ffho_netfilter.py 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400
  1. #
  2. # FFHO netfilter helper functions
  3. #
  4. import ipaddress
  5. import re
  6. import ffho_net
  7. # Prepare regex to match VLAN intefaces / extract IDs
  8. vlan_re = re.compile (r'^vlan(\d+)$')
  9. ################################################################################
  10. # Internal helper functions #
  11. ################################################################################
  12. #
  13. # Check if at least one of the node roles are supposed to run DHCP
  14. def _allow_dhcp (fw_policy, roles):
  15. for dhcp_role in fw_policy.get ('dhcp_roles', []):
  16. if dhcp_role in roles:
  17. return True
  18. return False
  19. # Generate services rules for the given AF
  20. def _generate_service_rules (services, acls, af):
  21. rules = []
  22. for srv in services:
  23. rule = ""
  24. comment = srv['descr']
  25. acl_comment = ""
  26. src_prefixes = []
  27. # If there are no DST IPs set at all or DST IPs for this AF set, we have a rule to build,
  28. # if this is NOT the case, there is no rule for this AF to generate, carry on.
  29. if not ((not srv['ips']['4'] and not srv['ips']['6']) or srv['ips'][str(af)]):
  30. continue
  31. # Is/are IP(s) set for this service?
  32. if srv['ips'][str(af)]:
  33. rule += "ip" if af == 4 else "ip6"
  34. dst_ips = srv['ips'][str(af)]
  35. if len (dst_ips) == 1:
  36. rule += " daddr %s " % dst_ips[0]
  37. else:
  38. rule += " daddr { %s } " % ", ".join (dst_ips)
  39. # ACLs defined for this service?
  40. if srv['acl']:
  41. srv_acl = sorted (srv['acl'])
  42. for ace in srv_acl:
  43. ace_pfx = (acls[ace][af])
  44. # Many entries
  45. if type (ace_pfx) == list:
  46. src_prefixes.extend (ace_pfx)
  47. else:
  48. src_prefixes.append (ace_pfx)
  49. acl_comment = "acl: %s" % ", ".join (srv_acl)
  50. # Additional prefixes defined for this service?
  51. if srv['additional_prefixes']:
  52. add_pfx = []
  53. # Additional prefixes are given as a space separated list
  54. for entry in srv['additional_prefixes'].split ():
  55. # Strip commas and spaces, just in case
  56. pfx_str = entry.strip (" ,")
  57. pfx_obj = ipaddress.ip_network (pfx_str)
  58. # We only care for additional pfx for this AF
  59. if pfx_obj.version != af:
  60. continue
  61. add_pfx.append (pfx_str)
  62. if add_pfx:
  63. src_prefixes.extend (add_pfx)
  64. if acl_comment:
  65. acl_comment += ", "
  66. acl_comment += "additional pfx"
  67. # Combine ACL + additional prefixes (if any)
  68. if src_prefixes:
  69. rule += "ip" if af == 4 else "ip6"
  70. if len (src_prefixes) > 1:
  71. rule += " saddr { %s } " % ", ".join (src_prefixes)
  72. else:
  73. rule += " saddr %s " % src_prefixes[0]
  74. if acl_comment:
  75. comment += " (%s)" % acl_comment
  76. # Multiple ports?
  77. if len (srv['ports']) > 1:
  78. ports = "{ %s }" % ", ".join (map (str, srv['ports']))
  79. else:
  80. ports = srv['ports'][0]
  81. rule += "%s dport %s counter accept comment \"%s\"" % (srv['proto'], ports, comment)
  82. rules.append (rule)
  83. return rules
  84. def _generate_wireguard_rule (node_config):
  85. ports = []
  86. wg = node_config.get ('wireguard')
  87. if not wg or not 'tunnels' in wg:
  88. return None
  89. for iface, wg_cfg in node_config['wireguard']['tunnels'].items ():
  90. if wg_cfg['mode'] == 'server':
  91. ports.append (wg_cfg['port'])
  92. if not ports:
  93. return None
  94. if len (ports) > 1:
  95. ports = "{ %s }" % ", ".join (map (str, ports))
  96. else:
  97. ports = ports[0]
  98. return "udp dport %s counter accept comment Wireguard" % ports
  99. def _active_urpf (iface, iface_config):
  100. # Ignore loopbacks
  101. if iface == 'lo' or iface_config.get ('link-type', '') == 'dummy':
  102. return False
  103. # Forcefully enable/disable uRPF via tags on Netbox interface?
  104. if 'urpf' in iface_config:
  105. return iface_config['urpf']
  106. # No uRPF on infra VPNs
  107. for vpn_prefix in ["gre_", "ovpn-", "wg-"]:
  108. if iface.startswith (vpn_prefix):
  109. return False
  110. # No address, no uRPF
  111. if not iface_config.get ('prefixes'):
  112. return False
  113. # Interface in vrf_external connect to the Internet
  114. if iface_config.get ('vrf') in ['vrf_external']:
  115. return False
  116. # Ignore interfaces by VLAN
  117. match = vlan_re.search (iface)
  118. if match:
  119. vid = int (match.group (1))
  120. # Magic
  121. if 900 <= vid <= 999:
  122. return False
  123. # Wired infrastructure stuff
  124. if 1000 <= vid <= 1499:
  125. return False
  126. # Wireless infrastructure stuff
  127. if 2000 <= vid <= 2299:
  128. return False
  129. return True
  130. ################################################################################
  131. # Public functions #
  132. ################################################################################
  133. #
  134. # Generate rules to allow access to services running on this node.
  135. # Services can either be allow programmatically here or explicitly
  136. # as Services applied to the device/VM in Netbox
  137. def generate_service_rules (fw_config, node_config):
  138. acls = fw_config.get ('acls', {})
  139. fw_policy = fw_config.get ('policy', {})
  140. services = node_config.get ('services', [])
  141. roles = node_config.get ('roles', [])
  142. rules = {
  143. 4 : [],
  144. 6 : [],
  145. }
  146. #
  147. # Add rules based on roles and tunnels
  148. #
  149. # Does this node run a DHCP server?
  150. if _allow_dhcp (fw_policy, roles):
  151. rules[4].append ('udp dport 67 counter accept comment "DHCP"')
  152. # Allow respondd queries on B.A.T.M.A.N. adv. nodes
  153. if 'batman' in roles:
  154. rules[6].append ('ip6 saddr fe80::/64 ip6 daddr ff05::2:1001 udp dport 1001 counter accept comment "responnd"')
  155. # Allow respondd replies to yanic
  156. if 'yanic' in roles:
  157. rules[6].append ('ip6 saddr fe80::/64 udp sport 1001 counter accept comment "respondd replies to yanic"')
  158. # Allow Wireguard tunnels
  159. wg_rule = _generate_wireguard_rule (node_config)
  160. if wg_rule:
  161. rules[4].append (wg_rule)
  162. for af in [ 4, 6 ]:
  163. comment = "Generated rules" if rules[af] else "No generated rules"
  164. rules[af].insert (0, "# %s" % comment)
  165. #
  166. # Generate and add rules for services from Netbox, if any
  167. #
  168. for af in [ 4, 6 ]:
  169. srv_rules = _generate_service_rules (services, acls, af)
  170. if not srv_rules:
  171. rules[af].append ("# No services defined in Netbox")
  172. continue
  173. rules[af].append ("# Services defined in Netbox")
  174. rules[af].extend (srv_rules)
  175. return rules
  176. def generate_forward_policy (fw_config, node_config):
  177. policy = fw_config.get ('policy', {})
  178. roles = node_config.get ('roles', [])
  179. nf_cc = node_config.get ('nftables', {})
  180. fp = {
  181. # Get default policy for packets to be forwarded
  182. 'policy' : 'drop',
  183. 'policy_reason' : 'default',
  184. 'rules': {
  185. 4 : [],
  186. 6 : [],
  187. },
  188. }
  189. if 'forward_default_policy' in policy:
  190. fp['policy'] = policy['forward_default_policy']
  191. fp['policy_reason'] = 'forward_default_policy'
  192. # Does any local role warrants for forwarding packets?
  193. accept_roles = [role for role in policy.get ('forward_accept_roles', []) if role in roles]
  194. if accept_roles:
  195. fp['policy'] = 'accept'
  196. fp['policy_reason'] = "roles: " + ",".join (accept_roles)
  197. try:
  198. cust_rules = nf_cc['filter']['forward']
  199. for af in [ 4, 6 ]:
  200. if af not in cust_rules:
  201. continue
  202. if type (cust_rules[af]) != list:
  203. raise ValueError ("nftables:filter:forward:%d in config context expected to be a list!" % af)
  204. fp['rules'][af] = cust_rules[af]
  205. except KeyError:
  206. pass
  207. return fp
  208. def generate_mgmt_config (fw_config, node_config):
  209. # If this box is not a router, it will not be responsible for providing
  210. # access to any management network, so there's nothing to do here.
  211. roles = node_config.get ('roles', [])
  212. if 'router' not in roles:
  213. return None
  214. # Get management prefixes from firewall configuration.
  215. # If there are no prefixes defined, there's nothing we can do here.
  216. mgmt_prefixes = fw_config.get ('acls', {}).get ('Management networks', {})
  217. if not mgmt_prefixes:
  218. return None
  219. # We only care for IPv4 prefixes for now.
  220. if 4 not in mgmt_prefixes:
  221. return None
  222. config = {
  223. 'ifaces': [],
  224. 'prefixes': mgmt_prefixes,
  225. }
  226. mgmt_interfaces = []
  227. interfaces = node_config['ifaces']
  228. for iface in interfaces.keys ():
  229. match = vlan_re.match (iface)
  230. if match:
  231. vlan_id = int (match.group (1))
  232. if vlan_id >= 3000 and vlan_id < 3099:
  233. config['ifaces'].append (iface)
  234. if len (config['ifaces']) == 0:
  235. return None
  236. return config
  237. def generate_nat_policy (node_config):
  238. roles = node_config.get ('roles', [])
  239. nf_cc = node_config.get ('nftables', {})
  240. np = {
  241. 4 : {},
  242. 6 : {},
  243. }
  244. # Any custom rules?
  245. cc_nat = nf_cc.get ('nat')
  246. if cc_nat:
  247. for chain in ['output', 'prerouting', 'postrouting']:
  248. if chain not in cc_nat:
  249. continue
  250. for af in [ 4, 6 ]:
  251. if str (af) in cc_nat[chain]:
  252. np[af][chain] = cc_nat[chain][str (af)]
  253. return np
  254. def generate_urpf_policy (node_config):
  255. roles = node_config.get ('roles', [])
  256. # If this box is not a router, all traffic will come in via the internal/
  257. # external interface an uRPF doesn't make any sense here, so we don't even
  258. # have to look at the interfaces.
  259. if 'router' not in roles:
  260. return []
  261. urpf = {}
  262. interfaces = node_config['ifaces']
  263. for iface in sorted (interfaces.keys ()):
  264. iface_config = interfaces[iface]
  265. if not _active_urpf (iface, iface_config):
  266. continue
  267. # Ok this seems to be and edge interface
  268. urpf[iface] = {
  269. 'iface' : iface,
  270. 'desc' : iface_config.get ('desc', ''),
  271. 4 : [],
  272. 6 : [],
  273. }
  274. # Gather configure prefixes
  275. for address in iface_config.get ('prefixes'):
  276. pfx = ipaddress.ip_network (address, strict = False)
  277. urpf[iface][pfx.version].append ("%s/%s" % (pfx.network_address, pfx.prefixlen))
  278. sorted_urpf = []
  279. for iface in ffho_net.get_interface_list (urpf):
  280. sorted_urpf.append (urpf[iface])
  281. return sorted_urpf
  282. #
  283. # Get a list of interfaces which will form OSPF adjacencies
  284. def get_ospf_active_interface (node_config):
  285. ifaces = []
  286. ospf_config = ffho_net.get_ospf_config (node_config, "doesnt_matter_here")
  287. for area in sorted (ospf_config.keys ()):
  288. area_ifaces = ospf_config[area]
  289. for iface in ffho_net.get_interface_list (area_ifaces):
  290. if not area_ifaces[iface].get ('stub', False):
  291. ifaces.append (iface)
  292. return ifaces
  293. #
  294. # Get a list of interfaces to allow VXLAN encapsulated traffic on
  295. def get_vxlan_interfaces (interfaces):
  296. vxlan_ifaces = []
  297. for iface in interfaces:
  298. if interfaces[iface].get ('batman_connect_sites'):
  299. vxlan_ifaces.append (iface)
  300. return vxlan_ifaces