feature: forceMasqueradeCIDRs

cmd/ip-masq-agent/ip-masq-agent.go

@@ -66,11 +66,12 @@ var (
 
 // MasqConfig object
 type MasqConfig struct {
-	NonMasqueradeCIDRs []string        `json:"nonMasqueradeCIDRs"`
-	CidrLimit          int             `json:"cidrLimit"`
-	MasqLinkLocal      bool            `json:"masqLinkLocal"`
-	MasqLinkLocalIPv6  bool            `json:"masqLinkLocalIPv6"`
-	ResyncInterval     metav1.Duration `json:"resyncInterval"`
+	ForceMasqueradeCIDRs []string        `json:"forceMasqueradeCIDRs"`
+	NonMasqueradeCIDRs   []string        `json:"nonMasqueradeCIDRs"`
+	CidrLimit            int             `json:"cidrLimit"`
+	MasqLinkLocal        bool            `json:"masqLinkLocal"`
+	MasqLinkLocalIPv6    bool            `json:"masqLinkLocalIPv6"`
+	ResyncInterval       metav1.Duration `json:"resyncInterval"`
 }
 
 // NewMasqConfig returns a MasqConfig with default values
@@ -312,6 +313,13 @@ func (m *MasqDaemon) syncMasqRules() error {
 		writeNonMasqRule(lines, linkLocalCIDR)
 	}
 
+	// force-masquerade for user-provided CIDRs
+	for _, cidr := range m.config.ForceMasqueradeCIDRs {
+		if !isIPv6CIDR(cidr) {
+			writeForceMasqRule(lines, cidr, m.iptables.HasRandomFully())
+		}
+	}
+
 	// non-masquerade for user-provided CIDRs
 	for _, cidr := range m.config.NonMasqueradeCIDRs {
 		if !isIPv6CIDR(cidr) {
@@ -358,6 +366,12 @@ func (m *MasqDaemon) syncMasqRulesIPv6() error {
 		writeNonMasqRule(lines6, linkLocalCIDRIPv6)
 	}
 
+	for _, cidr := range m.config.ForceMasqueradeCIDRs {
+		if isIPv6CIDR(cidr) {
+			writeForceMasqRule(lines6, cidr, m.ip6tables.HasRandomFully())
+		}
+	}
+
 	for _, cidr := range m.config.NonMasqueradeCIDRs {
 		if isIPv6CIDR(cidr) {
 			writeNonMasqRule(lines6, cidr)
@@ -424,6 +438,17 @@ func writeMasqRules(lines *bytes.Buffer, hasRandomFully bool, toPorts interval.I
 	writeRule(lines, utiliptables.Append, masqChain, args...)
 }
 
+const forceMasqRuleComment = `-m comment --comment "ip-masq-agent: specific outbound traffic is subject to MASQUERADE (must be before nonMasqRules in chain)"`
+
+func writeForceMasqRule(lines *bytes.Buffer, cidr string, hasRandomFully bool) {
+	args := []string{forceMasqRuleComment, "-d", cidr, "-j", "MASQUERADE"}
+	if hasRandomFully && *randomFully {
+		args = append(args, "--random-fully")
+	}
+
+	writeRule(lines, utiliptables.Append, masqChain, args...)
+}
+
 func writeMasqToPortsRules(lines *bytes.Buffer, args []string, toPorts interval.Intervals) {
 	size := toPorts.Size()
 

cmd/ip-masq-agent/ip-masq-agent_test.go

@@ -191,14 +191,17 @@ var syncConfigTests = []struct {
 nonMasqueradeCIDRs:
   - 172.16.0.0/12
   - 10.0.0.0/8
+forceMasqueradeCIDRs:
+  - 10.8.42.0/16
 cidrLimit: 64
 masqLinkLocal: true
 resyncInterval: 5s
 `}, nil, &MasqConfig{
-		NonMasqueradeCIDRs: []string{"172.16.0.0/12", "10.0.0.0/8"},
-		MasqLinkLocal:      true,
-		CidrLimit:          64,
-		ResyncInterval:     metav1.Duration{Duration: 5 * time.Second}}},
+		NonMasqueradeCIDRs:   []string{"172.16.0.0/12", "10.0.0.0/8"},
+		ForceMasqueradeCIDRs: []string{"10.8.42.0/16"},
+		MasqLinkLocal:        true,
+		CidrLimit:            64,
+		ResyncInterval:       metav1.Duration{Duration: 5 * time.Second}}},
 
 	{"valid yaml file, just nonMasqueradeCIDRs", fakefs.StringFS{File: `
 nonMasqueradeCIDRs:
@@ -686,6 +689,57 @@ func TestWriteLine(t *testing.T) {
 	}
 }
 
+// tests writeForceMasqRule
+func TestWriteForceMasqRule(t *testing.T) {
+	var writeForceMasqRuleTests = []struct {
+		desc           string
+		cidr           string
+		hasRandomFully bool
+		want           string
+	}{
+		{
+			desc:           "with ipv4 force masquerade cidr, no random-fully",
+			cidr:           "10.8.0.0/24",
+			hasRandomFully: false,
+			want: string(utiliptables.Append) + " " + string(masqChain) +
+				" " + forceMasqRuleComment + " -d 10.8.0.0/24 -j MASQUERADE\n",
+		},
+		{
+			desc:           "with ipv4 force masquerade cidr, with random-fully",
+			cidr:           "10.1.2.0/16",
+			hasRandomFully: true,
+			want: string(utiliptables.Append) + " " + string(masqChain) +
+				" " + forceMasqRuleComment + " -d 10.1.2.0/16 -j MASQUERADE --random-fully\n",
+		},
+		{
+			desc:           "with ipv6 force masquerade cidr, with random-fully",
+			cidr:           "fc00::/7",
+			hasRandomFully: true,
+			want: string(utiliptables.Append) + " " + string(masqChain) +
+				" " + forceMasqRuleComment + " -d fc00::/7 -j MASQUERADE --random-fully\n",
+		},
+	}
+
+	for _, tt := range writeForceMasqRuleTests {
+		t.Run(tt.desc, func(t *testing.T) {
+			lines := bytes.NewBuffer(nil)
+			// Set the global randomFully flag to true for random-fully tests
+			oldRandomFully := *randomFully
+			*randomFully = true
+			defer func() { *randomFully = oldRandomFully }()
+			writeForceMasqRule(lines, tt.cidr, tt.hasRandomFully)
+
+			s, err := lines.ReadString('\n')
+			if err != nil {
+				t.Error("writeForceMasqRule did not append a newline")
+			}
+			if s != tt.want {
+				t.Errorf("writeForceMasqRule(lines, %q, %v):\n   got: %q\n  want: %q", tt.cidr, tt.hasRandomFully, s, tt.want)
+			}
+		})
+	}
+}
+
 // convert error to string, while also handling nil errors
 func errorToString(err error) string {
 	if err == nil {