diff --git a/share/pkgs/CentOS/opennebula.sudoers b/share/pkgs/CentOS/opennebula.sudoers index a440487ee2..b78abe88b5 100644 --- a/share/pkgs/CentOS/opennebula.sudoers +++ b/share/pkgs/CentOS/opennebula.sudoers @@ -2,7 +2,7 @@ Defaults:oneadmin !requiretty Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync, /sbin/mkswap -Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /usr/sbin/ipset +Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /usr/sbin/ipset Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /sbin/vgdisplay, /sbin/lvchange, /sbin/lvscan Cmnd_Alias ONE_ISCSI = /sbin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --git a/share/pkgs/Ubuntu/opennebula.sudoers b/share/pkgs/Ubuntu/opennebula.sudoers index 673f25b36a..c58aef544c 100644 --- a/share/pkgs/Ubuntu/opennebula.sudoers +++ b/share/pkgs/Ubuntu/opennebula.sudoers @@ -2,7 +2,7 @@ Defaults:oneadmin !requiretty Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync, /sbin/mkswap -Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /sbin/ipset +Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /sbin/vgdisplay, /sbin/lvchange, /sbin/lvscan Cmnd_Alias ONE_ISCSI = /usr/bin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --git a/share/pkgs/openSUSE/opennebula.sudoers b/share/pkgs/openSUSE/opennebula.sudoers index 889483d571..d19d98d430 100644 --- a/share/pkgs/openSUSE/opennebula.sudoers +++ b/share/pkgs/openSUSE/opennebula.sudoers @@ -2,7 +2,7 @@ Defaults:oneadmin !requiretty Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /usr/bin/dd, /sbin/mkfs, /usr/bin/sync -Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /sbin/ip +Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /usr/sbin/ip6tables, /sbin/ip Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /sbin/vgdisplay, /sbin/lvchange, /sbin/lvscan Cmnd_Alias ONE_ISCSI = /sbin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --git a/share/sudoers/sudo_commands.rb b/share/sudoers/sudo_commands.rb index bc41afbee5..8c1958a95d 100644 --- a/share/sudoers/sudo_commands.rb +++ b/share/sudoers/sudo_commands.rb @@ -21,7 +21,7 @@ require "erb" CMDS = { :MISC => %w(dd mkfs sync), - :NET => %w(brctl ebtables iptables ip ipset), + :NET => %w(brctl ebtables iptables ip6tables ip ipset), :LVM => %w(lvcreate lvremove lvs vgdisplay lvchange lvscan), :ISCSI => %w(iscsiadm tgt-admin tgtadm), :OVS => %w(ovs-ofctl ovs-vsctl), diff --git a/src/cli/one_helper/onesecgroup_helper.rb b/src/cli/one_helper/onesecgroup_helper.rb index a83e52fd84..1cf925f994 100644 --- a/src/cli/one_helper/onesecgroup_helper.rb +++ b/src/cli/one_helper/onesecgroup_helper.rb @@ -153,6 +153,10 @@ class OneSecurityGroupHelper < OpenNebulaHelper::OneHelper d["ICMP_TYPE"] end + column :ICMVP6_TYPE, "", :left, :size=>11 do |d| + d["ICMPV6_TYPE"] + end + column :NETWORK, "", :left, :donottruncate, :size=>35 do |d| network = "" if(!d["NETWORK_ID"].nil? && d["NETWORK_ID"] != "") diff --git a/src/secgroup/SecurityGroup.cc b/src/secgroup/SecurityGroup.cc index caa75d2464..80910db133 100644 --- a/src/secgroup/SecurityGroup.cc +++ b/src/secgroup/SecurityGroup.cc @@ -319,11 +319,11 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con one_util::toupper(proto); - if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "IPSEC" - && proto != "ALL") + if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "ICMPV6" + && proto != "IPSEC" && proto != "ALL") { - error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, IPSEC," - " ALL."; + error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, ICMPV6," + " IPSEC, ALL."; return false; } @@ -362,6 +362,23 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con } } + value = rule->vector_value("ICMPV6_TYPE"); + + if (!value.empty()) + { + if (proto != "ICMPV6") + { + error = "ICMPV6_TYPE is supported only for ICMPV6 protocol."; + return false; + } + + if (rule->vector_value("ICMPV6_TYPE", ivalue) != 0) + { + error = "Wrong ICMPV6_TYPE, it must be integer"; + return false; + } + } + // ------------------------------------------------------------------------- // RULE_TYPE // ------------------------------------------------------------------------- @@ -384,7 +401,7 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con if (!ip.empty()) //Target as IP & SIZE { - struct in_addr ip_addr; + struct in6_addr ip_addr; if (rule->vector_value("SIZE", ivalue) != 0) { @@ -392,10 +409,13 @@ bool SecurityGroup::isValidRule(const VectorAttribute * rule, string& error) con return false; } - if (inet_pton(AF_INET, ip.c_str(), static_cast(&ip_addr)) != 1) + if (inet_pton(AF_INET6, ip.c_str(), static_cast(&ip_addr)) != 1) { - error = "Wrong format for IP value."; - return false; + if (inet_pton(AF_INET, ip.c_str(), static_cast(&ip_addr)) != 1) + { + error = "Wrong format for IP value."; + return false; + } } } else //Target is ANY or NETWORK_ID diff --git a/src/vnm_mad/remotes/lib/address.rb b/src/vnm_mad/remotes/lib/address.rb index 6d31425de3..b2790fdc79 100644 --- a/src/vnm_mad/remotes/lib/address.rb +++ b/src/vnm_mad/remotes/lib/address.rb @@ -14,6 +14,8 @@ # limitations under the License. # #--------------------------------------------------------------------------- # +require 'ipaddr' + module VNMMAD module VNMNetwork @@ -26,28 +28,49 @@ module VNMNetwork # @return [Array] The networks in CIDR def self.to_nets(ip_start, size) nets = Array.new - ip_i = IPv4.to_i(ip_start) + + if ip_start.match(/:/) + family = "inet6" + else + family = "inet" + end + + if family == "inet" + ip_i = IPv4.to_i(ip_start) + ip_totalLength = 32 + else + ip_i = IPv6.to_i(ip_start) + ip_totalLength = 128 + end # Find the largest address block (look for the first 1-bit) lblock = 0 - lblock += 1 while (ip_i[lblock] == 0 && lblock < 32 ) + lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength ) # Allocate whole blocks till the size fits while ( size >= 2**lblock ) - nets << "#{IPv4.to_s(ip_i)}/#{32-lblock}" + if family == "inet" + nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-lblock}" + else + nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-lblock}" + end ip_i += 2**lblock size -= 2**lblock - lblock += 1 while (ip_i[lblock] == 0 && lblock < 32 ) + lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength ) end # Fit remaining address blocks - 32.downto(0) { |i| + ip_totalLength.downto(0) { |i| next if size[i] == 0 - nets << "#{IPv4.to_s(ip_i)}/#{32-i}" + if family == "inet" + nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-i}" + else + nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-i}" + end ip_i += 2**i } @@ -72,6 +95,26 @@ module VNMNetwork ip = 3.downto(0).collect {|s| (ip >> 8*s) & 0xff }.join('.') end end + + module IPv6 + # Returns the binary equivalent of a IP address + # @param ip [String] IP in dot notation + # @return [Fixnum] IP as an integer + def self.to_i(ip) + ipaddr = IPAddr.new ip, Socket::AF_INET6 + + return ipaddr.to_i + end + + # Returns the string equivalent of a IP address + # @param ip [Fixnum] IP as an integer + # @return [String] IP in dot notation + def self.to_s(ip) + ipaddr = IPAddr.new ip, Socket::AF_INET6 + + return ipaddr.to_s + end + end end end diff --git a/src/vnm_mad/remotes/lib/command.rb b/src/vnm_mad/remotes/lib/command.rb index 53e44b7480..e52c578eac 100644 --- a/src/vnm_mad/remotes/lib/command.rb +++ b/src/vnm_mad/remotes/lib/command.rb @@ -24,6 +24,7 @@ module VNMNetwork COMMANDS = { :ebtables => "sudo ebtables", :iptables => "sudo iptables", + :ip6tables=> "sudo ip6tables", :brctl => "sudo brctl", :ip => "sudo ip", :virsh => "virsh -c qemu:///system", diff --git a/src/vnm_mad/remotes/lib/security_groups.rb b/src/vnm_mad/remotes/lib/security_groups.rb index 593f3c8c55..bdb4d1d2e2 100644 --- a/src/vnm_mad/remotes/lib/security_groups.rb +++ b/src/vnm_mad/remotes/lib/security_groups.rb @@ -24,7 +24,7 @@ module VNMNetwork # # PROTOCOL (mandatory) # - Specifies the protocol of the rule - # - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'IPSEC'] + # - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'ICMPV6', 'IPSEC'] # # RULE_TYPE (mandatory) # - Specifies the direction of application of the rule @@ -34,8 +34,9 @@ module VNMNetwork # - only works for protocols ['TCP', 'UDP'] # - uses the iptables multiports syntax # - # ICMP_TYPE (optional) - # - Only works for protocol 'ICMP' + # ICMP_TYPE and ICMPV6_TYPE (optional) + # - Only works for protocol 'ICMP' (for ICMP_TYPE) or protocol 'ICMPV6' (for + # ICMPV6_TYPE) # - Is either in the form of '' or '/', where both # '' and '' are integers. This class has a helper method # tgat expands '' into all the '/' subtypes. @@ -50,9 +51,11 @@ module VNMNetwork :protocol, # Type 1: block the whole protocol :portrange, # Type 2a: block a port range within a protocol :icmp_type, # Type 2b: block selected icmp types + :icmpv6_type, # Type 2c: block selected icmpv6 types :net, # Type 3: block a whole protocol for a network :net_portrange, # Type 4a: block a port range from a network - :net_icmp_type # Type 4b: block selected icmp types from a network + :net_icmp_type, # Type 4b: block selected icmp types from a network + :net_icmpv6_type # Type 4c: block selected icmpv6 types from a network ] # Initialize a new rule. @@ -63,6 +66,7 @@ module VNMNetwork @rule_type = @rule[:rule_type].downcase.to_sym @icmp_type = @rule[:icmp_type] + @icmpv6_type = @rule[:icmpv6_type] @range = @rule[:range] @ip = @rule[:ip] @@ -84,6 +88,9 @@ module VNMNetwork when :icmp_type process_icmp_type(cmds, vars) + when :icmpv6_type + process_icmpv6_type(cmds, vars) + when :net process_net(cmds, vars) @@ -92,6 +99,9 @@ module VNMNetwork when :net_icmp_type process_net_icmp_type(cmds, vars) + + when :net_icmpv6_type + process_net_icmpv6_type(cmds, vars) end end @@ -113,6 +123,13 @@ module VNMNetwork end end + # Expand the ICMP type with associated codes if any + # @return [Array] expanded ICMP types to include all codes + def icmpv6_type_expand + # XXX:TODO: Implement expansion of codes for IPv6 types + ["#{@icmpv6_type}/0"] + end + private # ICMP Codes for each ICMP type @@ -129,17 +146,21 @@ module VNMNetwork # @protocol + @rule_type => Type 1: 'protocol' # @protocol + @rule_type + @range => Type 2A: 'portrange' # @protocol + @rule_type + @icmp_type => Type 2B: 'icmp_type' + # @protocol + @rule_type + @icmpv6_type => Type 2C: 'icmpv6_type' # @protocol + @rule_type + @ip + @size => Type 3: 'net' # @protocol + @rule_type + @ip + @size + @range => Type 4A: 'net_portrange' # @protocol + @rule_type + @ip + @size + @icmp_type => Type 4B: 'net_icmp_type' + # @protocol + @rule_type + @ip + @size + @icmpv6_type => Type 4C: 'net_icmpv6_type' # # @return [Symbol] The rule type def set_type if @ip.nil? && @size.nil? + return :icmpv6_type if !@icmpv6_type.nil? return :icmp_type if !@icmp_type.nil? return :portrange if !@range.nil? return :protocol else + return :net_icmpv6_type if !@icmpv6_type.nil? return :net_icmp_type if !@icmp_type.nil? return :net_portrange if !@range.nil? return :net @@ -161,6 +182,9 @@ module VNMNetwork def process_icmp_type(cmds, vars) end + def process_icmpv6_type(cmds, vars) + end + def process_net(cmds, vars) end @@ -169,6 +193,9 @@ module VNMNetwork def process_net_icmp_type(cmds, vars) end + + def process_net_icmpv6_type(cmds, vars) + end end ############################################################################ @@ -219,4 +246,4 @@ module VNMNetwork end -end \ No newline at end of file +end diff --git a/src/vnm_mad/remotes/lib/security_groups_iptables.rb b/src/vnm_mad/remotes/lib/security_groups_iptables.rb index 6eb921d0f0..b0357761c8 100644 --- a/src/vnm_mad/remotes/lib/security_groups_iptables.rb +++ b/src/vnm_mad/remotes/lib/security_groups_iptables.rb @@ -33,7 +33,12 @@ module SGIPTables def process_protocol(cmds, vars) chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out] - cmds.add :iptables, "-A #{chain} -p #{@protocol} -j RETURN" + if @protocol != :icmpv6 + cmds.add :iptables, "-A #{chain} -p #{@protocol} -j RETURN" + end + if @protocol != :icmp + cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -j RETURN" + end end # Implements the :portrange rule. Example: @@ -43,6 +48,8 @@ module SGIPTables cmds.add :iptables, "-A #{chain} -p #{@protocol} -m multiport" \ " --dports #{@range} -j RETURN" + cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -m multiport" \ + " --dports #{@range} -j RETURN" end # Implements the :icmp_type rule. Example: @@ -54,61 +61,106 @@ module SGIPTables " -j RETURN" end + # Implements the :icmpv6_type rule. Example: + # ip6tables -A one-3-0-o -p icmpv6 --icmpv6-type 128 -j RETURN + def process_icmpv6_type(cmds, vars) + chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out] + + cmds.add :ip6tables, "-A #{chain} -p icmpv6 --icmpv6-type #{@icmpv6_type}" \ + " -j RETURN" + end + # Implements the :net rule. Example: - # ipset create one-3-0-1-i-tcp-n hash:net - # iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i src -j RETURN - # ipset add -exist one-3-0-1-i-tcp-n 10.0.0.0/24 + # ipset create one-3-0-1-i-tcp-n-inet hash:net family inet + # iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i-tcp-n-inet src -j RETURN + # ipset add -exist one-3-0-1-i-tcp-n-inet 10.0.0.0/24 def process_net(cmds, vars) - if @rule_type == :inbound - chain = vars[:chain_in] - set = "#{vars[:set_sg_in]}-#{@protocol}-n" - dir = "src" - else - chain = vars[:chain_out] - set = "#{vars[:set_sg_out]}-#{@protocol}-n" - dir = "dst" - end + ["inet", "inet6"].each do |family| + if family == "inet" + command = :iptables + else + command = :ip6tables + end - cmds.add :ipset, "create #{set} hash:net" - cmds.add :iptables, "-A #{chain} -p #{@protocol} -m set" \ - " --match-set #{set} #{dir} -j RETURN" + if @rule_type == :inbound + chain = vars[:chain_in] + set = "#{vars[:set_sg_in]}-#{@protocol}-n-#{family}" + dir = "src" + else + chain = vars[:chain_out] + set = "#{vars[:set_sg_out]}-#{@protocol}-n-#{family}" + dir = "dst" + end - net.each do |n| - cmds.add :ipset, "add -exist #{set} #{n}" + cmds.add :ipset, "create #{set} hash:net family #{family}" + cmds.add command, "-A #{chain} -p #{@protocol} -m set" \ + " --match-set #{set} #{dir} -j RETURN" + + net.each do |n| + if n.match(/:/) + n_family = "inet6" + else + n_family = "inet" + end + + if n_family != family + next + end + + cmds.add :ipset, "add -exist #{set} #{n}" + end end end # Implements the :net_portrange rule. Example: - # ipset create one-3-0-1-i-nr hash:net,port - # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr src,dst -j RETURN - # ipset add -exist one-3-0-1-i-nr 10.0.0.0/24,tcp:80 + # ipset create one-3-0-1-i-nr-inet hash:net,port family inet + # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr-inet src,dst -j RETURN + # ipset add -exist one-3-0-1-i-nr-inet 10.0.0.0/24,tcp:80 def process_net_portrange(cmds, vars) - if @rule_type == :inbound - chain = vars[:chain_in] - set = "#{vars[:set_sg_in]}-nr" - dir = "src,dst" - else - chain = vars[:chain_out] - set = "#{vars[:set_sg_out]}-nr" - dir = "dst,dst" - end + ["inet", "inet6"].each do |family| + if family == "inet" + command = :iptables + else + command = :ip6tables + end - cmds.add :ipset, "create #{set} hash:net,port" - cmds.add :iptables, "-A #{chain} -m set --match-set" \ - " #{set} #{dir} -j RETURN" + if @rule_type == :inbound + chain = vars[:chain_in] + set = "#{vars[:set_sg_in]}-nr-#{family}" + dir = "src,dst" + else + chain = vars[:chain_out] + set = "#{vars[:set_sg_out]}-nr-#{family}" + dir = "dst,dst" + end - net.each do |n| - @range.split(",").each do |r| - r.gsub!(":","-") - net_range = "#{n},#{@protocol}:#{r}" - cmds.add :ipset, "add -exist #{set} #{net_range}" + cmds.add :ipset, "create #{set} hash:net,port family #{family}" + cmds.add command, "-A #{chain} -m set --match-set" \ + " #{set} #{dir} -j RETURN" + + net.each do |n| + if n.match(/:/) + n_family = "inet6" + else + n_family = "inet" + end + + if n_family != family + next + end + + @range.split(",").each do |r| + r.gsub!(":","-") + net_range = "#{n},#{@protocol}:#{r}" + cmds.add :ipset, "add -exist #{set} #{net_range}" + end end end end # Implements the :net_icmp_type rule. Example: - # ipset create one-3-0-1-i-ni hash:net,port - # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr src,dst -j RETURN + # ipset create one-3-0-1-i-ni hash:net,port family inet + # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-ni src,dst -j RETURN # ipset add -exist one-3-0-1-i-ni 10.0.0.0/24,icmp:8/0 def process_net_icmp_type(cmds, vars) if @rule_type == :inbound @@ -121,7 +173,7 @@ module SGIPTables dir = "dst,dst" end - cmds.add :ipset, "create #{set} hash:net,port" + cmds.add :ipset, "create #{set} hash:net,port family inet" cmds.add :iptables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN" net.each do |n| @@ -130,6 +182,31 @@ module SGIPTables end end end + + # Implements the :net_icmpv6_type rule. Example: + # ipset create one-3-0-1-i-ni6 hash:net,port family inet6 + # ip6tables -A one-3-0-i -m set --match-set one-3-0-1-i-ni6 src,dst -j RETURN + # ipset add -exist one-3-0-1-i-ni6 10.0.0.0/24,icmpv6:128/0 + def process_net_icmpv6_type(cmds, vars) + if @rule_type == :inbound + chain = vars[:chain_in] + set = "#{vars[:set_sg_in]}-ni6" + dir = "src,dst" + else + chain = vars[:chain_out] + set = "#{vars[:set_sg_out]}-ni6" + dir = "dst,dst" + end + + cmds.add :ipset, "create #{set} hash:net,port family inet6" + cmds.add :ip6tables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN" + + net.each do |n| + icmpv6_type_expand.each do |type_code| + cmds.add :ipset, "add -exist #{set} #{n},icmpv6:#{type_code}" + end + end + end end ############################################################################ @@ -166,19 +243,30 @@ module SGIPTables commands.add :iptables, "-S" iptables_s = commands.run! + commands.add :ip6tables, "-S" + ip6tables_s = commands.run! + iptables_forwards = "" + ip6tables_forwards = "" if iptables_s.match(/^-N #{GLOBAL_CHAIN}$/) commands.add :iptables, "-L #{GLOBAL_CHAIN} --line-numbers" iptables_forwards = commands.run! end + if ip6tables_s.match(/^-N #{GLOBAL_CHAIN}$/) + commands.add :ip6tables, "-L #{GLOBAL_CHAIN} --line-numbers" + ip6tables_forwards = commands.run! + end + commands.add :ipset, "list -name" ipset_list = commands.run! { :iptables_forwards => iptables_forwards, :iptables_s => iptables_s, + :ip6tables_forwards => ip6tables_forwards, + :ip6tables_s => ip6tables_s, :ipset_list => ipset_list } end @@ -190,13 +278,20 @@ module SGIPTables def self.global_bootstrap info = SGIPTables.info - return if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}" + if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}" + if info[:ip6tables_s].split("\n").include? "-N #{GLOBAL_CHAIN}" + return + end + end commands = VNMNetwork::Commands.new commands.add :iptables, "-N #{GLOBAL_CHAIN}" commands.add :iptables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}" commands.add :iptables, "-A #{GLOBAL_CHAIN} -j ACCEPT" + commands.add :ip6tables, "-N #{GLOBAL_CHAIN}" + commands.add :ip6tables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}" + commands.add :ip6tables, "-A #{GLOBAL_CHAIN} -j ACCEPT" commands.run! end @@ -259,32 +354,84 @@ module SGIPTables # create chains commands.add :iptables, "-N #{chain_in}" # inbound commands.add :iptables, "-N #{chain_out}" # outbound + commands.add :ip6tables, "-N #{chain_in}" # inbound + commands.add :ip6tables, "-N #{chain_out}" # outbound # Send traffic to the NIC chains commands.add :iptables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}" commands.add :iptables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in #{nic[:tap]} --physdev-is-bridged -j #{chain_out}" + commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}" + commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in #{nic[:tap]} --physdev-is-bridged -j #{chain_out}" + + # ICMPv6 Neighbor Discovery Protocol (ARP replacement for IPv6) + ## Allow routers to send router advertisements + commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 134 -j ACCEPT" + + ## Allow neighbor solicitations to reach the host + commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 135 -j ACCEPT" + + ## Allow routers to send Redirect messages + commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 137 -j ACCEPT" + + ## Allow the host to send a router solicitation + commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 133 -j ACCEPT" + + ## Allow the host to send neighbor solicitation replies + commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 136 -j ACCEPT" # Mac-spofing if nic[:filter_mac_spoofing] == "YES" commands.add :iptables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP" + commands.add :ip6tables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP" end # IP-spofing if nic[:filter_ip_spoofing] == "YES" - commands.add :iptables, "-A #{chain_out} -p udp --source 0.0.0.0/32 --sport 68 --destination 255.255.255.255/32 --dport 67 -j ACCEPT" + if !nic[:ip].nil? and !nic[:ip].empty? + commands.add :iptables, "-A #{chain_out} -p udp --source 0.0.0.0/32 --sport 68 --destination 255.255.255.255/32 --dport 67 -j ACCEPT" - set = "#{vars[:chain]}-ip-spoofing" + set = "#{vars[:chain]}-ip-spoofing" - commands.add :ipset, "create #{set} hash:ip" - commands.add :ipset, "add -exist #{set} #{nic[:ip]}" - commands.add :ipset, "add -exist #{set} #{nic[:vrouter_ip]}" if nic[:vrouter_ip] + commands.add :ipset, "create #{set} hash:ip" + commands.add :ipset, "add -exist #{set} #{nic[:ip]}" + commands.add :ipset, "add -exist #{set} #{nic[:vrouter_ip]}" if nic[:vrouter_ip] - commands.add :iptables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP" + commands.add :iptables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP" + else + # If there are no IPv4 addresses allowed, block all IPv4 addresses + commands.add :ip6tables, "-A #{chain_out} --source 0.0.0.0/0 -j DROP" + end + + ip6_addrs = Array.new + + [:ip6_global, :ip6_link, :ip6_ula].each do |keyName| + if !nic[keyName].nil? and !nic[keyName].empty? + ip6_addrs << nic[keyName] + end + end + + if ip6_addrs.length > 1 + set = "#{chain_out}-ip6-spoofing" + + commands.add :ipset, "create #{set} hash:ip family inet6" + ip6_addrs.each do |ip6_addr| + commands.add :ipset, "add -exist #{set} #{ip6_addr}" + end + + commands.add :ip6tables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP" + elsif ip6_addrs.length == 1 + commands.add :ip6tables, "-A #{chain_out} ! --source #{ip6_addrs[0]} -j DROP" + else + # If there are no IPv6 addresses allowed, block all IPv6 addresses + commands.add :ip6tables, "-A #{chain_out} --source ::/0 -j DROP" + end end # Related, Established commands.add :iptables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT" commands.add :iptables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT" + commands.add :ip6tables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT" + commands.add :ip6tables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT" commands.run! end @@ -300,6 +447,8 @@ module SGIPTables commands = VNMNetwork::Commands.new commands.add :iptables, "-A #{chain_in} -j DROP" commands.add :iptables, "-A #{chain_out} -j DROP" + commands.add :ip6tables, "-A #{chain_in} -j DROP" + commands.add :ip6tables, "-A #{chain_out} -j DROP" commands.run! end @@ -314,6 +463,8 @@ module SGIPTables info = self.info iptables_forwards = info[:iptables_forwards] iptables_s = info[:iptables_s] + ip6tables_forwards = info[:ip6tables_forwards] + ip6tables_s = info[:ip6tables_s] ipset_list = info[:ipset_list] commands = VNMNetwork::Commands.new @@ -326,6 +477,14 @@ module SGIPTables end end + ip6tables_forwards.lines.reverse_each do |line| + fields = line.split + if [chain_in, chain_out].include?(fields[1]) + n = fields[0] + commands.add :ip6tables, "-D #{GLOBAL_CHAIN} #{n}" + end + end + remove_chains = [] iptables_s.lines.each do |line| if line.match(/^-N #{chain}(-|$)/) @@ -334,6 +493,8 @@ module SGIPTables end remove_chains.each {|c| commands.add :iptables, "-F #{c}" } remove_chains.each {|c| commands.add :iptables, "-X #{c}" } + remove_chains.each {|c| commands.add :ip6tables, "-F #{c}" } + remove_chains.each {|c| commands.add :ip6tables, "-X #{c}" } ipset_list.lines.each do |line| if line.match(/^#{chain}(-|$)/)