OpenNebula

Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /usr/sbin/ipset

Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset

Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset

Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /usr/sbin/ip6tables, /sbin/ip

    :NET   => %w(brctl ebtables iptables ip6tables ip ipset),

            column :ICMVP6_TYPE, "", :left, :size=>11 do |d|

                d["ICMPV6_TYPE"]

            end

    if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "ICMP6"

        && proto != "IPSEC" && proto != "ALL")

        error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, ICMP6,"

            " IPSEC, ALL.";

    value = rule->vector_value("ICMPV6_TYPE");

    if (!value.empty())

    {

        if (proto != "ICMP6")

        {

            error = "ICMPV6_TYPE is supported only for ICMP6 protocol.";

            return false;

        }

        if (rule->vector_value("ICMPV6_TYPE", ivalue) != 0)

        {

            error = "Wrong ICMPV6_TYPE, it must be integer";

            return false;

        }

    }

        struct in6_addr ip_addr;

        if (inet_pton(AF_INET6, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)

            if (inet_pton(AF_INET, ip.c_str(), static_cast<void*>(&ip_addr)) != 1)

            {

                error = "Wrong format for IP value.";

                return false;

            }

require 'ipaddr'

        if ip_start.match(/:/)

            family = "inet6"

        else

            family = "inet"

        end

        if family == "inet"

            ip_i = IPv4.to_i(ip_start)

            ip_totalLength = 32

        else

            ip_i = IPv6.to_i(ip_start)

            ip_totalLength = 128

        end

        lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength )

            if family == "inet"

                nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-lblock}"

            else

                nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-lblock}"

            end

            lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength )

        ip_totalLength.downto(0) { |i|

            if family == "inet"

                nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-i}"

            else

                nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-i}"

            end

    module IPv6

        # Returns the binary equivalent of a IP address

        #  @param ip [String] IP in dot notation

        #  @return [Fixnum] IP as an integer

        def self.to_i(ip)

            ipaddr = IPAddr.new ip, Socket::AF_INET6

            return ipaddr.to_i

        end

        # Returns the string equivalent  of a IP address 

        #  @param ip [Fixnum] IP as an integer

        #  @return [String] IP in dot notation

        def self.to_s(ip)

            ipaddr = IPAddr.new ip, Socket::AF_INET6

            return ipaddr.to_s

        end

    end

      :ip6tables=> "sudo ip6tables",

end

                    #ICMPv6

                    if nic[:icmp6]

                        if %w(no drop).include? nic[:icmp6].downcase

                            nic_rules << filter_established(chain, :icmp6, :accept)

                            nic_rules << filter_protocol(chain, :icmp6, :drop)

                        end

                    end

                purge_chain(chain)

        def purge_chain(chain)

            # IPv4

            iptables_out = `#{command(:iptables)} -n -v --line-numbers -L FORWARD`

            rule_name = nil

            if m = iptables_out.match(/.* #{chain}$/)

                rule_num = m[0].split(/\s+/)[0]

            end

            if ! rule_num.nil?

                rules << rule("-D FORWARD #{rule_num}")

            end

            # IPv6

            iptables_out = `#{command(:ip6tables)} -n -v --line-numbers -L FORWARD`

            rule_num = nil

            if m = iptables_out.match(/.* #{chain}$/)

                rule_num = m[0].split(/\s+/)[0]

            end

            if ! rule_num.nil?

                rules << rule6("-D FORWARD #{rule_num}")

            end

            rules << rule6("-F #{chain}")

            rules << rule6("-X #{chain}")

            rules = Array.new

            rules << rule("-A #{chain} -p #{protocol} -m state --state ESTABLISHED -j #{policy}")

            rules << rule6("-A #{chain} -p #{protocol} -m state --state ESTABLISHED -j #{policy}")

            return rules

            rules = Array.new

            rules << rule("-A #{chain} -p #{protocol} -j #{policy}")

            rules << rule6("-A #{chain} -p #{protocol} -j #{policy}")

            return rules

            rules = Array.new

               rules << rule("-A #{chain} -p #{protocol} -m multiport --dports #{range} -j #{policy}")

               rules << rule6("-A #{chain} -p #{protocol} -m multiport --dports #{range} -j #{policy}")

            return rules

            # IPv4

            rules = Array.new

                rules << rule("-I FORWARD #{index} -m physdev --physdev-out #{tap} -j #{chain}")

                rules << rule("-A FORWARD -m physdev --physdev-out #{tap} -j #{chain}")

            # IPv6

            iptables_out = `#{command(:ip6tables)} -n -v --line-numbers -L FORWARD`

            # Insert the rule on top of the 'opennebula' chain if it exists, so it

            # doesn't conflict with the security groups driver

            index = nil

            iptables_out.lines.each do |line|

                fields = line.split

                if fields.include?("opennebula") && fields.include?("--physdev-is-bridged")

                    index = fields[0]

                    break

                end

            end

            if index

                rules << rule6("-I FORWARD #{index} -m physdev --physdev-out #{tap} -j #{chain}")

            else

                rules << rule6("-A FORWARD -m physdev --physdev-out #{tap} -j #{chain}")

            end

            return rules

            rules = Array.new

            rules << rule("-N #{chain}")

            rules << rule6("-N #{chain}")

            return rules

        def rule6(rule)

            "#{command(:ip6tables)} #{rule}"

        end

end

    #   - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'ICMP6', 'IPSEC']

    # ICMP_TYPE and ICMPV6_TYPE (optional)

    #   - Only works for protocol 'ICMP' (for ICMP_TYPE) or protocol 'ICMP6' (for

    #     ICMPV6_TYPE)

            :icmp6_type,    # Type 2c: block selected icmp6 types 

            :net_icmp_type, # Type 4b: block selected icmp types from a network 

            :net_icmp6_type # Type 4c: block selected icmpv6 types from a network 

            @icmp6_type = @rule[:icmp6_type]

                when :net_icmp6_type

                    process_net_icmp6_type(cmds, vars)

        # Expand the ICMP type with associated codes if any 

        #   @return [Array<String>] expanded ICMP types to include all codes

        def icmpv6_type_expand

            # XXX:TODO: Implement expansion of codes for IPv6 types

            ["#{@icmpv6_type}/0"]

        end

        # @protocol + @rule_type + @icmpv6_type => Type 2C: 'icmp6_type'

        # @protocol + @rule_type + @ip + @size + @icmpv6_type => Type 4C: 'net_icmp6_type'

                return :icmp6_type if !@icmpv6_type.nil?

                return :net_icmp6_type if !@icmpv6_type.nil?

        def process_net_icmp6_type(cmds, vars)

        end            

end

            cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -j RETURN"

            cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -m multiport" \

                " --dports #{@range} -j RETURN"

        # Implements the :icmp6_type rule. Example:

        #   ip6tables -A one-3-0-o -p icmp6 --icmpv6-type 128 -j RETURN

        def     process_icmp6_type(cmds, vars)

            chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out]

            cmds.add :ip6tables, "-A #{chain} -p icmp6 --icmpv6-type #{@icmpv6_type}" \

                " -j RETURN"

        end

        #   ipset create one-3-0-1-i-tcp-n-inet hash:net family inet

        #   iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i-tcp-n-inet src -j RETURN

        #   ipset add -exist one-3-0-1-i-tcp-n-inet 10.0.0.0/24

            ["inet", "inet6"].each do |family|

                if family == "inet"

                    command = :iptables

                else

                    command = :ip6tables

                end

                if @rule_type == :inbound

                    chain = vars[:chain_in]

                    set = "#{vars[:set_sg_in]}-#{@protocol}-n-#{family}"

                    dir = "src"

                else

                    chain = vars[:chain_out]

                    set = "#{vars[:set_sg_out]}-#{@protocol}-n-#{family}"

                    dir = "dst"

                end

                cmds.add :ipset, "create #{set} hash:net family #{family}"

                cmds.add command, "-A #{chain} -p #{@protocol} -m set" \

                    " --match-set #{set} #{dir} -j RETURN"

                net.each do |n|

                    if n.match(/:/)

                        n_family = "inet6"

                    else

                        n_family = "inet"

                    end

                    if n_family != family

                        next

                    end

                    cmds.add :ipset, "add -exist #{set} #{n}"

                end

        #   ipset create one-3-0-1-i-nr-inet hash:net,port family inet

        #   iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr-inet src,dst -j RETURN

        #   ipset add -exist one-3-0-1-i-nr-inet 10.0.0.0/24,tcp:80

            ["inet", "inet6"].each do |family|

                if family == "inet"

                    command = :iptables

                else

                    command = :ip6tables

                end

                if @rule_type == :inbound

                    chain = vars[:chain_in]

                    set = "#{vars[:set_sg_in]}-nr-#{family}"

                    dir = "src,dst"

                else

                    chain = vars[:chain_out]

                    set = "#{vars[:set_sg_out]}-nr-#{family}"

                    dir = "dst,dst"

                end

                cmds.add :ipset, "create #{set} hash:net,port family #{family}"

                cmds.add command, "-A #{chain} -m set --match-set" \

                    " #{set} #{dir} -j RETURN"

                net.each do |n|

                    if n.match(/:/)

                        n_family = "inet6"

                    else

                        n_family = "inet"

                    end

                    if n_family != family

                        next

                    end

                    @range.split(",").each do |r|

                        r.gsub!(":","-")

                        net_range = "#{n},#{@protocol}:#{r}"

                        cmds.add :ipset, "add -exist #{set} #{net_range}"

                    end

        #   ipset create one-3-0-1-i-ni hash:net,port family inet

        #   iptables -A one-3-0-i -m set --match-set one-3-0-1-i-ni src,dst -j RETURN

            cmds.add :ipset, "create #{set} hash:net,port family inet"

        # Implements the :net_icmp6_type rule. Example:

        #   ipset create one-3-0-1-i-ni6 hash:net,port family inet6

        #   ip6tables -A one-3-0-i -m set --match-set one-3-0-1-i-ni6 src,dst -j RETURN

        #   ipset add -exist one-3-0-1-i-ni6 10.0.0.0/24,icmpv6:128/0

        def process_net_icmp6_type(cmds, vars)

            if @rule_type == :inbound

                chain = vars[:chain_in]

                set = "#{vars[:set_sg_in]}-ni6"

                dir = "src,dst"

            else

                chain = vars[:chain_out]

                set = "#{vars[:set_sg_out]}-ni6"                

                dir = "dst,dst"

            end

            cmds.add :ipset, "create #{set} hash:net,port family inet6"

            cmds.add :ip6tables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN"

            net.each do |n|

                icmpv6_type_expand.each do |type_code|

                    cmds.add :ipset, "add -exist #{set} #{n},icmpv6:#{type_code}"

                end

            end

        end

        commands.add :ip6tables, "-S"

        ip6tables_s = commands.run!

        ip6tables_forwards = ""

        if ip6tables_s.match(/^-N #{GLOBAL_CHAIN}$/)

            commands.add :ip6tables, "-L #{GLOBAL_CHAIN} --line-numbers"

            ip6tables_forwards = commands.run!    

        end

            :ip6tables_forwards => ip6tables_forwards,

            :ip6tables_s => ip6tables_s,

        if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"

            if info[:ip6tables_s].split("\n").include? "-N #{GLOBAL_CHAIN}"

                return

            end

        end

        commands.add :ip6tables, "-N #{GLOBAL_CHAIN}"

        commands.add :ip6tables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}"

        commands.add :ip6tables, "-A #{GLOBAL_CHAIN} -j ACCEPT"

        commands.add :ip6tables, "-N #{chain_in}"  # inbound

        commands.add :ip6tables, "-N #{chain_out}" # outbound

        commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}"

        commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in  #{nic[:tap]} --physdev-is-bridged -j #{chain_out}"

            commands.add :ip6tables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP"

            if !nic[:ip].nil? and !nic[:ip].empty?

                commands.add :iptables, "-A #{chain_out} ! --source #{nic[:ip]} -j DROP"

            end

            ip6_addrs = Array.new

            [:ip6_global, :ip6_link, :ip6_ula].each do |keyName|

                if !nic[keyName].nil? and !nic[keyName].empty?

                    ip6_addrs << nic[keyName]

                end

            end

            if ip6_addrs.length > 1

                set = "#{chain_out}-nospoof-inet66"

                commands.add :ipset, "create #{set} hash:ip family inet6"

                ip6_addrs.each do |ip6_addr|

                    commands.add :ipset, "add -exist #{set} #{ip6_addr}"

                end

                commands.add :ip6tables, "-A #{chain_out} -m set ! --match-set #{set} src -j DROP"

            elsif ip6_addrs.length == 1

                commands.add :ip6tables, "-A #{chain_out} ! --source #{ip6_addrs[0]} -j DROP"

            end

        commands.add :ip6tables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT"

        commands.add :ip6tables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT"

        commands.add :ip6tables, "-A #{chain_in} -j DROP"

        commands.add :ip6tables, "-A #{chain_out} -j DROP"

        ip6tables_forwards = info[:ip6tables_forwards]

        ip6tables_s       = info[:ip6tables_s]

        ip6tables_forwards.lines.reverse_each do |line|

            fields = line.split

            if [chain_in, chain_out].include?(fields[1])

                n = fields[0]

                commands.add :ip6tables, "-D #{GLOBAL_CHAIN} #{n}"

            end

        end

        remove_chains.each {|c| commands.add :ip6tables, "-F #{c}" }

        remove_chains.each {|c| commands.add :ip6tables, "-X #{c}" }

end