diff --no-dereference -uNr opennebula-4.12.1.orig/share/pkgs/CentOS/opennebula.sudoers opennebula-4.12.1-securitygroup6/share/pkgs/CentOS/opennebula.sudoers --- opennebula-4.12.1.orig/share/pkgs/CentOS/opennebula.sudoers 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/share/pkgs/CentOS/opennebula.sudoers 2015-11-13 12:03:04.865595680 -0600 @@ -2,7 +2,7 @@ Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync -Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /usr/sbin/ipset +Cmnd_Alias ONE_NET = /usr/sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /usr/sbin/ipset Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvrename, /sbin/lvs, /sbin/vgdisplay Cmnd_Alias ONE_ISCSI = /sbin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --no-dereference -uNr opennebula-4.12.1.orig/share/pkgs/Debian/opennebula.sudoers opennebula-4.12.1-securitygroup6/share/pkgs/Debian/opennebula.sudoers --- opennebula-4.12.1.orig/share/pkgs/Debian/opennebula.sudoers 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/share/pkgs/Debian/opennebula.sudoers 2015-11-13 12:02:42.022596856 -0600 @@ -2,7 +2,7 @@ Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync -Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /sbin/ipset +Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvrename, /sbin/lvs, /sbin/vgdisplay Cmnd_Alias ONE_ISCSI = /usr/bin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --no-dereference -uNr opennebula-4.12.1.orig/share/pkgs/Ubuntu/opennebula.sudoers opennebula-4.12.1-securitygroup6/share/pkgs/Ubuntu/opennebula.sudoers --- opennebula-4.12.1.orig/share/pkgs/Ubuntu/opennebula.sudoers 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/share/pkgs/Ubuntu/opennebula.sudoers 2015-11-13 12:02:53.003596290 -0600 @@ -2,7 +2,7 @@ Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /bin/dd, /sbin/mkfs, /bin/sync -Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip, /sbin/ipset +Cmnd_Alias ONE_NET = /sbin/brctl, /sbin/ebtables, /sbin/iptables, /sbin/ip6tables, /sbin/ip, /sbin/ipset Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvrename, /sbin/lvs, /sbin/vgdisplay Cmnd_Alias ONE_ISCSI = /usr/bin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --no-dereference -uNr opennebula-4.12.1.orig/share/pkgs/openSUSE/opennebula.sudoers opennebula-4.12.1-securitygroup6/share/pkgs/openSUSE/opennebula.sudoers --- opennebula-4.12.1.orig/share/pkgs/openSUSE/opennebula.sudoers 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/share/pkgs/openSUSE/opennebula.sudoers 2015-11-13 12:02:32.918597324 -0600 @@ -2,7 +2,7 @@ Defaults:oneadmin secure_path = /sbin:/bin:/usr/sbin:/usr/bin Cmnd_Alias ONE_MISC = /usr/bin/dd, /sbin/mkfs, /usr/bin/sync -Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /sbin/ip +Cmnd_Alias ONE_NET = /sbin/brctl, /usr/sbin/ebtables, /usr/sbin/iptables, /usr/sbin/ip6tables, /sbin/ip Cmnd_Alias ONE_LVM = /sbin/lvcreate, /sbin/lvremove, /sbin/lvrename, /sbin/lvs, /sbin/vgdisplay Cmnd_Alias ONE_ISCSI = /sbin/iscsiadm, /usr/sbin/tgt-admin, /usr/sbin/tgtadm Cmnd_Alias ONE_OVS = /usr/bin/ovs-ofctl, /usr/bin/ovs-vsctl diff --no-dereference -uNr opennebula-4.12.1.orig/share/sudoers/sudo_commands.rb opennebula-4.12.1-securitygroup6/share/sudoers/sudo_commands.rb --- opennebula-4.12.1.orig/share/sudoers/sudo_commands.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/share/sudoers/sudo_commands.rb 2015-11-13 12:02:16.774598155 -0600 @@ -22,7 +22,7 @@ CMDS = { :MISC => %w(dd mkfs sync), - :NET => %w(brctl ebtables iptables ip ipset), + :NET => %w(brctl ebtables iptables ip6tables ip ipset), :LVM => %w(lvcreate lvremove lvrename lvs vgdisplay), :ISCSI => %w(iscsiadm tgt-admin tgtadm), :OVS => %w(ovs-ofctl ovs-vsctl), diff --no-dereference -uNr opennebula-4.12.1.orig/src/cli/one_helper/onesecgroup_helper.rb opennebula-4.12.1-securitygroup6/src/cli/one_helper/onesecgroup_helper.rb --- opennebula-4.12.1.orig/src/cli/one_helper/onesecgroup_helper.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/cli/one_helper/onesecgroup_helper.rb 2015-11-13 14:43:27.143389017 -0600 @@ -110,6 +110,10 @@ d["ICMP_TYPE"] end + column :ICMVP6_TYPE, "", :left, :size=>11 do |d| + d["ICMPV6_TYPE"] + end + column :NETWORK, "", :left, :donottruncate, :size=>35 do |d| network = "" if(!d["NETWORK_ID"].nil? && d["NETWORK_ID"] != "") diff --no-dereference -uNr opennebula-4.12.1.orig/src/secgroup/SecurityGroup.cc opennebula-4.12.1-securitygroup6/src/secgroup/SecurityGroup.cc --- opennebula-4.12.1.orig/src/secgroup/SecurityGroup.cc 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/secgroup/SecurityGroup.cc 2015-11-13 14:39:40.657700182 -0600 @@ -333,11 +333,11 @@ one_util::toupper(proto); - if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "IPSEC" - && proto != "ALL") + if ( proto != "TCP" && proto != "UDP" && proto != "ICMP" && proto != "ICMP6" + && proto != "IPSEC" && proto != "ALL") { - error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, IPSEC," - " ALL."; + error = "Wrong PROTOCOL in rule. Valid options: TCP, UDP, ICMP, ICMP6," + " IPSEC, ALL."; return false; } @@ -376,6 +376,23 @@ } } + value = rule->vector_value("ICMPV6_TYPE"); + + if (!value.empty()) + { + if (proto != "ICMP6") + { + error = "ICMPV6_TYPE is supported only for ICMP6 protocol."; + return false; + } + + if (rule->vector_value("ICMPV6_TYPE", ivalue) != 0) + { + error = "Wrong ICMPV6_TYPE, it must be integer"; + return false; + } + } + // ------------------------------------------------------------------------- // RULE_TYPE // ------------------------------------------------------------------------- @@ -398,7 +415,7 @@ if (!ip.empty()) //Target as IP & SIZE { - struct in_addr ip_addr; + struct in6_addr ip_addr; if (rule->vector_value("SIZE", ivalue) != 0) { @@ -406,10 +423,13 @@ return false; } - if (inet_pton(AF_INET, ip.c_str(), static_cast(&ip_addr)) != 1) + if (inet_pton(AF_INET6, ip.c_str(), static_cast(&ip_addr)) != 1) { - error = "Wrong format for IP value."; - return false; + if (inet_pton(AF_INET, ip.c_str(), static_cast(&ip_addr)) != 1) + { + error = "Wrong format for IP value."; + return false; + } } } else //Target is ANY or NETWORK_ID diff --no-dereference -uNr opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/address.rb opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/address.rb --- opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/address.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/address.rb 2015-11-13 15:14:38.015388649 -0600 @@ -14,6 +14,8 @@ # limitations under the License. # #--------------------------------------------------------------------------- # +require 'ipaddr' + module VNMMAD module VNMNetwork @@ -26,28 +28,49 @@ # @return [Array] The networks in CIDR def self.to_nets(ip_start, size) nets = Array.new - ip_i = IPv4.to_i(ip_start) + + if ip_start.match(/:/) + family = "inet6" + else + family = "inet" + end + + if family == "inet" + ip_i = IPv4.to_i(ip_start) + ip_totalLength = 32 + else + ip_i = IPv6.to_i(ip_start) + ip_totalLength = 128 + end # Find the largest address block (look for the first 1-bit) lblock = 0 - lblock += 1 while (ip_i[lblock] == 0 && lblock < 32 ) + lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength ) # Allocate whole blocks till the size fits while ( size >= 2**lblock ) - nets << "#{IPv4.to_s(ip_i)}/#{32-lblock}" + if family == "inet" + nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-lblock}" + else + nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-lblock}" + end ip_i += 2**lblock size -= 2**lblock - lblock += 1 while (ip_i[lblock] == 0 && lblock < 32 ) + lblock += 1 while (ip_i[lblock] == 0 && lblock < ip_totalLength ) end # Fit remaining address blocks - 32.downto(0) { |i| + ip_totalLength.downto(0) { |i| next if size[i] == 0 - nets << "#{IPv4.to_s(ip_i)}/#{32-i}" + if family == "inet" + nets << "#{IPv4.to_s(ip_i)}/#{ip_totalLength-i}" + else + nets << "#{IPv6.to_s(ip_i)}/#{ip_totalLength-i}" + end ip_i += 2**i } @@ -72,6 +95,26 @@ ip = 3.downto(0).collect {|s| (ip >> 8*s) & 0xff }.join('.') end end + + module IPv6 + # Returns the binary equivalent of a IP address + # @param ip [String] IP in dot notation + # @return [Fixnum] IP as an integer + def self.to_i(ip) + ipaddr = IPAddr.new ip, Socket::AF_INET6 + + return ipaddr.to_i + end + + # Returns the string equivalent of a IP address + # @param ip [Fixnum] IP as an integer + # @return [String] IP in dot notation + def self.to_s(ip) + ipaddr = IPAddr.new ip, Socket::AF_INET6 + + return ipaddr.to_s + end + end end end diff --no-dereference -uNr opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/command.rb opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/command.rb --- opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/command.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/command.rb 2015-11-13 13:28:43.743331109 -0600 @@ -38,6 +38,7 @@ COMMANDS = { :ebtables => "sudo ebtables", :iptables => "sudo iptables", + :ip6tables=> "sudo ip6tables", :brctl => "sudo brctl", :ip => "sudo ip", :virsh => "virsh -c qemu:///system", @@ -83,4 +84,4 @@ end end -end \ No newline at end of file +end diff --no-dereference -uNr opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/fw_driver.rb opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/fw_driver.rb --- opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/fw_driver.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/fw_driver.rb 2015-11-13 12:21:32.476538655 -0600 @@ -82,6 +82,14 @@ end end + #ICMPv6 + if nic[:icmp6] + if %w(no drop).include? nic[:icmp6].downcase + nic_rules << filter_established(chain, :icmp6, :accept) + nic_rules << filter_protocol(chain, :icmp6, :drop) + end + end + process_chain(chain, tap, nic_rules) end end @@ -96,11 +104,7 @@ vm_id = @vm['ID'] process do |nic| chain = "one-#{vm_id}-#{nic[:network_id]}" - iptables_out = `#{command(:iptables)} -n -v --line-numbers -L FORWARD` - if m = iptables_out.match(/.*#{chain}.*/) - rule_num = m[0].split(/\s+/)[0] - purge_chain(chain, rule_num) - end + purge_chain(chain) end unlock @@ -111,11 +115,35 @@ ######################################################################## private - def purge_chain(chain, rule_num) + def purge_chain(chain) rules = Array.new - rules << rule("-D FORWARD #{rule_num}") + + # IPv4 + iptables_out = `#{command(:iptables)} -n -v --line-numbers -L FORWARD` + rule_name = nil + if m = iptables_out.match(/.* #{chain}$/) + rule_num = m[0].split(/\s+/)[0] + end + + if ! rule_num.nil? + rules << rule("-D FORWARD #{rule_num}") + end rules << rule("-F #{chain}") rules << rule("-X #{chain}") + + # IPv6 + iptables_out = `#{command(:ip6tables)} -n -v --line-numbers -L FORWARD` + rule_num = nil + if m = iptables_out.match(/.* #{chain}$/) + rule_num = m[0].split(/\s+/)[0] + end + + if ! rule_num.nil? + rules << rule6("-D FORWARD #{rule_num}") + end + rules << rule6("-F #{chain}") + rules << rule6("-X #{chain}") + run_rules rules end @@ -134,7 +162,12 @@ def filter_established(chain, protocol, policy) policy = policy.to_s.upcase - rule "-A #{chain} -p #{protocol} -m state --state ESTABLISHED -j #{policy}" + + rules = Array.new + rules << rule("-A #{chain} -p #{protocol} -m state --state ESTABLISHED -j #{policy}") + rules << rule6("-A #{chain} -p #{protocol} -m state --state ESTABLISHED -j #{policy}") + + return rules end def run_rules(rules) @@ -149,19 +182,29 @@ def filter_protocol(chain, protocol, policy) policy = policy.to_s.upcase - rule "-A #{chain} -p #{protocol} -j #{policy}" + + rules = Array.new + rules << rule("-A #{chain} -p #{protocol} -j #{policy}") + rules << rule6("-A #{chain} -p #{protocol} -j #{policy}") + + return rules end def filter_ports(chain, protocol, range, policy) policy = policy.to_s.upcase range.gsub!(/\s+/,"") + rules = Array.new if range? range - rule "-A #{chain} -p #{protocol} -m multiport --dports #{range} -j #{policy}" + rules << rule("-A #{chain} -p #{protocol} -m multiport --dports #{range} -j #{policy}") + rules << rule6("-A #{chain} -p #{protocol} -m multiport --dports #{range} -j #{policy}") end + + return rules end def tap_to_chain(tap, chain) + # IPv4 iptables_out = `#{command(:iptables)} -n -v --line-numbers -L FORWARD` # Insert the rule on top of the 'opennebula' chain if it exists, so it @@ -175,15 +218,43 @@ end end + rules = Array.new if index - rule "-I FORWARD #{index} -m physdev --physdev-out #{tap} -j #{chain}" + rules << rule("-I FORWARD #{index} -m physdev --physdev-out #{tap} -j #{chain}") else - rule "-A FORWARD -m physdev --physdev-out #{tap} -j #{chain}" + rules << rule("-A FORWARD -m physdev --physdev-out #{tap} -j #{chain}") end + + # IPv6 + iptables_out = `#{command(:ip6tables)} -n -v --line-numbers -L FORWARD` + + # Insert the rule on top of the 'opennebula' chain if it exists, so it + # doesn't conflict with the security groups driver + index = nil + iptables_out.lines.each do |line| + fields = line.split + if fields.include?("opennebula") && fields.include?("--physdev-is-bridged") + index = fields[0] + break + end + end + + if index + rules << rule6("-I FORWARD #{index} -m physdev --physdev-out #{tap} -j #{chain}") + else + rules << rule6("-A FORWARD -m physdev --physdev-out #{tap} -j #{chain}") + end + + return rules end def new_chain(chain) - rule "-N #{chain}" + rules = Array.new + + rules << rule("-N #{chain}") + rules << rule6("-N #{chain}") + + return rules end def chain_exists?(chain) @@ -195,5 +266,9 @@ def rule(rule) "#{command(:iptables)} #{rule}" end + + def rule6(rule) + "#{command(:ip6tables)} #{rule}" + end end -end \ No newline at end of file +end diff --no-dereference -uNr opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/security_groups.rb opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/security_groups.rb --- opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/security_groups.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/security_groups.rb 2015-11-13 15:02:46.151535316 -0600 @@ -24,7 +24,7 @@ # # PROTOCOL (mandatory) # - Specifies the protocol of the rule - # - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'IPSEC'] + # - values: ['ALL', 'TCP', 'UDP', 'ICMP', 'ICMP6', 'IPSEC'] # # RULE_TYPE (mandatory) # - Specifies the direction of application of the rule @@ -34,8 +34,9 @@ # - only works for protocols ['TCP', 'UDP'] # - uses the iptables multiports syntax # - # ICMP_TYPE (optional) - # - Only works for protocol 'ICMP' + # ICMP_TYPE and ICMPV6_TYPE (optional) + # - Only works for protocol 'ICMP' (for ICMP_TYPE) or protocol 'ICMP6' (for + # ICMPV6_TYPE) # - Is either in the form of '' or '/', where both # '' and '' are integers. This class has a helper method # tgat expands '' into all the '/' subtypes. @@ -50,9 +51,11 @@ :protocol, # Type 1: block the whole protocol :portrange, # Type 2a: block a port range within a protocol :icmp_type, # Type 2b: block selected icmp types + :icmp6_type, # Type 2c: block selected icmp6 types :net, # Type 3: block a whole protocol for a network :net_portrange, # Type 4a: block a port range from a network - :net_icmp_type # Type 4b: block selected icmp types from a network + :net_icmp_type, # Type 4b: block selected icmp types from a network + :net_icmp6_type # Type 4c: block selected icmpv6 types from a network ] # Initialize a new rule. @@ -63,6 +66,7 @@ @rule_type = @rule[:rule_type].downcase.to_sym @icmp_type = @rule[:icmp_type] + @icmp6_type = @rule[:icmp6_type] @range = @rule[:range] @ip = @rule[:ip] @@ -92,6 +96,9 @@ when :net_icmp_type process_net_icmp_type(cmds, vars) + + when :net_icmp6_type + process_net_icmp6_type(cmds, vars) end end @@ -113,6 +120,13 @@ end end + # Expand the ICMP type with associated codes if any + # @return [Array] expanded ICMP types to include all codes + def icmpv6_type_expand + # XXX:TODO: Implement expansion of codes for IPv6 types + ["#{@icmpv6_type}/0"] + end + private # ICMP Codes for each ICMP type @@ -129,17 +143,21 @@ # @protocol + @rule_type => Type 1: 'protocol' # @protocol + @rule_type + @range => Type 2A: 'portrange' # @protocol + @rule_type + @icmp_type => Type 2B: 'icmp_type' + # @protocol + @rule_type + @icmpv6_type => Type 2C: 'icmp6_type' # @protocol + @rule_type + @ip + @size => Type 3: 'net' # @protocol + @rule_type + @ip + @size + @range => Type 4A: 'net_portrange' # @protocol + @rule_type + @ip + @size + @icmp_type => Type 4B: 'net_icmp_type' + # @protocol + @rule_type + @ip + @size + @icmpv6_type => Type 4C: 'net_icmp6_type' # # @return [Symbol] The rule type def set_type if @ip.nil? && @size.nil? + return :icmp6_type if !@icmpv6_type.nil? return :icmp_type if !@icmp_type.nil? return :portrange if !@range.nil? return :protocol else + return :net_icmp6_type if !@icmpv6_type.nil? return :net_icmp_type if !@icmp_type.nil? return :net_portrange if !@range.nil? return :net @@ -169,6 +187,9 @@ def process_net_icmp_type(cmds, vars) end + + def process_net_icmp6_type(cmds, vars) + end end ############################################################################ @@ -219,4 +240,4 @@ end -end \ No newline at end of file +end diff --no-dereference -uNr opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/security_groups_iptables.rb opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/security_groups_iptables.rb --- opennebula-4.12.1.orig/src/vnm_mad/remotes/lib/security_groups_iptables.rb 2015-04-06 13:22:34.000000000 -0500 +++ opennebula-4.12.1-securitygroup6/src/vnm_mad/remotes/lib/security_groups_iptables.rb 2015-11-13 14:25:16.703156425 -0600 @@ -34,6 +34,7 @@ chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out] cmds.add :iptables, "-A #{chain} -p #{@protocol} -j RETURN" + cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -j RETURN" end # Implements the :portrange rule. Example: @@ -43,6 +44,8 @@ cmds.add :iptables, "-A #{chain} -p #{@protocol} -m multiport" \ " --dports #{@range} -j RETURN" + cmds.add :ip6tables, "-A #{chain} -p #{@protocol} -m multiport" \ + " --dports #{@range} -j RETURN" end # Implements the :icmp_type rule. Example: @@ -54,61 +57,106 @@ " -j RETURN" end + # Implements the :icmp6_type rule. Example: + # ip6tables -A one-3-0-o -p icmp6 --icmpv6-type 128 -j RETURN + def process_icmp6_type(cmds, vars) + chain = @rule_type == :inbound ? vars[:chain_in] : vars[:chain_out] + + cmds.add :ip6tables, "-A #{chain} -p icmp6 --icmpv6-type #{@icmpv6_type}" \ + " -j RETURN" + end + # Implements the :net rule. Example: - # ipset create one-3-0-1-i-tcp-n hash:net - # iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i src -j RETURN - # ipset add -exist one-3-0-1-i-tcp-n 10.0.0.0/24 + # ipset create one-3-0-1-i-tcp-n-inet hash:net family inet + # iptables -A one-3-0-i -p tcp -m set --match-set one-3-0-1-i-tcp-n-inet src -j RETURN + # ipset add -exist one-3-0-1-i-tcp-n-inet 10.0.0.0/24 def process_net(cmds, vars) - if @rule_type == :inbound - chain = vars[:chain_in] - set = "#{vars[:set_sg_in]}-#{@protocol}-n" - dir = "src" - else - chain = vars[:chain_out] - set = "#{vars[:set_sg_out]}-#{@protocol}-n" - dir = "dst" - end + ["inet", "inet6"].each do |family| + if family == "inet" + command = :iptables + else + command = :ip6tables + end - cmds.add :ipset, "create #{set} hash:net" - cmds.add :iptables, "-A #{chain} -p #{@protocol} -m set" \ - " --match-set #{set} #{dir} -j RETURN" + if @rule_type == :inbound + chain = vars[:chain_in] + set = "#{vars[:set_sg_in]}-#{@protocol}-n-#{family}" + dir = "src" + else + chain = vars[:chain_out] + set = "#{vars[:set_sg_out]}-#{@protocol}-n-#{family}" + dir = "dst" + end - net.each do |n| - cmds.add :ipset, "add -exist #{set} #{n}" + cmds.add :ipset, "create #{set} hash:net family #{family}" + cmds.add command, "-A #{chain} -p #{@protocol} -m set" \ + " --match-set #{set} #{dir} -j RETURN" + + net.each do |n| + if n.match(/:/) + n_family = "inet6" + else + n_family = "inet" + end + + if n_family != family + next + end + + cmds.add :ipset, "add -exist #{set} #{n}" + end end end # Implements the :net_portrange rule. Example: - # ipset create one-3-0-1-i-nr hash:net,port - # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr src,dst -j RETURN - # ipset add -exist one-3-0-1-i-nr 10.0.0.0/24,tcp:80 + # ipset create one-3-0-1-i-nr-inet hash:net,port family inet + # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr-inet src,dst -j RETURN + # ipset add -exist one-3-0-1-i-nr-inet 10.0.0.0/24,tcp:80 def process_net_portrange(cmds, vars) - if @rule_type == :inbound - chain = vars[:chain_in] - set = "#{vars[:set_sg_in]}-nr" - dir = "src,dst" - else - chain = vars[:chain_out] - set = "#{vars[:set_sg_out]}-nr" - dir = "dst,dst" - end + ["inet", "inet6"].each do |family| + if family == "inet" + command = :iptables + else + command = :ip6tables + end - cmds.add :ipset, "create #{set} hash:net,port" - cmds.add :iptables, "-A #{chain} -m set --match-set" \ - " #{set} #{dir} -j RETURN" + if @rule_type == :inbound + chain = vars[:chain_in] + set = "#{vars[:set_sg_in]}-nr-#{family}" + dir = "src,dst" + else + chain = vars[:chain_out] + set = "#{vars[:set_sg_out]}-nr-#{family}" + dir = "dst,dst" + end - net.each do |n| - @range.split(",").each do |r| - r.gsub!(":","-") - net_range = "#{n},#{@protocol}:#{r}" - cmds.add :ipset, "add -exist #{set} #{net_range}" + cmds.add :ipset, "create #{set} hash:net,port family #{family}" + cmds.add command, "-A #{chain} -m set --match-set" \ + " #{set} #{dir} -j RETURN" + + net.each do |n| + if n.match(/:/) + n_family = "inet6" + else + n_family = "inet" + end + + if n_family != family + next + end + + @range.split(",").each do |r| + r.gsub!(":","-") + net_range = "#{n},#{@protocol}:#{r}" + cmds.add :ipset, "add -exist #{set} #{net_range}" + end end end end # Implements the :net_icmp_type rule. Example: - # ipset create one-3-0-1-i-ni hash:net,port - # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-nr src,dst -j RETURN + # ipset create one-3-0-1-i-ni hash:net,port family inet + # iptables -A one-3-0-i -m set --match-set one-3-0-1-i-ni src,dst -j RETURN # ipset add -exist one-3-0-1-i-ni 10.0.0.0/24,icmp:8/0 def process_net_icmp_type(cmds, vars) if @rule_type == :inbound @@ -121,7 +169,7 @@ dir = "dst,dst" end - cmds.add :ipset, "create #{set} hash:net,port" + cmds.add :ipset, "create #{set} hash:net,port family inet" cmds.add :iptables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN" net.each do |n| @@ -130,6 +178,31 @@ end end end + + # Implements the :net_icmp6_type rule. Example: + # ipset create one-3-0-1-i-ni6 hash:net,port family inet6 + # ip6tables -A one-3-0-i -m set --match-set one-3-0-1-i-ni6 src,dst -j RETURN + # ipset add -exist one-3-0-1-i-ni6 10.0.0.0/24,icmpv6:128/0 + def process_net_icmp6_type(cmds, vars) + if @rule_type == :inbound + chain = vars[:chain_in] + set = "#{vars[:set_sg_in]}-ni6" + dir = "src,dst" + else + chain = vars[:chain_out] + set = "#{vars[:set_sg_out]}-ni6" + dir = "dst,dst" + end + + cmds.add :ipset, "create #{set} hash:net,port family inet6" + cmds.add :ip6tables, "-A #{chain} -m set --match-set #{set} #{dir} -j RETURN" + + net.each do |n| + icmpv6_type_expand.each do |type_code| + cmds.add :ipset, "add -exist #{set} #{n},icmpv6:#{type_code}" + end + end + end end ############################################################################ @@ -166,19 +239,30 @@ commands.add :iptables, "-S" iptables_s = commands.run! + commands.add :ip6tables, "-S" + ip6tables_s = commands.run! + iptables_forwards = "" + ip6tables_forwards = "" if iptables_s.match(/^-N #{GLOBAL_CHAIN}$/) commands.add :iptables, "-L #{GLOBAL_CHAIN} --line-numbers" iptables_forwards = commands.run! end + if ip6tables_s.match(/^-N #{GLOBAL_CHAIN}$/) + commands.add :ip6tables, "-L #{GLOBAL_CHAIN} --line-numbers" + ip6tables_forwards = commands.run! + end + commands.add :ipset, "list -name" ipset_list = commands.run! { :iptables_forwards => iptables_forwards, :iptables_s => iptables_s, + :ip6tables_forwards => ip6tables_forwards, + :ip6tables_s => ip6tables_s, :ipset_list => ipset_list } end @@ -190,13 +274,20 @@ def self.global_bootstrap info = SGIPTables.info - return if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}" - + if info[:iptables_s].split("\n").include? "-N #{GLOBAL_CHAIN}" + if info[:ip6tables_s].split("\n").include? "-N #{GLOBAL_CHAIN}" + return + end + end + commands = VNMNetwork::Commands.new commands.add :iptables, "-N #{GLOBAL_CHAIN}" commands.add :iptables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}" commands.add :iptables, "-A #{GLOBAL_CHAIN} -j ACCEPT" + commands.add :ip6tables, "-N #{GLOBAL_CHAIN}" + commands.add :ip6tables, "-A FORWARD -m physdev --physdev-is-bridged -j #{GLOBAL_CHAIN}" + commands.add :ip6tables, "-A #{GLOBAL_CHAIN} -j ACCEPT" commands.run! end @@ -259,24 +350,32 @@ # create chains commands.add :iptables, "-N #{chain_in}" # inbound commands.add :iptables, "-N #{chain_out}" # outbound + commands.add :ip6tables, "-N #{chain_in}" # inbound + commands.add :ip6tables, "-N #{chain_out}" # outbound # Send traffic to the NIC chains commands.add :iptables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}" commands.add :iptables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in #{nic[:tap]} --physdev-is-bridged -j #{chain_out}" + commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-out #{nic[:tap]} --physdev-is-bridged -j #{chain_in}" + commands.add :ip6tables, "-I #{GLOBAL_CHAIN} -m physdev --physdev-in #{nic[:tap]} --physdev-is-bridged -j #{chain_out}" # Mac-spofing if nic[:filter_mac_spoofing] == "YES" commands.add :iptables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP" + commands.add :ip6tables, "-A #{chain_out} -m mac ! --mac-source #{nic[:mac]} -j DROP" end # IP-spofing if nic[:filter_ip_spoofing] == "YES" commands.add :iptables, "-A #{chain_out} ! --source #{nic[:ip]} -j DROP" + commands.add :ip6tables, "-A #{chain_out} ! --source #{nic[:ip6]} -j DROP" end # Related, Established commands.add :iptables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT" commands.add :iptables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT" + commands.add :ip6tables, "-A #{chain_in} -m state --state ESTABLISHED,RELATED -j ACCEPT" + commands.add :ip6tables, "-A #{chain_out} -m state --state ESTABLISHED,RELATED -j ACCEPT" commands.run! end @@ -292,6 +391,8 @@ commands = VNMNetwork::Commands.new commands.add :iptables, "-A #{chain_in} -j DROP" commands.add :iptables, "-A #{chain_out} -j DROP" + commands.add :ip6tables, "-A #{chain_in} -j DROP" + commands.add :ip6tables, "-A #{chain_out} -j DROP" commands.run! end @@ -306,6 +407,8 @@ info = self.info iptables_forwards = info[:iptables_forwards] iptables_s = info[:iptables_s] + ip6tables_forwards = info[:ip6tables_forwards] + ip6tables_s = info[:ip6tables_s] ipset_list = info[:ipset_list] commands = VNMNetwork::Commands.new @@ -318,6 +421,14 @@ end end + ip6tables_forwards.lines.reverse_each do |line| + fields = line.split + if [chain_in, chain_out].include?(fields[1]) + n = fields[0] + commands.add :ip6tables, "-D #{GLOBAL_CHAIN} #{n}" + end + end + remove_chains = [] iptables_s.lines.each do |line| if line.match(/^-N #{chain}/) @@ -326,6 +437,8 @@ end remove_chains.each {|c| commands.add :iptables, "-F #{c}" } remove_chains.each {|c| commands.add :iptables, "-X #{c}" } + remove_chains.each {|c| commands.add :ip6tables, "-F #{c}" } + remove_chains.each {|c| commands.add :ip6tables, "-X #{c}" } ipset_list.lines.each do |line| if line.match(/^#{chain}/) @@ -338,4 +451,4 @@ end end -end \ No newline at end of file +end