X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/429f4314d0d1be69f7500cf7f97671595804fdd0..06ff80827cd67ab85ee31fc32fc5e740bda9193e:/classify.m4 diff --git a/classify.m4 b/classify.m4 index 25b1693..8b6a650 100644 --- a/classify.m4 +++ b/classify.m4 @@ -115,26 +115,129 @@ m4_divert(42)m4_dnl done m4_divert(46)m4_dnl -## Mark addresses reachable on non-default interfaces as not reachable on the -## default interface. -trace "nets = $allnets $allnets6" +## Build the input classification chains. There's one chain `in-IFACE' for +## each local interface. This chain does a further dispatch on the source +## address to the appropriate `mark-from-CLASS' chain for the source network +## class. +seen=: +for iface in $host_ifaces_<::>FWHOST; do + ifname=${iface%=*} + case $seen in *:$ifname:*) continue ;; esac + seen=$seen$ifname: + clearchain mangle:in-$ifname + run ip46tables -t mangle -A in-classify -i $ifname -g in-$ifname +done + +## Now populate the `in-IFACE' and `out-classify' chains. We iterate over +## the available networks and add addresses to the appropriate chains. Also, +## build up a map of which interfaces receive from which address ranged so +## that we can finish the chains off properly later. This contains entries +## of the form IFACE=:ADDR:ADDR:...: +ifnets="" for net in $allnets; do - case $net in - "$defaultiface":*) - ;; - *) - run iptables -t mangle -A in-$defaultiface \ - -s ${net#*:} -g bad-source-address - ;; - esac + + ## Determine the addresses and class for this network, and populate the + ## `out-classify' chains. + eval addr=\$net_inet_$net addr6=\$net_inet6_$net class=\$net_class_$net + case $class in virtual) continue ;; esac + trace "$net : $class" + for a in $addr; do + run iptables -t mangle -A out-classify -g mark-to-$class -d $a + done + for a in $addr6; do + run ip6tables -t mangle -A out-classify -g mark-to-$class -d $a + done + + ## Now work through the interfaces. + for iface in $(net_interfaces FWHOST $net); do + nets="" + case $iface in + + -) + ## A special `no interface' marker: we should not receive packets + ## from this network at all. + continue + ;; + + *-+) + ## A special marker indicating a collection of point-to-point + ## interfaces. We should match an address to a particular interface. + ## Later, we'll cap this chain off by rejecting all other traffic. + eval hosts=\$net_hosts_$net + for host in $hosts; do + eval ha=\$host_inet_$host ha6=\$host_inet6_$host + trace "$host : $class -> $iface" + for a in $ha; do + run iptables -t mangle -A in-$iface \ + -i ${iface%+}$host -s $a -g mark-from-$class + nets=$nets$a: + done + for a in $ha6; do + run ip6tables -t mangle -A in-$iface \ + -i ${iface%+}$host -s $a -g mark-from-$class + nets=$nets$a: + done + done + ;; + + *) + ## A normal interface. Classify incoming traffic according to the + ## source address. + trace "$net : $class -> $iface" + for a in $addr; do + run iptables -t mangle -A in-$iface -g mark-from-$class -s $a + nets=$nets$a: + done + for a in $addr6; do + run ip6tables -t mangle -A in-$iface -g mark-from-$class -s $a + nets=$nets$a: + done + case $net in default) nets=${nets}default: ;; esac + ;; + esac + + ## Record that this interface receives traffic from this network. + unset nifnets + foundp=nil + for ifnet in $ifnets; do + case $ifnet in + $iface=*:$net:*) addword nifnets $ifnet; foundp=t ;; + $iface=*) addword nifnets $ifnet$nets; foundp=t ;; + *) addword nifnets $ifnet ;; + esac + done + case $foundp in nil) addword nifnets $iface=:$nets ;; esac + ifnets=$nifnets + + done done -for net in $allnets6; do - case $net in - "$defaultiface":*) + +## Wrap up all of the `in-IFACE' chains. A chain which matches the `default' +## net should have unmatched but known networks blocked off, and then chain +## onto `in-default'. Other chains should just chain onto +## `bad-source-address'. +trace "ifnets = $ifnets" +for ifnet in $ifnets; do + iface=${ifnet%%=*} nets=${ifnet#*=} + case $nets in + *:default:*) + for n in $allnets; do + eval addr=\$net_inet_$n addr6=\$net_inet6_$n + for a in $addr; do + case $nets in *:$a:*) continue ;; esac + nets=$nets$a + run iptables -t mangle -A in-$iface -s $a -g bad-source-address + done + for a in $addr6; do + case $nets in *:$a:*) continue ;; esac + nets=$nets$a + run ip6tables -t mangle -A in-$iface -s $a -g bad-source-address + done + done + run ip46tables -t mangle -A in-$iface -g in-default ;; *) - run ip6tables -t mangle -A in-$defaultiface \ - -s ${net#*:} -g bad-source-address + run ip46tables -t mangle -A in-$iface -g bad-source-address ;; esac done @@ -152,11 +255,15 @@ for addr in \ do run ip6tables -t mangle -A in-default -s $addr -g bad-source-address done +run ip46tables -t mangle -A in-default -g mark-from-$net_class_default m4_divert(92)m4_dnl ## Put the final default decision on the in-default chain, and attach the ## classification chains to the PREROUTING hook. -run ip46tables -t mangle -A in-$defaultiface -g mark-from-$defaultclass +for iface in $defaultifaces; do + run ip46tables -t mangle -A in-$iface -g in-default +done +run ip46tables -t mangle -A out-classify -g mark-to-$net_class_default run ip46tables -t mangle -A PREROUTING -j in-classify run ip46tables -t mangle -A PREROUTING -j out-classify