blob: bb7cffae7eb3c1032e3b09bd15978aa92be73d14 [file] [log] [blame]
// Copyright 2017 The ChromiumOS Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "patchpanel/firewall.h"
#include <arpa/inet.h>
#include <linux/capability.h>
#include <netinet/in.h>
#include <string>
#include <string_view>
#include <vector>
#include <base/containers/span.h>
#include <base/functional/bind.h>
#include <base/functional/callback.h>
#include <base/functional/callback_helpers.h>
#include <base/logging.h>
#include <base/notreached.h>
#include <base/strings/strcat.h>
#include <base/strings/string_number_conversions.h>
#include <base/strings/string_util.h>
#include <base/strings/stringprintf.h>
#include "patchpanel/datapath.h"
#include "patchpanel/iptables.h"
namespace patchpanel {
const std::string ProtocolName(Protocol proto) {
if (proto == ModifyPortRuleRequest::INVALID_PROTOCOL) {
NOTREACHED_IN_MIGRATION() << "Unexpected L4 protocol value";
}
return base::ToLowerASCII(ModifyPortRuleRequest::Protocol_Name(proto));
}
Firewall::Firewall() : Firewall(MinijailedProcessRunner::GetInstance()) {}
Firewall::Firewall(MinijailedProcessRunner* process_runner)
: process_runner_(process_runner) {}
bool Firewall::AddAcceptRules(Protocol protocol,
uint16_t port,
std::string_view interface) {
if (port == 0U) {
LOG(ERROR) << "Port 0 is not a valid port";
return false;
}
if (!AddAcceptRule(IpFamily::kIPv4, protocol, port, interface)) {
LOG(ERROR) << "Could not add IPv4 ACCEPT rule";
return false;
}
if (!AddAcceptRule(IpFamily::kIPv6, protocol, port, interface)) {
LOG(ERROR) << "Could not add IPv6 ACCEPT rule";
DeleteAcceptRule(IpFamily::kIPv4, protocol, port, interface);
return false;
}
return true;
}
bool Firewall::DeleteAcceptRules(Protocol protocol,
uint16_t port,
std::string_view interface) {
if (port == 0U) {
LOG(ERROR) << "Port 0 is not a valid port";
return false;
}
bool ip4_success =
DeleteAcceptRule(IpFamily::kIPv4, protocol, port, interface);
bool ip6_success =
DeleteAcceptRule(IpFamily::kIPv6, protocol, port, interface);
return ip4_success && ip6_success;
}
bool Firewall::AddIpv4ForwardRule(
Protocol protocol,
const std::optional<net_base::IPv4Address>& input_ip,
uint16_t port,
std::string_view interface,
const net_base::IPv4Address& dst_ip,
uint16_t dst_port) {
if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
Iptables::Command::kI)) {
return false;
}
if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port,
Iptables::Command::kA)) {
ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
Iptables::Command::kD);
return false;
}
return true;
}
bool Firewall::DeleteIpv4ForwardRule(
Protocol protocol,
const std::optional<net_base::IPv4Address>& input_ip,
uint16_t port,
std::string_view interface,
const net_base::IPv4Address& dst_ip,
uint16_t dst_port) {
bool success = true;
if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
Iptables::Command::kD)) {
success = false;
}
if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port,
Iptables::Command::kD)) {
success = false;
}
return success;
}
bool Firewall::ModifyIpv4DNATRule(
Protocol protocol,
const std::optional<net_base::IPv4Address>& input_ip,
uint16_t port,
std::string_view interface,
const net_base::IPv4Address& dst_ip,
uint16_t dst_port,
Iptables::Command command) {
if (port == 0U) {
LOG(ERROR) << "Port 0 is not a valid port";
return false;
}
if (interface.empty()) {
LOG(ERROR) << "Interface name should not be empty";
return false;
}
if (dst_port == 0U) {
LOG(ERROR) << "Destination port 0 is not a valid port";
return false;
}
// Only support deleting existing forwarding rules or inserting rules in the
// first position: ARC++ generic inbound DNAT rule always need to go last.
if (command != Iptables::Command::kI && command != Iptables::Command::kD) {
LOG(ERROR) << "Invalid iptables command '" << command << "'";
return false;
}
std::vector<std::string> argv{
"-i",
std::string(interface),
"-p", // protocol
ProtocolName(protocol),
};
if (input_ip) {
argv.insert(argv.end(),
{"-d", input_ip->ToString()}); // input destination ip
}
argv.insert(
argv.end(),
{"--dport", std::to_string(port), // input destination port
"-j", "DNAT", "--to-destination", // new output destination ip:port
base::StrCat({dst_ip.ToString(), ":", std::to_string(dst_port)}), "-w"});
return RunIptables(IpFamily::kIPv4, Iptables::Table::kNat, command,
kIngressPortForwardingChain, argv);
}
bool Firewall::ModifyIpv4ForwardChain(Protocol protocol,
std::string_view interface,
const net_base::IPv4Address& dst_ip,
uint16_t dst_port,
Iptables::Command command) {
if (interface.empty()) {
LOG(ERROR) << "Interface name should not be empty";
return false;
}
if (dst_port == 0U) {
LOG(ERROR) << "Destination port 0 is not a valid port";
return false;
}
// Order does not matter for the FORWARD chain: both -A or -I are possible.
if (command != Iptables::Command::kA && command != Iptables::Command::kI &&
command != Iptables::Command::kD) {
LOG(ERROR) << "Invalid iptables command '" << command << "'";
return false;
}
std::vector<std::string> argv{
"-i",
std::string(interface),
"-p", // protocol
ProtocolName(protocol),
"-d", // destination ip
dst_ip.ToString(),
"--dport", // destination port
std::to_string(dst_port),
"-j",
"ACCEPT",
"-w",
}; // Wait for xtables lock.
return RunIptables(IpFamily::kIPv4, Iptables::Table::kFilter, command,
"FORWARD", argv);
}
bool Firewall::AddLoopbackLockdownRules(Protocol protocol, uint16_t port) {
if (port == 0U) {
LOG(ERROR) << "Port 0 is not a valid port";
return false;
}
if (!AddLoopbackLockdownRule(IpFamily::kIPv4, protocol, port)) {
LOG(ERROR) << "Could not add loopback IPv4 REJECT rule";
return false;
}
if (!AddLoopbackLockdownRule(IpFamily::kIPv6, protocol, port)) {
LOG(ERROR) << "Could not add loopback IPv6 REJECT rule";
DeleteLoopbackLockdownRule(IpFamily::kIPv4, protocol, port);
return false;
}
return true;
}
bool Firewall::DeleteLoopbackLockdownRules(Protocol protocol, uint16_t port) {
if (port == 0U) {
LOG(ERROR) << "Port 0 is not a valid port";
return false;
}
bool ip4_success =
DeleteLoopbackLockdownRule(IpFamily::kIPv4, protocol, port);
bool ip6_success =
DeleteLoopbackLockdownRule(IpFamily::kIPv6, protocol, port);
return ip4_success && ip6_success;
}
bool Firewall::AddAcceptRule(IpFamily ip_family,
Protocol protocol,
uint16_t port,
std::string_view interface) {
return ModifyAcceptRule(ip_family, protocol, port, interface,
Iptables::Command::kI);
}
bool Firewall::DeleteAcceptRule(IpFamily ip_family,
Protocol protocol,
uint16_t port,
std::string_view interface) {
return ModifyAcceptRule(ip_family, protocol, port, interface,
Iptables::Command::kD);
}
bool Firewall::ModifyAcceptRule(IpFamily ip_family,
Protocol protocol,
uint16_t port,
std::string_view interface,
Iptables::Command command) {
std::vector<std::string> argv{
"-p", // protocol
ProtocolName(protocol),
"--dport", // destination port
std::to_string(port),
};
if (!interface.empty()) {
argv.insert(argv.end(), {"-i", std::string(interface)});
}
argv.insert(argv.end(), {"-j", "ACCEPT", "-w"});
return RunIptables(ip_family, Iptables::Table::kFilter, command,
kIngressPortFirewallChain, argv);
}
bool Firewall::AddLoopbackLockdownRule(IpFamily ip_family,
Protocol protocol,
uint16_t port) {
return ModifyLoopbackLockdownRule(ip_family, protocol, port,
Iptables::Command::kI);
}
bool Firewall::DeleteLoopbackLockdownRule(IpFamily ip_family,
Protocol protocol,
uint16_t port) {
return ModifyLoopbackLockdownRule(ip_family, protocol, port,
Iptables::Command::kD);
}
bool Firewall::ModifyLoopbackLockdownRule(IpFamily ip_family,
Protocol protocol,
uint16_t port,
Iptables::Command command) {
std::vector<std::string> argv{
"-p", // protocol
ProtocolName(protocol),
"--dport", // destination port
std::to_string(port),
"-o", // output interface
"lo",
"-m", // match extension
"owner",
"!",
"--uid-owner",
"chronos",
"-j",
"REJECT",
"-w", // Wait for xtables lock.
};
return RunIptables(ip_family, Iptables::Table::kFilter, command,
kEgressPortFirewallChain, argv);
}
bool Firewall::RunIptables(IpFamily ip_family,
Iptables::Table table,
Iptables::Command command,
std::string_view chain,
base::span<const std::string> argv) {
if (ip_family == IpFamily::kIPv4) {
return process_runner_->iptables(table, command, chain, argv, false) == 0;
}
if (ip_family == IpFamily::kIPv6) {
return process_runner_->ip6tables(table, command, chain, argv, false) == 0;
}
return false;
}
} // namespace patchpanel