-
Notifications
You must be signed in to change notification settings - Fork 791
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
The new macspoofchk field is added to the bridge plugin to support anti-mac-spoofing. When the parameter is enabled, traffic is limited to the mac addresses of the container interface (the veth peer that is placed in the container ns). The implementation is using nftables and should only be used on nodes that support it. Signed-off-by: Edward Haas <edwardh@redhat.com>
- Loading branch information
Showing
186 changed files
with
7,620 additions
and
13,329 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| // Copyright 2021 CNI authors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package link_test | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| . "github.com/onsi/ginkgo" | ||
| . "github.com/onsi/gomega" | ||
| ) | ||
|
|
||
| func TestIp(t *testing.T) { | ||
| RegisterFailHandler(Fail) | ||
| RunSpecs(t, "pkg/link") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,237 @@ | ||
| // Copyright 2021 CNI authors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package link | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
|
|
||
| "github.com/networkplumbing/go-nft/nft" | ||
| "github.com/networkplumbing/go-nft/nft/schema" | ||
| ) | ||
|
|
||
| const ( | ||
| natTableName = "nat" | ||
| preRoutingBaseChainName = "PREROUTING" | ||
| ) | ||
|
|
||
| type applyAction func(*nft.Config) error | ||
| type readAction func() (*nft.Config, error) | ||
|
|
||
| type SpoofChecker struct { | ||
| iface string | ||
| macAddress string | ||
| refID string | ||
| applyFunc applyAction | ||
| readFunc readAction | ||
| } | ||
|
|
||
| func NewSpoofChecker(iface, macAddress, refID string) *SpoofChecker { | ||
| return &SpoofChecker{iface, macAddress, refID, nft.ApplyConfig, nft.ReadConfig} | ||
| } | ||
|
|
||
| func NewSpoofCheckerWithCustomActions(iface, macAddress, refID string, applyF applyAction, readF readAction) *SpoofChecker { | ||
| sc := NewSpoofChecker(iface, macAddress, refID) | ||
| sc.applyFunc = applyF | ||
| sc.readFunc = readF | ||
| return sc | ||
| } | ||
|
|
||
| // Setup applies nftables configuration to restrict traffic | ||
| // from the provided interface. Only traffic with the mentioned mac address | ||
| // is allowed to pass, all others are blocked. | ||
| // The configuration follows the format libvirt and ebtables implemented, allowing | ||
| // extensions to the rules in the future. | ||
| // refID is used to label the rules with a unique comment, identifying the rule-set. | ||
| // | ||
| // In order to take advantage of the nftables configuration change atomicity, the | ||
| // following steps are taken to apply the configuration: | ||
| // - Declare the table and chains (they will be created in case not present). | ||
| // - Apply the rules, while first flushing the iface/mac specific regular chain rules. | ||
| // Two transactions are used because the flush succeeds only if the table/chain it targets | ||
| // exists. This avoids the need to query the existing state and acting upon it (a raceful pattern). | ||
| // Although two transactions are taken place, only the 2nd one where the rules | ||
| // are added has a real impact on the system. | ||
| func (sc *SpoofChecker) Setup() error { | ||
| baseConfig := nft.NewConfig() | ||
|
|
||
| baseConfig.AddTable(&schema.Table{Family: schema.FamilyBridge, Name: natTableName}) | ||
|
|
||
| baseConfig.AddChain(sc.baseChain()) | ||
| ifaceChain := sc.ifaceChain() | ||
| baseConfig.AddChain(ifaceChain) | ||
| macChain := sc.macChain(ifaceChain.Name) | ||
| baseConfig.AddChain(macChain) | ||
|
|
||
| if err := sc.applyFunc(baseConfig); err != nil { | ||
| return fmt.Errorf("failed to setup spoof-check: %v", err) | ||
| } | ||
|
|
||
| rulesConfig := nft.NewConfig() | ||
|
|
||
| rulesConfig.FlushChain(ifaceChain) | ||
| rulesConfig.FlushChain(macChain) | ||
|
|
||
| rulesConfig.AddRule(sc.matchIfaceJumpToChainRule(preRoutingBaseChainName, ifaceChain.Name)) | ||
| rulesConfig.AddRule(sc.jumpToChainRule(ifaceChain.Name, macChain.Name)) | ||
| rulesConfig.AddRule(sc.matchMacRule(macChain.Name)) | ||
| rulesConfig.AddRule(sc.dropRule(macChain.Name)) | ||
|
|
||
| if err := sc.applyFunc(rulesConfig); err != nil { | ||
| return fmt.Errorf("failed to setup spoof-check: %v", err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // Teardown removes the interface and mac-address specific chains and their rules. | ||
| // The table and base-chain are expected to survive while the base-chain rule that matches the | ||
| // interface is removed. | ||
| func (sc *SpoofChecker) Teardown() error { | ||
| ifaceChain := sc.ifaceChain() | ||
| currentConfig, ifaceMatchRuleErr := sc.readFunc() | ||
| if ifaceMatchRuleErr == nil { | ||
| expectedRuleToFind := sc.matchIfaceJumpToChainRule(preRoutingBaseChainName, ifaceChain.Name) | ||
| // It is safer to exclude the statement matching, avoiding cases where a current statement includes | ||
| // additional default entries (e.g. counters). | ||
| ruleToFindExcludingStatements := *expectedRuleToFind | ||
| ruleToFindExcludingStatements.Expr = nil | ||
| rules := currentConfig.LookupRule(&ruleToFindExcludingStatements) | ||
| if len(rules) > 0 { | ||
| c := nft.NewConfig() | ||
| for _, rule := range rules { | ||
| c.DeleteRule(rule) | ||
| } | ||
| if err := sc.applyFunc(c); err != nil { | ||
| ifaceMatchRuleErr = fmt.Errorf("failed to delete iface match rule: %v", err) | ||
| } | ||
| } else { | ||
| fmt.Fprintf(os.Stderr, "spoofcheck/teardown: unable to detect iface match rule for deletion: %+v", expectedRuleToFind) | ||
| } | ||
| } | ||
|
|
||
| regularChainsConfig := nft.NewConfig() | ||
| regularChainsConfig.DeleteChain(ifaceChain) | ||
| regularChainsConfig.DeleteChain(sc.macChain(ifaceChain.Name)) | ||
|
|
||
| var regularChainsErr error | ||
| if err := sc.applyFunc(regularChainsConfig); err != nil { | ||
| regularChainsErr = fmt.Errorf("failed to delete regular chains: %v", err) | ||
| } | ||
|
|
||
| if ifaceMatchRuleErr != nil || regularChainsErr != nil { | ||
| return fmt.Errorf("failed to teardown spoof-check: %v, %v", ifaceMatchRuleErr, regularChainsErr) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (sc *SpoofChecker) matchIfaceJumpToChainRule(chain, toChain string) *schema.Rule { | ||
| return &schema.Rule{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Chain: chain, | ||
| Expr: []schema.Statement{ | ||
| {Match: &schema.Match{ | ||
| Op: schema.OperEQ, | ||
| Left: schema.Expression{RowData: []byte(`{"meta":{"key":"iifname"}}`)}, | ||
| Right: schema.Expression{String: &sc.iface}, | ||
| }}, | ||
| {Verdict: schema.Verdict{Jump: &schema.ToTarget{Target: toChain}}}, | ||
| }, | ||
| Comment: ruleComment(sc.refID), | ||
| } | ||
| } | ||
|
|
||
| func (sc *SpoofChecker) jumpToChainRule(chain, toChain string) *schema.Rule { | ||
| return &schema.Rule{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Chain: chain, | ||
| Expr: []schema.Statement{ | ||
| {Verdict: schema.Verdict{Jump: &schema.ToTarget{Target: toChain}}}, | ||
| }, | ||
| Comment: ruleComment(sc.refID), | ||
| } | ||
| } | ||
|
|
||
| func (sc *SpoofChecker) matchMacRule(chain string) *schema.Rule { | ||
| return &schema.Rule{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Chain: chain, | ||
| Expr: []schema.Statement{ | ||
| {Match: &schema.Match{ | ||
| Op: schema.OperEQ, | ||
| Left: schema.Expression{Payload: &schema.Payload{ | ||
| Protocol: schema.PayloadProtocolEther, | ||
| Field: schema.PayloadFieldEtherSAddr, | ||
| }}, | ||
| Right: schema.Expression{String: &sc.macAddress}, | ||
| }}, | ||
| {Verdict: schema.Verdict{SimpleVerdict: schema.SimpleVerdict{Return: true}}}, | ||
| }, | ||
| Comment: ruleComment(sc.refID), | ||
| } | ||
| } | ||
|
|
||
| func (sc *SpoofChecker) dropRule(chain string) *schema.Rule { | ||
| macRulesIndex := nft.NewRuleIndex() | ||
| return &schema.Rule{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Chain: chain, | ||
| Index: macRulesIndex.Next(), | ||
| Expr: []schema.Statement{ | ||
| {Verdict: schema.Verdict{SimpleVerdict: schema.SimpleVerdict{Drop: true}}}, | ||
| }, | ||
| Comment: ruleComment(sc.refID), | ||
| } | ||
| } | ||
|
|
||
| func (_ *SpoofChecker) baseChain() *schema.Chain { | ||
| chainPriority := -300 | ||
| return &schema.Chain{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Name: preRoutingBaseChainName, | ||
| Type: schema.TypeFilter, | ||
| Hook: schema.HookPreRouting, | ||
| Prio: &chainPriority, | ||
| Policy: schema.PolicyAccept, | ||
| } | ||
| } | ||
|
|
||
| func (sc *SpoofChecker) ifaceChain() *schema.Chain { | ||
| ifaceChainName := "cni-br-iface-" + sc.refID | ||
| return &schema.Chain{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Name: ifaceChainName, | ||
| } | ||
| } | ||
|
|
||
| func (_ *SpoofChecker) macChain(ifaceChainName string) *schema.Chain { | ||
| macChainName := ifaceChainName + "-mac" | ||
| return &schema.Chain{ | ||
| Family: schema.FamilyBridge, | ||
| Table: natTableName, | ||
| Name: macChainName, | ||
| } | ||
| } | ||
|
|
||
| func ruleComment(id string) string { | ||
| const refIDPrefix = "macspoofchk-" | ||
| return refIDPrefix + id | ||
| } |
Oops, something went wrong.