Skip to content

Commit

Permalink
Support IPv6
Browse files Browse the repository at this point in the history
  • Loading branch information
@majst01
majst01 committed Jul 13, 2024
1 parent 253b4d8 commit a03372d
Show file tree
Hide file tree
Showing 11 changed files with 50 additions and 19 deletions.
16 changes: 16 additions & 0 deletions pkg/netconf/nftables.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,11 @@ type (
VPN bool
ForwardPolicy string
FirewallRules FirewallRules
Input Input
}

Input struct {
InInterfaces []string
}

FirewallRules struct {
Expand Down Expand Up @@ -84,6 +89,7 @@ func newNftablesConfigApplier(c config, validator net.Validator, enableDNSProxy
SNAT: getSNAT(c, enableDNSProxy),
ForwardPolicy: string(forwardPolicy),
FirewallRules: getFirewallRules(c),
Input: getInput(c),
}

if enableDNSProxy {
Expand All @@ -105,6 +111,15 @@ func isDMZNetwork(n *models.V1MachineNetwork) bool {
return *n.Networktype == mn.PrivateSecondaryShared && containsDefaultRoute(n.Destinationprefixes)
}

func getInput(c config) Input {
input := Input{}
networks := c.GetNetworks(mn.PrivatePrimaryUnshared, mn.PrivatePrimaryShared, mn.PrivateSecondaryShared)
for _, n := range networks {
input.InInterfaces = append(input.InInterfaces, fmt.Sprintf("vrf%d", *n.Vrf))
}
return input
}

func getSNAT(c config, enableDNSProxy bool) []SNAT {
var result []SNAT

Expand All @@ -116,6 +131,7 @@ func getSNAT(c config, enableDNSProxy bool) []SNAT {
if isDMZNetwork(n) {
privatePfx = append(privatePfx, n.Prefixes...)
}

}

var (
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ table inet metal {
ct state established,related counter accept comment "stateful input"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3982" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3982" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules_accept_forwarding
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ table inet metal {
ct state established,related counter accept comment "stateful input"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3982" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3982" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules_dmz
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@ table inet metal {
ip saddr 10.0.0.0/8 udp dport domain ip daddr 185.1.2.3 accept comment "dnat to dns proxy"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3983" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3983" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules_dmz_app
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@ table inet metal {
ip saddr 10.0.0.0/8 udp dport domain ip daddr 10.0.20.2 accept comment "dnat to dns proxy"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3983" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3983" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules_ipv6
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@ table inet metal {
ip saddr 10.0.0.0/8 udp dport domain ip6 daddr 2a02:c00:20::1 accept comment "dnat to dns proxy"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3982" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3982" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
4 changes: 2 additions & 2 deletions pkg/netconf/testdata/nftrules_shared
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ table inet metal {
ip saddr 10.0.0.0/8 udp dport domain ip daddr 185.1.2.3 accept comment "dnat to dns proxy"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3982" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3982" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules_vpn
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ table inet metal {
ct state established,related counter accept comment "stateful input"

iifname "tailscale*" accept comment "Accept tailscale traffic"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3982" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3982" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/testdata/nftrules_with_rules
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ table inet metal {
ct state established,related counter accept comment "stateful input"

tcp dport ssh ct state new counter accept comment "SSH incoming connections"
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3981" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3981" tcp dport 9630 counter accept comment "nftables metrics"
iifname "vrf3982" tcp dport 9100 counter accept comment "node metrics"
iifname "vrf3982" tcp dport 9630 counter accept comment "nftables metrics"

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
6 changes: 4 additions & 2 deletions pkg/netconf/tpl/nftrules.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,10 @@ table inet metal {
{{- else -}}
tcp dport ssh ct state new counter accept comment "SSH incoming connections"
{{- end }}
ip saddr 10.0.0.0/8 tcp dport 9100 counter accept comment "node metrics"
ip saddr 10.0.0.0/8 tcp dport 9630 counter accept comment "nftables metrics"
{{- range .Input.InInterfaces }}
iifname "{{ . }}" tcp dport 9100 counter accept comment "node metrics"
iifname "{{ . }}" tcp dport 9630 counter accept comment "nftables metrics"
{{- end }}

ct state invalid counter drop comment "drop invalid packets to prevent malicious activity"
counter jump refuse
Expand Down
1 change: 0 additions & 1 deletion validate.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,4 @@ validate () {
}

validate "ubuntu" "24.04" "frr-10"
validate "debian" "12" "frr-8"
validate "debian" "12" "frr-10"

0 comments on commit a03372d

Please sign in to comment.