OpenNebula

Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /usr/sbin/ipset

Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset

Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /usr/sbin/ip6tables, /sbin/ip

    :NET   => %w(brctl ebtables iptables ip6tables ip ipset),

            column :ICMVP6_TYPE, "", :left, :size=>11 do |d|

                d["ICMPV6_TYPE"]

            end

    if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "ICMPV6"

        && proto != "IPSEC" && proto != "ALL")

        error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, ICMPV6,"

            " IPSEC, ALL.";

    value = rule->vector_value("ICMPV6_TYPE");

    if (!value.empty())

    {

        if (proto != "ICMPV6")

        {

            error = "ICMPV6_TYPE is supported only for ICMPV6 protocol.";

            return false;

        }

        if (rule->vector_value("ICMPV6_TYPE", ivalue) != 0)

        {

            error = "Wrong ICMPV6_TYPE, it must be integer";

            return false;

        }

    }

        struct in6_addr ip_addr;

        if (inet_pton(AF_INET6, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)

            if (inet_pton(AF_INET, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)

            {

                error = "Wrong format for IP value.";

                return false;

            }

require 'ipaddr'

        if ip_start.match(/:/)

            family = "inet6"

        else

            family = "inet"

        end

        if family == "inet"

            ip_i = IPv4.to_i(ip_start)

            ip_totalLength = 32

        else

            ip_i = IPv6.to_i(ip_start)

            ip_totalLength = 128

        end

        lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength )

            if family == "inet"

                nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-lblock}"

            else

                nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-lblock}"

            end

            lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength )

        ip_totalLength.downto(0) { |i|

            if family == "inet"

                nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-i}"

            else

                nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-i}"

            end

    module IPv6

        # Returns the binary equivalent of a IP address

        #  @param ip [String] IP in dot notation

        #  @return [Fixnum] IP as an integer

        def self.to_i(ip)

            ipaddr = IPAddr.new ip, Socket::AF_INET6

            return ipaddr.to_i

        end

        # Returns the string equivalent  of a IP address 

        #  @param ip [Fixnum] IP as an integer

        #  @return [String] IP in dot notation

        def self.to_s(ip)

            ipaddr = IPAddr.new ip, Socket::AF_INET6

            return ipaddr.to_s

        end

    end

      :ip6tables=> "sudo ip6tables",

    #   - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'ICMPV6', 'IPSEC']

    # ICMP_TYPE and ICMPV6_TYPE (optional)

    #   - Only works for protocol 'ICMP' (for ICMP_TYPE) or protocol 'ICMPV6' (for

    #     ICMPV6_TYPE)

            :icmpv6_type,   # Type 2c: block selected icmpv6 types

            :net_icmp_type, # Type 4b: block selected icmp types from a network

            :net_icmpv6_type # Type 4c: block selected icmpv6 types from a network

            @icmpv6_type = @rule[:icmpv6_type]

                when :icmpv6_type

                    process_icmpv6_type(cmds, vars)

                when :net_icmpv6_type

                    process_net_icmpv6_type(cmds, vars)

        # Expand the ICMP type with associated codes if any 

        #   @return [Array<String>] expanded ICMP types to include all codes

        def icmpv6_type_expand

            # XXX:TODO: Implement expansion of codes for IPv6 types

            ["#{@icmpv6_type}/0"]

        end

        # @protocol + @rule_type + @icmpv6_type => Type 2C: 'icmpv6_type'

        # @protocol + @rule_type + @ip + @size + @icmpv6_type => Type 4C: 'net_icmpv6_type'

                return :icmpv6_type if !@icmpv6_type.nil?

                return :net_icmpv6_type if !@icmpv6_type.nil?

        def process_icmpv6_type(cmds, vars)

        end

        def process_net_icmpv6_type(cmds, vars)

        end

end

            if @protocol != :icmpv6

                cmds.add :iptables, "-A #{chain} -p #{@protocol} -j RETURN"

            end

            if @protocol != :icmp

                cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -j RETURN"

            end

            cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -m multiport" \

                " --dports #{@range} -j RETURN"

        # Implements the :icmpv6_type rule. Example:

        #   ip6tables -A one-3-0-o -p icmpv6 --icmpv6-type 128 -j RETURN

        def     process_icmpv6_type(cmds, vars)

            chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out]

            cmds.add :ip6tables, "-A #{chain} -p icmpv6 --icmpv6-type #{@icmpv6_type}" \

                " -j RETURN"

        end

        #   ipset create one-3-0-1-i-tcp-n-inet hash:net family inet

        #   iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i-tcp-n-inet src -j RETURN

        #   ipset add -exist one-3-0-1-i-tcp-n-inet 10.0.0.0/24

            ["inet", "inet6"].each do |family|

                if family == "inet"

                    command = :iptables

                else

                    command = :ip6tables

                end

                if @rule_type == :inbound

                    chain = vars[:chain_in]

                    set = "#{vars[:set_sg_in]}-#{@protocol}-n-#{family}"

                    dir = "src"

                else

                    chain = vars[:chain_out]

                    set = "#{vars[:set_sg_out]}-#{@protocol}-n-#{family}"

                    dir = "dst"

                end

                cmds.add :ipset, "create #{set} hash:net family #{family}"

                cmds.add command, "-A #{chain} -p #{@protocol} -m set" \

                    " --match-set #{set} #{dir} -j RETURN"

                net.each do |n|

                    if n.match(/:/)

                        n_family = "inet6"

                    else

                        n_family = "inet"

                    end

                    if n_family != family

                        next

                    end

                    cmds.add :ipset, "add -exist #{set} #{n}"

                end

        #   ipset create one-3-0-1-i-nr-inet hash:net,port family inet

        #   iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr-inet src,dst -j RETURN

        #   ipset add -exist one-3-0-1-i-nr-inet 10.0.0.0/24,tcp:80

            ["inet", "inet6"].each do |family|

                if family == "inet"

                    command = :iptables

                else

                    command = :ip6tables

                end

                if @rule_type == :inbound

                    chain = vars[:chain_in]

                    set = "#{vars[:set_sg_in]}-nr-#{family}"

                    dir = "src,dst"

                else

                    chain = vars[:chain_out]

                    set = "#{vars[:set_sg_out]}-nr-#{family}"

                    dir = "dst,dst"

                end

                cmds.add :ipset, "create #{set} hash:net,port family #{family}"

                cmds.add command, "-A #{chain} -m set --match-set" \

                    " #{set} #{dir} -j RETURN"

                net.each do |n|

                    if n.match(/:/)

                        n_family = "inet6"

                    else

                        n_family = "inet"

                    end

                    if n_family != family

                        next

                    end

                    @range.split(",").each do |r|

                        r.gsub!(":","-")

                        net_range = "#{n},#{@protocol}:#{r}"

                        cmds.add :ipset, "add -exist #{set} #{net_range}"

                    end

        #   ipset create one-3-0-1-i-ni hash:net,port family inet

        #   iptables -A one-3-0-i -m set --match-set one-3-0-1-i-ni src,dst -j RETURN

            cmds.add :ipset, "create #{set} hash:net,port family inet"

        # Implements the :net_icmpv6_type rule. Example:

        #   ipset create one-3-0-1-i-ni6 hash:net,port family inet6

        #   ip6tables -A one-3-0-i -m set --match-set one-3-0-1-i-ni6 src,dst -j RETURN

        #   ipset add -exist one-3-0-1-i-ni6 10.0.0.0/24,icmpv6:128/0

        def process_net_icmpv6_type(cmds, vars)

            if @rule_type == :inbound

                chain = vars[:chain_in]

                set = "#{vars[:set_sg_in]}-ni6"

                dir = "src,dst"

            else

                chain = vars[:chain_out]

                set = "#{vars[:set_sg_out]}-ni6"                

                dir = "dst,dst"

            end

            cmds.add :ipset, "create #{set} hash:net,port family inet6"

            cmds.add :ip6tables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN"

            net.each do |n|

                icmpv6_type_expand.each do |type_code|

                    cmds.add :ipset, "add -exist #{set} #{n},icmpv6:#{type_code}"

                end

            end

        end

        commands.add :ip6tables, "-S"

        ip6tables_s = commands.run!

        ip6tables_forwards = ""

        if ip6tables_s.match(/^-N #{GLOBAL_CHAIN}$/)

            commands.add :ip6tables, "-L #{GLOBAL_CHAIN} --line-numbers"

            ip6tables_forwards = commands.run!

        end

            :ip6tables_forwards => ip6tables_forwards,

            :ip6tables_s => ip6tables_s,

        if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"

            if info[:ip6tables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"

                return

            end

        end

        commands.add :ip6tables, "-N #{GLOBAL_CHAIN}"

        commands.add :ip6tables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}"

        commands.add :ip6tables, "-A #{GLOBAL_CHAIN} -j ACCEPT"

        commands.add :ip6tables, "-N #{chain_in}"  # inbound

        commands.add :ip6tables, "-N #{chain_out}" # outbound

        commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}"

        commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in  #{nic[:tap]} --physdev-is-bridged -j #{chain_out}"

        # ICMPv6 Neighbor Discovery Protocol (ARP replacement for IPv6)

        ## Allow routers to send router advertisements

        commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 134 -j ACCEPT"

        ## Allow neighbor solicitations to reach the host

        commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 135 -j ACCEPT"

        ## Allow neighbor solicitations replies to reach the host

        commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 136 -j ACCEPT"

        ## Allow routers to send Redirect messages

        commands.add :ip6tables, "-A #{chain_in} -p icmpv6 --icmpv6-type 137 -j ACCEPT"

        ## Allow the host to send a router solicitation

        commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 133 -j ACCEPT"

        ## Allow the host to send neighbor solicitation requests

        commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 135 -j ACCEPT"

        ## Allow the host to send neighbor solicitation replies

        commands.add :ip6tables, "-A #{chain_out} -p icmpv6 --icmpv6-type 136 -j ACCEPT"

            commands.add :ip6tables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP"

            if !nic[:ip].nil? and !nic[:ip].empty?

                commands.add :iptables, "-A #{chain_out} -p udp --source 0.0.0.0/32 --sport 68 --destination 255.255.255.255/32 --dport 67 -j ACCEPT"

                set = "#{vars[:chain]}-ip-spoofing"

                commands.add :ipset, "create #{set} hash:ip"

                commands.add :ipset, "add -exist #{set} #{nic[:ip]}"

                commands.add :ipset, "add -exist #{set} #{nic[:vrouter_ip]}" if nic[:vrouter_ip]

                commands.add :iptables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP"

            else

                # If there are no IPv4 addresses allowed, block all IPv4 addresses

                commands.add :ip6tables, "-A #{chain_out} --source 0.0.0.0/0 -j DROP"

            end

            ip6_addrs = Array.new

            [:ip6_global, :ip6_link, :ip6_ula].each do |keyName|

                if !nic[keyName].nil? and !nic[keyName].empty?

                    ip6_addrs << nic[keyName]

                end

            end

            if ip6_addrs.length > 1

                set = "#{chain_out}-ip6-spoofing"

                commands.add :ipset, "create #{set} hash:ip family inet6"

                ip6_addrs.each do |ip6_addr|

                    commands.add :ipset, "add -exist #{set} #{ip6_addr}"

                end

                commands.add :ip6tables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP"

            elsif ip6_addrs.length == 1

                commands.add :ip6tables, "-A #{chain_out} ! --source #{ip6_addrs[0]} -j DROP"

            else

                # If there are no IPv6 addresses allowed, block all IPv6 addresses

                commands.add :ip6tables, "-A #{chain_out} --source ::/0 -j DROP"

            end

        commands.add :ip6tables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT"

        commands.add :ip6tables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT"

        commands.add :ip6tables, "-A #{chain_in} -j DROP"

        commands.add :ip6tables, "-A #{chain_out} -j DROP"

        ip6tables_forwards = info[:ip6tables_forwards]

        ip6tables_s       = info[:ip6tables_s]

        ip6tables_forwards.lines.reverse_each do |line|

            fields = line.split

            if [chain_in, chain_out].include?(fields[1])

                n = fields[0]

                commands.add :ip6tables, "-D #{GLOBAL_CHAIN} #{n}"

            end

        end

        remove_chains.each {|c| commands.add :ip6tables, "-F #{c}" }

        remove_chains.each {|c| commands.add :ip6tables, "-X #{c}" }