X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/20106bbbbe547861538c865ff88a9af0fbe68ad4..216285e1f550316101d0c49d4420664a5dc74963:/classify.m4 diff --git a/classify.m4 b/classify.m4 index 148a72f..16a92c9 100644 --- a/classify.m4 +++ b/classify.m4 @@ -1,4 +1,4 @@ -### -*-m4-*- +### -*-sh-*- ### ### Classify packets according to source and destination networks. ### @@ -67,25 +67,45 @@ clearchain mangle:local-source ## Packets over the loopback interface are automatically trusted. All manner ## of weird stuff happens on lo, and it's best not to second-guess it. -run iptables -t mangle -A in-classify -i lo -j ACCEPT +run ip46tables -t mangle -A in-classify -i lo -j ACCEPT -## Local bootp packets have bizarre addresses. Don't block them just because -## of this. +## Local broadcast and link-local multicast packets sometimes have bizarre +## addresses. Don't block them just because of this. run iptables -t mangle -A in-classify -j RETURN \ -s 0.0.0.0 -d 255.255.255.255 \ - -p udp --source-port $port_bootpc --destination-port $port_bootps + -p udp +run iptables -t mangle -A in-classify -j RETURN \ + -s 0.0.0.0 -d 224.0.0.0/24 \ + -p udp ## Since packets with source and destination addresses both local will go ## over the loopback interface, I shouldn't see a packet from me over any ## other interface. Except that I will if I sent a broadcast or multicast. -## Allow the broadcasts, and remember not to trust them. +## Allow the broadcasts, and remember not to trust them. There are no +## broadcast addresses in IPv6 (only link-local multicast)m so we don't have +## to worry about that. run iptables -t mangle -A local-source -j RETURN \ -m addrtype --dst-type BROADCAST run iptables -t mangle -A local-source -j RETURN \ -m addrtype --dst-type MULTICAST -run iptables -t mangle -A local-source -g bad-source-address +run ip6tables -t mangle -A local-source -j RETURN \ + -d ff00::/8 +run ip46tables -t mangle -A local-source -g bad-source-address run iptables -t mangle -A in-classify -j local-source \ -m addrtype --src-type LOCAL +for addr in $host_6addrs; do + run ip6tables -t mangle -A in-classify -j local-source \ + -s $addr +done + +## It's not valid to have a multicast address as a packet source: multicast +## routing is done away from the source, so a multicast address would make +## this impossible to do. So discard these packets. Also discard class-E +## IPv4 addresses, since they aren't assigned. +run iptables -t mangle -A in-classify -g bad-source-address \ + -s 224.0.0.0/3 +run ip6tables -t mangle -A in-classify -g bad-source-address \ + -s ff00::/8 m4_divert(41)m4_dnl ## Define the important networks. @@ -95,16 +115,129 @@ m4_divert(42)m4_dnl done m4_divert(46)m4_dnl -## Mark addresses reachable on non-default interfaces as not reachable on the -## default interface. -trace "nets = $allnets" +## Build the input classification chains. There's one chain `in-IFACE' for +## each local interface. This chain does a further dispatch on the source +## address to the appropriate `mark-from-CLASS' chain for the source network +## class. +seen=: +for iface in $host_ifaces_<::>FWHOST; do + ifname=${iface%=*} + case $seen in *:$ifname:*) continue ;; esac + seen=$seen$ifname: + clearchain mangle:in-$ifname + run ip46tables -t mangle -A in-classify -i $ifname -g in-$ifname +done + +## Now populate the `in-IFACE' and `out-classify' chains. We iterate over +## the available networks and add addresses to the appropriate chains. Also, +## build up a map of which interfaces receive from which address ranged so +## that we can finish the chains off properly later. This contains entries +## of the form IFACE=:ADDR:ADDR:...: +ifnets="" for net in $allnets; do - case $net in - "$defaultiface":*) + + ## Determine the addresses and class for this network, and populate the + ## `out-classify' chains. + eval addr=\$net_inet_$net addr6=\$net_inet6_$net class=\$net_class_$net + case $class in virtual) continue ;; esac + trace "$net : $class" + for a in $addr; do + run iptables -t mangle -A out-classify -g mark-to-$class -d $a + done + for a in $addr6; do + run ip6tables -t mangle -A out-classify -g mark-to-$class -d $a + done + + ## Now work through the interfaces. + for iface in $(net_interfaces FWHOST $net); do + nets="" + case $iface in + + -) + ## A special `no interface' marker: we should not receive packets + ## from this network at all. + continue + ;; + + *-+) + ## A special marker indicating a collection of point-to-point + ## interfaces. We should match an address to a particular interface. + ## Later, we'll cap this chain off by rejecting all other traffic. + eval hosts=\$net_hosts_$net + for host in $hosts; do + eval ha=\$host_inet_$host ha6=\$host_inet6_$host + trace "$host : $class -> $iface" + for a in $ha; do + run iptables -t mangle -A in-$iface \ + -i ${iface%+}$host -s $a -g mark-from-$class + nets=$nets$a: + done + for a in $ha6; do + run ip6tables -t mangle -A in-$iface \ + -i ${iface%+}$host -s $a -g mark-from-$class + nets=$nets$a: + done + done + ;; + + *) + ## A normal interface. Classify incoming traffic according to the + ## source address. + trace "$net : $class -> $iface" + for a in $addr; do + run iptables -t mangle -A in-$iface -g mark-from-$class -s $a + nets=$nets$a: + done + for a in $addr6; do + run ip6tables -t mangle -A in-$iface -g mark-from-$class -s $a + nets=$nets$a: + done + case $net in default) nets=${nets}default: ;; esac + ;; + esac + + ## Record that this interface receives traffic from this network. + unset nifnets + foundp=nil + for ifnet in $ifnets; do + case $ifnet in + $iface=*:$net:*) addword nifnets $ifnet; foundp=t ;; + $iface=*) addword nifnets $ifnet$nets; foundp=t ;; + *) addword nifnets $ifnet ;; + esac + done + case $foundp in nil) addword nifnets $iface=:$nets ;; esac + ifnets=$nifnets + + done +done + +## Wrap up all of the `in-IFACE' chains. A chain which matches the `default' +## net should have unmatched but known networks blocked off, and then chain +## onto `in-default'. Other chains should just chain onto +## `bad-source-address'. +trace "ifnets = $ifnets" +for ifnet in $ifnets; do + iface=${ifnet%%=*} nets=${ifnet#*=} + case $nets in + *:default:*) + for n in $allnets; do + eval addr=\$net_inet_$n addr6=\$net_inet6_$n + for a in $addr; do + case $nets in *:$a:*) continue ;; esac + nets=$nets$a + run iptables -t mangle -A in-$iface -s $a -g bad-source-address + done + for a in $addr6; do + case $nets in *:$a:*) continue ;; esac + nets=$nets$a + run ip6tables -t mangle -A in-$iface -s $a -g bad-source-address + done + done + run ip46tables -t mangle -A in-$iface -g in-default ;; *) - run iptables -t mangle -A in-$defaultiface \ - -s ${net#*:} -g bad-source-address + run ip46tables -t mangle -A in-$iface -g bad-source-address ;; esac done @@ -112,21 +245,32 @@ done ## Fill in the black holes in the network. for addr in \ 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \ - 127.0.0.0/8 192.0.2.0/24 + 127.0.0.0/8 \ + 192.0.2.0/24 198.51.100.0/24 203.0.113.0/24 do run iptables -t mangle -A in-default -s $addr -g bad-source-address done +for addr in \ + fc00::/7 \ + 2001:0db8::/32 +do + run ip6tables -t mangle -A in-default -s $addr -g bad-source-address +done +run ip46tables -t mangle -A in-default -g mark-from-$net_class_default m4_divert(92)m4_dnl ## Put the final default decision on the in-default chain, and attach the ## classification chains to the PREROUTING hook. -run iptables -t mangle -A in-$defaultiface -g mark-from-$defaultclass -run iptables -t mangle -A PREROUTING -j in-classify -run iptables -t mangle -A PREROUTING -j out-classify +for iface in $defaultifaces; do + run ip46tables -t mangle -A in-$iface -g in-default +done +run ip46tables -t mangle -A out-classify -g mark-to-$net_class_default +run ip46tables -t mangle -A PREROUTING -j in-classify +run ip46tables -t mangle -A PREROUTING -j out-classify ## Now it's safe to let stuff through. for i in PREROUTING INPUT FORWARD OUTPUT POSTROUTING; do - run iptables -t mangle -P $i ACCEPT + run ip46tables -t mangle -P $i ACCEPT done m4_divert(-1)