3 ### Classify packets according to source and destination networks.
5 ### (c) 2008 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 ###--------------------------------------------------------------------------
26 ### Address classification.
28 ### The objective of address classification is to work out what kind of
29 ### networks a packet is travelling between, in order to make filtering
32 ### Address classification is done in the mangle table, by attaching
33 ### appropriate marks to the packet. We split the Internet into a number of
34 ### address classes, and make forwarding decisions based on the classes of
35 ### the source and destination addresses.
37 ### The mark word is split into three fields: the FROM and TO fields simply
38 ### record the source and destination classes numerically; the MASK field is
39 ### used to determine whether forwarding should occur. There is a mask bit
40 ### for each address class. Source classification sets mask bits according
41 ### to the forwarding policy for the source address class. Destination
42 ### classification clears all of the mask bits except for the one
43 ### corresponding to the actual destination class. Therefore, forwarding is
44 ### permitted if and only if the mask bits are not all zero.
46 ### The mangle chains are arranged as follows.
48 ### The INPUT and FORWARD hooks simply invoke in-classify and out-classify
49 ### chains as subroutines. These will tail-call appropriate classification
52 ### The in-classify chain is responsible for both source address
53 ### classification and verifying that the packet arrived from the correct
54 ### interface. It does an initial dispatch on the source interface, to
55 ### in-IFACE. The in-IFACE chain dispatches to mark-from-CLASS when it
56 ### recognizes an address belonging to the CLASS; if no matches succeed, it
57 ### goes to bad-source-address, which logs a message and drops the packet.
58 ### The default interface is special. If no explicit matches are found, it
59 ### dispatches to in-default which forbids a few obviously evil things and
60 ### finally dispatches to mark-from-DEFAULT (usually `untrusted').
62 ### The out-classify is simpler because it doesn't care about the interface.
63 ### It simply checks each network range in turn, dispatching to mark-to-CLASS
64 ### on a match or mark-to-DEFAULT (probably `untrusted') if there is no
67 clearchain mangle:in-classify mangle:in-default mangle:out-classify
68 clearchain mangle:local-source
70 ## An unpleasant hack. We can't reject packets from the mangle table, so
71 ## we mark packets with a bad destination and then detect this in the
73 clearchain mangle:bad-destination-address
75 run ip46tables -t mangle -A bad-destination-address \
76 -j MARK --set-mark $BAD_DEST
77 run ip46tables -t mangle -A bad-destination-address -j ACCEPT
78 for i in $inchains; do
79 run ip46tables -A $i -m mark --mark $BAD_DEST -g bad-destination-address
82 ## Packets over the loopback interface are automatically trusted. All manner
83 ## of weird stuff happens on lo, and it's best not to second-guess it.
84 run ip46tables -t mangle -A in-classify -i lo -j ACCEPT
86 ## Local broadcast and link-local multicast packets sometimes have bizarre
87 ## addresses. Don't block them just because of this.
88 run iptables -t mangle -A in-classify -j RETURN \
89 -s 0.0.0.0 -d 255.255.255.255 \
91 run iptables -t mangle -A in-classify -j RETURN \
92 -s 0.0.0.0 -d 224.0.0.0/24 \
95 ## Since packets with source and destination addresses both local will go
96 ## over the loopback interface, I shouldn't see a packet from me over any
97 ## other interface. Except that I will if I sent a broadcast or multicast.
98 ## Allow the broadcasts, and remember not to trust them. There are no
99 ## broadcast addresses in IPv6 (only link-local multicast) so we don't have
100 ## to worry about that.
101 run iptables -t mangle -A local-source -j RETURN \
102 -m addrtype --dst-type BROADCAST
103 run iptables -t mangle -A local-source -j RETURN \
104 -m addrtype --dst-type MULTICAST
105 run ip6tables -t mangle -A local-source -j RETURN \
107 run ip46tables -t mangle -A local-source -g bad-source-address
108 run iptables -t mangle -A in-classify -j local-source \
109 -m addrtype --src-type LOCAL
110 for addr in $host_6addrs; do
111 run ip6tables -t mangle -A in-classify -j local-source \
116 ## Define the important networks.
123 ## Special IPv4 source addresses. Forbid broadcast and multicast sources.
124 ## Mark the special zero address and link-local addresses as such. (This
125 ## also matches class-E addresses, which are probably permanently invalid.)
126 for i in 0.0.0.0 169.254.0.0/16; do
127 run iptables -t mangle -A in-classify -g mark-from-link -s $i
129 run iptables -t mangle -A in-classify -g bad-source-address \
131 run iptables -t mangle -A in-classify -g bad-source-address \
132 -m addrtype --src-type BROADCAST \
134 ## Special IPv6 addresses. Forbid multicast sources, and mark zero and
135 ## link local addresses.
136 for i in :: fe80::/10; do
137 run ip6tables -t mangle -A in-classify -g mark-from-link -s $i
139 run ip6tables -t mangle -A in-classify -g bad-source-address \
142 ## Special IPv4 destination addresses. The zero address is invalid; mark
143 ## link-local and recognized broadcast addresses as link-local. We leave
144 ## multicast for later.
145 for i in 0.0.0.0 240.0.0.0/4; do
146 run iptables -t mangle -A out-classify -g bad-destination-address -d $i
148 run iptables -t mangle -A out-classify -g mark-to-link -d 169.254.0.0/16
149 run iptables -t mangle -A out-classify -g mark-to-link \
150 -m addrtype --dst-type BROADCAST
152 ## Special IPv6 destination addressses. The zero address is again invalid;
153 ## mark link local addresses. We do multicast later.
154 run ip6tables -t mangle -A out-classify -g bad-destination-address \
156 run ip6tables -t mangle -A out-classify -g mark-to-link -d fe80::/10
158 ## Now deal with multicast. Link-local multicast is detected as being
159 ## link-local, so that we can prevent it being forwarded correctly.
160 clearchain mangle:out-classify-mcast
161 run iptables -t mangle -A out-classify-mcast -g mark-to-link \
163 for i in 0 1 2 3 4 5 6 7 8 9 a b c d e f; do
164 run ip6tables -t mangle -A out-classify-mcast -g mark-to-link \
167 run ip46tables -t mangle -A out-classify-mcast -g mark-to-mcast
168 run iptables -t mangle -A out-classify -g out-classify-mcast \
170 run ip6tables -t mangle -A out-classify -g out-classify-mcast \
173 ## Build the input classification chains. There's one chain `in-IFACE' for
174 ## each local interface. This chain does a further dispatch on the source
175 ## address to the appropriate `mark-from-CLASS' chain for the source network
176 ## class. We also build a table mapping interface names to numbers (since
177 ## the names are so unhelpful).
181 for iface in $host_ifaces_<::>FWHOST; do
183 case $seen in *:$ifname:*) continue ;; esac
185 addword ifmap $ifname=$ifq
187 clearchain mangle:in-$ifname
188 run ip46tables -t mangle -A in-classify -i $ifname -g in-$ifname
191 ## We do a first pass over nets first, and then the interfaces which those
192 ## networks reach. During this pass, we populate the `out-classify' chains,
193 ## and we also build some lists so that we can do later passes over
194 ## interfaces first and then reaching networks. This is complicated by
195 ## interface names being unhelpful.
197 ## Here are the variables we maintain.
199 ## ifmap A list of entries IFACE=N mapping interface names to
202 ## ifnets_N A space-separated list of networks reaching interface
203 ## number N. This is used for building the matching
206 ## ifaddrs_N A bang-separated list of address ranges reaching
207 ## interface number N. This is used for filtering out
208 ## known networks if the default network reaches the
210 for net in $allnets; do
212 ## Work through the interfaces that this network reaches.
213 for iface in $(net_interfaces FWHOST $net); do
214 case $iface in -) break ;; esac
216 ## Find a sequence number for this interface.
219 case "$i" in "$iface"=*) q=${i##*=}; break ;; esac
223 echo >&2 "$0 INTERNAL ERROR: missing interface \`$iface'!"
228 ## Remember the reachability information.
229 addword ifnets_$q $net
233 ## Build the `ifaddr_N' map and an `all-addresses' list.
235 trace "ifmap = $ifmap"
236 for entry in $ifmap; do
237 iface=${entry%=*} q=${entry##*=}
238 eval nets=\$ifnets_$q
241 eval "addrs=\"\$net_inet_$n \$net_inet6_$n\""
242 trace "$iface $n addrs = $addrs"
244 case $aa in *!$a!*) ;; *) aa=$aa$a! ;; esac
245 case $alladdrs in *!$a!*) ;; *) alladdrs=$alladdrs$a! ;; esac
249 trace "iface $q = $iface; nets = $nets; addrs = $aa"
251 trace "alladdrs = $alladdrs"
253 ## Populate the `out-classify' chain, matching networks.
254 prepare_to () { mode=goto fail=mark-to-$net_class_default; }
255 matchnets -d mark-to : prepare_to out-classify "" 0 $allnets
257 ## A `finish' hook for rejecting known address ranges arriving on a
258 ## default-reachable interface.
259 finish_from_default () {
261 eval addrs=\$ifaddrs_$q
263 for n in $allnets; do
264 eval addr=\$net_inet_$n addr6=\$net_inet6_$n
266 case $a in !*) continue ;; esac
267 case $addrs in *"!$a!"*) continue ;; esac
268 run iptables -t mangle -A $chain -s $a -g bad-source-address
271 case $a in !*) continue ;; esac
272 case $addrs in *"!$a!"*) continue ;; esac
273 run ip6tables -t mangle -A $chain -s $a -g bad-source-address
276 run ip46tables -t mangle -A $chain -g in-default
279 ## A `prepare' hook for input classification. If the interface is
280 ## default-reachable, then we need to reject known address ranges before
281 ## dispatching to the default chain; otherwise just reject the packet.
285 *:default:*) mode=call finish="finish_from_default $q" ;;
286 *) mode=goto fail=bad-source-address ;;
290 ## Populate the `in-IFACE' chains.
291 for entry in $ifmap; do
292 iface=${entry%=*} q=${entry##*=}
293 eval nets=\$ifnets_$q
297 ## A special marker indicating a collection of point-to-point
298 ## interfaces. We should match an address to a particular interface.
301 eval hosts=\$net_hosts_$net class=\$net_class_$net
302 for host in $hosts; do
303 eval ha=\$host_inet_$host ha6=\$host_inet6_$host
304 trace "$host : $class -> $iface"
306 run iptables -t mangle -A in-$iface \
307 -i ${iface%+}$host -s $a -g mark-from-$class
310 run ip6tables -t mangle -A in-$iface \
311 -i ${iface%+}$host -s $a -g mark-from-$class
315 run ip46tables -t mangle -A in-$iface -g bad-source-address
318 matchnets -s mark-from : "prepare_from $q" in-$iface "" 0 $nets
323 ## Fill in the black holes in the network. Some of these might actually be
324 ## known networks, so don't fill those in again. See RFC5735 and RFC4291,
325 ## and their successors.
327 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \
329 192.0.2.0/24 198.51.100.0/24 203.0.113.0/24
331 case $alladdrs in *!$addr!*) continue ;; esac
332 run iptables -t mangle -A in-default -s $addr -g bad-source-address
336 ::0:0/96 ::ffff:0:0/96 \
339 case $alladdrs in *!$addr!*) continue ;; esac
340 run ip6tables -t mangle -A in-default -s $addr -g bad-source-address
342 run ip46tables -t mangle -A in-default -g mark-from-$net_class_default
345 ## Put the final default decision on the in-default chain, and attach the
346 ## classification chains to the INPUT and (maybe) FORWARD hooks.
347 for iface in $defaultifaces; do
348 run ip46tables -t mangle -A in-$iface -g in-default
351 case $forward in 1) chains="$chains FORWARD" ;; esac
353 run ip46tables -t mangle -A $c -j in-classify
354 run ip46tables -t mangle -A $c -j out-classify
357 ## Incoming stuff to or from a link-local address is OK.
358 run ip46tables -t mangle -A INPUT \
359 -m mark --mark $to_link/$MASK_TO \
360 -j MARK --or-mark $fwd_link
361 run ip46tables -t mangle -A INPUT \
362 -m mark --mark $from_link/$MASK_FROM \
363 -j MARK --or-mark $fwd_link
365 ## Now it's safe to let stuff through.
366 for i in PREROUTING INPUT FORWARD OUTPUT POSTROUTING; do
367 run ip46tables -t mangle -P $i ACCEPT
371 ###----- That's all, folks --------------------------------------------------