Skip to content

Commit 50947f4

Browse files
ssongliussongliu
authored
feat: ICMP ping disable compatibility with Debian 13 (#11514)
Refs #11472
1 parent d302bc0 commit 50947f4

File tree

5 files changed

+146
-107
lines changed

5 files changed

+146
-107
lines changed

‎agent/app/service/firewall.go‎

Lines changed: 11 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package service
33
import (
44
"context"
55
"fmt"
6-
"os"
76
"sort"
87
"strconv"
98
"strings"
@@ -14,7 +13,6 @@ import (
1413
"github.com/1Panel-dev/1Panel/agent/buserr"
1514
"github.com/1Panel-dev/1Panel/agent/constant"
1615
"github.com/1Panel-dev/1Panel/agent/global"
17-
"github.com/1Panel-dev/1Panel/agent/utils/cmd"
1816
"github.com/1Panel-dev/1Panel/agent/utils/common"
1917
"github.com/1Panel-dev/1Panel/agent/utils/controller"
2018
"github.com/1Panel-dev/1Panel/agent/utils/firewall"
@@ -23,9 +21,6 @@ import (
2321
"github.com/jinzhu/copier"
2422
)
2523

26-
const confPath = "/etc/sysctl.conf"
27-
const panelSysctlPath = "/etc/sysctl.d/98-onepanel.conf"
28-
2924
type FirewallService struct{}
3025

3126
type IFirewallService interface {
@@ -62,7 +57,7 @@ func (u *FirewallService) LoadBaseInfo(tab string) (dto.FirewallBaseInfo, error)
6257
wg.Add(2)
6358
go func() {
6459
defer wg.Done()
65-
baseInfo.PingStatus = u.pingStatus()
60+
baseInfo.PingStatus = firewall.LoadPingStatus()
6661
baseInfo.Version, _ = client.Version()
6762
}()
6863
go func() {
@@ -207,9 +202,17 @@ func (u *FirewallService) OperateFirewall(req dto.FirewallOperation) error {
207202
}
208203
needRestartDocker = true
209204
case "disablePing":
210-
return u.updatePingStatus("0")
205+
if err := firewall.UpdatePingStatus("0"); err != nil {
206+
_ = settingRepo.Update("BanPing", constant.StatusDisable)
207+
return err
208+
}
209+
return nil
211210
case "enablePing":
212-
return u.updatePingStatus("1")
211+
if err := firewall.UpdatePingStatus("1"); err != nil {
212+
_ = settingRepo.Update("BanPing", constant.StatusEnable)
213+
return err
214+
}
215+
return nil
213216
default:
214217
return fmt.Errorf("not supported operation: %s", req.Operation)
215218
}
@@ -589,105 +592,6 @@ func (u *FirewallService) cleanUnUsedData(client firewall.FirewallClient) {
589592
}
590593
}
591594

592-
func (u *FirewallService) pingStatus() string {
593-
data, err := os.ReadFile("/proc/sys/net/ipv4/icmp_echo_ignore_all")
594-
if err != nil {
595-
return constant.StatusNone
596-
}
597-
v6Data, v6err := os.ReadFile("/proc/sys/net/ipv6/icmp/echo_ignore_all")
598-
if v6err != nil {
599-
if strings.TrimSpace(string(data)) == "1" {
600-
return constant.StatusEnable
601-
}
602-
return constant.StatusDisable
603-
} else {
604-
if strings.TrimSpace(string(data)) == "1" && strings.TrimSpace(string(v6Data)) == "1" {
605-
return constant.StatusEnable
606-
}
607-
return constant.StatusDisable
608-
}
609-
610-
}
611-
612-
func (u *FirewallService) updatePingStatus(enable string) error {
613-
var targetPath string
614-
var applyCmd string
615-
616-
if _, err := os.Stat(confPath); os.IsNotExist(err) {
617-
// Debian 13
618-
targetPath = panelSysctlPath
619-
applyCmd = fmt.Sprintf("%s sysctl --system", cmd.SudoHandleCmd())
620-
if err := cmd.RunDefaultBashCf("%s mkdir -p /etc/sysctl.d", cmd.SudoHandleCmd()); err != nil {
621-
return fmt.Errorf("failed to create directory /etc/sysctl.d: %v", err)
622-
}
623-
} else {
624-
targetPath = confPath
625-
applyCmd = fmt.Sprintf("%s sysctl -p", cmd.SudoHandleCmd())
626-
}
627-
628-
lineBytes, err := os.ReadFile(targetPath)
629-
if err != nil && !os.IsNotExist(err) {
630-
return fmt.Errorf("failed to read %s: %v", targetPath, err)
631-
}
632-
633-
if err := cmd.RunDefaultBashCf("echo %s | %s tee /proc/sys/net/ipv4/icmp_echo_ignore_all > /dev/null", enable, cmd.SudoHandleCmd()); err != nil {
634-
return fmt.Errorf("failed to apply ipv4 ping status temporarily: %v", err)
635-
}
636-
637-
var hasIpv6 bool
638-
if _, err := os.Stat("/proc/sys/net/ipv6/icmp/echo_ignore_all"); err == nil {
639-
hasIpv6 = true
640-
if err := cmd.RunDefaultBashCf("echo %s | %s tee /proc/sys/net/ipv6/icmp/echo_ignore_all > /dev/null", enable, cmd.SudoHandleCmd()); err != nil {
641-
global.LOG.Warnf("failed to apply ipv6 ping status temporarily: %v", err)
642-
}
643-
}
644-
645-
var files []string
646-
if err == nil {
647-
files = strings.Split(string(lineBytes), "\n")
648-
}
649-
650-
var newFiles []string
651-
hasIPv4Line, hasIPv6Line := false, false
652-
653-
for _, line := range files {
654-
if strings.HasPrefix(strings.TrimSpace(line), "net.ipv4.icmp_echo_ignore_all") {
655-
newFiles = append(newFiles, "net.ipv4.icmp_echo_ignore_all="+enable)
656-
hasIPv4Line = true
657-
continue
658-
}
659-
if strings.HasPrefix(strings.TrimSpace(line), "net.ipv6.icmp.echo_ignore_all") {
660-
newFiles = append(newFiles, "net.ipv6.icmp.echo_ignore_all="+enable)
661-
hasIPv6Line = true
662-
continue
663-
}
664-
newFiles = append(newFiles, line)
665-
}
666-
667-
if !hasIPv4Line {
668-
newFiles = append(newFiles, "net.ipv4.icmp_echo_ignore_all="+enable)
669-
}
670-
if hasIpv6 && !hasIPv6Line {
671-
newFiles = append(newFiles, "net.ipv6.icmp.echo_ignore_all="+enable)
672-
}
673-
674-
file, err := os.OpenFile(targetPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, constant.FilePerm)
675-
if err != nil {
676-
return fmt.Errorf("failed to open %s: %v", targetPath, err)
677-
}
678-
defer file.Close()
679-
680-
if _, err = file.WriteString(strings.Join(newFiles, "\n")); err != nil {
681-
return fmt.Errorf("failed to write to %s: %v", targetPath, err)
682-
}
683-
684-
if err := cmd.RunDefaultBashC(applyCmd); err != nil {
685-
global.LOG.Warnf("failed to apply persistent config with '%s': %v", applyCmd, err)
686-
}
687-
688-
return nil
689-
}
690-
691595
func (u *FirewallService) addPortsBeforeStart(client firewall.FirewallClient) error {
692596
if !global.IsMaster {
693597
if err := client.Port(fireClient.FireInfo{Port: global.CONF.Base.Port, Protocol: "tcp", Strategy: "accept"}, "add"); err != nil {

‎agent/init/firewall/firewall.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ func Init() {
1818
if !needInit() {
1919
return
2020
}
21+
InitPingStatus()
2122
global.LOG.Info("initializing firewall settings...")
2223
client, err := firewall.NewFirewallClient()
2324
if err != nil {
@@ -122,3 +123,20 @@ func needInit() bool {
122123
fmt.Fprintf(file, "Boot Mark for 1panel\n")
123124
return true
124125
}
126+
127+
func InitPingStatus() {
128+
global.LOG.Info("initializing ban ping status from settings...")
129+
status := firewall.LoadPingStatus()
130+
statusInDB, _ := repo.NewISettingRepo().GetValueByKey("BanPing")
131+
if statusInDB == status {
132+
return
133+
}
134+
135+
enable := "1"
136+
if statusInDB == constant.StatusDisable {
137+
enable = "0"
138+
}
139+
if err := firewall.UpdatePingStatus(enable); err != nil {
140+
global.LOG.Errorf("initialize ping status failed: %v", err)
141+
}
142+
}

‎agent/init/migration/migrate.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ func InitAgentDB() {
5959
migrations.InitIptablesStatus,
6060
migrations.UpdateWebsite,
6161
migrations.AddisIPtoWebsiteSSL,
62+
migrations.InitPingStatus,
6263
})
6364
if err := m.Migrate(); err != nil {
6465
global.LOG.Error(err)

‎agent/init/migration/migrations/init.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -789,3 +789,14 @@ var AddisIPtoWebsiteSSL = &gormigrate.Migration{
789789
return tx.AutoMigrate(&model.WebsiteSSL{})
790790
},
791791
}
792+
793+
var InitPingStatus = &gormigrate.Migration{
794+
ID: "20251201-init-ping-status",
795+
Migrate: func(tx *gorm.DB) error {
796+
status := firewall.LoadPingStatus()
797+
if err := tx.Create(&model.Setting{Key: "BanPing", Value: status}).Error; err != nil {
798+
return err
799+
}
800+
return nil
801+
},
802+
}

‎agent/utils/firewall/client.go‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,12 @@ package firewall
22

33
import (
44
"errors"
5+
"fmt"
6+
"os"
7+
"strings"
58

9+
"github.com/1Panel-dev/1Panel/agent/constant"
10+
"github.com/1Panel-dev/1Panel/agent/global"
611
"github.com/1Panel-dev/1Panel/agent/utils/cmd"
712
"github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
813
)
@@ -47,3 +52,103 @@ func NewFirewallClient() (FirewallClient, error) {
4752
}
4853
return nil, errors.New("No system firewall service detected (firewalld/ufw/iptables), please check and try again!")
4954
}
55+
56+
func LoadPingStatus() string {
57+
data, err := os.ReadFile("/proc/sys/net/ipv4/icmp_echo_ignore_all")
58+
if err != nil {
59+
return constant.StatusNone
60+
}
61+
v6Data, v6err := os.ReadFile("/proc/sys/net/ipv6/icmp/echo_ignore_all")
62+
if v6err != nil {
63+
if strings.TrimSpace(string(data)) == "1" {
64+
return constant.StatusEnable
65+
}
66+
return constant.StatusDisable
67+
} else {
68+
if strings.TrimSpace(string(data)) == "1" && strings.TrimSpace(string(v6Data)) == "1" {
69+
return constant.StatusEnable
70+
}
71+
return constant.StatusDisable
72+
}
73+
}
74+
75+
func UpdatePingStatus(enable string) error {
76+
const confPath = "/etc/sysctl.conf"
77+
const panelSysctlPath = "/etc/sysctl.d/98-onepanel.conf"
78+
79+
var targetPath string
80+
var applyCmd string
81+
82+
if _, err := os.Stat(confPath); os.IsNotExist(err) {
83+
targetPath = panelSysctlPath
84+
applyCmd = fmt.Sprintf("%s sysctl --system", cmd.SudoHandleCmd())
85+
if err := cmd.RunDefaultBashCf("%s mkdir -p /etc/sysctl.d", cmd.SudoHandleCmd()); err != nil {
86+
return fmt.Errorf("failed to create directory /etc/sysctl.d: %v", err)
87+
}
88+
} else {
89+
targetPath = confPath
90+
applyCmd = fmt.Sprintf("%s sysctl -p", cmd.SudoHandleCmd())
91+
}
92+
93+
lineBytes, err := os.ReadFile(targetPath)
94+
if err != nil && !os.IsNotExist(err) {
95+
return fmt.Errorf("failed to read %s: %v", targetPath, err)
96+
}
97+
98+
if err := cmd.RunDefaultBashCf("echo %s | %s tee /proc/sys/net/ipv4/icmp_echo_ignore_all > /dev/null", enable, cmd.SudoHandleCmd()); err != nil {
99+
return fmt.Errorf("failed to apply ipv4 ping status temporarily: %v", err)
100+
}
101+
102+
var hasIpv6 bool
103+
if _, err := os.Stat("/proc/sys/net/ipv6/icmp/echo_ignore_all"); err == nil {
104+
hasIpv6 = true
105+
if err := cmd.RunDefaultBashCf("echo %s | %s tee /proc/sys/net/ipv6/icmp/echo_ignore_all > /dev/null", enable, cmd.SudoHandleCmd()); err != nil {
106+
global.LOG.Warnf("failed to apply ipv6 ping status temporarily: %v", err)
107+
}
108+
}
109+
110+
var files []string
111+
if err == nil {
112+
files = strings.Split(string(lineBytes), "\n")
113+
}
114+
115+
var newFiles []string
116+
hasIPv4Line, hasIPv6Line := false, false
117+
118+
for _, line := range files {
119+
if strings.HasPrefix(strings.TrimSpace(line), "net.ipv4.icmp_echo_ignore_all") {
120+
newFiles = append(newFiles, "net.ipv4.icmp_echo_ignore_all="+enable)
121+
hasIPv4Line = true
122+
continue
123+
}
124+
if strings.HasPrefix(strings.TrimSpace(line), "net.ipv6.icmp.echo_ignore_all") {
125+
newFiles = append(newFiles, "net.ipv6.icmp.echo_ignore_all="+enable)
126+
hasIPv6Line = true
127+
continue
128+
}
129+
newFiles = append(newFiles, line)
130+
}
131+
132+
if !hasIPv4Line {
133+
newFiles = append(newFiles, "net.ipv4.icmp_echo_ignore_all="+enable)
134+
}
135+
if hasIpv6 && !hasIPv6Line {
136+
newFiles = append(newFiles, "net.ipv6.icmp.echo_ignore_all="+enable)
137+
}
138+
139+
file, err := os.OpenFile(targetPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, constant.FilePerm)
140+
if err != nil {
141+
return fmt.Errorf("failed to open %s: %v", targetPath, err)
142+
}
143+
defer file.Close()
144+
145+
if _, err = file.WriteString(strings.Join(newFiles, "\n")); err != nil {
146+
return fmt.Errorf("failed to write to %s: %v", targetPath, err)
147+
}
148+
149+
if err := cmd.RunDefaultBashC(applyCmd); err != nil {
150+
global.LOG.Warnf("failed to apply persistent config with '%s': %v", applyCmd, err)
151+
}
152+
153+
return nil
154+
}

0 commit comments

Comments
 (0)