blob: 93d1a4ad2f7d0796cd249fe26184227500cee4da [file] [log] [blame]
William A. Kennington III1ef795b2021-03-10 18:59:12 -08001# Copyright 2021 Google LLC
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15[ -z "${gbmc_ncsi_nft_lib-}" ] || return
16
17gbmc_ncsi_nft_init=
18gbmc_ncsi_nft_lastip4=
19gbmc_ncsi_nft_lastip6=
20
21gbmc_ncsi_nft_update() {
22 [ -n "$gbmc_ncsi_nft_init" ] || return
23
24 printf 'NCSI firewall for IPv4(%s) IPv6(%s)\n' \
25 "${gbmc_ncsi_nft_lastip4:-(deleted)}" \
26 "${gbmc_ncsi_nft_lastip6:-(deleted)}" >&2
27
28 local contents=
29 contents+='table inet filter {'$'\n'
30 contents+=' chain ncsi_input {'$'\n'
31
32 local ip4="$gbmc_ncsi_nft_lastip4"
33 if [ -n "$ip4" ]; then
34 contents+=" ip daddr $ip4 goto ncsi_legacy_input"$'\n'
35 fi
36
37 local ip6="$gbmc_ncsi_nft_lastip6"
38 if [ -n "$ip6" ]; then
39 contents+=" ip6 daddr $ip6/128 goto ncsi_legacy_input"$'\n'
40
William A. Kennington IIIbdbe7ce2021-05-10 16:48:43 -070041 local ip_bytes=()
42 ip_to_bytes ip_bytes "$ip6"
William A. Kennington III1ef795b2021-03-10 18:59:12 -080043 # If our address has enough spare bits for appending the BMC suffix
44 # then we add a rule that allows the BMC subnet. That is, we need a /64
45 # as input.
William A. Kennington IIIbdbe7ce2021-05-10 16:48:43 -070046 local i
47 for (( i = 8; i < 16; i++ )); do
48 if (( ip_bytes[$i] != 0 )); then
49 ip_bytes=()
50 break
51 fi
52 done
53 if (( ${#ip_bytes[@]} != 0 )); then
54 ip_bytes[8]=0xfd
55 local pfx="$(ip_bytes_to_str ip_bytes)"
56 contents+=" ip6 saddr != $pfx/72 ip6 daddr"
57 contents+=" $pfx/72 goto ncsi_gbmc_br_pub_input"$'\n'
William A. Kennington III1ef795b2021-03-10 18:59:12 -080058 fi
59 fi
60
61 contents+=' }'$'\n'
William A. Kennington IIIcf1e7272021-05-12 00:57:41 -070062 contents+=' chain ncsi_forward {'$'\n'
63 if [ -n "$pfx" ]; then
64 contents+=" ip6 saddr != $pfx/72 ip6 daddr $pfx/72 accept"$'\n'
65 fi
66 contents+=' }'$'\n'
William A. Kennington III1ef795b2021-03-10 18:59:12 -080067 contents+='}'$'\n'
68
69 local rfile=/run/nftables/40-gbmc-ncsi-in.rules
70 mkdir -p -m 755 "$(dirname "$rfile")"
71 printf '%s' "$contents" >"$rfile"
72
73 echo 'Restarting nftables' >&2
74 systemctl reset-failed nftables
75 systemctl --no-block restart nftables
76}
77
78gbmc_ncsi_nft_hook() {
79 if [ "$change" = 'init' ]; then
80 gbmc_ncsi_nft_init=1
81 gbmc_ncsi_nft_update
82 elif [ "$change" = 'addr' -a "$intf" = '@NCSI_IF@' -a "$scope" = 'global' ]; then
83 if [ "$fam" = 'inet6' ]; then
84 local -n lastip='gbmc_ncsi_nft_lastip6'
85 else
86 local -n lastip='gbmc_ncsi_nft_lastip4'
87 fi
88 if [ "$action" = 'add' -a "$ip" != "$lastip" ]; then
89 lastip="$ip"
90 gbmc_ncsi_nft_update
91 fi
92 if [ "$action" = 'del' -a "$ip" = "$lastip" ]; then
93 lastip=
94 gbmc_ncsi_nft_update
95 fi
96 fi
97}
98
99GBMC_IP_MONITOR_HOOKS+=(gbmc_ncsi_nft_hook)
100
101gbmc_ncsi_nft_lib=1