From b0267902150824c1e0e6e626921181e461a101bd Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Wed, 19 Dec 2018 14:20:46 -0500 Subject: [PATCH 3/8] nftables: support RFC3964_IPv4 filtering (cherry picked from commit 5afa02271418284ae95dc81304c7af65ff6e41ae) --- src/firewall/core/nftables.py | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py index 72f2180ec504..1d0ce24d68a2 100644 --- a/src/firewall/core/nftables.py +++ b/src/firewall/core/nftables.py @@ -54,7 +54,7 @@ IPTABLES_TO_NFT_HOOK = { #}, "raw": { "PREROUTING": ("prerouting", -300 + NFT_HOOK_OFFSET), - # "OUTPUT": ("output", -300 + NFT_HOOK_OFFSET), + "OUTPUT": ("output", -300 + NFT_HOOK_OFFSET), }, "mangle": { "PREROUTING": ("prerouting", -150 + NFT_HOOK_OFFSET), @@ -412,6 +412,7 @@ class nftables(object): IPTABLES_TO_NFT_HOOK["raw"][chain][0], IPTABLES_TO_NFT_HOOK["raw"][chain][1])) + for chain in ["PREROUTING"]: default_rules.append("add chain inet %s raw_%s_ZONES_SOURCE" % (TABLE_NAME, chain)) default_rules.append("add chain inet %s raw_%s_ZONES" % (TABLE_NAME, chain)) default_rules.append("add rule inet %s raw_%s jump raw_%s_ZONES_SOURCE" % (TABLE_NAME, chain, chain)) @@ -1245,6 +1246,30 @@ class nftables(object): "accept"]) # RHBZ#1058505, RHBZ#1575431 (bug in kernel 4.16-4.17) return rules + def build_rfc3964_ipv4_rules(self): + daddr_set = ["{", + "::0.0.0.0/96,", # IPv4 compatible + "::ffff:0.0.0.0/96,", # IPv4 mapped + "2002:0000::/24,", # 0.0.0.0/8 (the system has no address assigned yet) + "2002:0a00::/24,", # 10.0.0.0/8 (private) + "2002:7f00::/24,", # 127.0.0.0/8 (loopback) + "2002:ac10::/28,", # 172.16.0.0/12 (private) + "2002:c0a8::/32,", # 192.168.0.0/16 (private) + "2002:a9fe::/32,", # 169.254.0.0/16 (IANA Assigned DHCP link-local) + "2002:e000::/19,", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast) + "}"] + + rule_fragment = ["ip6", "daddr"] + daddr_set + if self._fw._log_denied in ["unicast", "all"]: + rule_fragment += ["log", "prefix", "\"RFC3964_IPv4_DROP: \""] + rule_fragment += ["drop"] + + rules = [] + for chain in ["PREROUTING", "OUTPUT"]: + rules.append(["insert", "rule", "inet", "%s" % TABLE_NAME, + "raw_%s" % chain] + rule_fragment) + return rules + def build_zone_rich_source_destination_rules(self, enable, zone, rich_rule): table = "filter" target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"], -- 2.18.0