|
| 1 | +// Copyright 2021 CNI authors |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package link |
| 16 | + |
| 17 | +import ( |
| 18 | + "fmt" |
| 19 | + "os" |
| 20 | + |
| 21 | + "github.com/networkplumbing/go-nft/nft" |
| 22 | + "github.com/networkplumbing/go-nft/nft/schema" |
| 23 | +) |
| 24 | + |
| 25 | +const ( |
| 26 | + natTableName = "nat" |
| 27 | + preRoutingBaseChainName = "PREROUTING" |
| 28 | +) |
| 29 | + |
| 30 | +type NftConfigurer interface { |
| 31 | + Apply(*nft.Config) error |
| 32 | + Read() (*nft.Config, error) |
| 33 | +} |
| 34 | + |
| 35 | +type SpoofChecker struct { |
| 36 | + iface string |
| 37 | + macAddress string |
| 38 | + refID string |
| 39 | + configurer NftConfigurer |
| 40 | +} |
| 41 | + |
| 42 | +type defaultNftConfigurer struct{} |
| 43 | + |
| 44 | +func (_ defaultNftConfigurer) Apply(cfg *nft.Config) error { |
| 45 | + return nft.ApplyConfig(cfg) |
| 46 | +} |
| 47 | + |
| 48 | +func (_ defaultNftConfigurer) Read() (*nft.Config, error) { |
| 49 | + return nft.ReadConfig() |
| 50 | +} |
| 51 | + |
| 52 | +func NewSpoofChecker(iface, macAddress, refID string) *SpoofChecker { |
| 53 | + return NewSpoofCheckerWithConfigurer(iface, macAddress, refID, defaultNftConfigurer{}) |
| 54 | +} |
| 55 | + |
| 56 | +func NewSpoofCheckerWithConfigurer(iface, macAddress, refID string, configurer NftConfigurer) *SpoofChecker { |
| 57 | + return &SpoofChecker{iface, macAddress, refID, configurer} |
| 58 | +} |
| 59 | + |
| 60 | +// Setup applies nftables configuration to restrict traffic |
| 61 | +// from the provided interface. Only traffic with the mentioned mac address |
| 62 | +// is allowed to pass, all others are blocked. |
| 63 | +// The configuration follows the format libvirt and ebtables implemented, allowing |
| 64 | +// extensions to the rules in the future. |
| 65 | +// refID is used to label the rules with a unique comment, identifying the rule-set. |
| 66 | +// |
| 67 | +// In order to take advantage of the nftables configuration change atomicity, the |
| 68 | +// following steps are taken to apply the configuration: |
| 69 | +// - Declare the table and chains (they will be created in case not present). |
| 70 | +// - Apply the rules, while first flushing the iface/mac specific regular chain rules. |
| 71 | +// Two transactions are used because the flush succeeds only if the table/chain it targets |
| 72 | +// exists. This avoids the need to query the existing state and acting upon it (a raceful pattern). |
| 73 | +// Although two transactions are taken place, only the 2nd one where the rules |
| 74 | +// are added has a real impact on the system. |
| 75 | +func (sc *SpoofChecker) Setup() error { |
| 76 | + baseConfig := nft.NewConfig() |
| 77 | + |
| 78 | + baseConfig.AddTable(&schema.Table{Family: schema.FamilyBridge, Name: natTableName}) |
| 79 | + |
| 80 | + baseConfig.AddChain(sc.baseChain()) |
| 81 | + ifaceChain := sc.ifaceChain() |
| 82 | + baseConfig.AddChain(ifaceChain) |
| 83 | + macChain := sc.macChain(ifaceChain.Name) |
| 84 | + baseConfig.AddChain(macChain) |
| 85 | + |
| 86 | + if err := sc.configurer.Apply(baseConfig); err != nil { |
| 87 | + return fmt.Errorf("failed to setup spoof-check: %v", err) |
| 88 | + } |
| 89 | + |
| 90 | + rulesConfig := nft.NewConfig() |
| 91 | + |
| 92 | + rulesConfig.FlushChain(ifaceChain) |
| 93 | + rulesConfig.FlushChain(macChain) |
| 94 | + |
| 95 | + rulesConfig.AddRule(sc.matchIfaceJumpToChainRule(preRoutingBaseChainName, ifaceChain.Name)) |
| 96 | + rulesConfig.AddRule(sc.jumpToChainRule(ifaceChain.Name, macChain.Name)) |
| 97 | + rulesConfig.AddRule(sc.matchMacRule(macChain.Name)) |
| 98 | + rulesConfig.AddRule(sc.dropRule(macChain.Name)) |
| 99 | + |
| 100 | + if err := sc.configurer.Apply(rulesConfig); err != nil { |
| 101 | + return fmt.Errorf("failed to setup spoof-check: %v", err) |
| 102 | + } |
| 103 | + |
| 104 | + return nil |
| 105 | +} |
| 106 | + |
| 107 | +// Teardown removes the interface and mac-address specific chains and their rules. |
| 108 | +// The table and base-chain are expected to survive while the base-chain rule that matches the |
| 109 | +// interface is removed. |
| 110 | +func (sc *SpoofChecker) Teardown() error { |
| 111 | + ifaceChain := sc.ifaceChain() |
| 112 | + currentConfig, ifaceMatchRuleErr := sc.configurer.Read() |
| 113 | + if ifaceMatchRuleErr == nil { |
| 114 | + expectedRuleToFind := sc.matchIfaceJumpToChainRule(preRoutingBaseChainName, ifaceChain.Name) |
| 115 | + // It is safer to exclude the statement matching, avoiding cases where a current statement includes |
| 116 | + // additional default entries (e.g. counters). |
| 117 | + ruleToFindExcludingStatements := *expectedRuleToFind |
| 118 | + ruleToFindExcludingStatements.Expr = nil |
| 119 | + rules := currentConfig.LookupRule(&ruleToFindExcludingStatements) |
| 120 | + if len(rules) > 0 { |
| 121 | + c := nft.NewConfig() |
| 122 | + for _, rule := range rules { |
| 123 | + c.DeleteRule(rule) |
| 124 | + } |
| 125 | + if err := sc.configurer.Apply(c); err != nil { |
| 126 | + ifaceMatchRuleErr = fmt.Errorf("failed to delete iface match rule: %v", err) |
| 127 | + } |
| 128 | + } else { |
| 129 | + fmt.Fprintf(os.Stderr, "spoofcheck/teardown: unable to detect iface match rule for deletion: %+v", expectedRuleToFind) |
| 130 | + } |
| 131 | + } |
| 132 | + |
| 133 | + regularChainsConfig := nft.NewConfig() |
| 134 | + regularChainsConfig.DeleteChain(ifaceChain) |
| 135 | + regularChainsConfig.DeleteChain(sc.macChain(ifaceChain.Name)) |
| 136 | + |
| 137 | + var regularChainsErr error |
| 138 | + if err := sc.configurer.Apply(regularChainsConfig); err != nil { |
| 139 | + regularChainsErr = fmt.Errorf("failed to delete regular chains: %v", err) |
| 140 | + } |
| 141 | + |
| 142 | + if ifaceMatchRuleErr != nil || regularChainsErr != nil { |
| 143 | + return fmt.Errorf("failed to teardown spoof-check: %v, %v", ifaceMatchRuleErr, regularChainsErr) |
| 144 | + } |
| 145 | + return nil |
| 146 | +} |
| 147 | + |
| 148 | +func (sc *SpoofChecker) matchIfaceJumpToChainRule(chain, toChain string) *schema.Rule { |
| 149 | + return &schema.Rule{ |
| 150 | + Family: schema.FamilyBridge, |
| 151 | + Table: natTableName, |
| 152 | + Chain: chain, |
| 153 | + Expr: []schema.Statement{ |
| 154 | + {Match: &schema.Match{ |
| 155 | + Op: schema.OperEQ, |
| 156 | + Left: schema.Expression{RowData: []byte(`{"meta":{"key":"iifname"}}`)}, |
| 157 | + Right: schema.Expression{String: &sc.iface}, |
| 158 | + }}, |
| 159 | + {Verdict: schema.Verdict{Jump: &schema.ToTarget{Target: toChain}}}, |
| 160 | + }, |
| 161 | + Comment: ruleComment(sc.refID), |
| 162 | + } |
| 163 | +} |
| 164 | + |
| 165 | +func (sc *SpoofChecker) jumpToChainRule(chain, toChain string) *schema.Rule { |
| 166 | + return &schema.Rule{ |
| 167 | + Family: schema.FamilyBridge, |
| 168 | + Table: natTableName, |
| 169 | + Chain: chain, |
| 170 | + Expr: []schema.Statement{ |
| 171 | + {Verdict: schema.Verdict{Jump: &schema.ToTarget{Target: toChain}}}, |
| 172 | + }, |
| 173 | + Comment: ruleComment(sc.refID), |
| 174 | + } |
| 175 | +} |
| 176 | + |
| 177 | +func (sc *SpoofChecker) matchMacRule(chain string) *schema.Rule { |
| 178 | + return &schema.Rule{ |
| 179 | + Family: schema.FamilyBridge, |
| 180 | + Table: natTableName, |
| 181 | + Chain: chain, |
| 182 | + Expr: []schema.Statement{ |
| 183 | + {Match: &schema.Match{ |
| 184 | + Op: schema.OperEQ, |
| 185 | + Left: schema.Expression{Payload: &schema.Payload{ |
| 186 | + Protocol: schema.PayloadProtocolEther, |
| 187 | + Field: schema.PayloadFieldEtherSAddr, |
| 188 | + }}, |
| 189 | + Right: schema.Expression{String: &sc.macAddress}, |
| 190 | + }}, |
| 191 | + {Verdict: schema.Verdict{SimpleVerdict: schema.SimpleVerdict{Return: true}}}, |
| 192 | + }, |
| 193 | + Comment: ruleComment(sc.refID), |
| 194 | + } |
| 195 | +} |
| 196 | + |
| 197 | +func (sc *SpoofChecker) dropRule(chain string) *schema.Rule { |
| 198 | + macRulesIndex := nft.NewRuleIndex() |
| 199 | + return &schema.Rule{ |
| 200 | + Family: schema.FamilyBridge, |
| 201 | + Table: natTableName, |
| 202 | + Chain: chain, |
| 203 | + Index: macRulesIndex.Next(), |
| 204 | + Expr: []schema.Statement{ |
| 205 | + {Verdict: schema.Verdict{SimpleVerdict: schema.SimpleVerdict{Drop: true}}}, |
| 206 | + }, |
| 207 | + Comment: ruleComment(sc.refID), |
| 208 | + } |
| 209 | +} |
| 210 | + |
| 211 | +func (_ *SpoofChecker) baseChain() *schema.Chain { |
| 212 | + chainPriority := -300 |
| 213 | + return &schema.Chain{ |
| 214 | + Family: schema.FamilyBridge, |
| 215 | + Table: natTableName, |
| 216 | + Name: preRoutingBaseChainName, |
| 217 | + Type: schema.TypeFilter, |
| 218 | + Hook: schema.HookPreRouting, |
| 219 | + Prio: &chainPriority, |
| 220 | + Policy: schema.PolicyAccept, |
| 221 | + } |
| 222 | +} |
| 223 | + |
| 224 | +func (sc *SpoofChecker) ifaceChain() *schema.Chain { |
| 225 | + ifaceChainName := "cni-br-iface-" + sc.refID |
| 226 | + return &schema.Chain{ |
| 227 | + Family: schema.FamilyBridge, |
| 228 | + Table: natTableName, |
| 229 | + Name: ifaceChainName, |
| 230 | + } |
| 231 | +} |
| 232 | + |
| 233 | +func (_ *SpoofChecker) macChain(ifaceChainName string) *schema.Chain { |
| 234 | + macChainName := ifaceChainName + "-mac" |
| 235 | + return &schema.Chain{ |
| 236 | + Family: schema.FamilyBridge, |
| 237 | + Table: natTableName, |
| 238 | + Name: macChainName, |
| 239 | + } |
| 240 | +} |
| 241 | + |
| 242 | +func ruleComment(id string) string { |
| 243 | + const refIDPrefix = "macspoofchk-" |
| 244 | + return refIDPrefix + id |
| 245 | +} |
0 commit comments