shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2025-01-08 21:17:43 +03:00
Code Releases Wiki Activity

Ported securitygroup6 patch

Browse Source
This commit is contained in:
Roy Keene 2016-11-09 19:21:48 -06:00
parent 72603252f5
commit 43605bedbf
10 changed files with 327 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
share/pkgs/CentOS/opennebula.sudoers
View File

@ -2,7 +2,7 @@ Defaults:oneadmin !requiretty
Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin
Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync, /sbin/mkswap
Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /usr/sbin/ipset
Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /usr/sbin/ipset
Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /sbin/vgdisplay, /sbin/lvchange, /sbin/lvscan
Cmnd_Alias ONE_ISCSI = /sbin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm
Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl

2
share/pkgs/Ubuntu/opennebula.sudoers
View File

@ -2,7 +2,7 @@ Defaults:oneadmin !requiretty
Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin
Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync, /sbin/mkswap
Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /sbin/ipset
Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset
Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /sbin/vgdisplay, /sbin/lvchange, /sbin/lvscan
Cmnd_Alias ONE_ISCSI = /usr/bin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm
Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl

2
share/pkgs/openSUSE/opennebula.sudoers
View File

@ -2,7 +2,7 @@ Defaults:oneadmin !requiretty
Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin
Cmnd_Alias ONE_MISC = /usr/bin/dd, /sbin/mkfs, /usr/bin/sync
Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /sbin/ip
Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /usr/sbin/ip6tables, /sbin/ip
Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /sbin/vgdisplay, /sbin/lvchange, /sbin/lvscan
Cmnd_Alias ONE_ISCSI = /sbin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm
Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl

2
share/sudoers/sudo_commands.rb
View File

@ -21,7 +21,7 @@ require "erb"
CMDS = {
:MISC => %w(dd mkfs sync),
:NET => %w(brctl ebtables iptables ip ipset),
:NET => %w(brctl ebtables iptables ip6tables ip ipset),
:LVM => %w(lvcreate lvremove lvs vgdisplay lvchange lvscan),
:ISCSI => %w(iscsiadm tgt-admin tgtadm),
:OVS => %w(ovs-ofctl ovs-vsctl),

4
src/cli/one_helper/onesecgroup_helper.rb
View File

@ -153,6 +153,10 @@ class OneSecurityGroupHelper < OpenNebulaHelper::OneHelper
d["ICMP_TYPE"]
end
column :ICMVP6_TYPE, "", :left, :size=>11 do |d|
d["ICMPV6_TYPE"]
end
column :NETWORK, "", :left, :donottruncate, :size=>35 do |d|
network = ""
if(!d["NETWORK_ID"].nil? && d["NETWORK_ID"] != "")

36
src/secgroup/SecurityGroup.cc
View File

@ -319,11 +319,11 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con
one_util::toupper(proto);
if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "IPSEC"
&& proto != "ALL")
if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "ICMPV6"
&& proto != "IPSEC" && proto != "ALL")
{
error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, IPSEC,"
" ALL.";
error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, ICMPV6,"
" IPSEC, ALL.";
return false;
}
@ -362,6 +362,23 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con
}
}
value = rule->vector_value("ICMPV6_TYPE");
if (!value.empty())
{
if (proto != "ICMPV6")
{
error = "ICMPV6_TYPE is supported only for ICMPV6 protocol.";
return false;
}
if (rule->vector_value("ICMPV6_TYPE", ivalue) != 0)
{
error = "Wrong ICMPV6_TYPE, it must be integer";
return false;
}
}
// -------------------------------------------------------------------------
// RULE_TYPE
// -------------------------------------------------------------------------
@ -384,7 +401,7 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con
if (!ip.empty()) //Target as IP & SIZE
{
struct in_addr ip_addr;
struct in6_addr ip_addr;
if (rule->vector_value("SIZE", ivalue) != 0)
{
@ -392,10 +409,13 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con
return false;
}
if (inet_pton(AF_INET, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)
if (inet_pton(AF_INET6, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)
{
error = "Wrong format for IP value.";
return false;
if (inet_pton(AF_INET, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)
{
error = "Wrong format for IP value.";
return false;
}
}
}
else //Target is ANY or NETWORK_ID

55
src/vnm_mad/remotes/lib/address.rb
View File

@ -14,6 +14,8 @@
# limitations under the License. #
#--------------------------------------------------------------------------- #
require 'ipaddr'
module VNMMAD
module VNMNetwork
@ -26,28 +28,49 @@ module VNMNetwork
# @return [Array<String>] The networks in CIDR
def self.to_nets(ip_start, size)
nets = Array.new
ip_i = IPv4.to_i(ip_start)
if ip_start.match(/:/)
family = "inet6"
else
family = "inet"
end
if family == "inet"
ip_i = IPv4.to_i(ip_start)
ip_totalLength = 32
else
ip_i = IPv6.to_i(ip_start)
ip_totalLength = 128
end
# Find the largest address block (look for the first 1-bit)
lblock = 0
lblock += 1 while (ip_i[lblock] == 0 && lblock < 32 )
lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength )
# Allocate whole blocks till the size fits
while ( size >= 2**lblock )
nets << "#{IPv4.to_s(ip_i)}/#{32-lblock}"
if family == "inet"
nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-lblock}"
else
nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-lblock}"
end
ip_i += 2**lblock
size -= 2**lblock
lblock += 1 while (ip_i[lblock] == 0 && lblock < 32 )
lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength )
end
# Fit remaining address blocks
32.downto(0) { |i|
ip_totalLength.downto(0) { |i|
next if size[i] == 0
nets << "#{IPv4.to_s(ip_i)}/#{32-i}"
if family == "inet"
nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-i}"
else
nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-i}"
end
ip_i += 2**i
}
@ -72,6 +95,26 @@ module VNMNetwork
ip = 3.downto(0).collect {|s| (ip >> 8*s) & 0xff }.join('.')
end
end
module IPv6
# Returns the binary equivalent of a IP address
# @param ip [String] IP in dot notation
# @return [Fixnum] IP as an integer
def self.to_i(ip)
ipaddr = IPAddr.new ip, Socket::AF_INET6
return ipaddr.to_i
end
# Returns the string equivalent of a IP address
# @param ip [Fixnum] IP as an integer
# @return [String] IP in dot notation
def self.to_s(ip)
ipaddr = IPAddr.new ip, Socket::AF_INET6
return ipaddr.to_s
end
end
end
end

1
src/vnm_mad/remotes/lib/command.rb
View File

@ -24,6 +24,7 @@ module VNMNetwork
COMMANDS = {
:ebtables => "sudo ebtables",
:iptables => "sudo iptables",
:ip6tables=> "sudo ip6tables",
:brctl => "sudo brctl",
:ip => "sudo ip",
:virsh => "virsh -c qemu:///system",

37
src/vnm_mad/remotes/lib/security_groups.rb
View File

@ -24,7 +24,7 @@ module VNMNetwork
#
# PROTOCOL (mandatory)
# - Specifies the protocol of the rule
# - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'IPSEC']
# - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'ICMPV6', 'IPSEC']
#
# RULE_TYPE (mandatory)
# - Specifies the direction of application of the rule
@ -34,8 +34,9 @@ module VNMNetwork
# - only works for protocols ['TCP', 'UDP']
# - uses the iptables multiports syntax
#
# ICMP_TYPE (optional)
# - Only works for protocol 'ICMP'
# ICMP_TYPE and ICMPV6_TYPE (optional)
# - Only works for protocol 'ICMP' (for ICMP_TYPE) or protocol 'ICMPV6' (for
# ICMPV6_TYPE)
# - Is either in the form of '<TYPE>' or '<TYPE>/<CODE>', where both
# '<TYPE>' and '<CODE>' are integers. This class has a helper method
# tgat expands '<TYPE>' into all the '<TYPE>/<CODE>' subtypes.
@ -50,9 +51,11 @@ module VNMNetwork
:protocol, # Type 1: block the whole protocol
:portrange, # Type 2a: block a port range within a protocol
:icmp_type, # Type 2b: block selected icmp types
:icmpv6_type, # Type 2c: block selected icmpv6 types
:net, # Type 3: block a whole protocol for a network
:net_portrange, # Type 4a: block a port range from a network
:net_icmp_type # Type 4b: block selected icmp types from a network
:net_icmp_type, # Type 4b: block selected icmp types from a network
:net_icmpv6_type # Type 4c: block selected icmpv6 types from a network
]
# Initialize a new rule.
@ -63,6 +66,7 @@ module VNMNetwork
@rule_type = @rule[:rule_type].downcase.to_sym
@icmp_type = @rule[:icmp_type]
@icmpv6_type = @rule[:icmpv6_type]
@range = @rule[:range]
@ip = @rule[:ip]
@ -84,6 +88,9 @@ module VNMNetwork
when :icmp_type
process_icmp_type(cmds, vars)
when :icmpv6_type
process_icmpv6_type(cmds, vars)
when :net
process_net(cmds, vars)
@ -92,6 +99,9 @@ module VNMNetwork
when :net_icmp_type
process_net_icmp_type(cmds, vars)
when :net_icmpv6_type
process_net_icmpv6_type(cmds, vars)
end
end
@ -113,6 +123,13 @@ module VNMNetwork
end
end
# Expand the ICMP type with associated codes if any
# @return [Array<String>] expanded ICMP types to include all codes
def icmpv6_type_expand
# XXX:TODO: Implement expansion of codes for IPv6 types
["#{@icmpv6_type}/0"]
end
private
# ICMP Codes for each ICMP type
@ -129,17 +146,21 @@ module VNMNetwork
# @protocol + @rule_type => Type 1: 'protocol'
# @protocol + @rule_type + @range => Type 2A: 'portrange'
# @protocol + @rule_type + @icmp_type => Type 2B: 'icmp_type'
# @protocol + @rule_type + @icmpv6_type => Type 2C: 'icmpv6_type'
# @protocol + @rule_type + @ip + @size => Type 3: 'net'
# @protocol + @rule_type + @ip + @size + @range => Type 4A: 'net_portrange'
# @protocol + @rule_type + @ip + @size + @icmp_type => Type 4B: 'net_icmp_type'
# @protocol + @rule_type + @ip + @size + @icmpv6_type => Type 4C: 'net_icmpv6_type'
#
# @return [Symbol] The rule type
def set_type
if @ip.nil? && @size.nil?
return :icmpv6_type if !@icmpv6_type.nil?
return :icmp_type if !@icmp_type.nil?
return :portrange if !@range.nil?
return :protocol
else
return :net_icmpv6_type if !@icmpv6_type.nil?
return :net_icmp_type if !@icmp_type.nil?
return :net_portrange if !@range.nil?
return :net
@ -161,6 +182,9 @@ module VNMNetwork
def process_icmp_type(cmds, vars)
end
def process_icmpv6_type(cmds, vars)
end
def process_net(cmds, vars)
end
@ -169,6 +193,9 @@ module VNMNetwork
def process_net_icmp_type(cmds, vars)
end
def process_net_icmpv6_type(cmds, vars)
end
end
############################################################################
@ -219,4 +246,4 @@ module VNMNetwork
end
end
end

257
src/vnm_mad/remotes/lib/security_groups_iptables.rb
View File

@ -33,7 +33,12 @@ module SGIPTables
def process_protocol(cmds, vars)
chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out]
cmds.add :iptables, "-A #{chain} -p #{@protocol} -j RETURN"
if @protocol != :icmpv6
cmds.add :iptables, "-A #{chain} -p #{@protocol} -j RETURN"
end
if @protocol != :icmp
cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -j RETURN"
end
end
# Implements the :portrange rule. Example:
@ -43,6 +48,8 @@ module SGIPTables
cmds.add :iptables, "-A #{chain} -p #{@protocol} -m multiport" \
" --dports #{@range} -j RETURN"
cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -m multiport" \
" --dports #{@range} -j RETURN"
end
# Implements the :icmp_type rule. Example:
@ -54,61 +61,106 @@ module SGIPTables
" -j RETURN"
end
# Implements the :icmpv6_type rule. Example:
# ip6tables -A one-3-0-o -p icmpv6 --icmpv6-type 128 -j RETURN
def process_icmpv6_type(cmds, vars)
chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out]
cmds.add :ip6tables, "-A #{chain} -p icmpv6 --icmpv6-type #{@icmpv6_type}" \
" -j RETURN"
end
# Implements the :net rule. Example:
# ipset create one-3-0-1-i-tcp-n hash:net
# iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i src -j RETURN
# ipset add -exist one-3-0-1-i-tcp-n 10.0.0.0/24
# ipset create one-3-0-1-i-tcp-n-inet hash:net family inet
# iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i-tcp-n-inet src -j RETURN
# ipset add -exist one-3-0-1-i-tcp-n-inet 10.0.0.0/24
def process_net(cmds, vars)
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-#{@protocol}-n"
dir = "src"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-#{@protocol}-n"
dir = "dst"
end
["inet", "inet6"].each do |family|
if family == "inet"
command = :iptables
else
command = :ip6tables
end
cmds.add :ipset, "create #{set} hash:net"
cmds.add :iptables, "-A #{chain} -p #{@protocol} -m set" \
" --match-set #{set} #{dir} -j RETURN"
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-#{@protocol}-n-#{family}"
dir = "src"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-#{@protocol}-n-#{family}"
dir = "dst"
end
net.each do |n|
cmds.add :ipset, "add -exist #{set} #{n}"
cmds.add :ipset, "create #{set} hash:net family #{family}"
cmds.add command, "-A #{chain} -p #{@protocol} -m set" \
" --match-set #{set} #{dir} -j RETURN"
net.each do |n|
if n.match(/:/)
n_family = "inet6"
else
n_family = "inet"
end
if n_family != family
next
end
cmds.add :ipset, "add -exist #{set} #{n}"
end
end
end
# Implements the :net_portrange rule. Example:
# ipset create one-3-0-1-i-nr hash:net,port
# iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr src,dst -j RETURN
# ipset add -exist one-3-0-1-i-nr 10.0.0.0/24,tcp:80
# ipset create one-3-0-1-i-nr-inet hash:net,port family inet
# iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr-inet src,dst -j RETURN
# ipset add -exist one-3-0-1-i-nr-inet 10.0.0.0/24,tcp:80
def process_net_portrange(cmds, vars)
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-nr"
dir = "src,dst"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-nr"
dir = "dst,dst"
end
["inet", "inet6"].each do |family|
if family == "inet"
command = :iptables
else
command = :ip6tables
end
cmds.add :ipset, "create #{set} hash:net,port"
cmds.add :iptables, "-A #{chain} -m set --match-set" \
" #{set} #{dir} -j RETURN"
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-nr-#{family}"
dir = "src,dst"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-nr-#{family}"
dir = "dst,dst"
end
net.each do |n|
@range.split(",").each do |r|
r.gsub!(":","-")
net_range = "#{n},#{@protocol}:#{r}"
cmds.add :ipset, "add -exist #{set} #{net_range}"
cmds.add :ipset, "create #{set} hash:net,port family #{family}"
cmds.add command, "-A #{chain} -m set --match-set" \
" #{set} #{dir} -j RETURN"
net.each do |n|
if n.match(/:/)
n_family = "inet6"
else
n_family = "inet"
end
if n_family != family
next
end
@range.split(",").each do |r|
r.gsub!(":","-")
net_range = "#{n},#{@protocol}:#{r}"
cmds.add :ipset, "add -exist #{set} #{net_range}"
end
end
end
end
# Implements the :net_icmp_type rule. Example:
# ipset create one-3-0-1-i-ni hash:net,port
# iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr src,dst -j RETURN
# ipset create one-3-0-1-i-ni hash:net,port family inet
# iptables -A one-3-0-i -m set --match-set one-3-0-1-i-ni src,dst -j RETURN
# ipset add -exist one-3-0-1-i-ni 10.0.0.0/24,icmp:8/0
def process_net_icmp_type(cmds, vars)
if @rule_type == :inbound
@ -121,7 +173,7 @@ module SGIPTables
dir = "dst,dst"
end
cmds.add :ipset, "create #{set} hash:net,port"
cmds.add :ipset, "create #{set} hash:net,port family inet"
cmds.add :iptables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN"
net.each do |n|
@ -130,6 +182,31 @@ module SGIPTables
end
end
end
# Implements the :net_icmpv6_type rule. Example:
# ipset create one-3-0-1-i-ni6 hash:net,port family inet6
# ip6tables -A one-3-0-i -m set --match-set one-3-0-1-i-ni6 src,dst -j RETURN
# ipset add -exist one-3-0-1-i-ni6 10.0.0.0/24,icmpv6:128/0
def process_net_icmpv6_type(cmds, vars)
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-ni6"
dir = "src,dst"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-ni6"
dir = "dst,dst"
end
cmds.add :ipset, "create #{set} hash:net,port family inet6"
cmds.add :ip6tables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN"
net.each do |n|
icmpv6_type_expand.each do |type_code|
cmds.add :ipset, "add -exist #{set} #{n},icmpv6:#{type_code}"
end
end
end
end
############################################################################
@ -166,19 +243,30 @@ module SGIPTables
commands.add :iptables, "-S"
iptables_s = commands.run!
commands.add :ip6tables, "-S"
ip6tables_s = commands.run!
iptables_forwards = ""
ip6tables_forwards = ""
if iptables_s.match(/^-N #{GLOBAL_CHAIN}$/)
commands.add :iptables, "-L #{GLOBAL_CHAIN} --line-numbers"
iptables_forwards = commands.run!
end
if ip6tables_s.match(/^-N #{GLOBAL_CHAIN}$/)
commands.add :ip6tables, "-L #{GLOBAL_CHAIN} --line-numbers"
ip6tables_forwards = commands.run!
end
commands.add :ipset, "list -name"
ipset_list = commands.run!
{
:iptables_forwards => iptables_forwards,
:iptables_s => iptables_s,
:ip6tables_forwards => ip6tables_forwards,
:ip6tables_s => ip6tables_s,
:ipset_list => ipset_list
}
end
@ -190,13 +278,20 @@ module SGIPTables
def self.global_bootstrap
info = SGIPTables.info
return if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"
if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"
if info[:ip6tables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"
return
end
end
commands = VNMNetwork::Commands.new
commands.add :iptables, "-N #{GLOBAL_CHAIN}"
commands.add :iptables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}"
commands.add :iptables, "-A #{GLOBAL_CHAIN} -j ACCEPT"
commands.add :ip6tables, "-N #{GLOBAL_CHAIN}"
commands.add :ip6tables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}"
commands.add :ip6tables, "-A #{GLOBAL_CHAIN} -j ACCEPT"
commands.run!
end
@ -259,32 +354,84 @@ module SGIPTables
# create chains
commands.add :iptables, "-N #{chain_in}" # inbound
commands.add :iptables, "-N #{chain_out}" # outbound
commands.add :ip6tables, "-N #{chain_in}" # inbound
commands.add :ip6tables, "-N #{chain_out}" # outbound
# Send traffic to the NIC chains
commands.add :iptables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}"
commands.add :iptables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in #{nic[:tap]} --physdev-is-bridged -j #{chain_out}"
commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}"
commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in #{nic[:tap]} --physdev-is-bridged -j #{chain_out}"
# ICMPv6 Neighbor Discovery Protocol (ARP replacement for IPv6)
## Allow routers to send router advertisements
commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 134 -j ACCEPT"
## Allow neighbor solicitations to reach the host
commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 135 -j ACCEPT"
## Allow routers to send Redirect messages
commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 137 -j ACCEPT"
## Allow the host to send a router solicitation
commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 133 -j ACCEPT"
## Allow the host to send neighbor solicitation replies
commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 136 -j ACCEPT"
# Mac-spofing
if nic[:filter_mac_spoofing] == "YES"
commands.add :iptables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP"
commands.add :ip6tables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP"
end
# IP-spofing
if nic[:filter_ip_spoofing] == "YES"
commands.add :iptables, "-A #{chain_out} -p udp --source 0.0.0.0/32 --sport 68 --destination 255.255.255.255/32 --dport 67 -j ACCEPT"
if !nic[:ip].nil? and !nic[:ip].empty?
commands.add :iptables, "-A #{chain_out} -p udp --source 0.0.0.0/32 --sport 68 --destination 255.255.255.255/32 --dport 67 -j ACCEPT"
set = "#{vars[:chain]}-ip-spoofing"
set = "#{vars[:chain]}-ip-spoofing"
commands.add :ipset, "create #{set} hash:ip"
commands.add :ipset, "add -exist #{set} #{nic[:ip]}"
commands.add :ipset, "add -exist #{set} #{nic[:vrouter_ip]}" if nic[:vrouter_ip]
commands.add :ipset, "create #{set} hash:ip"
commands.add :ipset, "add -exist #{set} #{nic[:ip]}"
commands.add :ipset, "add -exist #{set} #{nic[:vrouter_ip]}" if nic[:vrouter_ip]
commands.add :iptables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP"
commands.add :iptables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP"
else
# If there are no IPv4 addresses allowed, block all IPv4 addresses
commands.add :ip6tables, "-A #{chain_out} --source 0.0.0.0/0 -j DROP"
end
ip6_addrs = Array.new
[:ip6_global, :ip6_link, :ip6_ula].each do |keyName|
if !nic[keyName].nil? and !nic[keyName].empty?
ip6_addrs << nic[keyName]
end
end
if ip6_addrs.length > 1
set = "#{chain_out}-ip6-spoofing"
commands.add :ipset, "create #{set} hash:ip family inet6"
ip6_addrs.each do |ip6_addr|
commands.add :ipset, "add -exist #{set} #{ip6_addr}"
end
commands.add :ip6tables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP"
elsif ip6_addrs.length == 1
commands.add :ip6tables, "-A #{chain_out} ! --source #{ip6_addrs[0]} -j DROP"
else
# If there are no IPv6 addresses allowed, block all IPv6 addresses
commands.add :ip6tables, "-A #{chain_out} --source ::/0 -j DROP"
end
end
# Related, Established
commands.add :iptables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT"
commands.add :iptables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT"
commands.add :ip6tables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT"
commands.add :ip6tables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT"
commands.run!
end
@ -300,6 +447,8 @@ module SGIPTables
commands = VNMNetwork::Commands.new
commands.add :iptables, "-A #{chain_in} -j DROP"
commands.add :iptables, "-A #{chain_out} -j DROP"
commands.add :ip6tables, "-A #{chain_in} -j DROP"
commands.add :ip6tables, "-A #{chain_out} -j DROP"
commands.run!
end
@ -314,6 +463,8 @@ module SGIPTables
info = self.info
iptables_forwards = info[:iptables_forwards]
iptables_s = info[:iptables_s]
ip6tables_forwards = info[:ip6tables_forwards]
ip6tables_s = info[:ip6tables_s]
ipset_list = info[:ipset_list]
commands = VNMNetwork::Commands.new
@ -326,6 +477,14 @@ module SGIPTables
end
end
ip6tables_forwards.lines.reverse_each do |line|
fields = line.split
if [chain_in, chain_out].include?(fields[1])
n = fields[0]
commands.add :ip6tables, "-D #{GLOBAL_CHAIN} #{n}"
end
end
remove_chains = []
iptables_s.lines.each do |line|
if line.match(/^-N #{chain}(-|$)/)
@ -334,6 +493,8 @@ module SGIPTables
end
remove_chains.each {|c| commands.add :iptables, "-F #{c}" }
remove_chains.each {|c| commands.add :iptables, "-X #{c}" }
remove_chains.each {|c| commands.add :ip6tables, "-F #{c}" }
remove_chains.each {|c| commands.add :ip6tables, "-X #{c}" }
ipset_list.lines.each do |line|
if line.match(/^#{chain}(-|$)/)