && isFilterInit, isNatBind && isFilterBind
200+
default:
201+
return false, false
202+
}
203+
}
204+
205+
func checkWithInitAndBind(initRules, bindRules []string, lines []string) (bool, bool) {
206+
for _, rule := range initRules {
207+
found := false
208+
for _, line := range lines {
209+
if strings.TrimSpace(line) == strings.TrimSpace(rule) {
210+
found = true
211+
break
212+
}
213+
}
214+
if !found {
215+
global.LOG.Debugf("not found init rule: %s", rule)
216+
return false, false
217+
}
218+
}
219+
for _, rule := range bindRules {
220+
found := false
221+
for _, line := range lines {
222+
if strings.TrimSpace(line) == strings.TrimSpace(rule) {
223+
found = true
224+
break
225+
}
226+
}
227+
if !found {
228+
global.LOG.Debugf("not found bind rule: %s", rule)
229+
return true, false
230+
}
231+
}
232+
return true, true
233+
}
234+
120235
func loadPort(position string, portStr []string) string {
121236
if len(portStr) < 7 {
122237
return ""

0 commit comments

Comments
 (0)