starred/1Panel
1
0
Fork 0
mirror of https://github.com/1Panel-dev/1Panel.git synced 2026-09-22 00:00:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: fix firewall whitelist rules not applied after restart (#12957)

Browse Source
This commit is contained in:
ssongliu
2026-06-09 11:27:38 +08:00
committed by GitHub
parent a2e6e7e879
commit 6495869664
3 changed files with 109 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent/app/service/firewall.go
+10
View File
@@ -186,6 +186,9 @@ func (u *FirewallService) OperateFirewall(req dto.FirewallOperation) error {
if err := client.Restart(); err != nil {
return err
}
if err := u.addPortsBeforeStart(client); err != nil {
return err
}
needRestartDocker = true
case "disableBanPing":
if err := firewall.UpdatePingStatus("0"); err != nil {
@@ -579,6 +582,13 @@ func (u *FirewallService) cleanUnUsedData(client firewall.FirewallClient) {
}
func (u *FirewallService) addPortsBeforeStart(client firewall.FirewallClient) error {
if client.Name() == "iptables" {
isInit, _ := iptables.LoadInitStatus("iptables", "base")
if !isInit {
return nil
}
return syncIptablesFirewallPortWhiteList(true)
}
portWhiteList, err := loadFirewallPortWhiteList()
if err != nil {
return err
agent/app/service/firewall_setting.go
+40 -17
View File
@@ -16,7 +16,7 @@ type firewallPortWhitelist struct {
Protocol string
}
func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
func loadConfiguredFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
value, err := settingRepo.GetValueByKey(constant.FirewallPortWhiteList)
if err != nil {
value = constant.FirewallPortWhiteListValue
@@ -24,21 +24,30 @@ func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
return nil, err
}
}
return parseFullFirewallPortWhiteList(value)
return parseFirewallPortWhiteList(value)
}
func parseFullFirewallPortWhiteList(value string) ([]firewallPortWhitelist, error) {
portWhiteList, err := parseFirewallPortWhiteList(value)
func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
portWhiteList, err := loadConfiguredFirewallPortWhiteList()
if err != nil {
return nil, err
}
requiredPorts, err := loadRequiredFirewallPortWhiteList()
if err != nil {
return nil, err
}
return normalizeFirewallPortWhiteList(append(portWhiteList, requiredPorts...)), nil
}
func loadRequiredFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
panelPort := LoadPanelPort()
if panelPort == "" {
return nil, fmt.Errorf("find 1panel service port failed")
}
portWhiteList = append(portWhiteList, firewallPortWhitelist{Port: panelPort, Protocol: "tcp"})
portWhiteList = append(portWhiteList, firewallPortWhitelist{Port: loadSSHPort(), Protocol: "tcp"})
return normalizeFirewallPortWhiteList(portWhiteList), nil
return normalizeFirewallPortWhiteList([]firewallPortWhitelist{
{Port: panelPort, Protocol: "tcp"},
{Port: loadSSHPort(), Protocol: "tcp"},
}), nil
}
func parseFirewallPortWhiteList(value string) ([]firewallPortWhitelist, error) {
@@ -97,22 +106,36 @@ func syncFirewallPortWhiteListAfterUpdate(oldValue string) error {
if err != nil {
return err
}
if client.Name() == "iptables" {
isInit, _ := iptables.LoadInitStatus("iptables", "base")
if !isInit {
return nil
}
oldPortWhiteList, err := parseFirewallPortWhiteList(oldValue)
if err != nil {
return err
}
return syncIptablesFirewallPortWhiteList(true, oldPortWhiteList)
}
isActive, _ := client.Status()
if !isActive {
return nil
}
portWhiteList, err := loadFirewallPortWhiteList()
if err != nil {
return err
}
if client.Name() != "iptables" {
oldPortWhiteList, err := parseFullFirewallPortWhiteList(oldValue)
if err != nil {
return err
}
return syncFirewallClientPortWhiteList(client, oldPortWhiteList, portWhiteList)
oldPortWhiteList, err := parseFirewallPortWhiteList(oldValue)
if err != nil {
return err
}
isInit, _ := iptables.LoadInitStatus("iptables", "base")
if !isInit {
return nil
requiredPorts, err := loadRequiredFirewallPortWhiteList()
if err != nil {
return err
}
return applyFirewallPortWhiteListRules(portWhiteList, true)
oldPortWhiteList = normalizeFirewallPortWhiteList(append(oldPortWhiteList, requiredPorts...))
return syncFirewallClientPortWhiteList(client, oldPortWhiteList, portWhiteList)
}
func syncFirewallClientPortWhiteList(client firewall.FirewallClient, oldPortWhiteList, portWhiteList []firewallPortWhitelist) error {
agent/app/service/iptables.go
+59 -8
View File
@@ -187,6 +187,9 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
return err
}
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
return err
}
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
return err
}
@@ -231,6 +234,9 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
return err
}
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
return err
}
if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
return err
}
@@ -371,11 +377,7 @@ func initPreRules() error {
if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT", "-m", "comment", "--comment", "ESTABLISHED Whitelist"); err != nil {
return err
}
portWhiteList, err := loadFirewallPortWhiteList()
if err != nil {
return err
}
if err := applyFirewallPortWhiteListRules(portWhiteList, false); err != nil {
if err := syncIptablesFirewallPortWhiteList(false); err != nil {
return err
}
if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, "-p", "tcp", "-j", "DROP"); err != nil {
@@ -387,8 +389,23 @@ func initPreRules() error {
return nil
}
func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool) error {
if err := syncFirewallPortWhiteListRules(portWhiteList); err != nil {
func syncIptablesFirewallPortWhiteList(withSave bool, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
requiredPorts, err := loadRequiredFirewallPortWhiteList()
if err != nil {
return err
}
if err := applyRequiredFirewallPortWhiteListRules(requiredPorts, withSave); err != nil {
return err
}
portWhiteList, err := loadConfiguredFirewallPortWhiteList()
if err != nil {
return err
}
return applyFirewallPortWhiteListRules(portWhiteList, withSave, oldConfiguredPortWhiteList...)
}
func applyRequiredFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool) error {
if err := syncRequiredFirewallPortWhiteListRules(portWhiteList); err != nil {
return err
}
for _, item := range portWhiteList {
@@ -405,7 +422,22 @@ func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, with
return iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName)
}
func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error {
func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
if err := syncFirewallPortWhiteListRules(portWhiteList, oldConfiguredPortWhiteList...); err != nil {
return err
}
for _, item := range portWhiteList {
if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "-m", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
return err
}
}
if !withSave {
return nil
}
return iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName)
}
func syncRequiredFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error {
tcpWhitelist := make(map[string]struct{})
udpWhitelist := make(map[string]struct{})
for _, item := range portWhiteList {
@@ -425,6 +457,25 @@ func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error
return cleanExtraFirewallPortRules(iptables.Chain1PanelBasicAfter, "udp", map[string]struct{}{})
}
func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
portWhitelist := firewallPortWhiteListMap(portWhiteList)
if len(oldConfiguredPortWhiteList) == 0 {
return nil
}
for _, item := range oldConfiguredPortWhiteList[0] {
if _, ok := portWhitelist[firewallPortWhiteListKey(item)]; ok {
continue
}
if !iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "--dport", item.Port, "-j", "ACCEPT") {
continue
}
if err := iptables.DeleteRule(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
return err
}
}
return nil
}
func cleanExtraFirewallPortRules(chain, protocol string, whitelist map[string]struct{}) error {
rules, err := iptables.ReadFilterRulesByChain(chain)
if err != nil {