ffho_netfilter.py 7.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307
  1. #
  2. # FFHO netfilter helper functions
  3. #
  4. import ipaddress
  5. import re
  6. import ffho_net
  7. # Prepare regex to match VLAN intefaces / extract IDs
  8. vlan_re = re.compile (r'^vlan(\d+)$')
  9. ################################################################################
  10. # Internal helper functions #
  11. ################################################################################
  12. #
  13. # Check if at least one of the node roles are supposed to run DHCP
  14. def _allow_dhcp (fw_policy, roles):
  15. for dhcp_role in fw_policy.get ('dhcp_roles', []):
  16. if dhcp_role in roles:
  17. return True
  18. return False
  19. # Generate services rules for the given AF
  20. def _generate_service_rules (services, acls, af):
  21. rules = []
  22. for srv in services:
  23. rule = ""
  24. comment = srv['descr']
  25. acl_comment = ""
  26. src_prefixes = []
  27. # If there are no DST IPs set at all or DST IPs for this AF set, we have a rule to build,
  28. # if this is NOT the case, there is no rule for this AF to generate, carry on.
  29. if not ((not srv['ips']['4'] and not srv['ips']['6']) or srv['ips'][str(af)]):
  30. continue
  31. # Is/are IP(s) set for this service?
  32. if srv['ips'][str(af)]:
  33. rule += "ip" if af == 4 else "ip6"
  34. dst_ips = srv['ips'][str(af)]
  35. if len (dst_ips) == 1:
  36. rule += " daddr %s " % dst_ips[0]
  37. else:
  38. rule += " daddr { %s } " % ", ".join (dst_ips)
  39. # ACLs defined for this service?
  40. if srv['acl']:
  41. srv_acl = sorted (srv['acl'])
  42. for ace in srv_acl:
  43. ace_pfx = (acls[ace][af])
  44. # Many entries
  45. if type (ace_pfx) == list:
  46. src_prefixes.extend (ace_pfx)
  47. else:
  48. src_prefixes.append (ace_pfx)
  49. acl_comment = "acl: %s" % ", ".join (srv_acl)
  50. # Additional prefixes defined for this service?
  51. if srv['additional_prefixes']:
  52. add_pfx = []
  53. # Additional prefixes are given as a space separated list
  54. for entry in srv['additional_prefixes'].split ():
  55. # Strip commas and spaces, just in case
  56. pfx_str = entry.strip (" ,")
  57. pfx_obj = ipaddress.ip_network (pfx_str)
  58. # We only care for additional pfx for this AF
  59. if pfx_obj.version != af:
  60. continue
  61. add_pfx.append (pfx_str)
  62. if add_pfx:
  63. src_prefixes.extend (add_pfx)
  64. if acl_comment:
  65. acl_comment += ", "
  66. acl_comment += "additional pfx"
  67. # Combine ACL + additional prefixes (if any)
  68. if src_prefixes:
  69. rule += "ip" if af == 4 else "ip6"
  70. if len (src_prefixes) > 1:
  71. rule += " saddr { %s } " % ", ".join (src_prefixes)
  72. else:
  73. rule += " saddr %s " % src_prefixes[0]
  74. if acl_comment:
  75. comment += " (%s)" % acl_comment
  76. # Multiple ports?
  77. if len (srv['ports']) > 1:
  78. ports = "{ %s }" % ", ".join (map (str, srv['ports']))
  79. else:
  80. ports = srv['ports'][0]
  81. rule += "%s dport %s counter accept comment \"%s\"" % (srv['proto'], ports, comment)
  82. rules.append (rule)
  83. return rules
  84. ################################################################################
  85. # Public functions #
  86. ################################################################################
  87. #
  88. # Generate rules to allow access to services running on this node.
  89. # Services can either be allow programmatically here or explicitly
  90. # as Services applied to the device/VM in Netbox
  91. def generate_service_rules (fw_config, node_config):
  92. acls = fw_config.get ('acls', {})
  93. fw_policy = fw_config.get ('policy', {})
  94. services = node_config.get ('services', [])
  95. roles = node_config.get ('roles', [])
  96. rules = {
  97. 4 : [],
  98. 6 : [],
  99. }
  100. #
  101. # Add rules based on roles
  102. #
  103. # Does this node run a DHCP server?
  104. if _allow_dhcp (fw_policy, roles):
  105. rules[4].append ('udp dport 67 counter accept comment "DHCP"')
  106. # Allow respondd queries on gateways
  107. if 'batman_gw' in roles:
  108. rules[6].append ('ip6 saddr fe80::/64 ip6 daddr ff05::2:1001 udp dport 1001 counter accept comment "responnd"')
  109. for af in [ 4, 6 ]:
  110. comment = "Generated rules" if rules[af] else "No generated rules"
  111. rules[af].insert (0, "# %s" % comment)
  112. #
  113. # Generate and add rules for services from Netbox, if any
  114. #
  115. for af in [ 4, 6 ]:
  116. srv_rules = _generate_service_rules (services, acls, af)
  117. if not srv_rules:
  118. rules[af].append ("# No services defined")
  119. rules[af].append ("# Services defined in Netbox")
  120. rules[af].extend (srv_rules)
  121. return rules
  122. def generate_forward_policy (fw_config, node_config):
  123. policy = fw_config.get ('policy', {})
  124. roles = node_config.get ('roles', [])
  125. nf_cc = node_config.get ('nftables', {})
  126. fp = {
  127. # Get default policy for packets to be forwarded
  128. 'policy' : 'drop',
  129. 'policy_reason' : 'default',
  130. 'rules': {
  131. 4 : [],
  132. 6 : [],
  133. },
  134. }
  135. if 'forward_default_policy' in policy:
  136. fp['policy'] = policy['forward_default_policy']
  137. fp['policy_reason'] = 'forward_default_policy'
  138. # Does any local role warrants for forwarding packets?
  139. accept_roles = [role for role in policy.get ('forward_accept_roles', []) if role in roles]
  140. if accept_roles:
  141. fp['policy'] = 'accept'
  142. fp['policy_reason'] = "roles: " + ",".join (accept_roles)
  143. try:
  144. cust_rules = nf_cc['filter']['forward']
  145. for af in [ 4, 6 ]:
  146. if af not in cust_rules:
  147. continue
  148. if type (cust_rules[af]) != list:
  149. raise ValueError ("nftables:filter:forward:%d in config context expected to be a list!" % af)
  150. fp['rules'][af] = cust_rules[af]
  151. except KeyError:
  152. pass
  153. return fp
  154. def generate_nat_policy (node_config):
  155. roles = node_config.get ('roles', [])
  156. nf_cc = node_config.get ('nftables', {})
  157. np = {
  158. 4 : {},
  159. 6 : {},
  160. }
  161. # Any custom rules?
  162. cc_nat = nf_cc.get ('nat')
  163. if cc_nat:
  164. for chain in ['output', 'prerouting', 'postrouting']:
  165. if chain not in cc_nat:
  166. continue
  167. for af in [ 4, 6 ]:
  168. if str (af) in cc_nat[chain]:
  169. np[af][chain] = cc_nat[chain][str (af)]
  170. return np
  171. def _active_urpf (iface, iface_config):
  172. # Ignore loopbacks
  173. if iface == 'lo' or iface_config.get ('link-type', '') == 'dummy':
  174. return False
  175. # Forcefully enable uRPF via tags on Netbox interface?
  176. if 'urpf_enable' in iface_config.get ('tags', []):
  177. return True
  178. # No uRPF on infra VPNs
  179. for vpn_prefix in ["gre_", "ovpn-", "wg-"]:
  180. if iface.startswith (vpn_prefix):
  181. return False
  182. # No address, no uRPF
  183. if not iface_config.get ('prefixes'):
  184. return False
  185. # Interface in vrf_external connect to the Internet
  186. if iface_config.get ('vrf') in ['vrf_external']:
  187. return False
  188. # Ignore interfaces by VLAN
  189. match = vlan_re.search (iface)
  190. if match:
  191. vid = int (match.group (1))
  192. # Magic
  193. if 900 <= vid <= 999:
  194. return False
  195. # Wired infrastructure stuff
  196. if 1000 <= vid <= 1499:
  197. return False
  198. # Wireless infrastructure stuff
  199. if 2000 <= vid <= 2299:
  200. return False
  201. return True
  202. def generate_urpf_policy (interfaces):
  203. urpf = {}
  204. for iface in sorted (interfaces.keys ()):
  205. iface_config = interfaces[iface]
  206. if not _active_urpf (iface, iface_config):
  207. continue
  208. # Ok this seems to be and edge interface
  209. urpf[iface] = {
  210. 'iface' : iface,
  211. 'desc' : iface_config.get ('desc', ''),
  212. 4 : [],
  213. 6 : [],
  214. }
  215. # Gather configure prefixes
  216. for address in iface_config.get ('prefixes'):
  217. pfx = ipaddress.ip_network (address, strict = False)
  218. urpf[iface][pfx.version].append ("%s/%s" % (pfx.network_address, pfx.prefixlen))
  219. sorted_urpf = []
  220. for iface in ffho_net.get_interface_list (urpf):
  221. sorted_urpf.append (urpf[iface])
  222. return sorted_urpf
  223. #
  224. # Get a list of interfaces to allow VXLAN encapsulated traffic on
  225. def get_vxlan_interfaces (interfaces):
  226. vxlan_ifaces = []
  227. for iface in interfaces:
  228. if interfaces[iface].get ('batman_connect_sites'):
  229. vxlan_ifaces.append (iface)
  230. return vxlan_ifaces