fix: Fix bug in iptables firewall module (#10927)

agent/app/service/firewall.go

@@ -685,7 +685,7 @@ func (u *FirewallService) updatePingStatus(enable string) error {
 		return fmt.Errorf("failed to write to %s: %v", targetPath, err)
 	}
 
-	if err := cmd.RunDefaultBashCf(applyCmd); err != nil {
+	if err := cmd.RunDefaultBashC(applyCmd); err != nil {
 		global.LOG.Warnf("failed to apply persistent config with '%s': %v", applyCmd, err)
 	}
 
@@ -820,7 +820,10 @@ func checkPortUsed(ports, proto string, apps []portOfApp) string {
 }
 
 func loadInitStatus(clientName, tab string) (bool, bool) {
-	if clientName != "firewalld" || (clientName != "iptables" && tab != "forward") {
+	if clientName == "firewalld" {
+		return true, true
+	}
+	if clientName == "ufw" && tab == "forward" {
 		return true, true
 	}
 	switch tab {
@@ -840,7 +843,10 @@ func loadInitStatus(clientName, tab string) (bool, bool) {
 		if exist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter); !exist {
 			return false, false
 		}
-		if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAll); !exist {
+		if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllTcp); !exist {
+			return false, false
+		}
+		if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllUdp); !exist {
 			return false, false
 		}
 		if bind, _ := iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore); !bind {

agent/app/service/iptables.go

@@ -316,7 +316,10 @@ func initPreRules() error {
 			return err
 		}
 	}
-	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAll); err != nil {
+	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllTcp); err != nil {
+		return err
+	}
+	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllUdp); err != nil {
 		return err
 	}
 	return nil

agent/server/server.go

@@ -45,9 +45,6 @@ func Start() {
 	firewall.Init()
 	lang.Init()
 	validator.Init()
-	if os.Getenv("GIN_MODE") == "" {
-		gin.SetMode(gin.ReleaseMode)
-	}
 	cron.Run()
 	hook.Init()
 	InitOthers()

agent/utils/firewall/client/iptables.go

@@ -72,6 +72,12 @@ func (i *Iptables) ListPort() ([]FireInfo, error) {
 		if item.Strategy == "drop" || item.Strategy == "reject" {
 			item.Strategy = "drop"
 		}
+		if item.Protocol == "6" {
+			item.Protocol = "tcp"
+		} else if item.Protocol == "17" {
+			item.Protocol = "udp"
+		}
+
 		datas = append(datas, FireInfo{
 			Chain:    item.Chain,
 			Address:  item.SrcIP,

agent/utils/firewall/client/iptables/common.go

@@ -26,7 +26,8 @@ const (
 const (
 	EstablishedRule = "-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment 'ESTABLISHED Whitelist'"
 	IoRuleIn        = "-i lo -j ACCEPT -m comment --comment 'Loopback Whitelist'"
-	DropAll         = "-j DROP"
+	DropAllTcp      = "-p tcp -j DROP"
+	DropAllUdp      = "-p udp -j DROP"
 	AllowSSH        = "-p tcp --dport ssh -j ACCEPT"
 )
 

core/server/server.go

@@ -40,9 +40,6 @@ func Start() {
 	gob.Register(psession.SessionUser{})
 	cron.Init()
 	session.Init()
-	if os.Getenv("GIN_MODE") == "" {
-		gin.SetMode(gin.ReleaseMode)
-	}
 	hook.Init()
 	InitOthers()