2023-05-29 16:00:18 +02:00
|
|
|
package nftables
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bytes"
|
2023-12-08 10:48:21 +01:00
|
|
|
"context"
|
2023-05-29 16:00:18 +02:00
|
|
|
"fmt"
|
|
|
|
"net"
|
|
|
|
"sync"
|
|
|
|
|
|
|
|
"github.com/google/nftables"
|
|
|
|
"github.com/google/nftables/expr"
|
2023-07-18 11:12:50 +02:00
|
|
|
log "github.com/sirupsen/logrus"
|
2023-05-29 16:00:18 +02:00
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
firewall "github.com/netbirdio/netbird/client/firewall/manager"
|
2023-05-29 16:00:18 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2023-12-08 10:48:21 +01:00
|
|
|
// tableName is the name of the table that is used for filtering by the Netbird client
|
|
|
|
tableName = "netbird"
|
2023-05-29 16:00:18 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
// Manager of iptables firewall
|
|
|
|
type Manager struct {
|
2023-12-08 10:48:21 +01:00
|
|
|
mutex sync.Mutex
|
|
|
|
rConn *nftables.Conn
|
2023-06-07 15:24:27 +02:00
|
|
|
wgIface iFaceMapper
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
router *router
|
|
|
|
aclManager *AclManager
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// Create nftables firewall manager
|
2023-12-08 10:48:21 +01:00
|
|
|
func Create(context context.Context, wgIface iFaceMapper) (*Manager, error) {
|
|
|
|
m := &Manager{
|
|
|
|
rConn: &nftables.Conn{},
|
|
|
|
wgIface: wgIface,
|
|
|
|
}
|
|
|
|
|
|
|
|
workTable, err := m.createWorkTable()
|
2023-07-18 11:12:50 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
m.router, err = newRouter(context, workTable)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
m.aclManager, err = newAclManager(workTable, wgIface, m.router.RouteingFwChainName())
|
|
|
|
if err != nil {
|
2023-05-29 16:00:18 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return m, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// AddFiltering rule to the firewall
|
|
|
|
//
|
|
|
|
// If comment argument is empty firewall manager should set
|
|
|
|
// rule ID as comment for the rule
|
|
|
|
func (m *Manager) AddFiltering(
|
|
|
|
ip net.IP,
|
2023-12-08 10:48:21 +01:00
|
|
|
proto firewall.Protocol,
|
|
|
|
sPort *firewall.Port,
|
|
|
|
dPort *firewall.Port,
|
|
|
|
direction firewall.RuleDirection,
|
|
|
|
action firewall.Action,
|
2023-07-18 11:12:50 +02:00
|
|
|
ipsetName string,
|
2023-05-29 16:00:18 +02:00
|
|
|
comment string,
|
2023-12-08 10:48:21 +01:00
|
|
|
) ([]firewall.Rule, error) {
|
2023-05-29 16:00:18 +02:00
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
|
|
|
|
2023-07-18 11:12:50 +02:00
|
|
|
rawIP := ip.To4()
|
|
|
|
if rawIP == nil {
|
2023-12-08 10:48:21 +01:00
|
|
|
return nil, fmt.Errorf("unsupported IP version: %s", ip.String())
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
return m.aclManager.AddFiltering(ip, proto, sPort, dPort, direction, action, ipsetName, comment)
|
2023-07-18 11:12:50 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
// DeleteRule from the firewall by rule definition
|
|
|
|
func (m *Manager) DeleteRule(rule firewall.Rule) error {
|
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
2023-05-29 16:00:18 +02:00
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
return m.aclManager.DeleteRule(rule)
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
func (m *Manager) IsServerRouteSupported() bool {
|
|
|
|
return true
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
func (m *Manager) InsertRoutingRules(pair firewall.RouterPair) error {
|
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
2023-05-29 16:00:18 +02:00
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
return m.router.InsertRoutingRules(pair)
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
func (m *Manager) RemoveRoutingRules(pair firewall.RouterPair) error {
|
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
2023-05-29 16:00:18 +02:00
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
return m.router.RemoveRoutingRules(pair)
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
// AllowNetbird allows netbird interface traffic
|
|
|
|
func (m *Manager) AllowNetbird() error {
|
2024-01-11 12:21:58 +01:00
|
|
|
if !m.wgIface.IsUserspaceBind() {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
2023-05-29 16:00:18 +02:00
|
|
|
|
2024-01-11 12:21:58 +01:00
|
|
|
err := m.aclManager.createDefaultAllowRules()
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to create default allow rules: %v", err)
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
chains, err := m.rConn.ListChainsOfTableFamily(nftables.TableFamilyIPv4)
|
2023-05-29 16:00:18 +02:00
|
|
|
if err != nil {
|
2023-12-08 10:48:21 +01:00
|
|
|
return fmt.Errorf("list of chains: %w", err)
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
var chain *nftables.Chain
|
2023-05-29 16:00:18 +02:00
|
|
|
for _, c := range chains {
|
2023-12-08 10:48:21 +01:00
|
|
|
if c.Table.Name == "filter" && c.Name == "INPUT" {
|
|
|
|
chain = c
|
|
|
|
break
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
if chain == nil {
|
|
|
|
log.Debugf("chain INPUT not found. Skipping add allow netbird rule")
|
2023-07-18 11:12:50 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
rules, err := m.rConn.GetRules(chain.Table, chain)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to get rules for the INPUT chain: %v", err)
|
2023-07-18 11:12:50 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
if rule := m.detectAllowNetbirdRule(rules); rule != nil {
|
|
|
|
log.Debugf("allow netbird rule already exists: %v", rule)
|
2023-07-18 11:12:50 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
m.applyAllowNetbirdRules(chain)
|
2023-07-18 11:12:50 +02:00
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
err = m.rConn.Flush()
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to flush allow input netbird rules: %v", err)
|
2023-07-18 11:12:50 +02:00
|
|
|
}
|
2024-01-11 12:21:58 +01:00
|
|
|
|
2023-07-18 11:12:50 +02:00
|
|
|
return nil
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// Reset firewall to the default state
|
|
|
|
func (m *Manager) Reset() error {
|
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
|
|
|
|
2023-07-18 11:12:50 +02:00
|
|
|
chains, err := m.rConn.ListChains()
|
2023-05-29 16:00:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("list of chains: %w", err)
|
|
|
|
}
|
2023-12-08 10:48:21 +01:00
|
|
|
|
2023-05-29 16:00:18 +02:00
|
|
|
for _, c := range chains {
|
2023-09-05 21:07:32 +02:00
|
|
|
// delete Netbird allow input traffic rule if it exists
|
|
|
|
if c.Table.Name == "filter" && c.Name == "INPUT" {
|
|
|
|
rules, err := m.rConn.GetRules(c.Table, c)
|
|
|
|
if err != nil {
|
|
|
|
log.Errorf("get rules for chain %q: %v", c.Name, err)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
for _, r := range rules {
|
2023-12-08 10:48:21 +01:00
|
|
|
if bytes.Equal(r.UserData, []byte(allowNetbirdInputRuleID)) {
|
2023-09-05 21:07:32 +02:00
|
|
|
if err := m.rConn.DelRule(r); err != nil {
|
|
|
|
log.Errorf("delete rule: %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
m.router.ResetForwardRules()
|
|
|
|
|
2023-07-18 11:12:50 +02:00
|
|
|
tables, err := m.rConn.ListTables()
|
2023-05-29 16:00:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("list of tables: %w", err)
|
|
|
|
}
|
|
|
|
for _, t := range tables {
|
2023-12-08 10:48:21 +01:00
|
|
|
if t.Name == tableName {
|
2023-07-18 11:12:50 +02:00
|
|
|
m.rConn.DelTable(t)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return m.rConn.Flush()
|
|
|
|
}
|
|
|
|
|
|
|
|
// Flush rule/chain/set operations from the buffer
|
|
|
|
//
|
|
|
|
// Method also get all rules after flush and refreshes handle values in the rulesets
|
2023-12-08 10:48:21 +01:00
|
|
|
// todo review this method usage
|
2023-07-18 11:12:50 +02:00
|
|
|
func (m *Manager) Flush() error {
|
|
|
|
m.mutex.Lock()
|
|
|
|
defer m.mutex.Unlock()
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
return m.aclManager.Flush()
|
2023-07-18 11:12:50 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
func (m *Manager) createWorkTable() (*nftables.Table, error) {
|
|
|
|
tables, err := m.rConn.ListTablesOfFamily(nftables.TableFamilyIPv4)
|
2023-09-05 21:07:32 +02:00
|
|
|
if err != nil {
|
2023-12-08 10:48:21 +01:00
|
|
|
return nil, fmt.Errorf("list of tables: %w", err)
|
2023-09-05 21:07:32 +02:00
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
for _, t := range tables {
|
|
|
|
if t.Name == tableName {
|
|
|
|
m.rConn.DelTable(t)
|
2023-09-05 21:07:32 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-12-08 10:48:21 +01:00
|
|
|
table := m.rConn.AddTable(&nftables.Table{Name: tableName, Family: nftables.TableFamilyIPv4})
|
2023-09-05 21:07:32 +02:00
|
|
|
err = m.rConn.Flush()
|
2023-12-08 10:48:21 +01:00
|
|
|
return table, err
|
2023-05-29 16:00:18 +02:00
|
|
|
}
|
|
|
|
|
2023-09-05 21:07:32 +02:00
|
|
|
func (m *Manager) applyAllowNetbirdRules(chain *nftables.Chain) {
|
|
|
|
rule := &nftables.Rule{
|
|
|
|
Table: chain.Table,
|
|
|
|
Chain: chain,
|
|
|
|
Exprs: []expr.Any{
|
|
|
|
&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
|
|
|
|
&expr.Cmp{
|
|
|
|
Op: expr.CmpOpEq,
|
|
|
|
Register: 1,
|
|
|
|
Data: ifname(m.wgIface.Name()),
|
|
|
|
},
|
|
|
|
&expr.Verdict{
|
|
|
|
Kind: expr.VerdictAccept,
|
|
|
|
},
|
|
|
|
},
|
2023-12-08 10:48:21 +01:00
|
|
|
UserData: []byte(allowNetbirdInputRuleID),
|
2023-09-05 21:07:32 +02:00
|
|
|
}
|
|
|
|
_ = m.rConn.InsertRule(rule)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (m *Manager) detectAllowNetbirdRule(existedRules []*nftables.Rule) *nftables.Rule {
|
|
|
|
ifName := ifname(m.wgIface.Name())
|
|
|
|
for _, rule := range existedRules {
|
|
|
|
if rule.Table.Name == "filter" && rule.Chain.Name == "INPUT" {
|
|
|
|
if len(rule.Exprs) < 4 {
|
|
|
|
if e, ok := rule.Exprs[0].(*expr.Meta); !ok || e.Key != expr.MetaKeyIIFNAME {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
if e, ok := rule.Exprs[1].(*expr.Cmp); !ok || e.Op != expr.CmpOpEq || !bytes.Equal(e.Data, ifName) {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
return rule
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|