Skip to content

Commit 4d67337

Browse files
ssongliussongliu
committed
fix: Fix iptables state persistence issue
1 parent 25fb431 commit 4d67337

File tree

4 files changed

+118
-41
lines changed

4 files changed

+118
-41
lines changed

‎agent/app/service/iptables.go‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88

99
"github.com/1Panel-dev/1Panel/agent/app/dto"
1010
"github.com/1Panel-dev/1Panel/agent/app/model"
11+
"github.com/1Panel-dev/1Panel/agent/constant"
1112
"github.com/1Panel-dev/1Panel/agent/global"
1213
"github.com/1Panel-dev/1Panel/agent/utils/cmd"
1314
"github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
@@ -189,9 +190,14 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
189190
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
190191
return err
191192
}
193+
_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
192194
return nil
193195
case "init-forward":
194-
return client.EnableIptablesForward()
196+
if err := client.EnableIptablesForward(); err != nil {
197+
return err
198+
}
199+
_ = settingRepo.Update("IptablesForwardStatus", constant.StatusEnable)
200+
return nil
195201
case "init-advance":
196202
if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelInput); err != nil {
197203
return err
@@ -206,6 +212,8 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
206212
if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelInput, number); err != nil {
207213
return err
208214
}
215+
_ = settingRepo.Update("IptablesInputStatus", constant.StatusEnable)
216+
_ = settingRepo.Update("IptablesOutputStatus", constant.StatusEnable)
209217
return nil
210218
case "bind-base":
211219
if err := initPreRules(); err != nil {
@@ -220,6 +228,7 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
220228
if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter, 3); err != nil {
221229
return err
222230
}
231+
_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
223232
return nil
224233
case "unbind-base":
225234
if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter); err != nil {
@@ -231,16 +240,29 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
231240
if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic); err != nil {
232241
return err
233242
}
243+
_ = settingRepo.Update("IptablesStatus", constant.StatusDisable)
234244
return nil
235245
case "bind":
236246
if err := iptables.BindChain(iptables.FilterTab, targetChain, req.Name, loadBindNumber(req.Name)); err != nil {
237247
return err
238248
}
249+
if req.Name == iptables.Chain1PanelInput {
250+
_ = settingRepo.Update("IptablesInputStatus", constant.StatusEnable)
251+
}
252+
if req.Name == iptables.Chain1PanelOutput {
253+
_ = settingRepo.Update("IptablesOutputStatus", constant.StatusEnable)
254+
}
239255
return nil
240256
case "unbind":
241257
if err := iptables.UnbindChain(iptables.FilterTab, targetChain, req.Name); err != nil {
242258
return err
243259
}
260+
if req.Name == iptables.Chain1PanelInput {
261+
_ = settingRepo.Update("IptablesInputStatus", constant.StatusDisable)
262+
}
263+
if req.Name == iptables.Chain1PanelOutput {
264+
_ = settingRepo.Update("IptablesOutputStatus", constant.StatusDisable)
265+
}
244266
return nil
245267
}
246268
return nil

‎agent/init/firewall/firewall.go‎

Lines changed: 75 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,30 @@ package firewall
22

33
import (
44
"fmt"
5+
"os"
56

67
"github.com/1Panel-dev/1Panel/agent/app/dto"
8+
"github.com/1Panel-dev/1Panel/agent/app/repo"
79
"github.com/1Panel-dev/1Panel/agent/app/service"
10+
"github.com/1Panel-dev/1Panel/agent/constant"
811
"github.com/1Panel-dev/1Panel/agent/global"
912
"github.com/1Panel-dev/1Panel/agent/utils/firewall"
1013
firewallClient "github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
1114
"github.com/1Panel-dev/1Panel/agent/utils/firewall/client/iptables"
1215
)
1316

1417
func Init() {
18+
if !needInit() {
19+
return
20+
}
21+
global.LOG.Info("initializing firewall settings...")
1522
client, err := firewall.NewFirewallClient()
1623
if err != nil {
1724
return
1825
}
1926
clientName := client.Name()
27+
28+
settingRepo := repo.NewISettingRepo()
2029
if clientName == "ufw" || clientName == "iptables" {
2130
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelForward, iptables.ForwardFileName); err != nil {
2231
global.LOG.Errorf("load forward rules from file failed, err: %v", err)
@@ -30,65 +39,91 @@ func Init() {
3039
global.LOG.Errorf("load postrouting rules from file failed, err: %v", err)
3140
return
3241
}
33-
if err := firewallClient.EnableIptablesForward(); err != nil {
34-
global.LOG.Errorf("enable iptables forward failed, err: %v", err)
35-
return
36-
}
3742
global.LOG.Infof("loaded iptables rules for forward from file successfully")
43+
44+
iptablesForwardStatus, _ := settingRepo.GetValueByKey("IptablesForwardStatus")
45+
if iptablesForwardStatus == constant.StatusEnable {
46+
if err := firewallClient.EnableIptablesForward(); err != nil {
47+
global.LOG.Errorf("enable iptables forward failed, err: %v", err)
48+
return
49+
}
50+
}
3851
}
52+
3953
if clientName == "ufw" {
4054
_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter)
4155
_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore)
4256
_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic)
4357
_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelInput)
4458
_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainOutput, iptables.Chain1PanelOutput)
4559
}
46-
if clientName == "iptables" {
47-
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
48-
global.LOG.Errorf("load basic before rules from file failed, err: %v", err)
49-
return
50-
}
51-
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
52-
global.LOG.Errorf("load basic rules from file failed, err: %v", err)
53-
return
54-
}
55-
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
56-
global.LOG.Errorf("load basic after rules from file failed, err: %v", err)
57-
return
58-
}
59-
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelInput, iptables.InputFileName); err != nil {
60-
global.LOG.Errorf("load input rules from file failed, err: %v", err)
61-
return
62-
}
63-
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelOutput, iptables.OutputFileName); err != nil {
64-
global.LOG.Errorf("load output rules from file failed, err: %v", err)
65-
return
66-
}
67-
global.LOG.Infof("loaded iptables rules for basic, input and output from file successfully")
6860

69-
panelPort := service.LoadPanelPort()
70-
if len(panelPort) == 0 {
71-
global.LOG.Errorf("find 1panel service port failed")
72-
return
73-
}
74-
if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, fmt.Sprintf("-p tcp -m tcp --dport %v -j ACCEPT", panelPort)); err != nil {
75-
global.LOG.Errorf("add port accept rule %v failed, err: %v", panelPort, err)
61+
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
62+
global.LOG.Errorf("load basic before rules from file failed, err: %v", err)
63+
return
64+
}
65+
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
66+
global.LOG.Errorf("load basic rules from file failed, err: %v", err)
67+
return
68+
}
69+
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
70+
global.LOG.Errorf("load basic after rules from file failed, err: %v", err)
71+
return
72+
}
73+
panelPort := service.LoadPanelPort()
74+
if len(panelPort) == 0 {
75+
global.LOG.Errorf("find 1panel service port failed")
76+
return
77+
}
78+
if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, fmt.Sprintf("-p tcp -m tcp --dport %v -j ACCEPT", panelPort)); err != nil {
79+
global.LOG.Errorf("add port accept rule %v failed, err: %v", panelPort, err)
80+
return
81+
}
82+
global.LOG.Infof("loaded iptables rules for basic from file successfully")
83+
iptablesService := service.IptablesService{}
84+
iptablesStatus, _ := settingRepo.GetValueByKey("IptablesStatus")
85+
if iptablesStatus == constant.StatusEnable {
86+
if err := iptablesService.Operate(dto.IptablesOp{Operate: "bind-base"}); err != nil {
87+
global.LOG.Errorf("bind base chains failed, err: %v", err)
7688
return
7789
}
90+
}
7891

79-
iptablesService := service.IptablesService{}
80-
if err := iptablesService.Operate(dto.IptablesOp{Operate: "bind-base"}); err != nil {
81-
global.LOG.Errorf("bind base chains failed, err: %v", err)
92+
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelInput, iptables.InputFileName); err != nil {
93+
global.LOG.Errorf("load input rules from file failed, err: %v", err)
94+
return
95+
}
96+
if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelOutput, iptables.OutputFileName); err != nil {
97+
global.LOG.Errorf("load output rules from file failed, err: %v", err)
98+
return
99+
}
100+
global.LOG.Infof("loaded iptables rules for input and output from file successfully")
101+
iptablesInputStatus, _ := settingRepo.GetValueByKey("IptablesInputStatus")
102+
if iptablesInputStatus == constant.StatusEnable {
103+
if err := iptablesService.Operate(dto.IptablesOp{Name: iptables.Chain1PanelInput, Operate: "bind"}); err != nil {
104+
global.LOG.Errorf("bind input chains failed, err: %v", err)
82105
return
83106
}
107+
}
108+
iptablesOutputStatus, _ := settingRepo.GetValueByKey("IptablesOutputStatus")
109+
if iptablesOutputStatus == constant.StatusEnable {
84110
if err := iptablesService.Operate(dto.IptablesOp{Name: iptables.Chain1PanelOutput, Operate: "bind"}); err != nil {
85111
global.LOG.Errorf("bind output chains failed, err: %v", err)
86112
return
87113
}
88-
if err := iptablesService.Operate(dto.IptablesOp{Name: iptables.Chain1PanelInput, Operate: "bind"}); err != nil {
89-
global.LOG.Errorf("bind input chains failed, err: %v", err)
90-
return
91-
}
92114
}
115+
}
93116

117+
func needInit() bool {
118+
file, err := os.OpenFile("/run/1panel_boot_mark", os.O_RDWR|os.O_CREATE|os.O_EXCL, 0644)
119+
if err != nil {
120+
if os.IsExist(err) {
121+
return false
122+
}
123+
global.LOG.Errorf("check boot mark file failed: %v", err)
124+
return true
125+
}
126+
defer file.Close()
127+
fmt.Fprintf(file, "Boot Mark for 1panel\n")
128+
return true
94129
}

‎agent/init/migration/migrate.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func InitAgentDB() {
5656
migrations.UpdateDatabase,
5757
migrations.AddGPUMonitor,
5858
migrations.UpdateDatabaseMysql,
59+
migrations.InitIptablesStatus,
5960
})
6061
if err := m.Migrate(); err != nil {
6162
global.LOG.Error(err)

‎agent/init/migration/migrations/init.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -756,3 +756,22 @@ var UpdateDatabaseMysql = &gormigrate.Migration{
756756
return nil
757757
},
758758
}
759+
760+
var InitIptablesStatus = &gormigrate.Migration{
761+
ID: "20251201-init-iptables-status",
762+
Migrate: func(tx *gorm.DB) error {
763+
if err := tx.Create(&model.Setting{Key: "IptablesStatus", Value: constant.StatusDisable}).Error; err != nil {
764+
return err
765+
}
766+
if err := tx.Create(&model.Setting{Key: "IptablesForwardStatus", Value: constant.StatusDisable}).Error; err != nil {
767+
return err
768+
}
769+
if err := tx.Create(&model.Setting{Key: "IptablesInputStatus", Value: constant.StatusDisable}).Error; err != nil {
770+
return err
771+
}
772+
if err := tx.Create(&model.Setting{Key: "IptablesOutputStatus", Value: constant.StatusDisable}).Error; err != nil {
773+
return err
774+
}
775+
return nil
776+
},
777+
}

0 commit comments

Comments
 (0)