From 3cf4b4249a0de10dd2da83a3e27669560ad72c5e Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Fri, 21 Feb 2025 13:50:04 +0100 Subject: [PATCH 01/32] first firewall iteration --- Cargo.lock | 52 ++ Cargo.toml | 3 + LICENSE | 13 - LICENSE.md | 666 +++++++++++++++++ build.rs | 7 +- src/enterprise/LICENSE.md | 16 + src/enterprise/firewall/api.rs | 29 + src/enterprise/firewall/linux/mod.rs | 106 +++ src/enterprise/firewall/linux/netfilter.rs | 824 +++++++++++++++++++++ src/enterprise/firewall/mod.rs | 61 ++ src/enterprise/mod.rs | 1 + src/lib.rs | 6 + 12 files changed, 1769 insertions(+), 15 deletions(-) delete mode 100644 LICENSE create mode 100644 LICENSE.md create mode 100644 src/enterprise/LICENSE.md create mode 100644 src/enterprise/firewall/api.rs create mode 100644 src/enterprise/firewall/linux/mod.rs create mode 100644 src/enterprise/firewall/linux/netfilter.rs create mode 100644 src/enterprise/firewall/mod.rs create mode 100644 src/enterprise/mod.rs diff --git a/Cargo.lock b/Cargo.lock index 771103a1..ac3af77b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -406,7 +406,10 @@ dependencies = [ "defguard_wireguard_rs", "env_logger", "gethostname", + "ipnetwork", "log", + "mnl", + "nftnl", "prost", "prost-build", "serde", @@ -977,6 +980,12 @@ dependencies = [ "hashbrown 0.15.2", ] +[[package]] +name = "ipnetwork" +version = "0.21.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf370abdafd54d13e54a620e8c3e1145f28e46cc9d704bc6d94414559df41763" + [[package]] name = "is_terminal_polyfill" version = "1.70.1" @@ -1102,6 +1111,27 @@ dependencies = [ "windows-sys 0.52.0", ] +[[package]] +name = "mnl" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d1a5469630da93e1813bb257964c0ccee3b26b6879dd858039ddec35cc8681ed" +dependencies = [ + "libc", + "log", + "mnl-sys", +] + +[[package]] +name = "mnl-sys" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9750685b201e1ecfaaf7aa5d0387829170fa565989cc481b49080aa155f70457" +dependencies = [ + "libc", + "pkg-config", +] + [[package]] name = "multimap" version = "0.10.0" @@ -1183,6 +1213,28 @@ dependencies = [ "log", ] +[[package]] +name = "nftnl" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "06a7491dd91b71643f65546389f25506da70723d1f1ec8c8d6d20444d1c23f27" +dependencies = [ + "bitflags", + "log", + "nftnl-sys", +] + +[[package]] +name = "nftnl-sys" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b193f2c2a70e6421534c3f3b75eaaed4e4b9df45281b3d94f5bc8c32fb346cbb" +dependencies = [ + "cfg-if", + "libc", + "pkg-config", +] + [[package]] name = "nix" version = "0.29.0" diff --git a/Cargo.toml b/Cargo.toml index af0c4cfc..7e89e183 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -19,6 +19,9 @@ tonic = { version = "0.12", features = ["gzip", "tls", "tls-native-roots"] } tokio = { version = "1", features = ["macros", "rt-multi-thread"] } tokio-stream = { version = "0.1", features = [] } toml = { version = "0.8", default-features = false, features = ["parse"] } +mnl = "0.2" +ipnetwork = "0.21" +nftnl = "0.7.0" [dev-dependencies] tokio = { version = "1", features = ["io-std", "io-util"] } diff --git a/LICENSE b/LICENSE deleted file mode 100644 index 8ddd1409..00000000 --- a/LICENSE +++ /dev/null @@ -1,13 +0,0 @@ -Copyright 2023 teonite ventures sp. z o.o. (teonite) - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 00000000..65be7750 --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,666 @@ +# Dual license info +The code in this repository is available under a dual licensing model: + +1. Open Source License: The code, except for the contents of the "src/enterprise" directory, is licensed under the AGPL license (this license). This applies to the open core components of the software. +2. Enterprise License: All code in this repository (including within the "src/enterprise" directory) is licensed under a separate Enterprise License (see file src/enterprise/LICENSE.md). + +# GNU AFFERO GENERAL PUBLIC LICENSE + +Version 3, 19 November 2007 + +Copyright (C) 2007 Free Software Foundation, Inc. + + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + +## Preamble + +The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + +The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains +free software for all its users. + +When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + +Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + +A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + +The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + +An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing +under this license. + +The precise terms and conditions for copying, distribution and +modification follow. + +## TERMS AND CONDITIONS + +### 0. Definitions. + +"This License" refers to version 3 of the GNU Affero General Public +License. + +"Copyright" also means copyright-like laws that apply to other kinds +of works, such as semiconductor masks. + +"The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + +To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of +an exact copy. The resulting work is called a "modified version" of +the earlier work or a work "based on" the earlier work. + +A "covered work" means either the unmodified Program or a work based +on the Program. + +To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + +To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user +through a computer network, with no transfer of a copy, is not +conveying. + +An interactive user interface displays "Appropriate Legal Notices" to +the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + +### 1. Source Code. + +The "source code" for a work means the preferred form of the work for +making modifications to it. "Object code" means any non-source form of +a work. + +A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + +The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + +The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + +The Corresponding Source need not include anything that users can +regenerate automatically from other parts of the Corresponding Source. + +The Corresponding Source for a work in source code form is that same +work. + +### 2. Basic Permissions. + +All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + +You may make, run and propagate covered works that you do not convey, +without conditions so long as your license otherwise remains in force. +You may convey covered works to others for the sole purpose of having +them make modifications exclusively for you, or provide you with +facilities for running those works, provided that you comply with the +terms of this License in conveying all material for which you do not +control copyright. Those thus making or running the covered works for +you must do so exclusively on your behalf, under your direction and +control, on terms that prohibit them from making any copies of your +copyrighted material outside their relationship with you. + +Conveying under any other circumstances is permitted solely under the +conditions stated below. Sublicensing is not allowed; section 10 makes +it unnecessary. + +### 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + +No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + +When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such +circumvention is effected by exercising rights under this License with +respect to the covered work, and you disclaim any intention to limit +operation or modification of the work as a means of enforcing, against +the work's users, your or third parties' legal rights to forbid +circumvention of technological measures. + +### 4. Conveying Verbatim Copies. + +You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + +You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + +### 5. Conveying Modified Source Versions. + +You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these +conditions: + +- a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. +- b) The work must carry prominent notices stating that it is + released under this License and any conditions added under + section 7. This requirement modifies the requirement in section 4 + to "keep intact all notices". +- c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. +- d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + +A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + +### 6. Conveying Non-Source Forms. + +You may convey a covered work in object code form under the terms of +sections 4 and 5, provided that you also convey the machine-readable +Corresponding Source under the terms of this License, in one of these +ways: + +- a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. +- b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the Corresponding + Source from a network server at no charge. +- c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. +- d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. +- e) Convey the object code using peer-to-peer transmission, + provided you inform other peers where the object code and + Corresponding Source of the work are being offered to the general + public at no charge under subsection 6d. + +A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + +A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, +family, or household purposes, or (2) anything designed or sold for +incorporation into a dwelling. In determining whether a product is a +consumer product, doubtful cases shall be resolved in favor of +coverage. For a particular product received by a particular user, +"normally used" refers to a typical or common use of that class of +product, regardless of the status of the particular user or of the way +in which the particular user actually uses, or expects or is expected +to use, the product. A product is a consumer product regardless of +whether the product has substantial commercial, industrial or +non-consumer uses, unless such uses represent the only significant +mode of use of the product. + +"Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to +install and execute modified versions of a covered work in that User +Product from a modified version of its Corresponding Source. The +information must suffice to ensure that the continued functioning of +the modified object code is in no case prevented or interfered with +solely because modification has been made. + +If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + +The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or +updates for a work that has been modified or installed by the +recipient, or for the User Product in which it has been modified or +installed. Access to a network may be denied when the modification +itself materially and adversely affects the operation of the network +or violates the rules and protocols for communication across the +network. + +Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + +### 7. Additional Terms. + +"Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + +When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + +Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders +of that material) supplement the terms of this License with terms: + +- a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or +- b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or +- c) Prohibiting misrepresentation of the origin of that material, + or requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or +- d) Limiting the use for publicity purposes of names of licensors + or authors of the material; or +- e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or +- f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions + of it) with contractual assumptions of liability to the recipient, + for any liability that these contractual assumptions directly + impose on those licensors and authors. + +All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + +If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + +Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; the +above requirements apply either way. + +### 8. Termination. + +You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + +However, if you cease all violation of this License, then your license +from a particular copyright holder is reinstated (a) provisionally, +unless and until the copyright holder explicitly and finally +terminates your license, and (b) permanently, if the copyright holder +fails to notify you of the violation by some reasonable means prior to +60 days after the cessation. + +Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + +Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + +### 9. Acceptance Not Required for Having Copies. + +You are not required to accept this License in order to receive or run +a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + +### 10. Automatic Licensing of Downstream Recipients. + +Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + +An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + +You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + +### 11. Patents. + +A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + +A contributor's "essential patent claims" are all patent claims owned +or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + +Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + +In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + +If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + +If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + +A patent license is "discriminatory" if it does not include within the +scope of its coverage, prohibits the exercise of, or is conditioned on +the non-exercise of one or more of the rights that are specifically +granted under this License. You may not convey a covered work if you +are a party to an arrangement with a third party that is in the +business of distributing software, under which you make payment to the +third party based on the extent of your activity of conveying the +work, and under which the third party grants, to any of the parties +who would receive the covered work from you, a discriminatory patent +license (a) in connection with copies of the covered work conveyed by +you (or copies made from those copies), or (b) primarily for and in +connection with specific products or compilations that contain the +covered work, unless you entered into that arrangement, or that patent +license was granted, prior to 28 March 2007. + +Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + +### 12. No Surrender of Others' Freedom. + +If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under +this License and any other pertinent obligations, then as a +consequence you may not convey it at all. For example, if you agree to +terms that obligate you to collect a royalty for further conveying +from those to whom you convey the Program, the only way you could +satisfy both those terms and this License would be to refrain entirely +from conveying the Program. + +### 13. Remote Network Interaction; Use with the GNU General Public License. + +Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your +version supports such interaction) an opportunity to receive the +Corresponding Source of your version by providing access to the +Corresponding Source from a network server at no charge, through some +standard or customary means of facilitating copying of software. This +Corresponding Source shall include the Corresponding Source for any +work covered by version 3 of the GNU General Public License that is +incorporated pursuant to the following paragraph. + +Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + +### 14. Revised Versions of this License. + +The Free Software Foundation may publish revised and/or new versions +of the GNU Affero General Public License from time to time. Such new +versions will be similar in spirit to the present version, but may +differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever +published by the Free Software Foundation. + +If the Program specifies that a proxy can decide which future versions +of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + +Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + +### 15. Disclaimer of Warranty. + +THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT +WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND +PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE +DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR +CORRECTION. + +### 16. Limitation of Liability. + +IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR +CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES +ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT +NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR +LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM +TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER +PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +### 17. Interpretation of Sections 15 and 16. + +If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + +END OF TERMS AND CONDITIONS + +## How to Apply These Terms to Your New Programs + +If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these +terms. + +To do so, attach the following notices to the program. It is safest to +attach them to the start of each source file to most effectively state +the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as + published by the Free Software Foundation, either version 3 of the + License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper +mail. + +If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for +the specific requirements. + +You should also get your employer (if you work as a programmer) or +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. For more information on this, and how to apply and follow +the GNU AGPL, see . diff --git a/build.rs b/build.rs index 2c920323..93c173f7 100644 --- a/build.rs +++ b/build.rs @@ -11,8 +11,11 @@ fn main() -> Result<(), Box> { config.protoc_arg("--experimental_allow_proto3_optional"); tonic_build::configure().compile_protos_with_config( config, - &["proto/wireguard/gateway.proto"], - &["proto/wireguard"], + &[ + "proto/wireguard/gateway.proto", + "proto/enterprise/firewall.proto", + ], + &["proto/wireguard", "proto/enterprise"], )?; Ok(()) } diff --git a/src/enterprise/LICENSE.md b/src/enterprise/LICENSE.md new file mode 100644 index 00000000..7a386fef --- /dev/null +++ b/src/enterprise/LICENSE.md @@ -0,0 +1,16 @@ +Copyright 2024 teonite ventures sp. z o. o. + +defguard enterprise license / defguard.net + +Use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + +1. Use is permitted for the purposes of the Licensee that paid for the relevant license only (no redistributions or products based on that). + +2. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote the Licensee when using the product without specific prior written permission. + +3. The Licensee may use the software in accordance with the terms and conditions of this license after paying the license fee to the Licensor, in accordance with the currently available price list on the defguard.net website, for the time period defined in the license. The Licensee is not permitted to resell, sublicense, or create derivative products based on the software. The Licensor may secure the ability to use the software with a license key or other technical protection. + +5. You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key. + +6. The licensor can provide support for the use of the software. The current terms in this respect are on the website defguard.net +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs new file mode 100644 index 00000000..f7cfd286 --- /dev/null +++ b/src/enterprise/firewall/api.rs @@ -0,0 +1,29 @@ +use std::net::IpAddr; + +use super::{Address, Port, Protocol}; + +pub struct FirewallApi { + pub ifname: String, +} + +impl FirewallApi { + pub fn new(ifname: &str, default_action: bool) -> Self { + Self { + ifname: ifname.into(), + } + } +} + +pub trait FirewallManagementApi { + fn setup(&self); + fn clear(&self); + fn set_access( + &self, + sources: Vec
, + destinations: Vec
, + destination_ports: Vec, + protocols: Vec, + allow: bool, + id: u32, + ); +} diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs new file mode 100644 index 00000000..fdcab961 --- /dev/null +++ b/src/enterprise/firewall/linux/mod.rs @@ -0,0 +1,106 @@ +mod netfilter; + +use netfilter::{apply_filter_rules, clear_chains, init_firewall, masq_interface}; + +use super::{ + api::{FirewallApi, FirewallManagementApi}, + proto, Address, Port, Protocol, +}; + +#[derive(Debug, Default)] +pub enum Action { + Accept, + Drop, + #[default] + None, +} + +impl From for Action { + fn from(allow: bool) -> Self { + if allow { + Self::Accept + } else { + Self::Drop + } + } +} + +#[derive(Debug, Default)] +pub enum State { + #[default] + Established, + Invalid, + New, + Related, +} + +#[derive(Debug, Default)] +pub struct FilterRule { + pub src_ips: Vec
, + pub dest_ips: Vec
, + pub src_ports: Vec, + pub dest_ports: Vec, + pub protocols: Vec, + pub oifname: Option, + pub iifname: Option, + pub action: Action, + pub states: Vec, + pub counter: bool, + pub id: u32, +} + +impl FirewallManagementApi for FirewallApi { + fn setup(&self) { + println!("Initializing firewall for interface {}", self.ifname); + init_firewall().expect("Failed to setup chains"); + masq_interface(&self.ifname).expect("Failed to masquerade interface"); + } + + fn clear(&self) { + println!("Cleaning up firewall for interface {}", self.ifname); + clear_chains(); + } + + fn set_access( + &self, + sources: Vec
, + destinations: Vec
, + destination_ports: Vec, + protocols: Vec, + allow: bool, + id: u32, + ) { + let mut rules = vec![]; + + if destination_ports.is_empty() { + let rule = FilterRule { + src_ips: sources, + dest_ips: destinations, + protocols, + action: allow.into(), + counter: true, + id, + ..Default::default() + }; + rules.push(rule); + } else { + let mut id_counter = id; + for protocol in protocols { + let rule = FilterRule { + src_ips: sources.clone(), + dest_ips: destinations.clone(), + dest_ports: destination_ports.clone(), + protocols: vec![protocol], + action: allow.into(), + counter: true, + id: id_counter, + ..Default::default() + }; + rules.push(rule); + id_counter += 1; + } + } + + apply_filter_rules(rules); + } +} diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs new file mode 100644 index 00000000..e627fe9d --- /dev/null +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -0,0 +1,824 @@ +#[cfg(test)] +use std::str::FromStr; +use std::{ + ffi::CString, + io, + net::{IpAddr, Ipv4Addr, Ipv6Addr}, +}; + +use ipnetwork::IpNetwork; +#[cfg(test)] +use ipnetwork::{Ipv4Network, Ipv6Network}; +use mnl::mnl_sys::libc; +use nftnl::{ + expr::{Expression, InterfaceName}, + nft_expr, nftnl_sys, + set::{Set, SetKey}, + Batch, Chain, FinalizedBatch, ProtoFamily, Rule, Table, +}; + +use super::{proto, Action, Address, FilterRule, Port, Protocol, State}; + +const FILTER_TABLE: &str = "filter"; +const NAT_TABLE: &str = "nat"; +const DEFGUARD_TABLE: &str = "DEFGUARD"; +const POSTROUTING_CHAIN: &str = "POSTROUTING"; +const FORWARD_CHAIN: &str = "FORWARD"; + +#[derive(Debug, Clone)] +pub enum AddressMatch { + IpList(Vec), + IpRange(IpAddr, IpAddr), + Network(IpNetwork), +} + +impl AddressMatch { + pub fn is_empty(&self) -> bool { + match self { + Self::IpList(list) => list.is_empty(), + _ => false, + } + } +} + +impl Default for AddressMatch { + fn default() -> Self { + Self::IpList(Vec::new()) + } +} + +impl From
for AddressMatch { + fn from(address: Address) -> Self { + match address { + Address::Ip(ip) => Self::IpList(vec![ip]), + Address::Network(network) => Self::Network(network), + Address::Range(start, end) => Self::IpRange(start, end), + } + } +} + +struct InetService(u16); + +impl SetKey for InetService { + const TYPE: u32 = 13; + const LEN: u32 = 2; + + fn data(&self) -> Box<[u8]> { + Box::new(self.0.to_be_bytes()) + } +} + +impl State { + const fn to_expr_state(&self) -> nftnl::expr::ct::States { + match self { + Self::Established => nftnl::expr::ct::States::ESTABLISHED, + Self::Invalid => nftnl::expr::ct::States::INVALID, + Self::New => nftnl::expr::ct::States::NEW, + Self::Related => nftnl::expr::ct::States::RELATED, + } + } +} + +impl From for Protocol { + fn from(proto: proto::enterprise::Protocol) -> Self { + match proto { + proto::enterprise::Protocol::Tcp => Self(libc::IPPROTO_TCP as u8), + proto::enterprise::Protocol::Udp => Self(libc::IPPROTO_UDP as u8), + proto::enterprise::Protocol::Icmp => Self(libc::IPPROTO_ICMP as u8), + _ => { + println!("Unsupported protocol: {:?}", proto); + panic!(); + } + } + } +} + +impl Protocol { + pub fn supports_ports(&self) -> bool { + matches!(self.0 as i32, libc::IPPROTO_TCP | libc::IPPROTO_UDP) + } + + pub fn to_payload_expr(&self) -> &impl Expression { + match self.0 as i32 { + libc::IPPROTO_TCP => &nft_expr!(payload tcp dport), + libc::IPPROTO_UDP => &nft_expr!(payload udp dport), + _ => panic!("Unsupported protocol"), + } + } +} + +impl SetKey for Protocol { + const TYPE: u32 = 12; + const LEN: u32 = 1; + + fn data(&self) -> Box<[u8]> { + Box::new([self.0]) + } +} + +pub trait FirewallRule { + fn to_chain_rule<'a>(&self, chain: &'a Chain, batch: &mut Batch) -> Rule<'a>; +} + +fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) { + match ip { + Address::Ip(ip) => match ip { + IpAddr::V4(ip) => { + add_to_set(set, ip, Some(ip)); + } + IpAddr::V6(ip) => { + add_to_set(set, ip, Some(ip)); + } + }, + Address::Range(start, end) => match (start, end) { + (IpAddr::V4(start), IpAddr::V4(end)) => { + add_to_set(set, start, Some(end)); + } + (IpAddr::V6(start), IpAddr::V6(end)) => { + add_to_set(set, start, Some(end)); + } + _ => panic!("Expected both addresses to be of the same type"), + }, + Address::Network(network) => { + let upper_bound = max_address(network); + let net = network.network(); + match (net, upper_bound) { + (IpAddr::V4(network), IpAddr::V4(upper_bound)) => { + add_to_set(set, &network, Some(&upper_bound)); + } + (IpAddr::V6(network), IpAddr::V6(upper_bound)) => { + add_to_set(set, &network, Some(&upper_bound)); + } + _ => panic!("Expected both addresses to be of the same type"), + } + } + } +} + +fn add_port_to_set(set: *mut nftnl_sys::nftnl_set, port: &Port) { + match port { + Port::Single(port) => { + let inet_service = InetService(*port); + add_to_set(set, &inet_service, Some(&inet_service)); + } + Port::Range(start, end) => { + let start = InetService(*start); + let end = InetService(*end); + + add_to_set(set, &start, Some(&end)); + } + } +} + +fn add_protocol_to_set(set: *mut nftnl_sys::nftnl_set, proto: &Protocol) { + add_to_set(set, proto, Some(proto)); +} + +impl FirewallRule for FilterRule { + fn to_chain_rule<'a>(&self, chain: &'a Chain, batch: &mut Batch) -> Rule<'a> { + let mut rule = Rule::new(chain); + + // let tcp = self.protocol == Some(libc::IPPROTO_TCP as u8); + // let tcp = matches!(self.protocol, Some(proto) if proto.0 == libc::IPPROTO_TCP as u8); + // println!("TCP: {}", tcp); + let v4 = true; + + if !self.dest_ports.is_empty() && self.protocols.len() > 1 { + panic!("Cannot specify multiple protocols with destination ports"); + } + + let mut id_counter = self.id; + + // TODO: Reduce code duplication here + if !self.src_ips.is_empty() { + if v4 { + let set = new_anon_set::( + id_counter, + chain.get_table(), + ProtoFamily::Inet, + true, + ); + id_counter += 1; + batch.add(&set, nftnl::MsgType::Add); + + for ip in &self.src_ips { + add_address_to_set(set.as_ptr(), ip); + } + + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta nfproto)); + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); + rule.add_expr(&nft_expr!(payload ipv4 saddr)); + + rule.add_expr(&nft_expr!(lookup & set)); + } else { + let set = new_anon_set::( + id_counter, + chain.get_table(), + ProtoFamily::Inet, + true, + ); + id_counter += 1; + + batch.add(&set, nftnl::MsgType::Add); + + for ip in &self.src_ips { + add_address_to_set(set.as_ptr(), ip); + } + + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta nfproto)); + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8)); + rule.add_expr(&nft_expr!(payload ipv6 saddr)); + + rule.add_expr(&nft_expr!(lookup & set)); + } + } + + // TODO: Reduce code duplication here + if !self.dest_ips.is_empty() { + if v4 { + let set = new_anon_set::( + id_counter, + chain.get_table(), + ProtoFamily::Inet, + true, + ); + id_counter += 1; + batch.add(&set, nftnl::MsgType::Add); + + for ip in &self.dest_ips { + add_address_to_set(set.as_ptr(), ip); + } + + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta nfproto)); + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); + rule.add_expr(&nft_expr!(payload ipv4 daddr)); + + rule.add_expr(&nft_expr!(lookup & set)); + } else { + let set = new_anon_set::( + id_counter, + chain.get_table(), + ProtoFamily::Inet, + true, + ); + id_counter += 1; + batch.add(&set, nftnl::MsgType::Add); + + for ip in &self.dest_ips { + add_address_to_set(set.as_ptr(), ip); + } + + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta nfproto)); + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8)); + rule.add_expr(&nft_expr!(payload ipv6 daddr)); + + rule.add_expr(&nft_expr!(lookup & set)); + } + } + + if !self.protocols.is_empty() { + // If there are many protocols, put them as a set + if self.protocols.len() > 1 { + let set = new_anon_set::( + id_counter, + chain.get_table(), + ProtoFamily::Inet, + true, + ); + id_counter += 1; + batch.add(&set, nftnl::MsgType::Add); + + for proto in &self.protocols { + add_protocol_to_set(set.as_ptr(), proto); + } + + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta l4proto)); + rule.add_expr(&nft_expr!(lookup & set)); + } else if !self.dest_ports.is_empty() { + let protocol = self.protocols.first().unwrap(); + println!("Protocol: {:?}", protocol); + if protocol.supports_ports() { + let set = new_anon_set::( + id_counter, + chain.get_table(), + ProtoFamily::Inet, + true, + ); + id_counter += 1; + batch.add(&set, nftnl::MsgType::Add); + + for port in &self.dest_ports { + add_port_to_set(set.as_ptr(), port); + } + + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta l4proto)); + rule.add_expr(&nft_expr!(cmp == protocol.0)); + rule.add_expr(protocol.to_payload_expr()); + rule.add_expr(&nft_expr!(lookup & set)); + // rule.add_expr(&nft_expr!(meta l4proto)); + // if tcp { + // rule.add_expr(&nft_expr!(cmp == libc::IPPROTO_TCP as u8)); + // rule.add_expr(&nft_expr!(payload tcp dport)); + // } else { + // rule.add_expr(&nft_expr!(cmp == libc::IPPROTO_UDP as u8)); + // rule.add_expr(&nft_expr!(payload udp dport)); + // } + } + } + } + + if let Some(iifname) = &self.iifname { + rule.add_expr(&nft_expr!(meta iifname)); + let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap()); + rule.add_expr(&nft_expr!(cmp == exact)); + } + + if let Some(oifname) = &self.oifname { + rule.add_expr(&nft_expr!(meta oifname)); + let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap()); + rule.add_expr(&nft_expr!(cmp == exact)); + } + + if !self.states.is_empty() { + let combined_states = self + .states + .iter() + .fold(0u32, |acc, state| acc | state.to_expr_state().bits()); + rule.add_expr(&nft_expr!(ct state)); + rule.add_expr(&nft_expr!(bitwise mask combined_states, xor 0u32)); + rule.add_expr(&nft_expr!(cmp != 0u32)); + } + + if self.counter { + rule.add_expr(&nft_expr!(counter)); + } + + match self.action { + Action::Accept => { + rule.add_expr(&nft_expr!(verdict accept)); + } + Action::Drop => { + rule.add_expr(&nft_expr!(verdict drop)); + } + Action::None => {} + } + + rule + } +} + +#[derive(Debug, Default)] +struct NatRule { + src_ip: Option, + dest_ip: Option, + oifname: Option, + iifname: Option, + counter: bool, +} + +impl FirewallRule for NatRule { + fn to_chain_rule<'a>(&self, chain: &'a Chain, _batch: &mut Batch) -> Rule<'a> { + let mut rule = Rule::new(chain); + + if let Some(src_ip) = self.src_ip { + if src_ip.is_ipv4() { + rule.add_expr(&nft_expr!(payload ipv4 saddr)); + } else { + rule.add_expr(&nft_expr!(payload ipv6 saddr)); + } + rule.add_expr(&nft_expr!(cmp == src_ip)); + } + + if let Some(dest_ip) = self.dest_ip { + if dest_ip.is_ipv4() { + rule.add_expr(&nft_expr!(payload ipv4 daddr)); + } else { + rule.add_expr(&nft_expr!(payload ipv6 daddr)); + } + rule.add_expr(&nft_expr!(cmp == dest_ip)); + } + + if let Some(iifname) = &self.iifname { + rule.add_expr(&nft_expr!(meta iifname)); + let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap()); + rule.add_expr(&nft_expr!(cmp == exact)); + } + + if let Some(oifname) = &self.oifname { + rule.add_expr(&nft_expr!(meta oifname)); + let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap()); + rule.add_expr(&nft_expr!(cmp == exact)); + } + + if self.counter { + rule.add_expr(&nft_expr!(counter)); + } + + rule.add_expr(&nft_expr!(masquerade)); + + rule + } +} + +struct JumpRule; + +impl JumpRule { + fn to_chain_rule<'a>(src_chain: &'a Chain, dest_chain: &'a Chain) -> Rule<'a> { + let mut rule = Rule::new(src_chain); + + rule.add_expr(&nft_expr!(counter)); + rule.add_expr(&nft_expr!(verdict jump dest_chain.get_name().into())); + + rule + } +} + +/// Sets up the default chains for the firewall +pub fn init_firewall() -> io::Result<()> { + let mut batch = Batch::new(); + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + + batch.add(&table, nftnl::MsgType::Add); + batch.add(&table, nftnl::MsgType::Del); + batch.add(&table, nftnl::MsgType::Add); + + let mut chain = Chains::Forward.to_chain(&table); + chain.set_hook(nftnl::Hook::Forward, 0); + // FIXME: This should be configurable + chain.set_policy(nftnl::Policy::Accept); + chain.set_type(nftnl::ChainType::Filter); + batch.add(&chain, nftnl::MsgType::Add); + + let mut nat_chain = Chains::Postrouting.to_chain(&table); + nat_chain.set_hook(nftnl::Hook::PostRouting, 100); + nat_chain.set_policy(nftnl::Policy::Accept); + nat_chain.set_type(nftnl::ChainType::Nat); + batch.add(&nat_chain, nftnl::MsgType::Add); + + let finalized_batch = batch.finalize(); + + send_batch(&finalized_batch); + + Ok(()) +} + +pub fn clear_chains() { + let mut batch = Batch::new(); + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + batch.add(&table, nftnl::MsgType::Add); + batch.add(&table, nftnl::MsgType::Del); + + let finalized_batch = batch.finalize(); + + send_batch(&finalized_batch); +} + +/// Applies masquerade on the specified interface for the outgoing packets +pub fn masq_interface(ifname: &str) -> io::Result<()> { + let mut batch = Batch::new(); + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + batch.add(&table, nftnl::MsgType::Add); + + let post_routing = Chains::Postrouting.to_chain(&table); + batch.add(&post_routing, nftnl::MsgType::Add); + + let nat_rule = NatRule { + oifname: Some(ifname.to_string()), + counter: true, + ..Default::default() + } + .to_chain_rule(&post_routing, &mut batch); + + batch.add(&nat_rule, nftnl::MsgType::Add); + + let finalized_batch = batch.finalize(); + send_batch(&finalized_batch); + + Ok(()) +} + +pub enum Tables { + Filter(ProtoFamily), + Nat(ProtoFamily), + Defguard(ProtoFamily), +} + +impl Tables { + fn to_table(&self) -> Table { + match self { + Self::Filter(family) => Table::new(&CString::new(FILTER_TABLE).unwrap(), *family), + Self::Nat(family) => Table::new(&CString::new(NAT_TABLE).unwrap(), *family), + Self::Defguard(family) => Table::new(&CString::new(DEFGUARD_TABLE).unwrap(), *family), + } + } +} + +pub enum Chains { + Forward, + Postrouting, +} + +impl Chains { + fn to_chain<'a>(&self, table: &'a Table) -> Chain<'a> { + match self { + Self::Forward => Chain::new(&CString::new(FORWARD_CHAIN).unwrap(), table), + Self::Postrouting => Chain::new(&CString::new(POSTROUTING_CHAIN).unwrap(), table), + } + } +} + +pub fn apply_filter_rules(rules: Vec) { + let mut batch = Batch::new(); + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + batch.add(&table, nftnl::MsgType::Add); + + let forward_chain = Chains::Forward.to_chain(&table); + batch.add(&forward_chain, nftnl::MsgType::Add); + + for rule in rules.iter() { + let chain_rule = rule.to_chain_rule(&forward_chain, &mut batch); + batch.add(&chain_rule, nftnl::MsgType::Add); + } + + let finalized_batch = batch.finalize(); + + send_batch(&finalized_batch); +} + +fn send_batch(batch: &FinalizedBatch) { + let socket = mnl::Socket::new(mnl::Bus::Netfilter).unwrap(); + socket.send_all(batch).unwrap(); + + let portid = socket.portid(); + let mut buffer = vec![0; nftnl::nft_nlmsg_maxsize() as usize]; + + // TODO: Why is it 2? + let seq = 2; + while let Some(message) = socket_recv(&socket, &mut buffer[..]) { + match mnl::cb_run(message, seq, portid).unwrap() { + mnl::CbResult::Stop => { + println!("STOP"); + break; + } + mnl::CbResult::Ok => { + println!("OK"); + } + }; + } +} + +fn socket_recv<'a>(socket: &mnl::Socket, buf: &'a mut [u8]) -> Option<&'a [u8]> { + let ret = socket.recv(buf).unwrap(); + println!("Received {} bytes", ret); + if ret > 0 { + Some(&buf[..ret]) + } else { + None + } +} + +/// Get the max address in a network. +/// +/// - In IPv4 this is the broadcast address. +/// - In IPv6 this is just the last address in the network. +fn max_address(network: &IpNetwork) -> IpAddr { + match network { + IpNetwork::V4(network) => { + let ip_u32 = u32::from(network.ip()); + let mask_u32 = u32::from(network.mask()); + + IpAddr::V4(Ipv4Addr::from(ip_u32 | !mask_u32)) + } + IpNetwork::V6(network) => { + let ip_u128 = u128::from(network.ip()); + let mask_u128 = u128::from(network.mask()); + + IpAddr::V6(Ipv6Addr::from(ip_u128 | !mask_u128)) + } + } +} + +fn new_anon_set(id: u32, table: &Table, family: ProtoFamily, interval_set: bool) -> Set +where + T: SetKey, +{ + let set = Set::::new(&CString::new("__set%d").unwrap(), id, table, family); + + if interval_set { + unsafe { + nftnl_sys::nftnl_set_set_u32( + set.as_ptr(), + nftnl_sys::NFTNL_SET_FLAGS as u16, + (libc::NFT_SET_ANONYMOUS | libc::NFT_SET_CONSTANT | libc::NFT_SET_INTERVAL) as u32, + ); + } + } + + set +} + +/// Adds key to a set. If the range_end option is specified, it will assume the lower and upper +/// bounds of a range need to be added. +fn add_to_set(set: *mut nftnl_sys::nftnl_set, key: &K, range_end: Option<&K>) +where + K: SetKey, +{ + let key_data = key.data(); + let key_data_len = key_data.len() as u32; + + unsafe { + let elem = nftnl_sys::nftnl_set_elem_alloc(); + assert!(!elem.is_null(), "oom"); + nftnl_sys::nftnl_set_elem_set( + elem, + nftnl_sys::NFTNL_SET_ELEM_KEY as u16, + key_data.as_ptr().cast(), + key_data_len, + ); + nftnl_sys::nftnl_set_elem_add(set, elem); + + if let Some(end) = range_end { + let mut end_data = end.data(); + + // This is a workaround to make the upper bound inclusive. + // Perhaps there is a better way to do this. + increment_bytes(&mut end_data); + let end_data_len = (end_data.len()) as u32; + + let elem = nftnl_sys::nftnl_set_elem_alloc(); + assert!(!elem.is_null(), "oom"); + nftnl_sys::nftnl_set_elem_set( + elem, + nftnl_sys::NFTNL_SET_ELEM_KEY as u16, + end_data.as_ptr().cast(), + end_data_len, + ); + nftnl_sys::nftnl_set_elem_set_u32( + elem, + nftnl_sys::NFTNL_SET_ELEM_FLAGS as u16, + libc::NFT_SET_ELEM_INTERVAL_END as u32, + ); + nftnl_sys::nftnl_set_elem_add(set, elem); + } + } +} + +fn increment_bytes(bytes: &mut [u8]) { + for i in (0..bytes.len()).rev() { + if bytes[i] < 255 { + bytes[i] += 1; + return; + } else { + bytes[i] = 0; + } + } + + // the bytes have overflown, but that's okay for our purposes +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_increment_ipv4_basic() { + let mut ip = [192, 168, 1, 1]; + increment_bytes(&mut ip); + assert_eq!(ip, [192, 168, 1, 2]); + } + + #[test] + fn test_increment_ipv4_overflow_last_octet() { + let mut ip = [192, 168, 1, 255]; + increment_bytes(&mut ip); + assert_eq!(ip, [192, 168, 2, 0]); + } + + #[test] + fn test_increment_ipv4_overflow_multiple_octets() { + let mut ip = [192, 168, 255, 255]; + increment_bytes(&mut ip); + assert_eq!(ip, [192, 169, 0, 0]); + } + + #[test] + fn test_increment_ipv4_max_address() { + let mut ip = [255, 255, 255, 255]; + increment_bytes(&mut ip); + assert_eq!(ip, [0, 0, 0, 0]); + } + + #[test] + fn test_increment_ipv4_zero_address() { + let mut ip = [0, 0, 0, 0]; + increment_bytes(&mut ip); + assert_eq!(ip, [0, 0, 0, 1]); + } + + #[test] + fn test_increment_ipv6_basic() { + let mut ip = [0, 0, 0, 0, 0, 0, 0, 0]; + increment_bytes(&mut ip); + assert_eq!(ip, [0, 0, 0, 0, 0, 0, 0, 1]); + } + + #[test] + fn test_increment_ipv6_overflow_last_octet() { + let mut ip = [0, 0, 0, 0, 0, 0, 0, 255]; + increment_bytes(&mut ip); + assert_eq!(ip, [0, 0, 0, 0, 0, 0, 1, 0]); + } + + #[test] + fn test_increment_ipv6_overflow_multiple_octets() { + let mut ip = [0, 0, 0, 0, 0, 0, 255, 255]; + increment_bytes(&mut ip); + assert_eq!(ip, [0, 0, 0, 0, 0, 1, 0, 0]); + } + + #[test] + fn test_increment_ipv6_max_address() { + let mut ip = [255, 255, 255, 255, 255, 255, 255, 255]; + increment_bytes(&mut ip); + assert_eq!(ip, [0, 0, 0, 0, 0, 0, 0, 0]); + } + + #[test] + fn test_max_address_ipv4_24() { + let network = IpNetwork::V4(Ipv4Network::from_str("192.168.1.0/24").unwrap()); + let max = max_address(&network); + assert_eq!(max, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 255))); + } + + #[test] + fn test_max_address_ipv4_16() { + let network = IpNetwork::V4(Ipv4Network::from_str("10.1.0.0/16").unwrap()); + let max = max_address(&network); + assert_eq!(max, IpAddr::V4(Ipv4Addr::new(10, 1, 255, 255))); + } + + #[test] + fn test_max_address_ipv4_8() { + let network = IpNetwork::V4(Ipv4Network::from_str("172.16.0.0/8").unwrap()); + let max = max_address(&network); + assert_eq!(max, IpAddr::V4(Ipv4Addr::new(172, 255, 255, 255))); + } + + #[test] + fn test_max_address_ipv4_32() { + let network = IpNetwork::V4(Ipv4Network::from_str("192.168.1.1/32").unwrap()); + let max = max_address(&network); + assert_eq!(max, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 1))); + } + + #[test] + fn test_max_address_ipv6_64() { + let network = IpNetwork::V6(Ipv6Network::from_str("2001:db8::/64").unwrap()); + let max = max_address(&network); + assert_eq!( + max, + IpAddr::V6(Ipv6Addr::from_str("2001:db8::ffff:ffff:ffff:ffff").unwrap()) + ); + } + + #[test] + fn test_max_address_ipv6_128() { + let network = IpNetwork::V6(Ipv6Network::from_str("2001:db8::1/128").unwrap()); + let max = max_address(&network); + assert_eq!(max, IpAddr::V6(Ipv6Addr::from_str("2001:db8::1").unwrap())); + } + + #[test] + fn test_max_address_ipv6_48() { + let network = IpNetwork::V6(Ipv6Network::from_str("2001:db8:1234::/48").unwrap()); + let max = max_address(&network); + assert_eq!( + max, + IpAddr::V6(Ipv6Addr::from_str("2001:db8:1234:ffff:ffff:ffff:ffff:ffff").unwrap()) + ); + } +} diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs new file mode 100644 index 00000000..95a0b298 --- /dev/null +++ b/src/enterprise/firewall/mod.rs @@ -0,0 +1,61 @@ +use std::{net::IpAddr, str::FromStr}; + +use ipnetwork::IpNetwork; + +use crate::proto; + +pub mod api; +#[cfg(target_os = "linux")] +pub mod linux; + +#[derive(Debug, Copy, Clone)] +pub enum Address { + Ip(IpAddr), + Network(IpNetwork), + Range(IpAddr, IpAddr), +} + +impl TryFrom<&proto::enterprise::IpAddress> for Address { + type Error = &'static str; + + fn try_from(ip: &proto::enterprise::IpAddress) -> Result { + match &ip.address { + Some(proto::enterprise::ip_address::Address::Ip(ip)) => Ok(Self::Ip( + IpAddr::from_str(ip).map_err(|_| "Invalid IP format")?, + )), + Some(proto::enterprise::ip_address::Address::IpSubnet(network)) => { + Ok(Self::Network(IpNetwork::from_str(network).unwrap())) + } + Some(proto::enterprise::ip_address::Address::IpRange(range)) => { + let start = IpAddr::from_str(&range.start).unwrap(); + let end = IpAddr::from_str(&range.end).unwrap(); + Ok(Self::Range(start, end)) + } + _ => Err("Invalid address"), + } + } +} + +#[derive(Debug, Copy, Clone)] +pub enum Port { + Single(u16), + Range(u16, u16), +} + +impl From<&proto::enterprise::Port> for Port { + fn from(port: &proto::enterprise::Port) -> Self { + match &port.port { + Some(proto::enterprise::port::Port::SinglePort(port)) => { + Self::Single(u16::try_from(*port).unwrap()) + } + Some(proto::enterprise::port::Port::PortRange(range)) => Self::Range( + u16::try_from(range.start).unwrap(), + u16::try_from(range.end).unwrap(), + ), + _ => panic!("Invalid port"), + } + } +} + +#[derive(Debug, Copy, Clone)] +pub struct Protocol(pub u8); diff --git a/src/enterprise/mod.rs b/src/enterprise/mod.rs new file mode 100644 index 00000000..a0734b85 --- /dev/null +++ b/src/enterprise/mod.rs @@ -0,0 +1 @@ +pub mod firewall; diff --git a/src/lib.rs b/src/lib.rs index 8fef5c67..38cd313e 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -5,6 +5,10 @@ pub mod server; pub mod proto { tonic::include_proto!("gateway"); + + pub mod enterprise { + tonic::include_proto!("firewall"); + } } #[macro_use] @@ -17,6 +21,8 @@ use defguard_wireguard_rs::{host::Peer, net::IpAddrMask, InterfaceConfiguration} use error::GatewayError; use syslog::{BasicLogger, Facility, Formatter3164}; +pub mod enterprise; + pub const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), "-", env!("VERGEN_GIT_SHA")); /// Masks object's field with "***" string. From 3059ba96b8420159ed1c63952a15972bec4399c8 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Fri, 21 Feb 2025 17:26:15 +0100 Subject: [PATCH 02/32] comments, port and protocol fixes --- src/enterprise/firewall/api.rs | 15 +- src/enterprise/firewall/linux/mod.rs | 93 ++++++---- src/enterprise/firewall/linux/netfilter.rs | 204 ++++++++++++++------- src/enterprise/firewall/mod.rs | 64 +++++++ 4 files changed, 269 insertions(+), 107 deletions(-) diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index f7cfd286..03a21107 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -1,13 +1,13 @@ use std::net::IpAddr; -use super::{Address, Port, Protocol}; +use super::{Address, FirewallRule, Port, Protocol}; pub struct FirewallApi { pub ifname: String, } impl FirewallApi { - pub fn new(ifname: &str, default_action: bool) -> Self { + pub fn new(ifname: &str) -> Self { Self { ifname: ifname.into(), } @@ -17,13 +17,6 @@ impl FirewallApi { pub trait FirewallManagementApi { fn setup(&self); fn clear(&self); - fn set_access( - &self, - sources: Vec
, - destinations: Vec
, - destination_ports: Vec, - protocols: Vec, - allow: bool, - id: u32, - ); + fn apply_rule(&self, rule: FirewallRule); + fn set_default_action(&self, allow: bool); } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index fdcab961..3b2376da 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -1,12 +1,26 @@ -mod netfilter; +pub mod netfilter; -use netfilter::{apply_filter_rules, clear_chains, init_firewall, masq_interface}; +use std::sync::atomic::{AtomicU32, Ordering}; + +use mnl::mnl_sys::libc::c_char; +use netfilter::{ + allow_established_traffic, apply_filter_rules, clear_chains, init_firewall, masq_interface, + set_default_action, +}; +use nftnl::{expr::Expression, nftnl_sys, Rule}; use super::{ api::{FirewallApi, FirewallManagementApi}, - proto, Address, Port, Protocol, + proto, Address, FirewallRule, Port, Protocol, }; +static SET_ID_COUNTER: AtomicU32 = AtomicU32::new(0); + +pub fn get_set_id() -> u32 { + println!("SET_ID_COUNTER: {:?}", SET_ID_COUNTER); + SET_ID_COUNTER.fetch_add(1, Ordering::SeqCst) +} + #[derive(Debug, Default)] pub enum Action { Accept, @@ -47,6 +61,7 @@ pub struct FilterRule { pub states: Vec, pub counter: bool, pub id: u32, + pub v4: bool, } impl FirewallManagementApi for FirewallApi { @@ -54,6 +69,7 @@ impl FirewallManagementApi for FirewallApi { println!("Initializing firewall for interface {}", self.ifname); init_firewall().expect("Failed to setup chains"); masq_interface(&self.ifname).expect("Failed to masquerade interface"); + allow_established_traffic(&self.ifname); } fn clear(&self) { @@ -61,43 +77,56 @@ impl FirewallManagementApi for FirewallApi { clear_chains(); } - fn set_access( - &self, - sources: Vec
, - destinations: Vec
, - destination_ports: Vec, - protocols: Vec, - allow: bool, - id: u32, - ) { + fn set_default_action(&self, allow: bool) { + println!( + "Setting default action to {} for interface {}", + if allow { "allow" } else { "drop" }, + self.ifname + ); + + set_default_action(allow); + } + + fn apply_rule(&self, rule: FirewallRule) { let mut rules = vec![]; - if destination_ports.is_empty() { + if rule.destination_ports.is_empty() { let rule = FilterRule { - src_ips: sources, - dest_ips: destinations, - protocols, - action: allow.into(), + src_ips: rule.source_addrs, + dest_ips: rule.destination_addrs, + protocols: rule.protocols, + action: rule.allow.into(), counter: true, - id, + id: rule.id, ..Default::default() }; rules.push(rule); } else { - let mut id_counter = id; - for protocol in protocols { - let rule = FilterRule { - src_ips: sources.clone(), - dest_ips: destinations.clone(), - dest_ports: destination_ports.clone(), - protocols: vec![protocol], - action: allow.into(), - counter: true, - id: id_counter, - ..Default::default() - }; - rules.push(rule); - id_counter += 1; + for protocol in rule.protocols { + if protocol.supports_ports() { + let rule = FilterRule { + src_ips: rule.source_addrs.clone(), + dest_ips: rule.destination_addrs.clone(), + dest_ports: rule.destination_ports.clone(), + protocols: vec![protocol], + action: rule.allow.into(), + counter: true, + id: rule.id, + ..Default::default() + }; + rules.push(rule); + } else { + let rule = FilterRule { + src_ips: rule.source_addrs.clone(), + dest_ips: rule.destination_addrs.clone(), + protocols: vec![protocol], + action: rule.allow.into(), + counter: true, + id: rule.id, + ..Default::default() + }; + rules.push(rule); + } } } diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index e627fe9d..268a114f 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -1,4 +1,5 @@ -#[cfg(test)] +use std::collections::HashSet; +use std::ffi::c_void; use std::str::FromStr; use std::{ ffi::CString, @@ -9,15 +10,19 @@ use std::{ use ipnetwork::IpNetwork; #[cfg(test)] use ipnetwork::{Ipv4Network, Ipv6Network}; -use mnl::mnl_sys::libc; +use mnl::mnl_sys::libc::{self, c_char}; +use nftnl::nftnl_sys::{ + nftnl_udata_buf_alloc, nftnl_udata_buf_data, nftnl_udata_buf_len, NFTNL_RULE_USERDATA, +}; use nftnl::{ expr::{Expression, InterfaceName}, nft_expr, nftnl_sys, set::{Set, SetKey}, Batch, Chain, FinalizedBatch, ProtoFamily, Rule, Table, }; +use rand::{random, rngs::OsRng, Rng}; -use super::{proto, Action, Address, FilterRule, Port, Protocol, State}; +use super::{get_set_id, proto, Action, Address, FilterRule, Port, Protocol, State}; const FILTER_TABLE: &str = "filter"; const NAT_TABLE: &str = "nat"; @@ -25,6 +30,40 @@ const DEFGUARD_TABLE: &str = "DEFGUARD"; const POSTROUTING_CHAIN: &str = "POSTROUTING"; const FORWARD_CHAIN: &str = "FORWARD"; +macro_rules! try_alloc { + ($e:expr) => {{ + let ptr = $e; + if ptr.is_null() { + std::process::abort(); + } + ptr + }}; +} + +pub struct Comment; + +impl Expression for Comment { + fn to_expr(&self, _rule: &Rule) -> *mut nftnl_sys::nftnl_expr { + try_alloc!(unsafe { + nftnl_sys::nftnl_expr_alloc(b"comment\0" as *const _ as *const c_char) + }) + } +} + +pub fn put_comment(rule: &mut Rule, comment: &str) { + let udata_buf = try_alloc!(unsafe { nftnl_udata_buf_alloc(256) }); + + let comment = &CString::new(comment).unwrap(); + unsafe { nftnl_sys::nftnl_udata_put_strz(udata_buf, 0, comment.as_ptr()) }; + + unsafe { + let data = nftnl_udata_buf_data(udata_buf) as *const c_void; + let data_len = nftnl_udata_buf_len(udata_buf); + nftnl_sys::nftnl_rule_set_data(rule.as_ptr(), NFTNL_RULE_USERDATA as u16, data, data_len); + nftnl_sys::nftnl_udata_buf_free(udata_buf); + } +} + #[derive(Debug, Clone)] pub enum AddressMatch { IpList(Vec), @@ -98,7 +137,7 @@ impl Protocol { matches!(self.0 as i32, libc::IPPROTO_TCP | libc::IPPROTO_UDP) } - pub fn to_payload_expr(&self) -> &impl Expression { + pub fn to_port_payload_expr(&self) -> &impl Expression { match self.0 as i32 { libc::IPPROTO_TCP => &nft_expr!(payload tcp dport), libc::IPPROTO_UDP => &nft_expr!(payload udp dport), @@ -171,34 +210,22 @@ fn add_port_to_set(set: *mut nftnl_sys::nftnl_set, port: &Port) { } fn add_protocol_to_set(set: *mut nftnl_sys::nftnl_set, proto: &Protocol) { - add_to_set(set, proto, Some(proto)); + add_to_set(set, proto, None); } impl FirewallRule for FilterRule { fn to_chain_rule<'a>(&self, chain: &'a Chain, batch: &mut Batch) -> Rule<'a> { let mut rule = Rule::new(chain); - - // let tcp = self.protocol == Some(libc::IPPROTO_TCP as u8); - // let tcp = matches!(self.protocol, Some(proto) if proto.0 == libc::IPPROTO_TCP as u8); - // println!("TCP: {}", tcp); let v4 = true; if !self.dest_ports.is_empty() && self.protocols.len() > 1 { panic!("Cannot specify multiple protocols with destination ports"); } - let mut id_counter = self.id; - // TODO: Reduce code duplication here if !self.src_ips.is_empty() { if v4 { - let set = new_anon_set::( - id_counter, - chain.get_table(), - ProtoFamily::Inet, - true, - ); - id_counter += 1; + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); batch.add(&set, nftnl::MsgType::Add); for ip in &self.src_ips { @@ -215,14 +242,7 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(lookup & set)); } else { - let set = new_anon_set::( - id_counter, - chain.get_table(), - ProtoFamily::Inet, - true, - ); - id_counter += 1; - + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); batch.add(&set, nftnl::MsgType::Add); for ip in &self.src_ips { @@ -244,13 +264,7 @@ impl FirewallRule for FilterRule { // TODO: Reduce code duplication here if !self.dest_ips.is_empty() { if v4 { - let set = new_anon_set::( - id_counter, - chain.get_table(), - ProtoFamily::Inet, - true, - ); - id_counter += 1; + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); batch.add(&set, nftnl::MsgType::Add); for ip in &self.dest_ips { @@ -267,13 +281,7 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(lookup & set)); } else { - let set = new_anon_set::( - id_counter, - chain.get_table(), - ProtoFamily::Inet, - true, - ); - id_counter += 1; + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); batch.add(&set, nftnl::MsgType::Add); for ip in &self.dest_ips { @@ -293,15 +301,10 @@ impl FirewallRule for FilterRule { } if !self.protocols.is_empty() { - // If there are many protocols, put them as a set + // > 0 Protocols + // 0 Ports if self.protocols.len() > 1 { - let set = new_anon_set::( - id_counter, - chain.get_table(), - ProtoFamily::Inet, - true, - ); - id_counter += 1; + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, false); batch.add(&set, nftnl::MsgType::Add); for proto in &self.protocols { @@ -312,19 +315,27 @@ impl FirewallRule for FilterRule { batch.add(&elem, nftnl::MsgType::Add); }); - rule.add_expr(&nft_expr!(meta l4proto)); + rule.add_expr(&nft_expr!(meta nfproto)); + + if v4 { + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); + rule.add_expr(&nft_expr!(payload ipv4 protocol)); + } else { + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8)); + rule.add_expr(&nft_expr!(payload ipv6 nextheader)); + } + rule.add_expr(&nft_expr!(lookup & set)); - } else if !self.dest_ports.is_empty() { + } + // 1 Protocol + // > 0 Ports + else if !self.dest_ports.is_empty() { let protocol = self.protocols.first().unwrap(); - println!("Protocol: {:?}", protocol); if protocol.supports_ports() { - let set = new_anon_set::( - id_counter, - chain.get_table(), - ProtoFamily::Inet, - true, - ); - id_counter += 1; + println!("Protocol: {:?}", protocol); + + let set = + new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); batch.add(&set, nftnl::MsgType::Add); for port in &self.dest_ports { @@ -335,10 +346,6 @@ impl FirewallRule for FilterRule { batch.add(&elem, nftnl::MsgType::Add); }); - rule.add_expr(&nft_expr!(meta l4proto)); - rule.add_expr(&nft_expr!(cmp == protocol.0)); - rule.add_expr(protocol.to_payload_expr()); - rule.add_expr(&nft_expr!(lookup & set)); // rule.add_expr(&nft_expr!(meta l4proto)); // if tcp { // rule.add_expr(&nft_expr!(cmp == libc::IPPROTO_TCP as u8)); @@ -347,7 +354,27 @@ impl FirewallRule for FilterRule { // rule.add_expr(&nft_expr!(cmp == libc::IPPROTO_UDP as u8)); // rule.add_expr(&nft_expr!(payload udp dport)); // } + + rule.add_expr(&nft_expr!(meta l4proto)); + rule.add_expr(&nft_expr!(cmp == protocol.0)); + rule.add_expr(protocol.to_port_payload_expr()); + rule.add_expr(&nft_expr!(lookup & set)); + } + } + // 1 Protocol + // 0 Ports + else if let Some(protocol) = self.protocols.first() { + rule.add_expr(&nft_expr!(meta nfproto)); + + if v4 { + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); + rule.add_expr(&nft_expr!(payload ipv4 protocol)); + } else { + rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8)); + rule.add_expr(&nft_expr!(payload ipv6 nextheader)); } + + rule.add_expr(&nft_expr!(cmp == protocol.0)); } } @@ -387,6 +414,10 @@ impl FirewallRule for FilterRule { Action::None => {} } + // comment test + let comment = format!("Rule ID: {}", self.id); + put_comment(&mut rule, &comment); + rule } } @@ -521,6 +552,46 @@ pub fn masq_interface(ifname: &str) -> io::Result<()> { Ok(()) } +pub fn set_default_action(allow: bool) { + let mut batch = Batch::new(); + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + batch.add(&table, nftnl::MsgType::Add); + + let mut forward_chain = Chains::Forward.to_chain(&table); + forward_chain.set_policy(if allow { + nftnl::Policy::Accept + } else { + nftnl::Policy::Drop + }); + batch.add(&forward_chain, nftnl::MsgType::Add); + + let finalized_batch = batch.finalize(); + send_batch(&finalized_batch); +} + +pub fn allow_established_traffic(ifname: &str) { + let mut batch = Batch::new(); + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + batch.add(&table, nftnl::MsgType::Add); + + let forward_chain = Chains::Forward.to_chain(&table); + batch.add(&forward_chain, nftnl::MsgType::Add); + + let established_rule = FilterRule { + states: vec![State::Established, State::Related], + iifname: Some(ifname.to_string()), + counter: true, + action: Action::Accept, + ..Default::default() + } + .to_chain_rule(&forward_chain, &mut batch); + + batch.add(&established_rule, nftnl::MsgType::Add); + + let finalized_batch = batch.finalize(); + send_batch(&finalized_batch); +} + pub enum Tables { Filter(ProtoFamily), Nat(ProtoFamily), @@ -622,11 +693,16 @@ fn max_address(network: &IpNetwork) -> IpAddr { } } -fn new_anon_set(id: u32, table: &Table, family: ProtoFamily, interval_set: bool) -> Set +fn new_anon_set(table: &Table, family: ProtoFamily, interval_set: bool) -> Set where T: SetKey, { - let set = Set::::new(&CString::new("__set%d").unwrap(), id, table, family); + let set = Set::::new( + &CString::new("__set%d").unwrap(), + get_set_id(), + table, + family, + ); if interval_set { unsafe { diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index 95a0b298..ea076187 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -59,3 +59,67 @@ impl From<&proto::enterprise::Port> for Port { #[derive(Debug, Copy, Clone)] pub struct Protocol(pub u8); + +pub struct FirewallRule { + pub id: u32, + pub source_addrs: Vec
, + pub destination_addrs: Vec
, + pub destination_ports: Vec, + pub protocols: Vec, + pub allow: bool, + pub v4: bool, + pub comment: Option, +} + +pub struct FirewallConfig { + pub rules: Vec, + pub default_action: bool, +} + +impl From for FirewallConfig { + fn from(config: proto::enterprise::FirewallConfig) -> Self { + let rules = config + .rules + .into_iter() + .map(|rule| FirewallRule { + // FIXME: Do something else here + id: rule.id as u32, + source_addrs: rule + .source_addr + .into_iter() + .map(|addr| Address::try_from(&addr).unwrap()) + .collect(), + destination_addrs: rule + .destination_addr + .into_iter() + .map(|addr| Address::try_from(&addr).unwrap()) + .collect(), + destination_ports: rule + .destination_port + .into_iter() + .map(|port| Port::from(&port)) + .collect(), + protocols: rule + .protocol + .into_iter() + .map(|proto| { + proto::enterprise::Protocol::try_from(proto) + .unwrap_or_else(|_| { + panic!("Unsupported protocol: {:?}", proto); + }) + .into() + }) + .collect(), + allow: rule.verdict == proto::enterprise::FirewallPolicy::Allow as i32, + v4: config.ip_version == proto::enterprise::IpVersion::Ipv4 as i32, + comment: rule.comment, + }) + .collect(); + + Self { + rules, + default_action: config.default_policy + == proto::enterprise::FirewallPolicy::Allow as i32, + } + } +} From 5b553517c199c778a6119838155da1c26666404e Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 25 Feb 2025 09:10:02 +0100 Subject: [PATCH 03/32] basic error handling --- Cargo.lock | 6 +- Cargo.toml | 2 +- src/enterprise/firewall/api.rs | 10 +- src/enterprise/firewall/linux/mod.rs | 82 ++--- src/enterprise/firewall/linux/netfilter.rs | 363 +++++++++++---------- src/enterprise/firewall/mod.rs | 225 +++++++++---- src/error.rs | 5 + 7 files changed, 392 insertions(+), 301 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ac3af77b..9153b3ec 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1216,8 +1216,7 @@ dependencies = [ [[package]] name = "nftnl" version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "06a7491dd91b71643f65546389f25506da70723d1f1ec8c8d6d20444d1c23f27" +source = "git+https://github.com/DefGuard/nftnl-rs.git?rev=1a1147271f43b9d7182a114bb056a5224c35d38f#1a1147271f43b9d7182a114bb056a5224c35d38f" dependencies = [ "bitflags", "log", @@ -1227,8 +1226,7 @@ dependencies = [ [[package]] name = "nftnl-sys" version = "0.6.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b193f2c2a70e6421534c3f3b75eaaed4e4b9df45281b3d94f5bc8c32fb346cbb" +source = "git+https://github.com/DefGuard/nftnl-rs.git?rev=1a1147271f43b9d7182a114bb056a5224c35d38f#1a1147271f43b9d7182a114bb056a5224c35d38f" dependencies = [ "cfg-if", "libc", diff --git a/Cargo.toml b/Cargo.toml index 7e89e183..e84a56c1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -21,7 +21,7 @@ tokio-stream = { version = "0.1", features = [] } toml = { version = "0.8", default-features = false, features = ["parse"] } mnl = "0.2" ipnetwork = "0.21" -nftnl = "0.7.0" +nftnl = { git = "https://github.com/DefGuard/nftnl-rs.git", rev = "1a1147271f43b9d7182a114bb056a5224c35d38f" } [dev-dependencies] tokio = { version = "1", features = ["io-std", "io-util"] } diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index 03a21107..94aad158 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -1,6 +1,6 @@ use std::net::IpAddr; -use super::{Address, FirewallRule, Port, Protocol}; +use super::{Address, FirewallError, FirewallRule, Policy, Port, Protocol}; pub struct FirewallApi { pub ifname: String, @@ -15,8 +15,8 @@ impl FirewallApi { } pub trait FirewallManagementApi { - fn setup(&self); - fn clear(&self); - fn apply_rule(&self, rule: FirewallRule); - fn set_default_action(&self, allow: bool); + fn setup(&self) -> Result<(), FirewallError>; + fn clear(&self) -> Result<(), FirewallError>; + fn apply_rule(&self, rule: FirewallRule) -> Result<(), FirewallError>; + fn set_default_policy(&self, policy: Policy) -> Result<(), FirewallError>; } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 3b2376da..2795eddd 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -2,43 +2,22 @@ pub mod netfilter; use std::sync::atomic::{AtomicU32, Ordering}; -use mnl::mnl_sys::libc::c_char; use netfilter::{ allow_established_traffic, apply_filter_rules, clear_chains, init_firewall, masq_interface, - set_default_action, + set_default_policy, }; -use nftnl::{expr::Expression, nftnl_sys, Rule}; use super::{ api::{FirewallApi, FirewallManagementApi}, - proto, Address, FirewallRule, Port, Protocol, + proto, Address, FirewallError, FirewallRule, Policy, Port, Protocol, }; static SET_ID_COUNTER: AtomicU32 = AtomicU32::new(0); pub fn get_set_id() -> u32 { - println!("SET_ID_COUNTER: {:?}", SET_ID_COUNTER); SET_ID_COUNTER.fetch_add(1, Ordering::SeqCst) } -#[derive(Debug, Default)] -pub enum Action { - Accept, - Drop, - #[default] - None, -} - -impl From for Action { - fn from(allow: bool) -> Self { - if allow { - Self::Accept - } else { - Self::Drop - } - } -} - #[derive(Debug, Default)] pub enum State { #[default] @@ -57,37 +36,41 @@ pub struct FilterRule { pub protocols: Vec, pub oifname: Option, pub iifname: Option, - pub action: Action, + pub action: Policy, pub states: Vec, pub counter: bool, - pub id: u32, + // The ID of the associated Defguard rule. + // The filter rules may not always be a 1:1 representation of the Defguard rules, so + // this value helps to keep track of them. + pub defguard_rule_id: i64, pub v4: bool, } impl FirewallManagementApi for FirewallApi { - fn setup(&self) { - println!("Initializing firewall for interface {}", self.ifname); + fn setup(&self) -> Result<(), FirewallError> { + debug!("Initializing firewall, VPN interface: {}", self.ifname); init_firewall().expect("Failed to setup chains"); masq_interface(&self.ifname).expect("Failed to masquerade interface"); - allow_established_traffic(&self.ifname); + allow_established_traffic(&self.ifname)?; + info!("Firewall initialized"); + Ok(()) } - fn clear(&self) { - println!("Cleaning up firewall for interface {}", self.ifname); - clear_chains(); + fn clear(&self) -> Result<(), FirewallError> { + debug!("Removing all firewall rules"); + clear_chains()?; + info!("Removed all firewall rules"); + Ok(()) } - fn set_default_action(&self, allow: bool) { - println!( - "Setting default action to {} for interface {}", - if allow { "allow" } else { "drop" }, - self.ifname - ); - - set_default_action(allow); + fn set_default_policy(&self, policy: Policy) -> Result<(), FirewallError> { + debug!("Setting default firewall policy to: {:?}", policy); + set_default_policy(policy)?; + info!("Set firewall default policy to {:?}", policy); + Ok(()) } - fn apply_rule(&self, rule: FirewallRule) { + fn apply_rule(&self, rule: FirewallRule) -> Result<(), FirewallError> { let mut rules = vec![]; if rule.destination_ports.is_empty() { @@ -95,9 +78,10 @@ impl FirewallManagementApi for FirewallApi { src_ips: rule.source_addrs, dest_ips: rule.destination_addrs, protocols: rule.protocols, - action: rule.allow.into(), + action: rule.verdict, counter: true, - id: rule.id, + defguard_rule_id: rule.id, + v4: rule.v4, ..Default::default() }; rules.push(rule); @@ -109,9 +93,10 @@ impl FirewallManagementApi for FirewallApi { dest_ips: rule.destination_addrs.clone(), dest_ports: rule.destination_ports.clone(), protocols: vec![protocol], - action: rule.allow.into(), + action: rule.verdict, counter: true, - id: rule.id, + defguard_rule_id: rule.id, + v4: rule.v4, ..Default::default() }; rules.push(rule); @@ -120,9 +105,10 @@ impl FirewallManagementApi for FirewallApi { src_ips: rule.source_addrs.clone(), dest_ips: rule.destination_addrs.clone(), protocols: vec![protocol], - action: rule.allow.into(), + action: rule.verdict, counter: true, - id: rule.id, + defguard_rule_id: rule.id, + v4: rule.v4, ..Default::default() }; rules.push(rule); @@ -130,6 +116,8 @@ impl FirewallManagementApi for FirewallApi { } } - apply_filter_rules(rules); + apply_filter_rules(rules)?; + + Ok(()) } } diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 268a114f..0c844fe8 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -20,9 +20,9 @@ use nftnl::{ set::{Set, SetKey}, Batch, Chain, FinalizedBatch, ProtoFamily, Rule, Table, }; -use rand::{random, rngs::OsRng, Rng}; -use super::{get_set_id, proto, Action, Address, FilterRule, Port, Protocol, State}; +use super::{get_set_id, proto, Address, FilterRule, Policy, Port, Protocol, State}; +use crate::enterprise::firewall::FirewallError; const FILTER_TABLE: &str = "filter"; const NAT_TABLE: &str = "nat"; @@ -30,71 +30,7 @@ const DEFGUARD_TABLE: &str = "DEFGUARD"; const POSTROUTING_CHAIN: &str = "POSTROUTING"; const FORWARD_CHAIN: &str = "FORWARD"; -macro_rules! try_alloc { - ($e:expr) => {{ - let ptr = $e; - if ptr.is_null() { - std::process::abort(); - } - ptr - }}; -} - -pub struct Comment; - -impl Expression for Comment { - fn to_expr(&self, _rule: &Rule) -> *mut nftnl_sys::nftnl_expr { - try_alloc!(unsafe { - nftnl_sys::nftnl_expr_alloc(b"comment\0" as *const _ as *const c_char) - }) - } -} - -pub fn put_comment(rule: &mut Rule, comment: &str) { - let udata_buf = try_alloc!(unsafe { nftnl_udata_buf_alloc(256) }); - - let comment = &CString::new(comment).unwrap(); - unsafe { nftnl_sys::nftnl_udata_put_strz(udata_buf, 0, comment.as_ptr()) }; - - unsafe { - let data = nftnl_udata_buf_data(udata_buf) as *const c_void; - let data_len = nftnl_udata_buf_len(udata_buf); - nftnl_sys::nftnl_rule_set_data(rule.as_ptr(), NFTNL_RULE_USERDATA as u16, data, data_len); - nftnl_sys::nftnl_udata_buf_free(udata_buf); - } -} - -#[derive(Debug, Clone)] -pub enum AddressMatch { - IpList(Vec), - IpRange(IpAddr, IpAddr), - Network(IpNetwork), -} - -impl AddressMatch { - pub fn is_empty(&self) -> bool { - match self { - Self::IpList(list) => list.is_empty(), - _ => false, - } - } -} - -impl Default for AddressMatch { - fn default() -> Self { - Self::IpList(Vec::new()) - } -} - -impl From
for AddressMatch { - fn from(address: Address) -> Self { - match address { - Address::Ip(ip) => Self::IpList(vec![ip]), - Address::Network(network) => Self::Network(network), - Address::Range(start, end) => Self::IpRange(start, end), - } - } -} +const ANON_SET_NAME: &str = "__set%d"; struct InetService(u16); @@ -118,30 +54,24 @@ impl State { } } -impl From for Protocol { - fn from(proto: proto::enterprise::Protocol) -> Self { +impl Protocol { + pub const fn from_proto(proto: proto::enterprise::Protocol) -> Result { match proto { - proto::enterprise::Protocol::Tcp => Self(libc::IPPROTO_TCP as u8), - proto::enterprise::Protocol::Udp => Self(libc::IPPROTO_UDP as u8), - proto::enterprise::Protocol::Icmp => Self(libc::IPPROTO_ICMP as u8), - _ => { - println!("Unsupported protocol: {:?}", proto); - panic!(); - } + proto::enterprise::Protocol::Tcp => Ok(Self(libc::IPPROTO_TCP as u8)), + proto::enterprise::Protocol::Udp => Ok(Self(libc::IPPROTO_UDP as u8)), + proto::enterprise::Protocol::Icmp => Ok(Self(libc::IPPROTO_ICMP as u8)), } } -} -impl Protocol { pub fn supports_ports(&self) -> bool { - matches!(self.0 as i32, libc::IPPROTO_TCP | libc::IPPROTO_UDP) + matches!(self.0.into(), libc::IPPROTO_TCP | libc::IPPROTO_UDP) } - pub fn to_port_payload_expr(&self) -> &impl Expression { - match self.0 as i32 { - libc::IPPROTO_TCP => &nft_expr!(payload tcp dport), - libc::IPPROTO_UDP => &nft_expr!(payload udp dport), - _ => panic!("Unsupported protocol"), + pub fn to_port_payload_expr(&self) -> Result<&impl Expression, FirewallError> { + match self.0.into() { + libc::IPPROTO_TCP => Ok(&nft_expr!(payload tcp dport)), + libc::IPPROTO_UDP => Ok(&nft_expr!(payload udp dport)), + _ => Err(FirewallError::UnsupportedProtocol(self.0)), } } } @@ -156,25 +86,29 @@ impl SetKey for Protocol { } pub trait FirewallRule { - fn to_chain_rule<'a>(&self, chain: &'a Chain, batch: &mut Batch) -> Rule<'a>; + fn to_chain_rule<'a>( + &self, + chain: &'a Chain, + batch: &mut Batch, + ) -> Result, FirewallError>; } -fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) { +fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) -> Result<(), FirewallError> { match ip { Address::Ip(ip) => match ip { IpAddr::V4(ip) => { - add_to_set(set, ip, Some(ip)); + add_to_set(set, ip, Some(ip))?; } IpAddr::V6(ip) => { - add_to_set(set, ip, Some(ip)); + add_to_set(set, ip, Some(ip))?; } }, Address::Range(start, end) => match (start, end) { (IpAddr::V4(start), IpAddr::V4(end)) => { - add_to_set(set, start, Some(end)); + add_to_set(set, start, Some(end))?; } (IpAddr::V6(start), IpAddr::V6(end)) => { - add_to_set(set, start, Some(end)); + add_to_set(set, start, Some(end))?; } _ => panic!("Expected both addresses to be of the same type"), }, @@ -183,40 +117,51 @@ fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) { let net = network.network(); match (net, upper_bound) { (IpAddr::V4(network), IpAddr::V4(upper_bound)) => { - add_to_set(set, &network, Some(&upper_bound)); + add_to_set(set, &network, Some(&upper_bound))?; } (IpAddr::V6(network), IpAddr::V6(upper_bound)) => { - add_to_set(set, &network, Some(&upper_bound)); + add_to_set(set, &network, Some(&upper_bound))?; } _ => panic!("Expected both addresses to be of the same type"), } } } + + Ok(()) } -fn add_port_to_set(set: *mut nftnl_sys::nftnl_set, port: &Port) { +fn add_port_to_set(set: *mut nftnl_sys::nftnl_set, port: &Port) -> Result<(), FirewallError> { match port { Port::Single(port) => { let inet_service = InetService(*port); - add_to_set(set, &inet_service, Some(&inet_service)); + add_to_set(set, &inet_service, Some(&inet_service))?; } Port::Range(start, end) => { let start = InetService(*start); let end = InetService(*end); - add_to_set(set, &start, Some(&end)); + add_to_set(set, &start, Some(&end))?; } } + + Ok(()) } -fn add_protocol_to_set(set: *mut nftnl_sys::nftnl_set, proto: &Protocol) { - add_to_set(set, proto, None); +fn add_protocol_to_set( + set: *mut nftnl_sys::nftnl_set, + proto: &Protocol, +) -> Result<(), FirewallError> { + add_to_set(set, proto, None)?; + Ok(()) } impl FirewallRule for FilterRule { - fn to_chain_rule<'a>(&self, chain: &'a Chain, batch: &mut Batch) -> Rule<'a> { + fn to_chain_rule<'a>( + &self, + chain: &'a Chain, + batch: &mut Batch, + ) -> Result, FirewallError> { let mut rule = Rule::new(chain); - let v4 = true; if !self.dest_ports.is_empty() && self.protocols.len() > 1 { panic!("Cannot specify multiple protocols with destination ports"); @@ -224,12 +169,12 @@ impl FirewallRule for FilterRule { // TODO: Reduce code duplication here if !self.src_ips.is_empty() { - if v4 { - let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); + if self.v4 { + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); for ip in &self.src_ips { - add_address_to_set(set.as_ptr(), ip); + add_address_to_set(set.as_ptr(), ip)?; } set.elems_iter().for_each(|elem| { @@ -242,11 +187,11 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(lookup & set)); } else { - let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); for ip in &self.src_ips { - add_address_to_set(set.as_ptr(), ip); + add_address_to_set(set.as_ptr(), ip)?; } set.elems_iter().for_each(|elem| { @@ -263,12 +208,12 @@ impl FirewallRule for FilterRule { // TODO: Reduce code duplication here if !self.dest_ips.is_empty() { - if v4 { - let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); + if self.v4 { + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); for ip in &self.dest_ips { - add_address_to_set(set.as_ptr(), ip); + add_address_to_set(set.as_ptr(), ip)?; } set.elems_iter().for_each(|elem| { @@ -281,11 +226,11 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(lookup & set)); } else { - let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); for ip in &self.dest_ips { - add_address_to_set(set.as_ptr(), ip); + add_address_to_set(set.as_ptr(), ip)?; } set.elems_iter().for_each(|elem| { @@ -304,11 +249,11 @@ impl FirewallRule for FilterRule { // > 0 Protocols // 0 Ports if self.protocols.len() > 1 { - let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, false); + let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, false)?; batch.add(&set, nftnl::MsgType::Add); for proto in &self.protocols { - add_protocol_to_set(set.as_ptr(), proto); + add_protocol_to_set(set.as_ptr(), proto)?; } set.elems_iter().for_each(|elem| { @@ -317,7 +262,7 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(meta nfproto)); - if v4 { + if self.v4 { rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); rule.add_expr(&nft_expr!(payload ipv4 protocol)); } else { @@ -335,29 +280,20 @@ impl FirewallRule for FilterRule { println!("Protocol: {:?}", protocol); let set = - new_anon_set::(chain.get_table(), ProtoFamily::Inet, true); + new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); for port in &self.dest_ports { - add_port_to_set(set.as_ptr(), port); + add_port_to_set(set.as_ptr(), port)?; } set.elems_iter().for_each(|elem| { batch.add(&elem, nftnl::MsgType::Add); }); - // rule.add_expr(&nft_expr!(meta l4proto)); - // if tcp { - // rule.add_expr(&nft_expr!(cmp == libc::IPPROTO_TCP as u8)); - // rule.add_expr(&nft_expr!(payload tcp dport)); - // } else { - // rule.add_expr(&nft_expr!(cmp == libc::IPPROTO_UDP as u8)); - // rule.add_expr(&nft_expr!(payload udp dport)); - // } - rule.add_expr(&nft_expr!(meta l4proto)); rule.add_expr(&nft_expr!(cmp == protocol.0)); - rule.add_expr(protocol.to_port_payload_expr()); + rule.add_expr(protocol.to_port_payload_expr()?); rule.add_expr(&nft_expr!(lookup & set)); } } @@ -366,7 +302,7 @@ impl FirewallRule for FilterRule { else if let Some(protocol) = self.protocols.first() { rule.add_expr(&nft_expr!(meta nfproto)); - if v4 { + if self.v4 { rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); rule.add_expr(&nft_expr!(payload ipv4 protocol)); } else { @@ -405,20 +341,25 @@ impl FirewallRule for FilterRule { } match self.action { - Action::Accept => { + Policy::Allow => { rule.add_expr(&nft_expr!(verdict accept)); } - Action::Drop => { + Policy::Deny => { rule.add_expr(&nft_expr!(verdict drop)); } - Action::None => {} + Policy::None => {} } - // comment test - let comment = format!("Rule ID: {}", self.id); - put_comment(&mut rule, &comment); + rule.add_expr(&nft_expr!(verdict accept)); - rule + let comment_string = format!("Rule ID: {}", self.defguard_rule_id); + let error_msg = format!("Failed to create CString from string {comment_string}"); + let comment = &CString::new(comment_string) + .map_err(|e| FirewallError::NetlinkError(format!("{error_msg}. Details: {e}")))?; + // The comment may have up to 256 chars, but we won't reach the limit with the rule ID + rule.set_comment(comment); + + Ok(rule) } } @@ -432,7 +373,11 @@ struct NatRule { } impl FirewallRule for NatRule { - fn to_chain_rule<'a>(&self, chain: &'a Chain, _batch: &mut Batch) -> Rule<'a> { + fn to_chain_rule<'a>( + &self, + chain: &'a Chain, + _batch: &mut Batch, + ) -> Result, FirewallError> { let mut rule = Rule::new(chain); if let Some(src_ip) = self.src_ip { @@ -471,25 +416,28 @@ impl FirewallRule for NatRule { rule.add_expr(&nft_expr!(masquerade)); - rule + Ok(rule) } } struct JumpRule; impl JumpRule { - fn to_chain_rule<'a>(src_chain: &'a Chain, dest_chain: &'a Chain) -> Rule<'a> { + fn to_chain_rule<'a>( + src_chain: &'a Chain, + dest_chain: &'a Chain, + ) -> Result, FirewallError> { let mut rule = Rule::new(src_chain); rule.add_expr(&nft_expr!(counter)); rule.add_expr(&nft_expr!(verdict jump dest_chain.get_name().into())); - rule + Ok(rule) } } /// Sets up the default chains for the firewall -pub fn init_firewall() -> io::Result<()> { +pub fn init_firewall() -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); @@ -512,24 +460,25 @@ pub fn init_firewall() -> io::Result<()> { let finalized_batch = batch.finalize(); - send_batch(&finalized_batch); + send_batch(&finalized_batch)?; Ok(()) } -pub fn clear_chains() { +pub fn clear_chains() -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); batch.add(&table, nftnl::MsgType::Del); let finalized_batch = batch.finalize(); + send_batch(&finalized_batch)?; - send_batch(&finalized_batch); + Ok(()) } /// Applies masquerade on the specified interface for the outgoing packets -pub fn masq_interface(ifname: &str) -> io::Result<()> { +pub fn masq_interface(ifname: &str) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -542,23 +491,23 @@ pub fn masq_interface(ifname: &str) -> io::Result<()> { counter: true, ..Default::default() } - .to_chain_rule(&post_routing, &mut batch); + .to_chain_rule(&post_routing, &mut batch)?; batch.add(&nat_rule, nftnl::MsgType::Add); let finalized_batch = batch.finalize(); - send_batch(&finalized_batch); + send_batch(&finalized_batch)?; Ok(()) } -pub fn set_default_action(allow: bool) { +pub fn set_default_policy(policy: Policy) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); let mut forward_chain = Chains::Forward.to_chain(&table); - forward_chain.set_policy(if allow { + forward_chain.set_policy(if policy == Policy::Allow { nftnl::Policy::Accept } else { nftnl::Policy::Drop @@ -566,10 +515,12 @@ pub fn set_default_action(allow: bool) { batch.add(&forward_chain, nftnl::MsgType::Add); let finalized_batch = batch.finalize(); - send_batch(&finalized_batch); + send_batch(&finalized_batch)?; + + Ok(()) } -pub fn allow_established_traffic(ifname: &str) { +pub fn allow_established_traffic(ifname: &str) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -581,15 +532,17 @@ pub fn allow_established_traffic(ifname: &str) { states: vec![State::Established, State::Related], iifname: Some(ifname.to_string()), counter: true, - action: Action::Accept, + action: Policy::Allow, ..Default::default() } - .to_chain_rule(&forward_chain, &mut batch); + .to_chain_rule(&forward_chain, &mut batch)?; batch.add(&established_rule, nftnl::MsgType::Add); let finalized_batch = batch.finalize(); - send_batch(&finalized_batch); + send_batch(&finalized_batch)?; + + Ok(()) } pub enum Tables { @@ -601,9 +554,21 @@ pub enum Tables { impl Tables { fn to_table(&self) -> Table { match self { - Self::Filter(family) => Table::new(&CString::new(FILTER_TABLE).unwrap(), *family), - Self::Nat(family) => Table::new(&CString::new(NAT_TABLE).unwrap(), *family), - Self::Defguard(family) => Table::new(&CString::new(DEFGUARD_TABLE).unwrap(), *family), + Self::Filter(family) => Table::new( + &CString::new(FILTER_TABLE) + .expect("Failed to create CString from FILTER_TABLE constant."), + *family, + ), + Self::Nat(family) => Table::new( + &CString::new(NAT_TABLE) + .expect("Failed to create CString from NAT_TABLE constant."), + *family, + ), + Self::Defguard(family) => Table::new( + &CString::new(DEFGUARD_TABLE) + .expect("Failed to create CString from DEFGUARD_TABLE constant."), + *family, + ), } } } @@ -616,13 +581,21 @@ pub enum Chains { impl Chains { fn to_chain<'a>(&self, table: &'a Table) -> Chain<'a> { match self { - Self::Forward => Chain::new(&CString::new(FORWARD_CHAIN).unwrap(), table), - Self::Postrouting => Chain::new(&CString::new(POSTROUTING_CHAIN).unwrap(), table), + Self::Forward => Chain::new( + &CString::new(FORWARD_CHAIN) + .expect("Failed to create CString from FORWARD_CHAIN constant."), + table, + ), + Self::Postrouting => Chain::new( + &CString::new(POSTROUTING_CHAIN) + .expect("Failed to create CString from POSTROUTING_CHAIN constant."), + table, + ), } } } -pub fn apply_filter_rules(rules: Vec) { +pub fn apply_filter_rules(rules: Vec) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -631,44 +604,62 @@ pub fn apply_filter_rules(rules: Vec) { batch.add(&forward_chain, nftnl::MsgType::Add); for rule in rules.iter() { - let chain_rule = rule.to_chain_rule(&forward_chain, &mut batch); + let chain_rule = rule.to_chain_rule(&forward_chain, &mut batch)?; batch.add(&chain_rule, nftnl::MsgType::Add); } let finalized_batch = batch.finalize(); - send_batch(&finalized_batch); + send_batch(&finalized_batch)?; + + Ok(()) } -fn send_batch(batch: &FinalizedBatch) { - let socket = mnl::Socket::new(mnl::Bus::Netfilter).unwrap(); - socket.send_all(batch).unwrap(); +fn send_batch(batch: &FinalizedBatch) -> Result<(), FirewallError> { + let socket = mnl::Socket::new(mnl::Bus::Netfilter) + .map_err(|e| FirewallError::NetlinkError(format!("Failed to create socket: {e:?}")))?; + socket.send_all(batch).map_err(|e| { + FirewallError::NetlinkError(format!("Failed to send batch through socket: {e:?}")) + })?; let portid = socket.portid(); let mut buffer = vec![0; nftnl::nft_nlmsg_maxsize() as usize]; // TODO: Why is it 2? let seq = 2; - while let Some(message) = socket_recv(&socket, &mut buffer[..]) { - match mnl::cb_run(message, seq, portid).unwrap() { - mnl::CbResult::Stop => { + while let Some(message) = socket_recv(&socket, &mut buffer[..])? { + match mnl::cb_run(message, seq, portid) { + Ok(mnl::CbResult::Stop) => { println!("STOP"); break; } - mnl::CbResult::Ok => { + Ok(mnl::CbResult::Ok) => { println!("OK"); } + Err(err) => { + return Err(FirewallError::NetlinkError(format!( + "There was an error while sending netlink messages: {err:?}" + ))) + } }; } + + Ok(()) } -fn socket_recv<'a>(socket: &mnl::Socket, buf: &'a mut [u8]) -> Option<&'a [u8]> { - let ret = socket.recv(buf).unwrap(); - println!("Received {} bytes", ret); +fn socket_recv<'a>( + socket: &mnl::Socket, + buf: &'a mut [u8], +) -> Result, FirewallError> { + let ret = socket.recv(buf).map_err(|err| { + FirewallError::NetlinkError(format!( + "Failed while reading a message from socket: {err:?}" + )) + })?; if ret > 0 { - Some(&buf[..ret]) + Ok(Some(&buf[..ret])) } else { - None + Ok(None) } } @@ -693,12 +684,17 @@ fn max_address(network: &IpNetwork) -> IpAddr { } } -fn new_anon_set(table: &Table, family: ProtoFamily, interval_set: bool) -> Set +fn new_anon_set( + table: &Table, + family: ProtoFamily, + interval_set: bool, +) -> Result, FirewallError> where T: SetKey, { let set = Set::::new( - &CString::new("__set%d").unwrap(), + &CString::new(ANON_SET_NAME) + .expect("Failed to create CString from ANON_SET_NAME constant."), get_set_id(), table, family, @@ -714,21 +710,28 @@ where } } - set + Ok(set) } /// Adds key to a set. If the range_end option is specified, it will assume the lower and upper /// bounds of a range need to be added. -fn add_to_set(set: *mut nftnl_sys::nftnl_set, key: &K, range_end: Option<&K>) +fn add_to_set( + set: *mut nftnl_sys::nftnl_set, + key: &K, + range_end: Option<&K>, +) -> Result<(), FirewallError> where K: SetKey, { let key_data = key.data(); let key_data_len = key_data.len() as u32; - unsafe { let elem = nftnl_sys::nftnl_set_elem_alloc(); - assert!(!elem.is_null(), "oom"); + if elem.is_null() { + return Err(FirewallError::OutOfMemory( + "Failed to allocate memory for set element".to_string(), + )); + } nftnl_sys::nftnl_set_elem_set( elem, nftnl_sys::NFTNL_SET_ELEM_KEY as u16, @@ -746,7 +749,11 @@ where let end_data_len = (end_data.len()) as u32; let elem = nftnl_sys::nftnl_set_elem_alloc(); - assert!(!elem.is_null(), "oom"); + if elem.is_null() { + return Err(FirewallError::OutOfMemory( + "Failed to allocate memory for set element".to_string(), + )); + } nftnl_sys::nftnl_set_elem_set( elem, nftnl_sys::NFTNL_SET_ELEM_KEY as u16, @@ -761,6 +768,8 @@ where nftnl_sys::nftnl_set_elem_add(set, elem); } } + + Ok(()) } fn increment_bytes(bytes: &mut [u8]) { diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index ea076187..b6c3fd5e 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -1,6 +1,7 @@ use std::{net::IpAddr, str::FromStr}; use ipnetwork::IpNetwork; +use thiserror::Error; use crate::proto; @@ -15,23 +16,32 @@ pub enum Address { Range(IpAddr, IpAddr), } -impl TryFrom<&proto::enterprise::IpAddress> for Address { - type Error = &'static str; - - fn try_from(ip: &proto::enterprise::IpAddress) -> Result { +impl Address { + pub fn from_proto(ip: &proto::enterprise::IpAddress) -> Result { match &ip.address { - Some(proto::enterprise::ip_address::Address::Ip(ip)) => Ok(Self::Ip( - IpAddr::from_str(ip).map_err(|_| "Invalid IP format")?, - )), - Some(proto::enterprise::ip_address::Address::IpSubnet(network)) => { - Ok(Self::Network(IpNetwork::from_str(network).unwrap())) + Some(proto::enterprise::ip_address::Address::Ip(ip)) => { + Ok(Self::Ip(IpAddr::from_str(ip).map_err(|err| { + FirewallError::TypeConversionError(format!("Invalid IP format: {}", err)) + })?)) } + Some(proto::enterprise::ip_address::Address::IpSubnet(network)) => Ok(Self::Network( + IpNetwork::from_str(network).map_err(|err| { + FirewallError::TypeConversionError(format!("Invalid subnet format: {}", err)) + })?, + )), Some(proto::enterprise::ip_address::Address::IpRange(range)) => { - let start = IpAddr::from_str(&range.start).unwrap(); - let end = IpAddr::from_str(&range.end).unwrap(); + let start = IpAddr::from_str(&range.start).map_err(|err| { + FirewallError::TypeConversionError(format!("Invalid IP format: {}", err)) + })?; + let end = IpAddr::from_str(&range.end).map_err(|err| { + FirewallError::TypeConversionError(format!("Invalid IP format: {}", err)) + })?; Ok(Self::Range(start, end)) } - _ => Err("Invalid address"), + _ => Err(FirewallError::TypeConversionError(format!( + "Invalid IP address type. Must be one of Ip, IpSubnet, IpRange. Instead got {:?}", + ip.address + ))), } } } @@ -42,17 +52,37 @@ pub enum Port { Range(u16, u16), } -impl From<&proto::enterprise::Port> for Port { - fn from(port: &proto::enterprise::Port) -> Self { +impl Port { + pub fn from_proto(port: &proto::enterprise::Port) -> Result { match &port.port { Some(proto::enterprise::port::Port::SinglePort(port)) => { - Self::Single(u16::try_from(*port).unwrap()) + let port_u16 = u16::try_from(*port).map_err(|err| { + FirewallError::TypeConversionError(format!( + "Invalid port number ({}): {}", + port, err + )) + })?; + Ok(Self::Single(port_u16)) } - Some(proto::enterprise::port::Port::PortRange(range)) => Self::Range( - u16::try_from(range.start).unwrap(), - u16::try_from(range.end).unwrap(), - ), - _ => panic!("Invalid port"), + Some(proto::enterprise::port::Port::PortRange(range)) => { + let start_u16 = u16::try_from(range.start).map_err(|err| { + FirewallError::TypeConversionError(format!( + "Invalid range start port number ({}): {}", + range.start, err + )) + })?; + let end_u16 = u16::try_from(range.end).map_err(|err| { + FirewallError::TypeConversionError(format!( + "Invalid range end port number ({}): {}", + range.end, err + )) + })?; + Ok(Self::Range(start_u16, end_u16)) + } + _ => Err(FirewallError::TypeConversionError(format!( + "Invalid port type. Must be one of SinglePort, PortRange. Instead got: {:?}", + port.port + ))), } } } @@ -60,66 +90,127 @@ impl From<&proto::enterprise::Port> for Port { #[derive(Debug, Copy, Clone)] pub struct Protocol(pub u8); +#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)] +pub enum Policy { + Allow, + Deny, + #[default] + None, +} + +impl From for Policy { + fn from(allow: bool) -> Self { + if allow { + Self::Allow + } else { + Self::Deny + } + } +} + +impl Policy { + pub const fn from_proto(verdict: proto::enterprise::FirewallPolicy) -> Self { + match verdict { + proto::enterprise::FirewallPolicy::Allow => Self::Allow, + proto::enterprise::FirewallPolicy::Deny => Self::Deny, + } + } +} + +#[derive(Debug)] pub struct FirewallRule { - pub id: u32, - pub source_addrs: Vec
, + pub comment: Option, pub destination_addrs: Vec
, pub destination_ports: Vec, + pub id: i64, + pub verdict: Policy, pub protocols: Vec, - pub allow: bool, + pub source_addrs: Vec
, pub v4: bool, - pub comment: Option, } pub struct FirewallConfig { pub rules: Vec, - pub default_action: bool, + pub default_policy: Policy, } -impl From for FirewallConfig { - fn from(config: proto::enterprise::FirewallConfig) -> Self { - let rules = config - .rules - .into_iter() - .map(|rule| FirewallRule { - // FIXME: Do something else here - id: rule.id as u32, - source_addrs: rule - .source_addr - .into_iter() - .map(|addr| Address::try_from(&addr).unwrap()) - .collect(), - destination_addrs: rule - .destination_addr - .into_iter() - .map(|addr| Address::try_from(&addr).unwrap()) - .collect(), - destination_ports: rule - .destination_port - .into_iter() - .map(|port| Port::from(&port)) - .collect(), - protocols: rule - .protocol - .into_iter() - .map(|proto| { - proto::enterprise::Protocol::try_from(proto) - .unwrap_or_else(|_| { - panic!("Unsupported protocol: {:?}", proto); - }) - .into() - }) - .collect(), - allow: rule.verdict == proto::enterprise::FirewallPolicy::Allow as i32, - v4: config.ip_version == proto::enterprise::IpVersion::Ipv4 as i32, +impl FirewallConfig { + pub fn from_proto(config: proto::enterprise::FirewallConfig) -> Result { + debug!("Parsing following received proto configuration: {config:?}"); + let mut rules = vec![]; + let v4 = config.ip_version == proto::enterprise::IpVersion::Ipv4 as i32; + let default_policy = + Policy::from_proto(config.default_policy.try_into().map_err(|err| { + FirewallError::TypeConversionError(format!("Invalid default policy: {:?}", err)) + })?); + debug!("Using IPv4: {v4:?}, default firewall policy defined: {default_policy:?}. Proceeding to parsing rules..."); + + for rule in config.rules { + debug!("Parsing the following received proto rule: {rule:?}"); + let mut source_addrs = vec![]; + let mut destination_addrs = vec![]; + let mut destination_ports = vec![]; + let mut protocols = vec![]; + + for addr in rule.source_addrs { + source_addrs.push(Address::from_proto(&addr)?); + } + + for addr in rule.destination_addrs { + destination_addrs.push(Address::from_proto(&addr)?); + } + + for port in rule.destination_ports { + destination_ports.push(Port::from_proto(&port)?); + } + + for protocol in rule.protocols { + protocols.push(Protocol::from_proto( + // Since the protocol is an i32, convert it to the proto enum variant first + proto::enterprise::Protocol::try_from(protocol).map_err(|err| { + FirewallError::TypeConversionError(format!( + "Invalid protocol: {:?}. Details: {:?}", + protocol, err + )) + })?, + )?); + } + + let verdict = Policy::from_proto(rule.verdict.try_into().map_err(|err| { + FirewallError::TypeConversionError(format!("Invalid rule verdict: {:?}", err)) + })?); + + let firewall_rule = FirewallRule { + id: rule.id, + source_addrs, + destination_addrs, + destination_ports, + protocols, + verdict, + v4, comment: rule.comment, - }) - .collect(); + }; - Self { - rules, - default_action: config.default_policy - == proto::enterprise::FirewallPolicy::Allow as i32, + debug!("Parsed received proto rule as: {firewall_rule:?}"); + + rules.push(firewall_rule); } + + Ok(Self { + rules, + default_policy, + }) } } + +#[derive(Debug, Error)] +pub enum FirewallError { + #[error("Type conversion error: {0}")] + TypeConversionError(String), + #[error("Out of memory: {0}")] + OutOfMemory(String), + #[error("Unsupported protocol: {0}")] + UnsupportedProtocol(u8), + #[error("Netlink error: {0}")] + NetlinkError(String), +} diff --git a/src/error.rs b/src/error.rs index e03cfa88..d05e5d45 100644 --- a/src/error.rs +++ b/src/error.rs @@ -1,6 +1,8 @@ use defguard_wireguard_rs::error::WireguardInterfaceError; use thiserror::Error; +use crate::enterprise::firewall::FirewallError; + #[derive(Debug, Error)] pub enum GatewayError { #[error("Command {command} execution failed. Error: {error}")] @@ -38,4 +40,7 @@ pub enum GatewayError { #[error(transparent)] IoError(#[from] std::io::Error), + + #[error("Firewall error: {0}")] + FirewallError(#[from] FirewallError), } From 17f9e1d22d2792255d753369e994f6592612717e Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 27 Feb 2025 12:10:28 +0100 Subject: [PATCH 04/32] proto update, gateway communication --- build.rs | 4 +- examples/server.rs | 47 ++-- proto | 2 +- src/enterprise/firewall/api.rs | 50 ++++- src/enterprise/firewall/linux/mod.rs | 106 +++++++-- src/enterprise/firewall/linux/netfilter.rs | 249 ++++++++++++++------- src/enterprise/firewall/mod.rs | 59 +++-- src/gateway.rs | 198 +++++++++++++--- src/lib.rs | 21 +- src/main.rs | 13 +- 10 files changed, 551 insertions(+), 198 deletions(-) diff --git a/build.rs b/build.rs index 93c173f7..f64a2177 100644 --- a/build.rs +++ b/build.rs @@ -13,9 +13,9 @@ fn main() -> Result<(), Box> { config, &[ "proto/wireguard/gateway.proto", - "proto/enterprise/firewall.proto", + "proto/enterprise/firewall/firewall.proto", ], - &["proto/wireguard", "proto/enterprise"], + &["proto/wireguard", "proto/enterprise/firewall"], )?; Ok(()) } diff --git a/examples/server.rs b/examples/server.rs index fb057ab7..466003bc 100644 --- a/examples/server.rs +++ b/examples/server.rs @@ -27,7 +27,7 @@ pub struct HostConfig { host: Host, } -type ClientMap = HashMap>>; +type ClientMap = HashMap>>; struct GatewayServer { config_rx: Receiver, @@ -42,12 +42,12 @@ impl GatewayServer { tokio::spawn(async move { while task_config_rx.changed().await.is_ok() { let config = (&*task_config_rx.borrow()).into(); - let update = proto::Update { - update_type: proto::UpdateType::Modify as i32, - update: Some(proto::update::Update::Network(config)), + let update = proto::gateway::Update { + update_type: proto::gateway::UpdateType::Modify as i32, + update: Some(proto::gateway::update::Update::Network(config)), }; task_clients.lock().unwrap().retain( - move |_addr, tx: &mut UnboundedSender>| { + move |_addr, tx: &mut UnboundedSender>| { tx.send(Ok(update.clone())).is_ok() }, ); @@ -58,7 +58,7 @@ impl GatewayServer { } } -impl From<&HostConfig> for proto::Configuration { +impl From<&HostConfig> for proto::gateway::Configuration { fn from(host_config: &HostConfig) -> Self { Self { name: host_config.name.clone(), @@ -80,18 +80,19 @@ impl From<&HostConfig> for proto::Configuration { .values() .map(|peer| peer.into()) .collect(), + firewall_config: None, } } } #[tonic::async_trait] -impl proto::gateway_service_server::GatewayService for GatewayServer { - type UpdatesStream = UnboundedReceiverStream>; +impl proto::gateway::gateway_service_server::GatewayService for GatewayServer { + type UpdatesStream = UnboundedReceiverStream>; async fn config( &self, - request: Request, - ) -> Result, Status> { + request: Request, + ) -> Result, Status> { let address = request.remote_addr().unwrap(); eprintln!("CONFIG connected from: {address}"); Ok(Response::new((&*self.config_rx.borrow()).into())) @@ -99,7 +100,7 @@ impl proto::gateway_service_server::GatewayService for GatewayServer { async fn stats( &self, - request: Request>, + request: Request>, ) -> Result, Status> { let address = request.remote_addr().unwrap(); eprintln!("STATS connected from: {address}"); @@ -158,12 +159,15 @@ pub async fn cli(tx: Sender, clients: Arc>) { if let Ok(key) = Key::try_from(key) { let peer = Peer::new(key.clone()); - let update = proto::Update { - update_type: proto::UpdateType::Create as i32, - update: Some(proto::update::Update::Peer((&peer).into())), + let update = proto::gateway::Update { + update_type: proto::gateway::UpdateType::Create as i32, + update: Some(proto::gateway::update::Update::Peer((&peer).into())), }; clients.lock().unwrap().retain( - move |addr, tx: &mut UnboundedSender>| { + move |addr, + tx: &mut UnboundedSender< + Result, + >| { eprintln!("Sending peer update to {addr}"); tx.send(Ok(update.clone())).is_ok() }, @@ -184,12 +188,15 @@ pub async fn cli(tx: Sender, clients: Arc>) { if let Ok(key) = Key::try_from(key) { let peer = Peer::new(key); - let update = proto::Update { - update_type: proto::UpdateType::Delete as i32, - update: Some(proto::update::Update::Peer((&peer).into())), + let update = proto::gateway::Update { + update_type: proto::gateway::UpdateType::Delete as i32, + update: Some(proto::gateway::update::Update::Peer((&peer).into())), }; clients.lock().unwrap().retain( - move |addr, tx: &mut UnboundedSender>| { + move |addr, + tx: &mut UnboundedSender< + Result, + >| { eprintln!("Sending peer update to {addr}"); tx.send(Ok(update.clone())).is_ok() }, @@ -234,7 +241,7 @@ pub async fn grpc( config_rx: Receiver, clients: Arc>, ) -> Result<(), tonic::transport::Error> { - let gateway_service = proto::gateway_service_server::GatewayServiceServer::new( + let gateway_service = proto::gateway::gateway_service_server::GatewayServiceServer::new( GatewayServer::new(config_rx, clients), ); let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 50055); // TODO: port as an option diff --git a/proto b/proto index 6197e062..7cc38b09 160000 --- a/proto +++ b/proto @@ -1 +1 @@ -Subproject commit 6197e0622fe6118bb680810d5dc75ecb289d2d72 +Subproject commit 7cc38b099bc12e8257d61988d162097606de4c8e diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index 94aad158..ad965390 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -1,22 +1,58 @@ -use std::net::IpAddr; - -use super::{Address, FirewallError, FirewallRule, Policy, Port, Protocol}; +use super::{FirewallConfig, FirewallError, FirewallRule, Policy}; +#[derive(Debug, Clone)] pub struct FirewallApi { pub ifname: String, + pub default_policy: Policy, + pub v4: bool, } impl FirewallApi { - pub fn new(ifname: &str) -> Self { + #[must_use] + pub fn from_config(ifname: &str, config: &FirewallConfig) -> Self { Self { ifname: ifname.into(), + default_policy: config.default_policy, + v4: config.v4, + } + } + + pub fn config_changed(&self, config: &FirewallConfig) -> bool { + self.default_policy != config.default_policy || self.v4 != config.v4 + } + + pub fn maybe_update_from_config( + &mut self, + config: &FirewallConfig, + ) -> Result { + debug!("Updating firewall configuration if it has changed"); + let changed = if self.default_policy != config.default_policy { + self.default_policy = config.default_policy; + true + } else if self.v4 != config.v4 { + self.v4 = config.v4; + true + } else { + false + }; + + if changed { + debug!( + "Updated firewall configuration as it has changed, new configuration: {:?}", + self + ); } + + Ok(changed) } } pub trait FirewallManagementApi { + /// Sets up the firewall with the default policy and cleans up any existing rules fn setup(&self) -> Result<(), FirewallError>; - fn clear(&self) -> Result<(), FirewallError>; - fn apply_rule(&self, rule: FirewallRule) -> Result<(), FirewallError>; - fn set_default_policy(&self, policy: Policy) -> Result<(), FirewallError>; + fn cleanup(&self) -> Result<(), FirewallError>; + fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError>; + fn apply_rules(&self, rules: Vec) -> Result<(), FirewallError>; + fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError>; + fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError>; } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 2795eddd..c5a4c28c 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -2,15 +2,17 @@ pub mod netfilter; use std::sync::atomic::{AtomicU32, Ordering}; +use mnl::mnl_sys::libc; use netfilter::{ - allow_established_traffic, apply_filter_rules, clear_chains, init_firewall, masq_interface, - set_default_policy, + allow_established_traffic, apply_filter_rules, drop_table, init_firewall, set_default_policy, + set_masq, }; use super::{ api::{FirewallApi, FirewallManagementApi}, - proto, Address, FirewallError, FirewallRule, Policy, Port, Protocol, + Address, FirewallError, FirewallRule, Policy, Port, Protocol, PORT_PROTOCOLS, }; +use crate::proto; static SET_ID_COUNTER: AtomicU32 = AtomicU32::new(0); @@ -18,6 +20,25 @@ pub fn get_set_id() -> u32 { SET_ID_COUNTER.fetch_add(1, Ordering::SeqCst) } +impl Protocol { + pub const fn from_proto( + proto: proto::enterprise::firewall::Protocol, + ) -> Result { + match proto { + proto::enterprise::firewall::Protocol::Tcp => Ok(Self(libc::IPPROTO_TCP as u8)), + proto::enterprise::firewall::Protocol::Udp => Ok(Self(libc::IPPROTO_UDP as u8)), + proto::enterprise::firewall::Protocol::Icmp => Ok(Self(libc::IPPROTO_ICMP as u8)), + proto::enterprise::firewall::Protocol::Invalid => { + Err(FirewallError::UnsupportedProtocol(proto as u8)) + } + } + } + + pub fn supports_ports(&self) -> bool { + PORT_PROTOCOLS.contains(self) + } +} + #[derive(Debug, Default)] pub enum State { #[default] @@ -44,36 +65,59 @@ pub struct FilterRule { // this value helps to keep track of them. pub defguard_rule_id: i64, pub v4: bool, + pub comment: Option, } impl FirewallManagementApi for FirewallApi { fn setup(&self) -> Result<(), FirewallError> { debug!("Initializing firewall, VPN interface: {}", self.ifname); - init_firewall().expect("Failed to setup chains"); - masq_interface(&self.ifname).expect("Failed to masquerade interface"); - allow_established_traffic(&self.ifname)?; - info!("Firewall initialized"); + self.cleanup()?; + init_firewall(Some(self.default_policy)).expect("Failed to setup chains"); + debug!("Allowing all established traffic"); + allow_established_traffic()?; + debug!("Allowed all established traffic"); + debug!("Initialized firewall"); Ok(()) } - fn clear(&self) -> Result<(), FirewallError> { - debug!("Removing all firewall rules"); - clear_chains()?; - info!("Removed all firewall rules"); + fn cleanup(&self) -> Result<(), FirewallError> { + debug!("Cleaning up all previous firewall rules, if any"); + drop_table()?; + debug!("Cleaned up all previous firewall rules"); Ok(()) } - fn set_default_policy(&self, policy: Policy) -> Result<(), FirewallError> { + fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> { debug!("Setting default firewall policy to: {:?}", policy); + self.default_policy = policy; set_default_policy(policy)?; - info!("Set firewall default policy to {:?}", policy); + debug!("Set firewall default policy to {:?}", policy); + Ok(()) + } + + fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError> { + debug!("Setting masquerade status to: {:?}", enabled); + set_masq(&self.ifname, enabled)?; + debug!("Set masquerade status to: {:?}", enabled); + Ok(()) + } + + fn apply_rules(&self, rules: Vec) -> Result<(), FirewallError> { + debug!("Applying the following Defguard ACL rules: {:?}", rules); + for rule in rules { + self.add_rule(rule)?; + } + debug!("Applied all Defguard ACL rules"); Ok(()) } - fn apply_rule(&self, rule: FirewallRule) -> Result<(), FirewallError> { + fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError> { + debug!("Applying the following Defguard ACL rule: {:?}", rule); let mut rules = vec![]; + debug!("The rule will be split into multiple nftables rules based on the specified destination ports and protocols."); if rule.destination_ports.is_empty() { + debug!("No destination ports specified, applying single aggregate nftables rule for every protocol."); let rule = FilterRule { src_ips: rule.source_addrs, dest_ips: rule.destination_addrs, @@ -82,12 +126,16 @@ impl FirewallManagementApi for FirewallApi { counter: true, defguard_rule_id: rule.id, v4: rule.v4, + comment: rule.comment, ..Default::default() }; rules.push(rule); - } else { + } else if !rule.protocols.is_empty() { + debug!("Destination ports and protocols specified, applying individual nftables rules for each protocol."); for protocol in rule.protocols { + debug!("Applying rule for protocol: {:?}", protocol); if protocol.supports_ports() { + debug!("Protocol supports ports, rule."); let rule = FilterRule { src_ips: rule.source_addrs.clone(), dest_ips: rule.destination_addrs.clone(), @@ -97,10 +145,12 @@ impl FirewallManagementApi for FirewallApi { counter: true, defguard_rule_id: rule.id, v4: rule.v4, + comment: rule.comment.clone(), ..Default::default() }; rules.push(rule); } else { + debug!("Protocol does not support ports, applying nftables rule and ignoring destination ports."); let rule = FilterRule { src_ips: rule.source_addrs.clone(), dest_ips: rule.destination_addrs.clone(), @@ -109,15 +159,39 @@ impl FirewallManagementApi for FirewallApi { counter: true, defguard_rule_id: rule.id, v4: rule.v4, + comment: rule.comment.clone(), ..Default::default() }; rules.push(rule); } } + } else { + debug!( + "Destination ports specified, but no protocols specified, applying nftables rules for each protocol that support ports." + ); + for protocol in PORT_PROTOCOLS.iter() { + debug!("Applying nftables rule for protocol: {:?}", protocol); + let rule = FilterRule { + src_ips: rule.source_addrs.clone(), + dest_ips: rule.destination_addrs.clone(), + dest_ports: rule.destination_ports.clone(), + protocols: vec![*protocol], + action: rule.verdict, + counter: true, + defguard_rule_id: rule.id, + v4: rule.v4, + comment: rule.comment.clone(), + ..Default::default() + }; + rules.push(rule); + } } apply_filter_rules(rules)?; - + debug!( + "Applied firewall rules for Defguard ACL rule ID: {}", + rule.id + ); Ok(()) } } diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 0c844fe8..35b68f5b 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -1,19 +1,14 @@ -use std::collections::HashSet; -use std::ffi::c_void; +#[cfg(test)] use std::str::FromStr; use std::{ ffi::CString, - io, net::{IpAddr, Ipv4Addr, Ipv6Addr}, }; use ipnetwork::IpNetwork; #[cfg(test)] use ipnetwork::{Ipv4Network, Ipv6Network}; -use mnl::mnl_sys::libc::{self, c_char}; -use nftnl::nftnl_sys::{ - nftnl_udata_buf_alloc, nftnl_udata_buf_data, nftnl_udata_buf_len, NFTNL_RULE_USERDATA, -}; +use mnl::mnl_sys::libc::{self}; use nftnl::{ expr::{Expression, InterfaceName}, nft_expr, nftnl_sys, @@ -21,7 +16,7 @@ use nftnl::{ Batch, Chain, FinalizedBatch, ProtoFamily, Rule, Table, }; -use super::{get_set_id, proto, Address, FilterRule, Policy, Port, Protocol, State}; +use super::{get_set_id, Address, FilterRule, Policy, Port, Protocol, State}; use crate::enterprise::firewall::FirewallError; const FILTER_TABLE: &str = "filter"; @@ -29,9 +24,11 @@ const NAT_TABLE: &str = "nat"; const DEFGUARD_TABLE: &str = "DEFGUARD"; const POSTROUTING_CHAIN: &str = "POSTROUTING"; const FORWARD_CHAIN: &str = "FORWARD"; - const ANON_SET_NAME: &str = "__set%d"; +const POSTROUTING_PRIORITY: i32 = 100; +const FORWARD_PRIORITY: i32 = 0; + struct InetService(u16); impl SetKey for InetService { @@ -55,19 +52,7 @@ impl State { } impl Protocol { - pub const fn from_proto(proto: proto::enterprise::Protocol) -> Result { - match proto { - proto::enterprise::Protocol::Tcp => Ok(Self(libc::IPPROTO_TCP as u8)), - proto::enterprise::Protocol::Udp => Ok(Self(libc::IPPROTO_UDP as u8)), - proto::enterprise::Protocol::Icmp => Ok(Self(libc::IPPROTO_ICMP as u8)), - } - } - - pub fn supports_ports(&self) -> bool { - matches!(self.0.into(), libc::IPPROTO_TCP | libc::IPPROTO_UDP) - } - - pub fn to_port_payload_expr(&self) -> Result<&impl Expression, FirewallError> { + pub(crate) fn to_port_payload_expr(&self) -> Result<&impl Expression, FirewallError> { match self.0.into() { libc::IPPROTO_TCP => Ok(&nft_expr!(payload tcp dport)), libc::IPPROTO_UDP => Ok(&nft_expr!(payload udp dport)), @@ -76,6 +61,16 @@ impl Protocol { } } +impl From for nftnl::Policy { + fn from(policy: Policy) -> Self { + match policy { + // This mirrors the nftables behavior, where passing no policy results in the default accept policy + Policy::Allow | Policy::None => Self::Accept, + Policy::Deny => Self::Drop, + } + } +} + impl SetKey for Protocol { const TYPE: u32 = 12; const LEN: u32 = 1; @@ -110,7 +105,12 @@ fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) -> Result<() (IpAddr::V6(start), IpAddr::V6(end)) => { add_to_set(set, start, Some(end))?; } - _ => panic!("Expected both addresses to be of the same type"), + _ => { + return Err(FirewallError::InvalidConfiguration(format!( + "Expected both addresses to be of the same type, got {:?} and {:?}", + start, end + ))) + } }, Address::Network(network) => { let upper_bound = max_address(network); @@ -122,7 +122,12 @@ fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) -> Result<() (IpAddr::V6(network), IpAddr::V6(upper_bound)) => { add_to_set(set, &network, Some(&upper_bound))?; } - _ => panic!("Expected both addresses to be of the same type"), + _ => { + return Err(FirewallError::InvalidConfiguration(format!( + "Expected both addresses to be of the same type, got {:?} and {:?}", + net, upper_bound + ))) + } } } } @@ -162,9 +167,15 @@ impl FirewallRule for FilterRule { batch: &mut Batch, ) -> Result, FirewallError> { let mut rule = Rule::new(chain); + debug!("Converting {:?} to nftables expression", self); + // Debug purposes only + let mut matches = vec![]; if !self.dest_ports.is_empty() && self.protocols.len() > 1 { - panic!("Cannot specify multiple protocols with destination ports"); + return Err(FirewallError::InvalidConfiguration( + format!("Cannot specify multiple protocols with destination ports, specified protocols: {:?}, destination ports: {:?}, Defguard Rule ID: {}", + self.protocols, self.dest_ports, self.defguard_rule_id) + )); } // TODO: Reduce code duplication here @@ -177,6 +188,7 @@ impl FirewallRule for FilterRule { add_address_to_set(set.as_ptr(), ip)?; } + // ip saddr {x.x.x.x, x.x.x.x} set.elems_iter().for_each(|elem| { batch.add(&elem, nftnl::MsgType::Add); }); @@ -194,6 +206,7 @@ impl FirewallRule for FilterRule { add_address_to_set(set.as_ptr(), ip)?; } + // ip6 saddr {x.x.x.x, x.x.x.x} set.elems_iter().for_each(|elem| { batch.add(&elem, nftnl::MsgType::Add); }); @@ -204,6 +217,11 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(lookup & set)); } + debug!( + "Added source IP addresses match to nftables expression: {:?}", + self.src_ips + ); + matches.push(format!("ANY SOURCE IPs: {:?}", self.src_ips)); } // TODO: Reduce code duplication here @@ -220,6 +238,7 @@ impl FirewallRule for FilterRule { batch.add(&elem, nftnl::MsgType::Add); }); + // ip daddr {x.x.x.x, x.x.x.x} rule.add_expr(&nft_expr!(meta nfproto)); rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8)); rule.add_expr(&nft_expr!(payload ipv4 daddr)); @@ -233,6 +252,7 @@ impl FirewallRule for FilterRule { add_address_to_set(set.as_ptr(), ip)?; } + // ip6 daddr {x.x.x.x, x.x.x.x} set.elems_iter().for_each(|elem| { batch.add(&elem, nftnl::MsgType::Add); }); @@ -243,6 +263,11 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(lookup & set)); } + debug!( + "Added destination IP addresses match to nftables expression: {:?}", + self.dest_ips + ); + matches.push(format!("ANY DEST IPs: {:?}", self.dest_ips)); } if !self.protocols.is_empty() { @@ -256,6 +281,7 @@ impl FirewallRule for FilterRule { add_protocol_to_set(set.as_ptr(), proto)?; } + // dport {x, x-x} set.elems_iter().for_each(|elem| { batch.add(&elem, nftnl::MsgType::Add); }); @@ -271,35 +297,51 @@ impl FirewallRule for FilterRule { } rule.add_expr(&nft_expr!(lookup & set)); + + debug!("Added protocol match to rule: {:?}", self.protocols); + matches.push(format!("ANY PROTOCOLS: {:?}", self.protocols)); } // 1 Protocol // > 0 Ports else if !self.dest_ports.is_empty() { - let protocol = self.protocols.first().unwrap(); - if protocol.supports_ports() { - println!("Protocol: {:?}", protocol); - - let set = - new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; - batch.add(&set, nftnl::MsgType::Add); - - for port in &self.dest_ports { - add_port_to_set(set.as_ptr(), port)?; + if let Some(protocol) = self.protocols.first() { + if protocol.supports_ports() { + let set = new_anon_set::( + chain.get_table(), + ProtoFamily::Inet, + true, + )?; + batch.add(&set, nftnl::MsgType::Add); + + for port in &self.dest_ports { + add_port_to_set(set.as_ptr(), port)?; + } + + // dport {x, x-x} + set.elems_iter().for_each(|elem| { + batch.add(&elem, nftnl::MsgType::Add); + }); + + rule.add_expr(&nft_expr!(meta l4proto)); + rule.add_expr(&nft_expr!(cmp == protocol.0)); + rule.add_expr(protocol.to_port_payload_expr()?); + rule.add_expr(&nft_expr!(lookup & set)); } - - set.elems_iter().for_each(|elem| { - batch.add(&elem, nftnl::MsgType::Add); - }); - - rule.add_expr(&nft_expr!(meta l4proto)); - rule.add_expr(&nft_expr!(cmp == protocol.0)); - rule.add_expr(protocol.to_port_payload_expr()?); - rule.add_expr(&nft_expr!(lookup & set)); } + + debug!( + "Added single protocol ({:?}) match and destination ports match to nftables expression: {:?}", + self.protocols, self.dest_ports + ); + matches.push(format!( + "PROTOCOL: {:?} AND ANY DEST PORTS: {:?}", + self.protocols, self.dest_ports + )); } // 1 Protocol // 0 Ports else if let Some(protocol) = self.protocols.first() { + // ip protocol rule.add_expr(&nft_expr!(meta nfproto)); if self.v4 { @@ -311,22 +353,31 @@ impl FirewallRule for FilterRule { } rule.add_expr(&nft_expr!(cmp == protocol.0)); + debug!("Added protocol match to rule: {:?}", protocol); + matches.push(format!("SINGLE PROTOCOL: {:?}", protocol)); } } if let Some(iifname) = &self.iifname { + // iifname rule.add_expr(&nft_expr!(meta iifname)); let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap()); rule.add_expr(&nft_expr!(cmp == exact)); + debug!("Added input interface match to rule: {:?}", iifname); + matches.push(format!("INPUT INTERFACE: {:?}", iifname)); } if let Some(oifname) = &self.oifname { + // oifname rule.add_expr(&nft_expr!(meta oifname)); let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap()); rule.add_expr(&nft_expr!(cmp == exact)); + debug!("Added output interface match to rule: {:?}", oifname); + matches.push(format!("OUTPUT INTERFACE: {:?}", oifname)); } if !self.states.is_empty() { + // ct state , let combined_states = self .states .iter() @@ -334,12 +385,20 @@ impl FirewallRule for FilterRule { rule.add_expr(&nft_expr!(ct state)); rule.add_expr(&nft_expr!(bitwise mask combined_states, xor 0u32)); rule.add_expr(&nft_expr!(cmp != 0u32)); + debug!( + "Added connection tracking states match to nftables expression: {:?}", + self.states + ); + matches.push(format!("ANY CT STATES: {:?}", self.states)); } if self.counter { + // counter rule.add_expr(&nft_expr!(counter)); + debug!("Added counter expression to rule"); } + // accept/drop match self.action { Policy::Allow => { rule.add_expr(&nft_expr!(verdict accept)); @@ -350,14 +409,33 @@ impl FirewallRule for FilterRule { Policy::None => {} } - rule.add_expr(&nft_expr!(verdict accept)); + // comment + if let Some(comment_string) = &self.comment { + debug!( + "Adding comment to nftables expression: {:?}", + comment_string + ); + // Since we are interoping with C, truncate the string to 255 *bytes* (not UTF-8 characters) + // 256 is the maximum length of a comment string in nftables, leave 1 byte for the null terminator + let maybe_truncated_str = if comment_string.len() > 255 { + warn!("Comment string {comment_string} is too long, truncating to 255 bytes"); + &comment_string[..=255] + } else { + comment_string.as_str() + }; + let comment = &CString::new(maybe_truncated_str).map_err(|e| { + FirewallError::NetlinkError(format!( + "Failed to create CString from string {comment_string}. Error: {e:?}" + )) + })?; + rule.set_comment(comment); + debug!("Added comment to nftables expression: {:?}", comment_string); + } else { + debug!("No comment provided for nftables expression"); + } - let comment_string = format!("Rule ID: {}", self.defguard_rule_id); - let error_msg = format!("Failed to create CString from string {comment_string}"); - let comment = &CString::new(comment_string) - .map_err(|e| FirewallError::NetlinkError(format!("{error_msg}. Details: {e}")))?; - // The comment may have up to 256 chars, but we won't reach the limit with the rule ID - rule.set_comment(comment); + let matches = matches.join(" AND "); + debug!("Created nftables rule with matches: {:?}", matches); Ok(rule) } @@ -420,24 +498,24 @@ impl FirewallRule for NatRule { } } -struct JumpRule; +// struct JumpRule; -impl JumpRule { - fn to_chain_rule<'a>( - src_chain: &'a Chain, - dest_chain: &'a Chain, - ) -> Result, FirewallError> { - let mut rule = Rule::new(src_chain); +// impl JumpRule { +// fn to_chain_rule<'a>( +// src_chain: &'a Chain, +// dest_chain: &'a Chain, +// ) -> Result, FirewallError> { +// let mut rule = Rule::new(src_chain); - rule.add_expr(&nft_expr!(counter)); - rule.add_expr(&nft_expr!(verdict jump dest_chain.get_name().into())); +// rule.add_expr(&nft_expr!(counter)); +// rule.add_expr(&nft_expr!(verdict jump dest_chain.get_name().into())); - Ok(rule) - } -} +// Ok(rule) +// } +// } /// Sets up the default chains for the firewall -pub fn init_firewall() -> Result<(), FirewallError> { +pub(crate) fn init_firewall(initial_policy: Option) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); @@ -446,18 +524,11 @@ pub fn init_firewall() -> Result<(), FirewallError> { batch.add(&table, nftnl::MsgType::Add); let mut chain = Chains::Forward.to_chain(&table); - chain.set_hook(nftnl::Hook::Forward, 0); - // FIXME: This should be configurable - chain.set_policy(nftnl::Policy::Accept); + chain.set_hook(nftnl::Hook::Forward, FORWARD_PRIORITY); + chain.set_policy(initial_policy.unwrap_or(Policy::Allow).into()); chain.set_type(nftnl::ChainType::Filter); batch.add(&chain, nftnl::MsgType::Add); - let mut nat_chain = Chains::Postrouting.to_chain(&table); - nat_chain.set_hook(nftnl::Hook::PostRouting, 100); - nat_chain.set_policy(nftnl::Policy::Accept); - nat_chain.set_type(nftnl::ChainType::Nat); - batch.add(&nat_chain, nftnl::MsgType::Add); - let finalized_batch = batch.finalize(); send_batch(&finalized_batch)?; @@ -465,7 +536,7 @@ pub fn init_firewall() -> Result<(), FirewallError> { Ok(()) } -pub fn clear_chains() -> Result<(), FirewallError> { +pub(crate) fn drop_table() -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -478,22 +549,29 @@ pub fn clear_chains() -> Result<(), FirewallError> { } /// Applies masquerade on the specified interface for the outgoing packets -pub fn masq_interface(ifname: &str) -> Result<(), FirewallError> { +pub(crate) fn set_masq(ifname: &str, enabled: bool) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); - let post_routing = Chains::Postrouting.to_chain(&table); - batch.add(&post_routing, nftnl::MsgType::Add); + let mut nat_chain = Chains::Postrouting.to_chain(&table); + nat_chain.set_hook(nftnl::Hook::PostRouting, POSTROUTING_PRIORITY); + nat_chain.set_policy(nftnl::Policy::Accept); + nat_chain.set_type(nftnl::ChainType::Nat); + batch.add(&nat_chain, nftnl::MsgType::Add); let nat_rule = NatRule { oifname: Some(ifname.to_string()), counter: true, ..Default::default() } - .to_chain_rule(&post_routing, &mut batch)?; + .to_chain_rule(&nat_chain, &mut batch)?; - batch.add(&nat_rule, nftnl::MsgType::Add); + if enabled { + batch.add(&nat_rule, nftnl::MsgType::Add); + } else { + batch.add(&nat_rule, nftnl::MsgType::Del); + } let finalized_batch = batch.finalize(); send_batch(&finalized_batch)?; @@ -501,7 +579,7 @@ pub fn masq_interface(ifname: &str) -> Result<(), FirewallError> { Ok(()) } -pub fn set_default_policy(policy: Policy) -> Result<(), FirewallError> { +pub(crate) fn set_default_policy(policy: Policy) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -520,7 +598,7 @@ pub fn set_default_policy(policy: Policy) -> Result<(), FirewallError> { Ok(()) } -pub fn allow_established_traffic(ifname: &str) -> Result<(), FirewallError> { +pub(crate) fn allow_established_traffic() -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -530,7 +608,8 @@ pub fn allow_established_traffic(ifname: &str) -> Result<(), FirewallError> { let established_rule = FilterRule { states: vec![State::Established, State::Related], - iifname: Some(ifname.to_string()), + // TODO: This is not always the case, allow all established traffic for now + // iifname: Some(ifname.to_string()), counter: true, action: Policy::Allow, ..Default::default() @@ -595,7 +674,7 @@ impl Chains { } } -pub fn apply_filter_rules(rules: Vec) -> Result<(), FirewallError> { +pub(crate) fn apply_filter_rules(rules: Vec) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -630,11 +709,11 @@ fn send_batch(batch: &FinalizedBatch) -> Result<(), FirewallError> { while let Some(message) = socket_recv(&socket, &mut buffer[..])? { match mnl::cb_run(message, seq, portid) { Ok(mnl::CbResult::Stop) => { - println!("STOP"); + debug!("Received stop signal from netlink callback"); break; } Ok(mnl::CbResult::Ok) => { - println!("OK"); + debug!("Received OK signal from netlink callback"); } Err(err) => { return Err(FirewallError::NetlinkError(format!( diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index b6c3fd5e..f0a088d8 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -9,7 +9,7 @@ pub mod api; #[cfg(target_os = "linux")] pub mod linux; -#[derive(Debug, Copy, Clone)] +#[derive(Debug, Copy, Clone, PartialEq, Eq)] pub enum Address { Ip(IpAddr), Network(IpNetwork), @@ -17,19 +17,19 @@ pub enum Address { } impl Address { - pub fn from_proto(ip: &proto::enterprise::IpAddress) -> Result { + pub fn from_proto(ip: &proto::enterprise::firewall::IpAddress) -> Result { match &ip.address { - Some(proto::enterprise::ip_address::Address::Ip(ip)) => { + Some(proto::enterprise::firewall::ip_address::Address::Ip(ip)) => { Ok(Self::Ip(IpAddr::from_str(ip).map_err(|err| { FirewallError::TypeConversionError(format!("Invalid IP format: {}", err)) })?)) } - Some(proto::enterprise::ip_address::Address::IpSubnet(network)) => Ok(Self::Network( - IpNetwork::from_str(network).map_err(|err| { + Some(proto::enterprise::firewall::ip_address::Address::IpSubnet(network)) => Ok( + Self::Network(IpNetwork::from_str(network).map_err(|err| { FirewallError::TypeConversionError(format!("Invalid subnet format: {}", err)) - })?, - )), - Some(proto::enterprise::ip_address::Address::IpRange(range)) => { + })?), + ), + Some(proto::enterprise::firewall::ip_address::Address::IpRange(range)) => { let start = IpAddr::from_str(&range.start).map_err(|err| { FirewallError::TypeConversionError(format!("Invalid IP format: {}", err)) })?; @@ -46,16 +46,16 @@ impl Address { } } -#[derive(Debug, Copy, Clone)] +#[derive(Debug, Copy, Clone, PartialEq, Eq)] pub enum Port { Single(u16), Range(u16, u16), } impl Port { - pub fn from_proto(port: &proto::enterprise::Port) -> Result { + pub fn from_proto(port: &proto::enterprise::firewall::Port) -> Result { match &port.port { - Some(proto::enterprise::port::Port::SinglePort(port)) => { + Some(proto::enterprise::firewall::port::Port::SinglePort(port)) => { let port_u16 = u16::try_from(*port).map_err(|err| { FirewallError::TypeConversionError(format!( "Invalid port number ({}): {}", @@ -64,7 +64,7 @@ impl Port { })?; Ok(Self::Single(port_u16)) } - Some(proto::enterprise::port::Port::PortRange(range)) => { + Some(proto::enterprise::firewall::port::Port::PortRange(range)) => { let start_u16 = u16::try_from(range.start).map_err(|err| { FirewallError::TypeConversionError(format!( "Invalid range start port number ({}): {}", @@ -87,9 +87,17 @@ impl Port { } } -#[derive(Debug, Copy, Clone)] +#[derive(Debug, Copy, Clone, PartialEq, Eq)] pub struct Protocol(pub u8); +// Protocols that have the concept of ports +pub const PORT_PROTOCOLS: [Protocol; 2] = [ + // TCP + Protocol(6), + // UDP + Protocol(17), +]; + #[derive(Debug, Default, Clone, Copy, PartialEq, Eq)] pub enum Policy { Allow, @@ -109,15 +117,15 @@ impl From for Policy { } impl Policy { - pub const fn from_proto(verdict: proto::enterprise::FirewallPolicy) -> Self { + pub const fn from_proto(verdict: proto::enterprise::firewall::FirewallPolicy) -> Self { match verdict { - proto::enterprise::FirewallPolicy::Allow => Self::Allow, - proto::enterprise::FirewallPolicy::Deny => Self::Deny, + proto::enterprise::firewall::FirewallPolicy::Allow => Self::Allow, + proto::enterprise::firewall::FirewallPolicy::Deny => Self::Deny, } } } -#[derive(Debug)] +#[derive(Debug, Clone, PartialEq, Eq)] pub struct FirewallRule { pub comment: Option, pub destination_addrs: Vec
, @@ -129,16 +137,20 @@ pub struct FirewallRule { pub v4: bool, } +#[derive(Debug, Clone, PartialEq, Eq)] pub struct FirewallConfig { pub rules: Vec, pub default_policy: Policy, + pub v4: bool, } impl FirewallConfig { - pub fn from_proto(config: proto::enterprise::FirewallConfig) -> Result { - debug!("Parsing following received proto configuration: {config:?}"); + pub fn from_proto( + config: proto::enterprise::firewall::FirewallConfig, + ) -> Result { + debug!("Parsing following received firewall proto configuration: {config:?}"); let mut rules = vec![]; - let v4 = config.ip_version == proto::enterprise::IpVersion::Ipv4 as i32; + let v4 = config.ip_version == proto::enterprise::firewall::IpVersion::Ipv4 as i32; let default_policy = Policy::from_proto(config.default_policy.try_into().map_err(|err| { FirewallError::TypeConversionError(format!("Invalid default policy: {:?}", err)) @@ -146,7 +158,7 @@ impl FirewallConfig { debug!("Using IPv4: {v4:?}, default firewall policy defined: {default_policy:?}. Proceeding to parsing rules..."); for rule in config.rules { - debug!("Parsing the following received proto rule: {rule:?}"); + debug!("Parsing the following received Defguard ACL proto rule: {rule:?}"); let mut source_addrs = vec![]; let mut destination_addrs = vec![]; let mut destination_ports = vec![]; @@ -167,7 +179,7 @@ impl FirewallConfig { for protocol in rule.protocols { protocols.push(Protocol::from_proto( // Since the protocol is an i32, convert it to the proto enum variant first - proto::enterprise::Protocol::try_from(protocol).map_err(|err| { + proto::enterprise::firewall::Protocol::try_from(protocol).map_err(|err| { FirewallError::TypeConversionError(format!( "Invalid protocol: {:?}. Details: {:?}", protocol, err @@ -199,6 +211,7 @@ impl FirewallConfig { Ok(Self { rules, default_policy, + v4, }) } } @@ -213,4 +226,6 @@ pub enum FirewallError { UnsupportedProtocol(u8), #[error("Netlink error: {0}")] NetlinkError(String), + #[error("Invalid configuration: {0}")] + InvalidConfiguration(String), } diff --git a/src/gateway.rs b/src/gateway.rs index dd1dda8b..81918688 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -9,6 +9,7 @@ use std::{ time::{Duration, SystemTime}, }; +use defguard_wireguard_rs::{net::IpAddrMask, WireguardInterfaceApi}; use gethostname::gethostname; use tokio::{ select, @@ -27,15 +28,18 @@ use tonic::{ use crate::{ config::Config, + enterprise::firewall::{ + api::{FirewallApi, FirewallManagementApi}, + FirewallConfig, FirewallRule, + }, error::GatewayError, execute_command, mask, - proto::{ + proto::gateway::{ gateway_service_client::GatewayServiceClient, stats_update::Payload, update, Configuration, ConfigurationRequest, Peer, StatsUpdate, Update, }, VERSION, }; -use defguard_wireguard_rs::{net::IpAddrMask, WireguardInterfaceApi}; const TEN_SECS: Duration = Duration::from_secs(10); @@ -101,6 +105,8 @@ pub struct Gateway { interface_configuration: Option, peers: HashMap, wgapi: Arc>, + firewall_api: Option, + firewall_rules: Vec, pub connected: Arc, client: GatewayServiceClient>, stats_thread: Option>, @@ -110,6 +116,7 @@ impl Gateway { pub fn new( config: Config, wgapi: impl WireguardInterfaceApi + Send + Sync + 'static, + firewallapi: Option, ) -> Result { let client = Self::setup_client(&config)?; Ok(Self { @@ -120,6 +127,8 @@ impl Gateway { connected: Arc::new(AtomicBool::new(false)), client, stats_thread: None, + firewall_api: firewallapi, + firewall_rules: vec![], }) } @@ -133,8 +142,15 @@ impl Gateway { self.peers = peers; } + fn is_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool { + if let Some(firewall_api) = &self.firewall_api { + return firewall_api.config_changed(new_fw_config); + } + true + } + // check if new received configuration is different than current one - fn is_config_changed( + fn is_interface_config_changed( &self, new_interface_configuration: &InterfaceConfiguration, new_peers: &[Peer], @@ -247,6 +263,97 @@ impl Gateway { } } + fn did_firewall_rules_change(&self, new_rules: &[FirewallRule]) -> bool { + debug!("Checking if Defguard ACL rules have changed"); + + if self.firewall_rules.len() != new_rules.len() { + debug!("Number of Defguard ACL rules is different, so the rules have changed"); + return true; + } + + for rule in new_rules { + if !self.firewall_rules.contains(rule) { + debug!("Found a new Defguard ACL rule: {rule:?}. Rules have changed."); + return true; + } + } + + for rule in &self.firewall_rules { + if !new_rules.contains(rule) { + debug!("Found a removed Defguard ACL rule: {rule:?}. Rules have changed."); + return true; + } + } + + debug!("Defguard ACL rules have not changed"); + false + } + + /// Process and apply firewall configuration changes. + /// - If the main config changed (default policy, IP version), reconfigure the whole firewall. + /// - If only the rules changed, apply the new rules. Currently also reconfigures the whole firewall but that + /// should be temporary. + /// + /// TODO: Reduce cloning here + fn process_firewall_changes( + &mut self, + fw_config: Option<&FirewallConfig>, + ) -> Result<(), GatewayError> { + if let Some(fw_config) = fw_config { + debug!("Received firewall configuration: {fw_config:?}"); + if self.is_firewall_config_changed(fw_config) { + debug!("Received firewall configuration is different than current one. Reconfiguring firewall..."); + if let Some(api) = &mut self.firewall_api { + api.maybe_update_from_config(fw_config)?; + api.setup()?; + } else { + let api = FirewallApi::from_config(&self.config.ifname, fw_config); + api.setup()?; + self.firewall_api = Some(api); + } + + if self.did_firewall_rules_change(&fw_config.rules) { + debug!("Received firewall rules are different than the current ones. Applying the new rules."); + if let Some(api) = &self.firewall_api { + api.apply_rules(fw_config.rules.clone())?; + self.firewall_rules = fw_config.rules.clone(); + } else { + error!( + "Firewall API not initialized. Configuration: {:?}", + fw_config.rules + ); + } + } else { + debug!("Received firewall rules are the same as the current ones. Skipping applying the rules."); + } + } else if self.did_firewall_rules_change(&fw_config.rules) { + debug!("Received firewall rules are different than the current ones. Applying the new rules."); + if let Some(api) = &self.firewall_api { + // Temporary simplest approach is to drop everything and reapply all rules + api.setup()?; + api.apply_rules(fw_config.rules.clone())?; + self.firewall_rules = fw_config.rules.clone(); + } else { + error!( + "Firewall API not initialized. Configuration: {:?}", + fw_config.rules + ); + } + } else { + debug!("Received firewall configuration and rules are identical to current one. Skipping firewall reconfiguration"); + } + } else { + debug!("Received firewall configuration is empty, cleaning up firewall rules..."); + if let Some(api) = &self.firewall_api { + api.cleanup()?; + self.firewall_api = None; + self.firewall_rules = vec![]; + } + } + + Ok(()) + } + /// Performs complete interface reconfiguration based on `configuration` object. /// Called when gateway (re)connects to gRPC endpoint and retrieves complete /// network and peers data. @@ -262,27 +369,39 @@ impl Gateway { // check if new configuration is different than current one let new_interface_configuration = new_configuration.clone().into(); - if !self.is_config_changed(&new_interface_configuration, &new_configuration.peers) { + + if !self.is_interface_config_changed(&new_interface_configuration, &new_configuration.peers) + { debug!("Received configuration is identical to current one. Skipping interface reconfiguration"); - return Ok(()); - }; + } else { + debug!( + "Received configuration is different than current one. Reconfiguring interface..." + ); + self.wgapi + .lock() + .unwrap() + .configure_interface(&new_configuration.clone().into())?; + info!( + "Reconfigured WireGuard interface {} (addresses: {:?})", + new_configuration.name, new_configuration.addresses + ); + trace!( + "Reconfigured WireGuard interface. Configuration: {:?}", + mask!(new_configuration, prvkey) + ); + // store new configuration and peers + self.interface_configuration = Some(new_interface_configuration); + self.replace_peers(new_configuration.peers); + } - self.wgapi - .lock() - .unwrap() - .configure_interface(&new_configuration.clone().into())?; - info!( - "Reconfigured WireGuard interface {} (addresses: {:?})", - new_configuration.name, new_configuration.addresses - ); - trace!( - "Reconfigured WireGuard interface. Configuration: {:?}", - mask!(new_configuration, prvkey) - ); + let new_firewall_configuration = + if let Some(firewall_config) = new_configuration.firewall_config { + Some(FirewallConfig::from_proto(firewall_config)?) + } else { + None + }; - // store new configuration and peers - self.interface_configuration = Some(new_interface_configuration); - self.replace_peers(new_configuration.peers); + self.process_firewall_changes(new_firewall_configuration.as_ref())?; Ok(()) } @@ -403,6 +522,25 @@ impl Gateway { } }; } + Some(update::Update::FirewallConfig(config)) => { + debug!("Applying received firewall configuration: {config:?}"); + let config_str = format!("{:?}", config); + match FirewallConfig::from_proto(config) { + Ok(new_firewall_config) => { + debug!("Parsed the received firewall configuration: {new_firewall_config:?}, processing it and applying changes"); + if let Err(err) = + self.process_firewall_changes(Some(&new_firewall_config)) + { + error!("Failed to process received firewall configuration: {err}"); + } + } + Err(err) => { + error!( + "Failed to parse received firewall configuration: {err}. Configuration: {config_str}" + ); + } + } + } _ => warn!("Unsupported kind of update: {update:?}"), } } @@ -517,12 +655,14 @@ mod tests { connected: Arc::new(AtomicBool::new(false)), client, stats_thread: None, + firewall_api: None, + firewall_rules: vec![], }; // new config is the same let new_config = old_config.clone(); let new_peers = old_peers.clone(); - assert!(!gateway.is_config_changed(&new_config, &new_peers)); + assert!(!gateway.is_interface_config_changed(&new_config, &new_peers)); // only interface config is different let new_config = InterfaceConfiguration { @@ -532,14 +672,14 @@ mod tests { port: 50051, }; let new_peers = old_peers.clone(); - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); // peer was removed let new_config = old_config.clone(); let mut new_peers = old_peers.clone(); new_peers.pop(); - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); // peer was added let new_config = old_config.clone(); @@ -551,7 +691,7 @@ mod tests { keepalive_interval: None, }); - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); // peer pubkey changed let new_config = old_config.clone(); @@ -570,7 +710,7 @@ mod tests { }, ]; - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); // peer IP changed let new_config = old_config.clone(); @@ -589,7 +729,7 @@ mod tests { }, ]; - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); // peer preshared key changed let new_config = old_config.clone(); @@ -608,7 +748,7 @@ mod tests { }, ]; - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); // peer keepalive interval changed let new_config = old_config.clone(); @@ -627,6 +767,6 @@ mod tests { }, ]; - assert!(gateway.is_config_changed(&new_config, &new_peers)); + assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); } } diff --git a/src/lib.rs b/src/lib.rs index 38cd313e..c488ff95 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -4,10 +4,13 @@ pub mod gateway; pub mod server; pub mod proto { - tonic::include_proto!("gateway"); - + pub mod gateway { + tonic::include_proto!("gateway"); + } pub mod enterprise { - tonic::include_proto!("firewall"); + pub mod firewall { + tonic::include_proto!("enterprise.firewall"); + } } } @@ -85,8 +88,8 @@ pub fn execute_command(command: &str) -> Result<(), GatewayError> { Ok(()) } -impl From for InterfaceConfiguration { - fn from(config: proto::Configuration) -> Self { +impl From for InterfaceConfiguration { + fn from(config: proto::gateway::Configuration) -> Self { let peers = config.peers.into_iter().map(Peer::from).collect(); // Try to convert an array of `String`s to `IpAddrMask`, leaving out the failed ones. let addresses = config @@ -105,8 +108,8 @@ impl From for InterfaceConfiguration { } } -impl From for Peer { - fn from(proto_peer: proto::Peer) -> Self { +impl From for Peer { + fn from(proto_peer: proto::gateway::Peer) -> Self { let mut peer = Self::new(proto_peer.pubkey.as_str().try_into().unwrap_or_default()); peer.persistent_keepalive_interval = proto_peer .keepalive_interval @@ -123,7 +126,7 @@ impl From for Peer { } } -impl From<&Peer> for proto::Peer { +impl From<&Peer> for proto::gateway::Peer { fn from(peer: &Peer) -> Self { let preshared_key = peer.preshared_key.as_ref().map(ToString::to_string); Self { @@ -135,7 +138,7 @@ impl From<&Peer> for proto::Peer { } } -impl From<&Peer> for proto::PeerStats { +impl From<&Peer> for proto::gateway::PeerStats { fn from(peer: &Peer) -> Self { Self { public_key: peer.public_key.to_string(), diff --git a/src/main.rs b/src/main.rs index f83194a4..2cecc98b 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,16 +1,15 @@ use std::{fs::File, io::Write, process, sync::Arc}; +use defguard_gateway::{ + config::get_config, error::GatewayError, execute_command, gateway::Gateway, init_syslog, + server::run_server, +}; #[cfg(not(target_os = "macos"))] use defguard_wireguard_rs::Kernel; use defguard_wireguard_rs::{Userspace, WGApi}; use env_logger::{init_from_env, Env, DEFAULT_FILTER_ENV}; use tokio::task::JoinSet; -use defguard_gateway::{ - config::get_config, error::GatewayError, execute_command, gateway::Gateway, init_syslog, - server::run_server, -}; - #[tokio::main] async fn main() -> Result<(), GatewayError> { // parse config @@ -42,12 +41,12 @@ async fn main() -> Result<(), GatewayError> { let ifname = config.ifname.clone(); let mut gateway = if config.userspace { let wgapi = WGApi::::new(ifname)?; - Gateway::new(config.clone(), wgapi)? + Gateway::new(config.clone(), wgapi, None)? } else { #[cfg(not(target_os = "macos"))] { let wgapi = WGApi::::new(ifname)?; - Gateway::new(config.clone(), wgapi)? + Gateway::new(config.clone(), wgapi, None)? } #[cfg(target_os = "macos")] { From 70a3a3aabb1057569fa873b830f4e30bf7d87e65 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 27 Feb 2025 12:28:15 +0100 Subject: [PATCH 05/32] install dependencies --- .github/workflows/ci.yml | 4 ++-- .github/workflows/docs.yml | 4 ++-- Dockerfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7ad4b0c0..910fbb29 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,8 +35,8 @@ jobs: uses: Swatinem/rust-cache@v2 with: key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - - name: Install protoc - run: apt-get update && apt-get -y install protobuf-compiler + - name: Install dependencies + run: apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev - name: Check format run: | rustup component add rustfmt diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9035e420..6c8f9745 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -25,8 +25,8 @@ jobs: - name: Install Rust toolchain run: rustup update --no-self-update stable - - name: Install protoc - run: apt-get update && apt-get -y install protobuf-compiler + - name: Install dependencies + run: apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev - name: Build Docs run: cargo doc --all --no-deps diff --git a/Dockerfile b/Dockerfile index 42cf61cb..1ec5c1e5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM rust:1-slim as builder -RUN apt-get update && apt-get -y install protobuf-compiler +RUN apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev WORKDIR /app COPY . . RUN cargo build --release From 40b326dda3b6257b3e61212f754a5a73c6e2239c Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 3 Mar 2025 13:11:08 +0100 Subject: [PATCH 06/32] add config option to masquarade the firewall --- example-config.toml | 3 +++ src/config.rs | 6 ++++++ src/enterprise/firewall/api.rs | 4 +++- src/enterprise/firewall/linux/mod.rs | 5 +++++ src/gateway.rs | 6 +++++- 5 files changed, 22 insertions(+), 2 deletions(-) diff --git a/example-config.toml b/example-config.toml index 8653c271..96ee0c0b 100644 --- a/example-config.toml +++ b/example-config.toml @@ -50,3 +50,6 @@ syslog_socket = "/var/run/log" # 200 - Gateway is working and is connected to CORE # 503 - gateway works but is not connected to CORE #health_port = 55003 + +# Optional: Enable automatic masquerading of traffic by the firewall +#masquerade = true diff --git a/src/config.rs b/src/config.rs index 16037880..26a4a658 100644 --- a/src/config.rs +++ b/src/config.rs @@ -90,6 +90,11 @@ pub struct Config { /// 503 - gateway works but is not connected to CORE #[arg(long, env = "HEALTH_PORT")] pub health_port: Option, + + /// Whether the firewall should automatically apply masquerading + #[arg(long, env = "MASQUERADE")] + #[serde(default)] + pub masquerade: bool, } impl Default for Config { @@ -112,6 +117,7 @@ impl Default for Config { pre_down: None, post_down: None, health_port: None, + masquerade: false, } } } diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index ad965390..772b307a 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -5,15 +5,17 @@ pub struct FirewallApi { pub ifname: String, pub default_policy: Policy, pub v4: bool, + pub masquerade: bool, } impl FirewallApi { #[must_use] - pub fn from_config(ifname: &str, config: &FirewallConfig) -> Self { + pub fn from_config(ifname: &str, config: &FirewallConfig, masquerade: bool) -> Self { Self { ifname: ifname.into(), default_policy: config.default_policy, v4: config.v4, + masquerade, } } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index c5a4c28c..0d7377a5 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -76,6 +76,11 @@ impl FirewallManagementApi for FirewallApi { debug!("Allowing all established traffic"); allow_established_traffic()?; debug!("Allowed all established traffic"); + if self.masquerade { + debug!("Enabling masquerade according to the gateway configuration"); + self.set_masquerade_status(self.masquerade)?; + debug!("Masquerade enabled"); + } debug!("Initialized firewall"); Ok(()) } diff --git a/src/gateway.rs b/src/gateway.rs index 81918688..8179cbbc 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -307,7 +307,11 @@ impl Gateway { api.maybe_update_from_config(fw_config)?; api.setup()?; } else { - let api = FirewallApi::from_config(&self.config.ifname, fw_config); + let api = FirewallApi::from_config( + &self.config.ifname, + fw_config, + self.config.masquerade, + ); api.setup()?; self.firewall_api = Some(api); } From 3a5eb9724c4ab4996c970859b1d84008d9881b42 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 4 Mar 2025 10:16:33 +0100 Subject: [PATCH 07/32] docker builds --- .github/workflows/build-docker.yml | 15 ++++++++------- .github/workflows/current.yml | 8 +++++++- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 3e5956d9..dccd2ab3 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -23,17 +23,18 @@ jobs: - ${{ matrix.runner }} strategy: matrix: - cpu: [arm64, amd64, arm/v7] + # cpu: [arm64, amd64, arm/v7] + cpu: [amd64] include: - - cpu: arm64 - runner: ARM64 - tag: arm64 + # - cpu: arm64 + # runner: ARM64 + # tag: arm64 - cpu: amd64 runner: X64 tag: amd64 - - cpu: arm/v7 - runner: ARM - tag: armv7 + # - cpu: arm/v7 + # runner: ARM + # tag: armv7 steps: - name: Checkout uses: actions/checkout@v4 diff --git a/.github/workflows/current.yml b/.github/workflows/current.yml index f67ce3ef..f1b5ff5c 100644 --- a/.github/workflows/current.yml +++ b/.github/workflows/current.yml @@ -4,6 +4,7 @@ on: branches: - main - dev + - firewall paths-ignore: - "*.md" - "LICENSE" @@ -16,7 +17,12 @@ jobs: build-current: uses: ./.github/workflows/build-docker.yml with: + # tags: | + # type=raw,value=current + # type=ref,event=branch + # type=sha tags: | - type=raw,value=current type=ref,event=branch type=sha + flavor: | + latest=false From dfd304a9fd4b0ae4657eecc26bb41ed838441939 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 4 Mar 2025 15:05:10 +0100 Subject: [PATCH 08/32] cleanup, refactor --- src/enterprise/firewall/api.rs | 43 +--- src/enterprise/firewall/linux/mod.rs | 16 +- src/enterprise/firewall/mod.rs | 12 +- src/enterprise/firewall/test/mod.rs | 41 ++++ src/gateway.rs | 311 +++++++++++++++++++++------ src/main.rs | 19 +- 6 files changed, 317 insertions(+), 125 deletions(-) create mode 100644 src/enterprise/firewall/test/mod.rs diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index 772b307a..8bbeec0d 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -1,60 +1,25 @@ -use super::{FirewallConfig, FirewallError, FirewallRule, Policy}; +use super::{FirewallError, FirewallRule, Policy}; #[derive(Debug, Clone)] pub struct FirewallApi { pub ifname: String, - pub default_policy: Policy, - pub v4: bool, - pub masquerade: bool, } impl FirewallApi { #[must_use] - pub fn from_config(ifname: &str, config: &FirewallConfig, masquerade: bool) -> Self { + pub fn new(ifname: &str) -> Self { Self { ifname: ifname.into(), - default_policy: config.default_policy, - v4: config.v4, - masquerade, } } - - pub fn config_changed(&self, config: &FirewallConfig) -> bool { - self.default_policy != config.default_policy || self.v4 != config.v4 - } - - pub fn maybe_update_from_config( - &mut self, - config: &FirewallConfig, - ) -> Result { - debug!("Updating firewall configuration if it has changed"); - let changed = if self.default_policy != config.default_policy { - self.default_policy = config.default_policy; - true - } else if self.v4 != config.v4 { - self.v4 = config.v4; - true - } else { - false - }; - - if changed { - debug!( - "Updated firewall configuration as it has changed, new configuration: {:?}", - self - ); - } - - Ok(changed) - } } pub trait FirewallManagementApi { /// Sets up the firewall with the default policy and cleans up any existing rules - fn setup(&self) -> Result<(), FirewallError>; + fn setup(&self, default_policy: Option) -> Result<(), FirewallError>; fn cleanup(&self) -> Result<(), FirewallError>; fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError>; - fn apply_rules(&self, rules: Vec) -> Result<(), FirewallError>; + fn add_rules(&self, rules: Vec) -> Result<(), FirewallError>; fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError>; fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError>; } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 0d7377a5..9f5e3ca8 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -33,10 +33,6 @@ impl Protocol { } } } - - pub fn supports_ports(&self) -> bool { - PORT_PROTOCOLS.contains(self) - } } #[derive(Debug, Default)] @@ -69,18 +65,13 @@ pub struct FilterRule { } impl FirewallManagementApi for FirewallApi { - fn setup(&self) -> Result<(), FirewallError> { + fn setup(&self, default_policy: Option) -> Result<(), FirewallError> { debug!("Initializing firewall, VPN interface: {}", self.ifname); self.cleanup()?; - init_firewall(Some(self.default_policy)).expect("Failed to setup chains"); + init_firewall(default_policy).expect("Failed to setup chains"); debug!("Allowing all established traffic"); allow_established_traffic()?; debug!("Allowed all established traffic"); - if self.masquerade { - debug!("Enabling masquerade according to the gateway configuration"); - self.set_masquerade_status(self.masquerade)?; - debug!("Masquerade enabled"); - } debug!("Initialized firewall"); Ok(()) } @@ -94,7 +85,6 @@ impl FirewallManagementApi for FirewallApi { fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> { debug!("Setting default firewall policy to: {:?}", policy); - self.default_policy = policy; set_default_policy(policy)?; debug!("Set firewall default policy to {:?}", policy); Ok(()) @@ -107,7 +97,7 @@ impl FirewallManagementApi for FirewallApi { Ok(()) } - fn apply_rules(&self, rules: Vec) -> Result<(), FirewallError> { + fn add_rules(&self, rules: Vec) -> Result<(), FirewallError> { debug!("Applying the following Defguard ACL rules: {:?}", rules); for rule in rules { self.add_rule(rule)?; diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index f0a088d8..dea52ef2 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -6,9 +6,13 @@ use thiserror::Error; use crate::proto; pub mod api; -#[cfg(target_os = "linux")] +#[cfg(all(not(test), target_os = "linux"))] pub mod linux; +// allow this only in tests +#[cfg(test)] +pub mod test; + #[derive(Debug, Copy, Clone, PartialEq, Eq)] pub enum Address { Ip(IpAddr), @@ -98,6 +102,12 @@ pub const PORT_PROTOCOLS: [Protocol; 2] = [ Protocol(17), ]; +impl Protocol { + pub fn supports_ports(&self) -> bool { + PORT_PROTOCOLS.contains(self) + } +} + #[derive(Debug, Default, Clone, Copy, PartialEq, Eq)] pub enum Policy { Allow, diff --git a/src/enterprise/firewall/test/mod.rs b/src/enterprise/firewall/test/mod.rs new file mode 100644 index 00000000..24916070 --- /dev/null +++ b/src/enterprise/firewall/test/mod.rs @@ -0,0 +1,41 @@ +use super::{ + api::{FirewallApi, FirewallManagementApi}, + FirewallError, FirewallRule, Policy, Protocol, +}; +use crate::proto; + +impl FirewallManagementApi for FirewallApi { + fn setup(&self, _default_policy: Option) -> Result<(), FirewallError> { + Ok(()) + } + + fn cleanup(&self) -> Result<(), FirewallError> { + Ok(()) + } + + fn set_firewall_default_policy(&mut self, _policy: Policy) -> Result<(), FirewallError> { + Ok(()) + } + + fn set_masquerade_status(&self, _enabled: bool) -> Result<(), FirewallError> { + Ok(()) + } + + fn add_rules(&self, _rules: Vec) -> Result<(), FirewallError> { + Ok(()) + } + + fn add_rule(&self, _rule: FirewallRule) -> Result<(), FirewallError> { + Ok(()) + } +} + +impl Protocol { + pub const fn from_proto( + proto: proto::enterprise::firewall::Protocol, + ) -> Result { + match proto { + _ => Ok(Self(proto as u8)), + } + } +} diff --git a/src/gateway.rs b/src/gateway.rs index 8179cbbc..3406a638 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -105,8 +105,8 @@ pub struct Gateway { interface_configuration: Option, peers: HashMap, wgapi: Arc>, - firewall_api: Option, - firewall_rules: Vec, + firewall_api: FirewallApi, + firewall_config: Option, pub connected: Arc, client: GatewayServiceClient>, stats_thread: Option>, @@ -116,7 +116,7 @@ impl Gateway { pub fn new( config: Config, wgapi: impl WireguardInterfaceApi + Send + Sync + 'static, - firewallapi: Option, + firewall_api: FirewallApi, ) -> Result { let client = Self::setup_client(&config)?; Ok(Self { @@ -127,8 +127,8 @@ impl Gateway { connected: Arc::new(AtomicBool::new(false)), client, stats_thread: None, - firewall_api: firewallapi, - firewall_rules: vec![], + firewall_api, + firewall_config: None, }) } @@ -142,13 +142,6 @@ impl Gateway { self.peers = peers; } - fn is_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool { - if let Some(firewall_api) = &self.firewall_api { - return firewall_api.config_changed(new_fw_config); - } - true - } - // check if new received configuration is different than current one fn is_interface_config_changed( &self, @@ -263,30 +256,46 @@ impl Gateway { } } - fn did_firewall_rules_change(&self, new_rules: &[FirewallRule]) -> bool { - debug!("Checking if Defguard ACL rules have changed"); - - if self.firewall_rules.len() != new_rules.len() { - debug!("Number of Defguard ACL rules is different, so the rules have changed"); - return true; + /// Checks whether the firewall config changed, but doesn't check the rules. + fn has_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool { + if let Some(current_config) = &self.firewall_config { + return current_config.default_policy != new_fw_config.default_policy + || current_config.v4 != new_fw_config.v4; } - for rule in new_rules { - if !self.firewall_rules.contains(rule) { - debug!("Found a new Defguard ACL rule: {rule:?}. Rules have changed."); + true + } + + /// Checks whether the firewall rules have changed. + fn has_firewall_rules_changed(&self, new_rules: &[FirewallRule]) -> bool { + debug!("Checking if Defguard ACL rules have changed"); + if let Some(current_config) = &self.firewall_config { + let current_rules = ¤t_config.rules; + if current_rules.len() != new_rules.len() { + debug!("Number of Defguard ACL rules is different, so the rules have changed"); return true; } - } - for rule in &self.firewall_rules { - if !new_rules.contains(rule) { - debug!("Found a removed Defguard ACL rule: {rule:?}. Rules have changed."); - return true; + for rule in new_rules { + if !current_rules.contains(rule) { + debug!("Found a new Defguard ACL rule: {rule:?}. Rules have changed."); + return true; + } + } + + for rule in current_rules { + if !new_rules.contains(rule) { + debug!("Found a removed Defguard ACL rule: {rule:?}. Rules have changed."); + return true; + } } - } - debug!("Defguard ACL rules have not changed"); - false + debug!("Defguard ACL rules are the same. Rules have not changed."); + false + } else { + debug!("There are new Defguard ACL rules in the new configuration, but we don't have any in the current one. Rules have changed."); + true + } } /// Process and apply firewall configuration changes. @@ -301,58 +310,35 @@ impl Gateway { ) -> Result<(), GatewayError> { if let Some(fw_config) = fw_config { debug!("Received firewall configuration: {fw_config:?}"); - if self.is_firewall_config_changed(fw_config) { + if self.has_firewall_config_changed(fw_config) { debug!("Received firewall configuration is different than current one. Reconfiguring firewall..."); - if let Some(api) = &mut self.firewall_api { - api.maybe_update_from_config(fw_config)?; - api.setup()?; - } else { - let api = FirewallApi::from_config( - &self.config.ifname, - fw_config, - self.config.masquerade, - ); - api.setup()?; - self.firewall_api = Some(api); - } + self.firewall_api.setup(Some(fw_config.default_policy))?; + self.firewall_config = Some(fw_config.clone()); + debug!("Reconfigured firewall with new configuration"); - if self.did_firewall_rules_change(&fw_config.rules) { + if self.has_firewall_rules_changed(&fw_config.rules) { debug!("Received firewall rules are different than the current ones. Applying the new rules."); - if let Some(api) = &self.firewall_api { - api.apply_rules(fw_config.rules.clone())?; - self.firewall_rules = fw_config.rules.clone(); - } else { - error!( - "Firewall API not initialized. Configuration: {:?}", - fw_config.rules - ); - } + self.firewall_api.add_rules(fw_config.rules.clone())?; } else { debug!("Received firewall rules are the same as the current ones. Skipping applying the rules."); } - } else if self.did_firewall_rules_change(&fw_config.rules) { + } else if self.has_firewall_rules_changed(&fw_config.rules) { debug!("Received firewall rules are different than the current ones. Applying the new rules."); - if let Some(api) = &self.firewall_api { - // Temporary simplest approach is to drop everything and reapply all rules - api.setup()?; - api.apply_rules(fw_config.rules.clone())?; - self.firewall_rules = fw_config.rules.clone(); + if let Some(current_config) = &mut self.firewall_config { + let rules = &fw_config.rules; + self.firewall_api.add_rules(rules.clone())?; + current_config.rules = fw_config.rules.clone(); } else { - error!( - "Firewall API not initialized. Configuration: {:?}", - fw_config.rules - ); + unreachable!("Firewall config should be present here"); } } else { debug!("Received firewall configuration and rules are identical to current one. Skipping firewall reconfiguration"); } } else { debug!("Received firewall configuration is empty, cleaning up firewall rules..."); - if let Some(api) = &self.firewall_api { - api.cleanup()?; - self.firewall_api = None; - self.firewall_rules = vec![]; - } + self.firewall_api.cleanup()?; + self.firewall_config = None; + debug!("Cleaned up firewall rules"); } Ok(()) @@ -613,8 +599,10 @@ mod tests { #[cfg(target_os = "macos")] use defguard_wireguard_rs::Userspace; use defguard_wireguard_rs::WGApi; + use ipnetwork::IpNetwork; use super::*; + use crate::enterprise::firewall::{Address, Policy, Port, Protocol}; #[tokio::test] async fn test_configuration_comparison() { @@ -651,6 +639,7 @@ mod tests { let wgapi = WGApi::::new("wg0".into()).unwrap(); let config = Config::default(); let client = Gateway::setup_client(&config).unwrap(); + let firewall_api = FirewallApi::new("wg0"); let gateway = Gateway { config, interface_configuration: Some(old_config.clone()), @@ -659,8 +648,8 @@ mod tests { connected: Arc::new(AtomicBool::new(false)), client, stats_thread: None, - firewall_api: None, - firewall_rules: vec![], + firewall_api: firewall_api, + firewall_config: None, }; // new config is the same @@ -773,4 +762,188 @@ mod tests { assert!(gateway.is_interface_config_changed(&new_config, &new_peers)); } + + #[tokio::test] + async fn test_firewall_rules_comparison() { + use std::net::IpAddr; + + let rule1 = FirewallRule { + comment: Some("Rule 1".to_string()), + destination_addrs: vec![Address::Ip(IpAddr::from_str("10.0.0.1").unwrap())], + destination_ports: vec![Port::Single(80)], + id: 1, + verdict: Policy::Allow, + protocols: vec![Protocol(6)], // TCP + source_addrs: vec![Address::Ip(IpAddr::from_str("192.168.1.1").unwrap())], + v4: true, + }; + + let rule2 = FirewallRule { + comment: Some("Rule 2".to_string()), + destination_addrs: vec![Address::Ip(IpAddr::from_str("10.0.0.2").unwrap())], + destination_ports: vec![Port::Single(443)], + id: 2, + verdict: Policy::Allow, + protocols: vec![Protocol(6)], // TCP + source_addrs: vec![Address::Ip(IpAddr::from_str("192.168.1.2").unwrap())], + v4: true, + }; + + let rule3 = FirewallRule { + comment: Some("Rule 3".to_string()), + destination_addrs: vec![Address::Network( + IpNetwork::from_str("10.0.1.0/24").unwrap(), + )], + destination_ports: vec![Port::Range(1000, 2000)], + id: 3, + verdict: Policy::Deny, + protocols: vec![Protocol(17)], // UDP + source_addrs: vec![Address::Network( + IpNetwork::from_str("192.168.0.0/16").unwrap(), + )], + v4: true, + }; + + let config1 = FirewallConfig { + rules: vec![rule1.clone(), rule2.clone()], + default_policy: Policy::Allow, + v4: true, + }; + + let config_empty = FirewallConfig { + rules: vec![], + default_policy: Policy::Allow, + v4: true, + }; + + #[cfg(target_os = "macos")] + let wgapi = WGApi::::new("wg0".into()).unwrap(); + #[cfg(not(target_os = "macos"))] + let wgapi = WGApi::::new("wg0".into()).unwrap(); + + let config = Config::default(); + let client = Gateway::setup_client(&config).unwrap(); + let mut gateway = Gateway { + config, + interface_configuration: None, + peers: HashMap::new(), + wgapi: Arc::new(Mutex::new(wgapi)), + connected: Arc::new(AtomicBool::new(false)), + client, + stats_thread: None, + firewall_api: FirewallApi::new("test_interface"), + firewall_config: None, + }; + + // Gateway has no firewall config, new rules are empty + gateway.firewall_config = None; + assert!(gateway.has_firewall_rules_changed(&[])); + + // Gateway has no firewall config, but new rules exist + gateway.firewall_config = None; + assert!(gateway.has_firewall_rules_changed(&[rule1.clone()])); + + // Gateway has firewall config, with empty rules list + gateway.firewall_config = Some(config1.clone()); + assert!(gateway.has_firewall_rules_changed(&[])); + + // Gateway has firewall config, new rules have different length + gateway.firewall_config = Some(config1.clone()); + assert!(gateway.has_firewall_rules_changed(&[rule1.clone()])); + + // Gateway has firewall config, new rules have different content + gateway.firewall_config = Some(config1.clone()); + assert!(gateway.has_firewall_rules_changed(&[rule1.clone(), rule3.clone()])); + + // Gateway has firewall config, new rules are identical + gateway.firewall_config = Some(config1.clone()); + assert!(!gateway.has_firewall_rules_changed(&[rule1.clone(), rule2.clone()])); + + // Gateway has empty firewall config, new rules exist + gateway.firewall_config = Some(config_empty.clone()); + assert!(gateway.has_firewall_rules_changed(&[rule1.clone()])); + + // Both configs are empty + gateway.firewall_config = Some(config_empty.clone()); + assert!(!gateway.has_firewall_rules_changed(&[])); + } + + #[tokio::test] + async fn test_firewall_config_comparison() { + let config1 = FirewallConfig { + rules: vec![], + default_policy: Policy::Allow, + v4: true, + }; + + let config2 = FirewallConfig { + rules: vec![], + default_policy: Policy::Deny, + v4: true, + }; + + let config3 = FirewallConfig { + rules: vec![], + default_policy: Policy::Allow, + v4: false, + }; + + let config4 = FirewallConfig { + rules: vec![], + default_policy: Policy::Allow, + v4: true, + }; + + #[cfg(target_os = "macos")] + let wgapi = WGApi::::new("wg0".into()).unwrap(); + #[cfg(not(target_os = "macos"))] + let wgapi = WGApi::::new("wg0".into()).unwrap(); + + let config = Config::default(); + let client = Gateway::setup_client(&config).unwrap(); + let mut gateway = Gateway { + config, + interface_configuration: None, + peers: HashMap::new(), + wgapi: Arc::new(Mutex::new(wgapi)), + connected: Arc::new(AtomicBool::new(false)), + client, + stats_thread: None, + firewall_api: FirewallApi::new("test_interface"), + firewall_config: None, + }; + // Gateway has no config + gateway.firewall_config = None; + assert!(gateway.has_firewall_config_changed(&config1)); + + // Gateway has config, new config has different default_policy + gateway.firewall_config = Some(config1.clone()); + assert!(gateway.has_firewall_config_changed(&config2)); + + // Gateway has config, new config has different v4 value + gateway.firewall_config = Some(config1.clone()); + assert!(gateway.has_firewall_config_changed(&config3)); + + // Gateway has config, new config is identical + gateway.firewall_config = Some(config1.clone()); + assert!(!gateway.has_firewall_config_changed(&config4)); + + // Rules are being ignored + let config5 = FirewallConfig { + rules: vec![FirewallRule { + comment: None, + destination_addrs: vec![], + destination_ports: vec![], + id: 0, + verdict: Policy::Allow, + protocols: vec![], + source_addrs: vec![], + v4: true, + }], + default_policy: Policy::Allow, + v4: true, + }; + gateway.firewall_config = Some(config1.clone()); + assert!(!gateway.has_firewall_config_changed(&config5)); + } } diff --git a/src/main.rs b/src/main.rs index 2cecc98b..85b96871 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,7 +1,12 @@ use std::{fs::File, io::Write, process, sync::Arc}; use defguard_gateway::{ - config::get_config, error::GatewayError, execute_command, gateway::Gateway, init_syslog, + config::get_config, + enterprise::firewall::api::{FirewallApi, FirewallManagementApi}, + error::GatewayError, + execute_command, + gateway::Gateway, + init_syslog, server::run_server, }; #[cfg(not(target_os = "macos"))] @@ -39,14 +44,21 @@ async fn main() -> Result<(), GatewayError> { } let ifname = config.ifname.clone(); + let firewall_api = FirewallApi::new(&ifname); + #[cfg(target_os = "linux")] + if config.masquerade { + firewall_api.setup(None)?; + firewall_api.set_masquerade_status(true)?; + } + let mut gateway = if config.userspace { let wgapi = WGApi::::new(ifname)?; - Gateway::new(config.clone(), wgapi, None)? + Gateway::new(config.clone(), wgapi, firewall_api)? } else { #[cfg(not(target_os = "macos"))] { let wgapi = WGApi::::new(ifname)?; - Gateway::new(config.clone(), wgapi, None)? + Gateway::new(config.clone(), wgapi, firewall_api)? } #[cfg(target_os = "macos")] { @@ -54,6 +66,7 @@ async fn main() -> Result<(), GatewayError> { return Ok(()); } }; + let mut tasks = JoinSet::new(); if let Some(health_port) = config.health_port { tasks.spawn(run_server(health_port, Arc::clone(&gateway.connected))); From 2b2ba59da6381f40df8f6e881d92d300eb1e738b Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:12:00 +0100 Subject: [PATCH 09/32] add more logging to gateway rule comparison --- src/gateway.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gateway.rs b/src/gateway.rs index 3406a638..7963fac8 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -290,7 +290,7 @@ impl Gateway { } } - debug!("Defguard ACL rules are the same. Rules have not changed."); + debug!("Defguard ACL rules are the same. Rules have not changed. My rules: {current_rules:?}, new rules: {new_rules:?}"); false } else { debug!("There are new Defguard ACL rules in the new configuration, but we don't have any in the current one. Rules have changed."); From ea0ee5e99c951f326528158db60fafb327697b68 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:38:46 +0100 Subject: [PATCH 10/32] fix firewall rules not being applied --- src/gateway.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gateway.rs b/src/gateway.rs index 7963fac8..18aef171 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -313,7 +313,6 @@ impl Gateway { if self.has_firewall_config_changed(fw_config) { debug!("Received firewall configuration is different than current one. Reconfiguring firewall..."); self.firewall_api.setup(Some(fw_config.default_policy))?; - self.firewall_config = Some(fw_config.clone()); debug!("Reconfigured firewall with new configuration"); if self.has_firewall_rules_changed(&fw_config.rules) { @@ -322,6 +321,7 @@ impl Gateway { } else { debug!("Received firewall rules are the same as the current ones. Skipping applying the rules."); } + self.firewall_config = Some(fw_config.clone()); } else if self.has_firewall_rules_changed(&fw_config.rules) { debug!("Received firewall rules are different than the current ones. Applying the new rules."); if let Some(current_config) = &mut self.firewall_config { From 6f5ab0461a5f7f0a8544c8a93e58f91fa23c23dd Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 13 Mar 2025 12:44:41 +0100 Subject: [PATCH 11/32] fix experimental docker builds --- .github/workflows/build-docker.yml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index dccd2ab3..349274d4 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -24,11 +24,11 @@ jobs: strategy: matrix: # cpu: [arm64, amd64, arm/v7] - cpu: [amd64] + cpu: [arm64, amd64] include: - # - cpu: arm64 - # runner: ARM64 - # tag: arm64 + - cpu: arm64 + runner: ARM64 + tag: arm64 - cpu: amd64 runner: X64 tag: amd64 @@ -82,11 +82,19 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Create and push manifests + # run: | + # tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}' + # for tag in ${tags} + # do + # docker manifest rm ${tag} || true + # docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7 + # docker manifest push ${tag} + # done run: | tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}' for tag in ${tags} do docker manifest rm ${tag} || true - docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7 + docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 docker manifest push ${tag} done From aae1ea6abb644af40945d23c57a7ae5b3a7bded2 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 17 Mar 2025 09:39:21 +0100 Subject: [PATCH 12/32] add nftables to container --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1ec5c1e5..16ba3ccb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,7 @@ RUN cargo build --release FROM debian:bookworm-slim RUN apt-get update && apt-get -y --no-install-recommends install \ - iproute2 wireguard-tools sudo ca-certificates iptables ebtables && \ + iproute2 wireguard-tools sudo ca-certificates iptables ebtables nftables && \ apt-get clean && rm -rf /var/lib/apt/lists/* WORKDIR /app COPY --from=builder /app/target/release/defguard-gateway /usr/local/bin From 738fbd9991f4bebdea6b82b2a2ae1da4acb3f874 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 17 Mar 2025 10:34:47 +0100 Subject: [PATCH 13/32] dont compile for non-linux, allow setting chain priority --- src/config.rs | 7 ++++++- src/enterprise/firewall/api.rs | 6 +++++- .../firewall/{test => dummy}/mod.rs | 6 +++++- src/enterprise/firewall/linux/mod.rs | 8 +++++-- src/enterprise/firewall/linux/netfilter.rs | 14 ++++++++----- src/enterprise/firewall/mod.rs | 5 ++--- src/gateway.rs | 21 ++++++++++++------- src/main.rs | 2 +- 8 files changed, 47 insertions(+), 22 deletions(-) rename src/enterprise/firewall/{test => dummy}/mod.rs (86%) diff --git a/src/config.rs b/src/config.rs index 26a4a658..619a58e1 100644 --- a/src/config.rs +++ b/src/config.rs @@ -92,9 +92,13 @@ pub struct Config { pub health_port: Option, /// Whether the firewall should automatically apply masquerading - #[arg(long, env = "MASQUERADE")] + #[arg(long, env = "DEFGUARD_MASQUERADE")] #[serde(default)] pub masquerade: bool, + + #[arg(long, env = "DEFGUARD_FW_PRIORITY")] + #[serde(default)] + pub fw_priority: Option, } impl Default for Config { @@ -118,6 +122,7 @@ impl Default for Config { post_down: None, health_port: None, masquerade: false, + fw_priority: None, } } } diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index 8bbeec0d..fba0693c 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -16,7 +16,11 @@ impl FirewallApi { pub trait FirewallManagementApi { /// Sets up the firewall with the default policy and cleans up any existing rules - fn setup(&self, default_policy: Option) -> Result<(), FirewallError>; + fn setup( + &self, + default_policy: Option, + priority: Option, + ) -> Result<(), FirewallError>; fn cleanup(&self) -> Result<(), FirewallError>; fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError>; fn add_rules(&self, rules: Vec) -> Result<(), FirewallError>; diff --git a/src/enterprise/firewall/test/mod.rs b/src/enterprise/firewall/dummy/mod.rs similarity index 86% rename from src/enterprise/firewall/test/mod.rs rename to src/enterprise/firewall/dummy/mod.rs index 24916070..9638b0bb 100644 --- a/src/enterprise/firewall/test/mod.rs +++ b/src/enterprise/firewall/dummy/mod.rs @@ -5,7 +5,11 @@ use super::{ use crate::proto; impl FirewallManagementApi for FirewallApi { - fn setup(&self, _default_policy: Option) -> Result<(), FirewallError> { + fn setup( + &self, + _default_policy: Option, + _priority: Option, + ) -> Result<(), FirewallError> { Ok(()) } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 9f5e3ca8..41d322d9 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -65,10 +65,14 @@ pub struct FilterRule { } impl FirewallManagementApi for FirewallApi { - fn setup(&self, default_policy: Option) -> Result<(), FirewallError> { + fn setup( + &self, + default_policy: Option, + priority: Option, + ) -> Result<(), FirewallError> { debug!("Initializing firewall, VPN interface: {}", self.ifname); self.cleanup()?; - init_firewall(default_policy).expect("Failed to setup chains"); + init_firewall(default_policy, priority).expect("Failed to setup chains"); debug!("Allowing all established traffic"); allow_established_traffic()?; debug!("Allowed all established traffic"); diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 35b68f5b..47408834 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -515,7 +515,10 @@ impl FirewallRule for NatRule { // } /// Sets up the default chains for the firewall -pub(crate) fn init_firewall(initial_policy: Option) -> Result<(), FirewallError> { +pub(crate) fn init_firewall( + initial_policy: Option, + defguard_fwd_chain_priority: Option, +) -> Result<(), FirewallError> { let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); @@ -524,7 +527,10 @@ pub(crate) fn init_firewall(initial_policy: Option) -> Result<(), Firewa batch.add(&table, nftnl::MsgType::Add); let mut chain = Chains::Forward.to_chain(&table); - chain.set_hook(nftnl::Hook::Forward, FORWARD_PRIORITY); + chain.set_hook( + nftnl::Hook::Forward, + defguard_fwd_chain_priority.unwrap_or(FORWARD_PRIORITY), + ); chain.set_policy(initial_policy.unwrap_or(Policy::Allow).into()); chain.set_type(nftnl::ChainType::Filter); batch.add(&chain, nftnl::MsgType::Add); @@ -608,8 +614,6 @@ pub(crate) fn allow_established_traffic() -> Result<(), FirewallError> { let established_rule = FilterRule { states: vec![State::Established, State::Related], - // TODO: This is not always the case, allow all established traffic for now - // iifname: Some(ifname.to_string()), counter: true, action: Policy::Allow, ..Default::default() @@ -704,7 +708,7 @@ fn send_batch(batch: &FinalizedBatch) -> Result<(), FirewallError> { let portid = socket.portid(); let mut buffer = vec![0; nftnl::nft_nlmsg_maxsize() as usize]; - // TODO: Why is it 2? + // TODO: Why is it supposed to be 2? let seq = 2; while let Some(message) = socket_recv(&socket, &mut buffer[..])? { match mnl::cb_run(message, seq, portid) { diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index dea52ef2..fadb33de 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -9,9 +9,8 @@ pub mod api; #[cfg(all(not(test), target_os = "linux"))] pub mod linux; -// allow this only in tests -#[cfg(test)] -pub mod test; +#[cfg(any(test, not(target_os = "linux")))] +pub mod dummy; #[derive(Debug, Copy, Clone, PartialEq, Eq)] pub enum Address { diff --git a/src/gateway.rs b/src/gateway.rs index 18aef171..94939f73 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -312,7 +312,8 @@ impl Gateway { debug!("Received firewall configuration: {fw_config:?}"); if self.has_firewall_config_changed(fw_config) { debug!("Received firewall configuration is different than current one. Reconfiguring firewall..."); - self.firewall_api.setup(Some(fw_config.default_policy))?; + self.firewall_api + .setup(Some(fw_config.default_policy), self.config.fw_priority)?; debug!("Reconfigured firewall with new configuration"); if self.has_firewall_rules_changed(&fw_config.rules) { @@ -384,14 +385,17 @@ impl Gateway { self.replace_peers(new_configuration.peers); } - let new_firewall_configuration = - if let Some(firewall_config) = new_configuration.firewall_config { - Some(FirewallConfig::from_proto(firewall_config)?) - } else { - None - }; + #[cfg(target_os = "linux")] + { + let new_firewall_configuration = + if let Some(firewall_config) = new_configuration.firewall_config { + Some(FirewallConfig::from_proto(firewall_config)?) + } else { + None + }; - self.process_firewall_changes(new_firewall_configuration.as_ref())?; + self.process_firewall_changes(new_firewall_configuration.as_ref())?; + } Ok(()) } @@ -512,6 +516,7 @@ impl Gateway { } }; } + #[cfg(target_os = "linux")] Some(update::Update::FirewallConfig(config)) => { debug!("Applying received firewall configuration: {config:?}"); let config_str = format!("{:?}", config); diff --git a/src/main.rs b/src/main.rs index 85b96871..f20fd117 100644 --- a/src/main.rs +++ b/src/main.rs @@ -47,7 +47,7 @@ async fn main() -> Result<(), GatewayError> { let firewall_api = FirewallApi::new(&ifname); #[cfg(target_os = "linux")] if config.masquerade { - firewall_api.setup(None)?; + firewall_api.setup(None, config.fw_priority)?; firewall_api.set_masquerade_status(true)?; } From 5e0eb29f21d7371419c56f4d35a5f0e23beba310 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 17 Mar 2025 10:37:58 +0100 Subject: [PATCH 14/32] correct the documentation --- src/gateway.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gateway.rs b/src/gateway.rs index 94939f73..beedf4b8 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -299,7 +299,7 @@ impl Gateway { } /// Process and apply firewall configuration changes. - /// - If the main config changed (default policy, IP version), reconfigure the whole firewall. + /// - If the main config changed (default policy), reconfigure the whole firewall. /// - If only the rules changed, apply the new rules. Currently also reconfigures the whole firewall but that /// should be temporary. /// From 4db3883fcbfa0d9e3a5eac1c2e0145584f880741 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 17 Mar 2025 11:26:54 +0100 Subject: [PATCH 15/32] reduce cloning, cleanup --- src/enterprise/firewall/linux/mod.rs | 36 +++++++++++----------- src/enterprise/firewall/linux/netfilter.rs | 12 ++++---- src/gateway.rs | 3 +- 3 files changed, 25 insertions(+), 26 deletions(-) diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 41d322d9..b969df33 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -45,11 +45,11 @@ pub enum State { } #[derive(Debug, Default)] -pub struct FilterRule { - pub src_ips: Vec
, - pub dest_ips: Vec
, - pub src_ports: Vec, - pub dest_ports: Vec, +pub struct FilterRule<'a> { + pub src_ips: &'a [Address], + pub dest_ips: &'a [Address], + pub src_ports: &'a [Port], + pub dest_ports: &'a [Port], pub protocols: Vec, pub oifname: Option, pub iifname: Option, @@ -118,14 +118,14 @@ impl FirewallManagementApi for FirewallApi { if rule.destination_ports.is_empty() { debug!("No destination ports specified, applying single aggregate nftables rule for every protocol."); let rule = FilterRule { - src_ips: rule.source_addrs, - dest_ips: rule.destination_addrs, + src_ips: &rule.source_addrs, + dest_ips: &rule.destination_addrs, protocols: rule.protocols, action: rule.verdict, counter: true, defguard_rule_id: rule.id, v4: rule.v4, - comment: rule.comment, + comment: rule.comment.clone(), ..Default::default() }; rules.push(rule); @@ -136,9 +136,9 @@ impl FirewallManagementApi for FirewallApi { if protocol.supports_ports() { debug!("Protocol supports ports, rule."); let rule = FilterRule { - src_ips: rule.source_addrs.clone(), - dest_ips: rule.destination_addrs.clone(), - dest_ports: rule.destination_ports.clone(), + src_ips: &rule.source_addrs, + dest_ips: &rule.destination_addrs, + dest_ports: &rule.destination_ports, protocols: vec![protocol], action: rule.verdict, counter: true, @@ -151,8 +151,8 @@ impl FirewallManagementApi for FirewallApi { } else { debug!("Protocol does not support ports, applying nftables rule and ignoring destination ports."); let rule = FilterRule { - src_ips: rule.source_addrs.clone(), - dest_ips: rule.destination_addrs.clone(), + src_ips: &rule.source_addrs, + dest_ips: &rule.destination_addrs, protocols: vec![protocol], action: rule.verdict, counter: true, @@ -168,13 +168,13 @@ impl FirewallManagementApi for FirewallApi { debug!( "Destination ports specified, but no protocols specified, applying nftables rules for each protocol that support ports." ); - for protocol in PORT_PROTOCOLS.iter() { + for protocol in PORT_PROTOCOLS { debug!("Applying nftables rule for protocol: {:?}", protocol); let rule = FilterRule { - src_ips: rule.source_addrs.clone(), - dest_ips: rule.destination_addrs.clone(), - dest_ports: rule.destination_ports.clone(), - protocols: vec![*protocol], + src_ips: &rule.source_addrs, + dest_ips: &rule.destination_addrs, + dest_ports: &rule.destination_ports, + protocols: vec![protocol], action: rule.verdict, counter: true, defguard_rule_id: rule.id, diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 47408834..2284814c 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -160,7 +160,7 @@ fn add_protocol_to_set( Ok(()) } -impl FirewallRule for FilterRule { +impl<'b> FirewallRule for FilterRule<'b> { fn to_chain_rule<'a>( &self, chain: &'a Chain, @@ -184,7 +184,7 @@ impl FirewallRule for FilterRule { let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); - for ip in &self.src_ips { + for ip in self.src_ips { add_address_to_set(set.as_ptr(), ip)?; } @@ -202,7 +202,7 @@ impl FirewallRule for FilterRule { let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); - for ip in &self.src_ips { + for ip in self.src_ips { add_address_to_set(set.as_ptr(), ip)?; } @@ -230,7 +230,7 @@ impl FirewallRule for FilterRule { let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); - for ip in &self.dest_ips { + for ip in self.dest_ips { add_address_to_set(set.as_ptr(), ip)?; } @@ -248,7 +248,7 @@ impl FirewallRule for FilterRule { let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?; batch.add(&set, nftnl::MsgType::Add); - for ip in &self.dest_ips { + for ip in self.dest_ips { add_address_to_set(set.as_ptr(), ip)?; } @@ -313,7 +313,7 @@ impl FirewallRule for FilterRule { )?; batch.add(&set, nftnl::MsgType::Add); - for port in &self.dest_ports { + for port in self.dest_ports { add_port_to_set(set.as_ptr(), port)?; } diff --git a/src/gateway.rs b/src/gateway.rs index beedf4b8..c0814dc6 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -326,8 +326,7 @@ impl Gateway { } else if self.has_firewall_rules_changed(&fw_config.rules) { debug!("Received firewall rules are different than the current ones. Applying the new rules."); if let Some(current_config) = &mut self.firewall_config { - let rules = &fw_config.rules; - self.firewall_api.add_rules(rules.clone())?; + self.firewall_api.add_rules(fw_config.rules.clone())?; current_config.rules = fw_config.rules.clone(); } else { unreachable!("Firewall config should be present here"); From 4f65c1a183a0e9e77a6cd6e78cc40ddae1eb507e Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 17 Mar 2025 13:28:01 +0100 Subject: [PATCH 16/32] fix building on other systems --- Cargo.toml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index e84a56c1..c284be3d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -19,9 +19,11 @@ tonic = { version = "0.12", features = ["gzip", "tls", "tls-native-roots"] } tokio = { version = "1", features = ["macros", "rt-multi-thread"] } tokio-stream = { version = "0.1", features = [] } toml = { version = "0.8", default-features = false, features = ["parse"] } -mnl = "0.2" ipnetwork = "0.21" + +[target.'cfg(target_os = "linux")'.dependencies] nftnl = { git = "https://github.com/DefGuard/nftnl-rs.git", rev = "1a1147271f43b9d7182a114bb056a5224c35d38f" } +mnl = "0.2" [dev-dependencies] tokio = { version = "1", features = ["io-std", "io-util"] } From badf7ca0df4354a79a00d84d1b4e1a3ca27b305c Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 18 Mar 2025 09:35:54 +0100 Subject: [PATCH 17/32] cleanup --- src/enterprise/firewall/linux/netfilter.rs | 4 ++-- src/gateway.rs | 16 +++++++++++----- src/main.rs | 11 ++++------- 3 files changed, 17 insertions(+), 14 deletions(-) diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 2284814c..b0f3fe72 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -32,8 +32,8 @@ const FORWARD_PRIORITY: i32 = 0; struct InetService(u16); impl SetKey for InetService { - const TYPE: u32 = 13; const LEN: u32 = 2; + const TYPE: u32 = 13; fn data(&self) -> Box<[u8]> { Box::new(self.0.to_be_bytes()) @@ -72,8 +72,8 @@ impl From for nftnl::Policy { } impl SetKey for Protocol { - const TYPE: u32 = 12; const LEN: u32 = 1; + const TYPE: u32 = 12; fn data(&self) -> Box<[u8]> { Box::new([self.0]) diff --git a/src/gateway.rs b/src/gateway.rs index c0814dc6..db26f859 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -26,12 +26,13 @@ use tonic::{ Request, Status, Streaming, }; +#[cfg(test)] +use crate::enterprise::firewall::FirewallRule; +#[cfg(target_os = "linux")] +use crate::enterprise::firewall::{api::FirewallManagementApi, FirewallRule}; use crate::{ config::Config, - enterprise::firewall::{ - api::{FirewallApi, FirewallManagementApi}, - FirewallConfig, FirewallRule, - }, + enterprise::firewall::{api::FirewallApi, FirewallConfig}, error::GatewayError, execute_command, mask, proto::gateway::{ @@ -105,7 +106,9 @@ pub struct Gateway { interface_configuration: Option, peers: HashMap, wgapi: Arc>, + #[cfg_attr(not(target_os = "linux"), allow(unused))] firewall_api: FirewallApi, + #[cfg_attr(not(target_os = "linux"), allow(unused))] firewall_config: Option, pub connected: Arc, client: GatewayServiceClient>, @@ -257,6 +260,7 @@ impl Gateway { } /// Checks whether the firewall config changed, but doesn't check the rules. + #[cfg(any(target_os = "linux", test))] fn has_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool { if let Some(current_config) = &self.firewall_config { return current_config.default_policy != new_fw_config.default_policy @@ -267,6 +271,7 @@ impl Gateway { } /// Checks whether the firewall rules have changed. + #[cfg(any(target_os = "linux", test))] fn has_firewall_rules_changed(&self, new_rules: &[FirewallRule]) -> bool { debug!("Checking if Defguard ACL rules have changed"); if let Some(current_config) = &self.firewall_config { @@ -304,6 +309,7 @@ impl Gateway { /// should be temporary. /// /// TODO: Reduce cloning here + #[cfg(target_os = "linux")] fn process_firewall_changes( &mut self, fw_config: Option<&FirewallConfig>, @@ -606,7 +612,7 @@ mod tests { use ipnetwork::IpNetwork; use super::*; - use crate::enterprise::firewall::{Address, Policy, Port, Protocol}; + use crate::enterprise::firewall::{Address, FirewallRule, Policy, Port, Protocol}; #[tokio::test] async fn test_configuration_comparison() { diff --git a/src/main.rs b/src/main.rs index f20fd117..7b11f192 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,13 +1,10 @@ use std::{fs::File, io::Write, process, sync::Arc}; +#[cfg(target_os = "linux")] +use defguard_gateway::enterprise::firewall::api::FirewallManagementApi; use defguard_gateway::{ - config::get_config, - enterprise::firewall::api::{FirewallApi, FirewallManagementApi}, - error::GatewayError, - execute_command, - gateway::Gateway, - init_syslog, - server::run_server, + config::get_config, enterprise::firewall::api::FirewallApi, error::GatewayError, + execute_command, gateway::Gateway, init_syslog, server::run_server, }; #[cfg(not(target_os = "macos"))] use defguard_wireguard_rs::Kernel; From 507e63d2b5e1940892db8587b7b7ec0249946753 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 18 Mar 2025 12:12:23 +0100 Subject: [PATCH 18/32] Apply suggestions from code review Co-authored-by: Adam --- src/enterprise/firewall/linux/mod.rs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index b969df33..892dca10 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -88,16 +88,16 @@ impl FirewallManagementApi for FirewallApi { } fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> { - debug!("Setting default firewall policy to: {:?}", policy); + debug!("Setting default firewall policy to: {policy:?}"); set_default_policy(policy)?; - debug!("Set firewall default policy to {:?}", policy); + debug!("Set firewall default policy to {policy:?}); Ok(()) } fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError> { - debug!("Setting masquerade status to: {:?}", enabled); + debug!("Setting masquerade status to: {enabled:?}); set_masq(&self.ifname, enabled)?; - debug!("Set masquerade status to: {:?}", enabled); + debug!("Set masquerade status to: {enabled:?}); Ok(()) } @@ -112,7 +112,7 @@ impl FirewallManagementApi for FirewallApi { fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError> { debug!("Applying the following Defguard ACL rule: {:?}", rule); - let mut rules = vec![]; + let mut rules = Vec::new(); debug!("The rule will be split into multiple nftables rules based on the specified destination ports and protocols."); if rule.destination_ports.is_empty() { From e9371784c08c9fdd0456de99ca2f058f83c40217 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 18 Mar 2025 12:14:00 +0100 Subject: [PATCH 19/32] cleanup, small refactor --- src/enterprise/firewall/linux/netfilter.rs | 3 +-- src/enterprise/firewall/mod.rs | 15 +++++++++++++-- src/gateway.rs | 4 +--- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index b0f3fe72..be7fa06d 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -65,7 +65,7 @@ impl From for nftnl::Policy { fn from(policy: Policy) -> Self { match policy { // This mirrors the nftables behavior, where passing no policy results in the default accept policy - Policy::Allow | Policy::None => Self::Accept, + Policy::Allow => Self::Accept, Policy::Deny => Self::Drop, } } @@ -406,7 +406,6 @@ impl<'b> FirewallRule for FilterRule<'b> { Policy::Deny => { rule.add_expr(&nft_expr!(verdict drop)); } - Policy::None => {} } // comment diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index fadb33de..c1f8f91f 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -39,6 +39,12 @@ impl Address { let end = IpAddr::from_str(&range.end).map_err(|err| { FirewallError::TypeConversionError(format!("Invalid IP format: {}", err)) })?; + if start > end { + return Err(FirewallError::TypeConversionError(format!( + "Invalid IP range: start IP ({}) is greater than end IP ({})", + start, end + ))); + } Ok(Self::Range(start, end)) } _ => Err(FirewallError::TypeConversionError(format!( @@ -80,6 +86,12 @@ impl Port { range.end, err )) })?; + if start_u16 > end_u16 { + return Err(FirewallError::TypeConversionError(format!( + "Invalid port range: start port ({}) is greater than end port ({})", + start_u16, end_u16 + ))); + } Ok(Self::Range(start_u16, end_u16)) } _ => Err(FirewallError::TypeConversionError(format!( @@ -109,10 +121,9 @@ impl Protocol { #[derive(Debug, Default, Clone, Copy, PartialEq, Eq)] pub enum Policy { + #[default] Allow, Deny, - #[default] - None, } impl From for Policy { diff --git a/src/gateway.rs b/src/gateway.rs index db26f859..b9dbb003 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -26,9 +26,7 @@ use tonic::{ Request, Status, Streaming, }; -#[cfg(test)] -use crate::enterprise::firewall::FirewallRule; -#[cfg(target_os = "linux")] +#[cfg(any(target_os = "linux", test))] use crate::enterprise::firewall::{api::FirewallManagementApi, FirewallRule}; use crate::{ config::Config, From 0d7e497394f4dfa01ac13f13292fdc0ae4fe6d69 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 18 Mar 2025 12:17:55 +0100 Subject: [PATCH 20/32] cleanup --- src/enterprise/firewall/linux/mod.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 892dca10..665c5d43 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -90,14 +90,14 @@ impl FirewallManagementApi for FirewallApi { fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> { debug!("Setting default firewall policy to: {policy:?}"); set_default_policy(policy)?; - debug!("Set firewall default policy to {policy:?}); + debug!("Set firewall default policy to {policy:?}"); Ok(()) } fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError> { - debug!("Setting masquerade status to: {enabled:?}); + debug!("Setting masquerade status to: {enabled:?}"); set_masq(&self.ifname, enabled)?; - debug!("Set masquerade status to: {enabled:?}); + debug!("Set masquerade status to: {enabled:?}"); Ok(()) } From edca2ff5aa1d95c896964a3c76e154385c399b89 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 18 Mar 2025 16:30:24 +0100 Subject: [PATCH 21/32] atomic firewall operations --- src/enterprise/firewall/api.rs | 20 ++-- src/enterprise/firewall/linux/mod.rs | 101 +++++++++++++++++---- src/enterprise/firewall/linux/netfilter.rs | 54 ++++------- src/enterprise/firewall/mod.rs | 4 + src/gateway.rs | 31 +++---- src/main.rs | 5 +- 6 files changed, 132 insertions(+), 83 deletions(-) diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs index fba0693c..9c76d927 100644 --- a/src/enterprise/firewall/api.rs +++ b/src/enterprise/firewall/api.rs @@ -1,8 +1,11 @@ +use nftnl::Batch; + use super::{FirewallError, FirewallRule, Policy}; -#[derive(Debug, Clone)] pub struct FirewallApi { pub ifname: String, + #[cfg(target_os = "linux")] + pub(crate) batch: Option, } impl FirewallApi { @@ -10,6 +13,8 @@ impl FirewallApi { pub fn new(ifname: &str) -> Self { Self { ifname: ifname.into(), + #[cfg(target_os = "linux")] + batch: None, } } } @@ -17,13 +22,16 @@ impl FirewallApi { pub trait FirewallManagementApi { /// Sets up the firewall with the default policy and cleans up any existing rules fn setup( - &self, + &mut self, default_policy: Option, priority: Option, ) -> Result<(), FirewallError>; - fn cleanup(&self) -> Result<(), FirewallError>; - fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError>; - fn add_rules(&self, rules: Vec) -> Result<(), FirewallError>; + fn cleanup(&mut self) -> Result<(), FirewallError>; + fn add_rule(&mut self, rule: FirewallRule) -> Result<(), FirewallError>; + fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError>; fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError>; - fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError>; + fn set_masquerade_status(&mut self, enabled: bool) -> Result<(), FirewallError>; + fn begin(&mut self) -> Result<(), FirewallError>; + fn commit(&mut self) -> Result<(), FirewallError>; + fn rollback(&mut self); } diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 665c5d43..088f6059 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -4,9 +4,10 @@ use std::sync::atomic::{AtomicU32, Ordering}; use mnl::mnl_sys::libc; use netfilter::{ - allow_established_traffic, apply_filter_rules, drop_table, init_firewall, set_default_policy, - set_masq, + allow_established_traffic, apply_filter_rules, drop_table, init_firewall, send_batch, + set_default_policy, set_masq, }; +use nftnl::Batch; use super::{ api::{FirewallApi, FirewallManagementApi}, @@ -17,7 +18,7 @@ use crate::proto; static SET_ID_COUNTER: AtomicU32 = AtomicU32::new(0); pub fn get_set_id() -> u32 { - SET_ID_COUNTER.fetch_add(1, Ordering::SeqCst) + SET_ID_COUNTER.fetch_add(1, Ordering::Relaxed) } impl Protocol { @@ -65,43 +66,66 @@ pub struct FilterRule<'a> { } impl FirewallManagementApi for FirewallApi { + /// Sets up the firewall with the given default policy and priority. Drops the previous table. + /// + /// This function also begins a batch of operations which can be applied later using the [`apply`] method. + /// This allows for making atomic changes to the firewall rules. fn setup( - &self, + &mut self, default_policy: Option, priority: Option, ) -> Result<(), FirewallError> { debug!("Initializing firewall, VPN interface: {}", self.ifname); - self.cleanup()?; - init_firewall(default_policy, priority).expect("Failed to setup chains"); - debug!("Allowing all established traffic"); - allow_established_traffic()?; - debug!("Allowed all established traffic"); - debug!("Initialized firewall"); - Ok(()) + if let Some(batch) = &mut self.batch { + drop_table(batch)?; + init_firewall(default_policy, priority, batch).expect("Failed to setup chains"); + debug!("Allowing all established traffic"); + allow_established_traffic(batch)?; + debug!("Allowed all established traffic"); + debug!("Initialized firewall"); + Ok(()) + } else { + Err(FirewallError::TransactionNotStarted) + } } - fn cleanup(&self) -> Result<(), FirewallError> { + /// Cleans up the whole Defguard table. + fn cleanup(&mut self) -> Result<(), FirewallError> { debug!("Cleaning up all previous firewall rules, if any"); - drop_table()?; + if let Some(batch) = &mut self.batch { + drop_table(batch)?; + } else { + return Err(FirewallError::TransactionNotStarted); + } debug!("Cleaned up all previous firewall rules"); Ok(()) } + /// Allows for changing the default policy of the firewall. fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> { debug!("Setting default firewall policy to: {policy:?}"); - set_default_policy(policy)?; + if let Some(batch) = &mut self.batch { + set_default_policy(policy, batch)?; + } else { + return Err(FirewallError::TransactionNotStarted); + } debug!("Set firewall default policy to {policy:?}"); Ok(()) } - fn set_masquerade_status(&self, enabled: bool) -> Result<(), FirewallError> { + /// Allows for changing the masquerade status of the firewall. + fn set_masquerade_status(&mut self, enabled: bool) -> Result<(), FirewallError> { debug!("Setting masquerade status to: {enabled:?}"); - set_masq(&self.ifname, enabled)?; + if let Some(batch) = &mut self.batch { + set_masq(&self.ifname, enabled, batch)?; + } else { + return Err(FirewallError::TransactionNotStarted); + } debug!("Set masquerade status to: {enabled:?}"); Ok(()) } - fn add_rules(&self, rules: Vec) -> Result<(), FirewallError> { + fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError> { debug!("Applying the following Defguard ACL rules: {:?}", rules); for rule in rules { self.add_rule(rule)?; @@ -110,9 +134,14 @@ impl FirewallManagementApi for FirewallApi { Ok(()) } - fn add_rule(&self, rule: FirewallRule) -> Result<(), FirewallError> { + fn add_rule(&mut self, rule: FirewallRule) -> Result<(), FirewallError> { debug!("Applying the following Defguard ACL rule: {:?}", rule); let mut rules = Vec::new(); + let batch = if let Some(ref mut batch) = self.batch { + batch + } else { + return Err(FirewallError::TransactionNotStarted); + }; debug!("The rule will be split into multiple nftables rules based on the specified destination ports and protocols."); if rule.destination_ports.is_empty() { @@ -186,11 +215,45 @@ impl FirewallManagementApi for FirewallApi { } } - apply_filter_rules(rules)?; + apply_filter_rules(rules, batch)?; + debug!( "Applied firewall rules for Defguard ACL rule ID: {}", rule.id ); Ok(()) } + + fn begin(&mut self) -> Result<(), FirewallError> { + if self.batch.is_none() { + debug!("Starting new firewall transaction"); + let batch = Batch::new(); + self.batch = Some(batch); + debug!("Firewall transaction successfully started"); + Ok(()) + } else { + Err(FirewallError::TransactionFailed( + "There is another firewall transaction already in progress. Commit or rollback it before starting a new one.".to_string() + )) + } + } + + fn rollback(&mut self) { + self.batch = None; + debug!("Firewall transaction has been rolled back.") + } + + /// Apply whole firewall configuration and send it in one go to the kernel. + fn commit(&mut self) -> Result<(), FirewallError> { + if let Some(batch) = self.batch.take() { + debug!("Committing firewall transaction"); + let finalized = batch.finalize(); + debug!("Firewall batch finalized, sending to kernel"); + send_batch(&finalized)?; + debug!("Firewall transaction successfully committed to kernel"); + Ok(()) + } else { + return Err(FirewallError::TransactionNotStarted); + } + } } diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index be7fa06d..46b85060 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -173,7 +173,7 @@ impl<'b> FirewallRule for FilterRule<'b> { if !self.dest_ports.is_empty() && self.protocols.len() > 1 { return Err(FirewallError::InvalidConfiguration( - format!("Cannot specify multiple protocols with destination ports, specified protocols: {:?}, destination ports: {:?}, Defguard Rule ID: {}", + format!("Cannot specify multiple protocols with destination ports, specified protocols: {:?}, destination ports: {:?}, Defguard Rule ID: {}", self.protocols, self.dest_ports, self.defguard_rule_id) )); } @@ -517,8 +517,8 @@ impl FirewallRule for NatRule { pub(crate) fn init_firewall( initial_policy: Option, defguard_fwd_chain_priority: Option, + batch: &mut Batch, ) -> Result<(), FirewallError> { - let mut batch = Batch::new(); let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -534,28 +534,23 @@ pub(crate) fn init_firewall( chain.set_type(nftnl::ChainType::Filter); batch.add(&chain, nftnl::MsgType::Add); - let finalized_batch = batch.finalize(); - - send_batch(&finalized_batch)?; - Ok(()) } -pub(crate) fn drop_table() -> Result<(), FirewallError> { - let mut batch = Batch::new(); +pub(crate) fn drop_table(batch: &mut Batch) -> Result<(), FirewallError> { let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); batch.add(&table, nftnl::MsgType::Del); - let finalized_batch = batch.finalize(); - send_batch(&finalized_batch)?; - Ok(()) } /// Applies masquerade on the specified interface for the outgoing packets -pub(crate) fn set_masq(ifname: &str, enabled: bool) -> Result<(), FirewallError> { - let mut batch = Batch::new(); +pub(crate) fn set_masq( + ifname: &str, + enabled: bool, + batch: &mut Batch, +) -> Result<(), FirewallError> { let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -570,7 +565,7 @@ pub(crate) fn set_masq(ifname: &str, enabled: bool) -> Result<(), FirewallError> counter: true, ..Default::default() } - .to_chain_rule(&nat_chain, &mut batch)?; + .to_chain_rule(&nat_chain, batch)?; if enabled { batch.add(&nat_rule, nftnl::MsgType::Add); @@ -578,14 +573,10 @@ pub(crate) fn set_masq(ifname: &str, enabled: bool) -> Result<(), FirewallError> batch.add(&nat_rule, nftnl::MsgType::Del); } - let finalized_batch = batch.finalize(); - send_batch(&finalized_batch)?; - Ok(()) } -pub(crate) fn set_default_policy(policy: Policy) -> Result<(), FirewallError> { - let mut batch = Batch::new(); +pub(crate) fn set_default_policy(policy: Policy, batch: &mut Batch) -> Result<(), FirewallError> { let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -597,14 +588,10 @@ pub(crate) fn set_default_policy(policy: Policy) -> Result<(), FirewallError> { }); batch.add(&forward_chain, nftnl::MsgType::Add); - let finalized_batch = batch.finalize(); - send_batch(&finalized_batch)?; - Ok(()) } -pub(crate) fn allow_established_traffic() -> Result<(), FirewallError> { - let mut batch = Batch::new(); +pub(crate) fn allow_established_traffic(batch: &mut Batch) -> Result<(), FirewallError> { let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -617,13 +604,10 @@ pub(crate) fn allow_established_traffic() -> Result<(), FirewallError> { action: Policy::Allow, ..Default::default() } - .to_chain_rule(&forward_chain, &mut batch)?; + .to_chain_rule(&forward_chain, batch)?; batch.add(&established_rule, nftnl::MsgType::Add); - let finalized_batch = batch.finalize(); - send_batch(&finalized_batch)?; - Ok(()) } @@ -677,8 +661,10 @@ impl Chains { } } -pub(crate) fn apply_filter_rules(rules: Vec) -> Result<(), FirewallError> { - let mut batch = Batch::new(); +pub(crate) fn apply_filter_rules( + rules: Vec, + batch: &mut Batch, +) -> Result<(), FirewallError> { let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); @@ -686,18 +672,14 @@ pub(crate) fn apply_filter_rules(rules: Vec) -> Result<(), FirewallE batch.add(&forward_chain, nftnl::MsgType::Add); for rule in rules.iter() { - let chain_rule = rule.to_chain_rule(&forward_chain, &mut batch)?; + let chain_rule = rule.to_chain_rule(&forward_chain, batch)?; batch.add(&chain_rule, nftnl::MsgType::Add); } - let finalized_batch = batch.finalize(); - - send_batch(&finalized_batch)?; - Ok(()) } -fn send_batch(batch: &FinalizedBatch) -> Result<(), FirewallError> { +pub(crate) fn send_batch(batch: &FinalizedBatch) -> Result<(), FirewallError> { let socket = mnl::Socket::new(mnl::Bus::Netfilter) .map_err(|e| FirewallError::NetlinkError(format!("Failed to create socket: {e:?}")))?; socket.send_all(batch).map_err(|e| { diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index c1f8f91f..e2732cb6 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -248,4 +248,8 @@ pub enum FirewallError { NetlinkError(String), #[error("Invalid configuration: {0}")] InvalidConfiguration(String), + #[error("Firewall transaction not started. Start the firewall transaction first in order to interact with the firewall API.")] + TransactionNotStarted, + #[error("Firewall transaction failed: {0}")] + TransactionFailed(String), } diff --git a/src/gateway.rs b/src/gateway.rs index b9dbb003..a519f0d7 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -257,12 +257,13 @@ impl Gateway { } } - /// Checks whether the firewall config changed, but doesn't check the rules. + /// Checks whether the firewall config changed #[cfg(any(target_os = "linux", test))] fn has_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool { if let Some(current_config) = &self.firewall_config { return current_config.default_policy != new_fw_config.default_policy - || current_config.v4 != new_fw_config.v4; + || current_config.v4 != new_fw_config.v4 + || self.has_firewall_rules_changed(&new_fw_config.rules); } true @@ -316,31 +317,21 @@ impl Gateway { debug!("Received firewall configuration: {fw_config:?}"); if self.has_firewall_config_changed(fw_config) { debug!("Received firewall configuration is different than current one. Reconfiguring firewall..."); + self.firewall_api.begin()?; self.firewall_api .setup(Some(fw_config.default_policy), self.config.fw_priority)?; - debug!("Reconfigured firewall with new configuration"); - - if self.has_firewall_rules_changed(&fw_config.rules) { - debug!("Received firewall rules are different than the current ones. Applying the new rules."); - self.firewall_api.add_rules(fw_config.rules.clone())?; - } else { - debug!("Received firewall rules are the same as the current ones. Skipping applying the rules."); - } + self.firewall_api.add_rules(fw_config.rules.clone())?; + self.firewall_api.commit()?; self.firewall_config = Some(fw_config.clone()); - } else if self.has_firewall_rules_changed(&fw_config.rules) { - debug!("Received firewall rules are different than the current ones. Applying the new rules."); - if let Some(current_config) = &mut self.firewall_config { - self.firewall_api.add_rules(fw_config.rules.clone())?; - current_config.rules = fw_config.rules.clone(); - } else { - unreachable!("Firewall config should be present here"); - } + info!("Reconfigured firewall with new configuration"); } else { - debug!("Received firewall configuration and rules are identical to current one. Skipping firewall reconfiguration"); + debug!("Received firewall configuration is the same as current one. Skipping reconfiguration."); } } else { debug!("Received firewall configuration is empty, cleaning up firewall rules..."); + self.firewall_api.begin()?; self.firewall_api.cleanup()?; + self.firewall_api.commit()?; self.firewall_config = None; debug!("Cleaned up firewall rules"); } @@ -656,7 +647,7 @@ mod tests { connected: Arc::new(AtomicBool::new(false)), client, stats_thread: None, - firewall_api: firewall_api, + firewall_api, firewall_config: None, }; diff --git a/src/main.rs b/src/main.rs index 7b11f192..2b75cd1d 100644 --- a/src/main.rs +++ b/src/main.rs @@ -41,11 +41,12 @@ async fn main() -> Result<(), GatewayError> { } let ifname = config.ifname.clone(); - let firewall_api = FirewallApi::new(&ifname); + let mut firewall_api = FirewallApi::new(&ifname); #[cfg(target_os = "linux")] if config.masquerade { - firewall_api.setup(None, config.fw_priority)?; + firewall_api.begin()?; firewall_api.set_masquerade_status(true)?; + firewall_api.commit()?; } let mut gateway = if config.userspace { From 9cec98e3b7239c01dd4238c7f8d56d2df75ed821 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 18 Mar 2025 16:41:31 +0100 Subject: [PATCH 22/32] rename v4 --- src/enterprise/firewall/mod.rs | 10 ++++++---- src/gateway.rs | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs index e2732cb6..af9aaecd 100644 --- a/src/enterprise/firewall/mod.rs +++ b/src/enterprise/firewall/mod.rs @@ -154,14 +154,16 @@ pub struct FirewallRule { pub verdict: Policy, pub protocols: Vec, pub source_addrs: Vec
, - pub v4: bool, + /// Whether a rule uses IPv4 (true) or IPv6 (false) + pub ipv4: bool, } #[derive(Debug, Clone, PartialEq, Eq)] pub struct FirewallConfig { pub rules: Vec, pub default_policy: Policy, - pub v4: bool, + /// Whether the rules use IPv4 (true) or IPv6 (false) + pub ipv4: bool, } impl FirewallConfig { @@ -219,7 +221,7 @@ impl FirewallConfig { destination_ports, protocols, verdict, - v4, + ipv4: v4, comment: rule.comment, }; @@ -231,7 +233,7 @@ impl FirewallConfig { Ok(Self { rules, default_policy, - v4, + ipv4: v4, }) } } diff --git a/src/gateway.rs b/src/gateway.rs index a519f0d7..67d7d153 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -262,7 +262,7 @@ impl Gateway { fn has_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool { if let Some(current_config) = &self.firewall_config { return current_config.default_policy != new_fw_config.default_policy - || current_config.v4 != new_fw_config.v4 + || current_config.ipv4 != new_fw_config.ipv4 || self.has_firewall_rules_changed(&new_fw_config.rules); } @@ -774,7 +774,7 @@ mod tests { verdict: Policy::Allow, protocols: vec![Protocol(6)], // TCP source_addrs: vec![Address::Ip(IpAddr::from_str("192.168.1.1").unwrap())], - v4: true, + ipv4: true, }; let rule2 = FirewallRule { @@ -785,7 +785,7 @@ mod tests { verdict: Policy::Allow, protocols: vec![Protocol(6)], // TCP source_addrs: vec![Address::Ip(IpAddr::from_str("192.168.1.2").unwrap())], - v4: true, + ipv4: true, }; let rule3 = FirewallRule { @@ -800,19 +800,19 @@ mod tests { source_addrs: vec![Address::Network( IpNetwork::from_str("192.168.0.0/16").unwrap(), )], - v4: true, + ipv4: true, }; let config1 = FirewallConfig { rules: vec![rule1.clone(), rule2.clone()], default_policy: Policy::Allow, - v4: true, + ipv4: true, }; let config_empty = FirewallConfig { rules: vec![], default_policy: Policy::Allow, - v4: true, + ipv4: true, }; #[cfg(target_os = "macos")] @@ -872,25 +872,25 @@ mod tests { let config1 = FirewallConfig { rules: vec![], default_policy: Policy::Allow, - v4: true, + ipv4: true, }; let config2 = FirewallConfig { rules: vec![], default_policy: Policy::Deny, - v4: true, + ipv4: true, }; let config3 = FirewallConfig { rules: vec![], default_policy: Policy::Allow, - v4: false, + ipv4: false, }; let config4 = FirewallConfig { rules: vec![], default_policy: Policy::Allow, - v4: true, + ipv4: true, }; #[cfg(target_os = "macos")] @@ -937,10 +937,10 @@ mod tests { verdict: Policy::Allow, protocols: vec![], source_addrs: vec![], - v4: true, + ipv4: true, }], default_policy: Policy::Allow, - v4: true, + ipv4: true, }; gateway.firewall_config = Some(config1.clone()); assert!(!gateway.has_firewall_config_changed(&config5)); From abd0b020bebfe8b1bce1568a2f1dcdb958ef5903 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 20 Mar 2025 10:24:00 +0100 Subject: [PATCH 23/32] update variable names --- src/enterprise/firewall/linux/mod.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs index 088f6059..b2800a39 100644 --- a/src/enterprise/firewall/linux/mod.rs +++ b/src/enterprise/firewall/linux/mod.rs @@ -153,7 +153,7 @@ impl FirewallManagementApi for FirewallApi { action: rule.verdict, counter: true, defguard_rule_id: rule.id, - v4: rule.v4, + v4: rule.ipv4, comment: rule.comment.clone(), ..Default::default() }; @@ -172,7 +172,7 @@ impl FirewallManagementApi for FirewallApi { action: rule.verdict, counter: true, defguard_rule_id: rule.id, - v4: rule.v4, + v4: rule.ipv4, comment: rule.comment.clone(), ..Default::default() }; @@ -186,7 +186,7 @@ impl FirewallManagementApi for FirewallApi { action: rule.verdict, counter: true, defguard_rule_id: rule.id, - v4: rule.v4, + v4: rule.ipv4, comment: rule.comment.clone(), ..Default::default() }; @@ -207,7 +207,7 @@ impl FirewallManagementApi for FirewallApi { action: rule.verdict, counter: true, defguard_rule_id: rule.id, - v4: rule.v4, + v4: rule.ipv4, comment: rule.comment.clone(), ..Default::default() }; From 334cfaa51df841a03677c23e5496247ef820cb68 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 20 Mar 2025 11:25:02 +0100 Subject: [PATCH 24/32] fix masquerade --- src/gateway.rs | 7 +++++++ src/main.rs | 10 +--------- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/src/gateway.rs b/src/gateway.rs index 67d7d153..408ab7c2 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -564,6 +564,13 @@ impl Gateway { "Couldn't create network interface {}: {err}. Proceeding anyway.", self.config.ifname ); + } else { + #[cfg(target_os = "linux")] + if self.config.masquerade { + self.firewall_api.begin()?; + self.firewall_api.set_masquerade_status(true)?; + self.firewall_api.commit()?; + } } info!( diff --git a/src/main.rs b/src/main.rs index 2b75cd1d..3a129cce 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,7 +1,5 @@ use std::{fs::File, io::Write, process, sync::Arc}; -#[cfg(target_os = "linux")] -use defguard_gateway::enterprise::firewall::api::FirewallManagementApi; use defguard_gateway::{ config::get_config, enterprise::firewall::api::FirewallApi, error::GatewayError, execute_command, gateway::Gateway, init_syslog, server::run_server, @@ -41,13 +39,7 @@ async fn main() -> Result<(), GatewayError> { } let ifname = config.ifname.clone(); - let mut firewall_api = FirewallApi::new(&ifname); - #[cfg(target_os = "linux")] - if config.masquerade { - firewall_api.begin()?; - firewall_api.set_masquerade_status(true)?; - firewall_api.commit()?; - } + let firewall_api = FirewallApi::new(&ifname); let mut gateway = if config.userspace { let wgapi = WGApi::::new(ifname)?; From 90dea84002e9eb9586f27ce32d2625dbb73d36d0 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 20 Mar 2025 12:29:32 +0100 Subject: [PATCH 25/32] drop chain before applying masquerade --- src/enterprise/firewall/linux/netfilter.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 46b85060..3eed1351 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -545,6 +545,15 @@ pub(crate) fn drop_table(batch: &mut Batch) -> Result<(), FirewallError> { Ok(()) } +pub(crate) fn drop_chain(chain: &Chains, batch: &mut Batch) -> Result<(), FirewallError> { + let table = Tables::Defguard(ProtoFamily::Inet).to_table(); + let chain = chain.to_chain(&table); + batch.add(&chain, nftnl::MsgType::Add); + batch.add(&chain, nftnl::MsgType::Del); + + Ok(()) +} + /// Applies masquerade on the specified interface for the outgoing packets pub(crate) fn set_masq( ifname: &str, @@ -554,6 +563,8 @@ pub(crate) fn set_masq( let table = Tables::Defguard(ProtoFamily::Inet).to_table(); batch.add(&table, nftnl::MsgType::Add); + drop_chain(&Chains::Postrouting, batch)?; + let mut nat_chain = Chains::Postrouting.to_chain(&table); nat_chain.set_hook(nftnl::Hook::PostRouting, POSTROUTING_PRIORITY); nat_chain.set_policy(nftnl::Policy::Accept); From c645cca5ecfd934388e83b9a75cd281644ab4531 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 20 Mar 2025 12:32:39 +0100 Subject: [PATCH 26/32] fix test --- src/gateway.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gateway.rs b/src/gateway.rs index 408ab7c2..4f33f507 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -934,7 +934,7 @@ mod tests { gateway.firewall_config = Some(config1.clone()); assert!(!gateway.has_firewall_config_changed(&config4)); - // Rules are being ignored + // Rules are not being ignored let config5 = FirewallConfig { rules: vec![FirewallRule { comment: None, @@ -950,6 +950,6 @@ mod tests { ipv4: true, }; gateway.firewall_config = Some(config1.clone()); - assert!(!gateway.has_firewall_config_changed(&config5)); + assert!(gateway.has_firewall_config_changed(&config5)); } } From 4fece3ef9f8919ea8ccf3b5912cfcaf596d9f6a3 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 20 Mar 2025 14:45:51 +0100 Subject: [PATCH 27/32] set masquerade status when reconfigured --- src/gateway.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/gateway.rs b/src/gateway.rs index 4f33f507..8283abce 100644 --- a/src/gateway.rs +++ b/src/gateway.rs @@ -320,6 +320,9 @@ impl Gateway { self.firewall_api.begin()?; self.firewall_api .setup(Some(fw_config.default_policy), self.config.fw_priority)?; + if self.config.masquerade { + self.firewall_api.set_masquerade_status(true)?; + } self.firewall_api.add_rules(fw_config.rules.clone())?; self.firewall_api.commit()?; self.firewall_config = Some(fw_config.clone()); From a6452dc63b7205045c38458ea40dc997de7282a5 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 20 Mar 2025 15:45:08 +0100 Subject: [PATCH 28/32] allow negating interfaces --- src/enterprise/firewall/linux/netfilter.rs | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs index 3eed1351..d114dfbc 100644 --- a/src/enterprise/firewall/linux/netfilter.rs +++ b/src/enterprise/firewall/linux/netfilter.rs @@ -25,6 +25,7 @@ const DEFGUARD_TABLE: &str = "DEFGUARD"; const POSTROUTING_CHAIN: &str = "POSTROUTING"; const FORWARD_CHAIN: &str = "FORWARD"; const ANON_SET_NAME: &str = "__set%d"; +const LOOPBACK_IFACE: &str = "lo"; const POSTROUTING_PRIORITY: i32 = 100; const FORWARD_PRIORITY: i32 = 0; @@ -446,6 +447,8 @@ struct NatRule { dest_ip: Option, oifname: Option, iifname: Option, + negated_oifname: bool, + negated_iifname: bool, counter: bool, } @@ -478,13 +481,21 @@ impl FirewallRule for NatRule { if let Some(iifname) = &self.iifname { rule.add_expr(&nft_expr!(meta iifname)); let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap()); - rule.add_expr(&nft_expr!(cmp == exact)); + if self.negated_iifname { + rule.add_expr(&nft_expr!(cmp != exact)); + } else { + rule.add_expr(&nft_expr!(cmp == exact)); + } } if let Some(oifname) = &self.oifname { rule.add_expr(&nft_expr!(meta oifname)); let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap()); - rule.add_expr(&nft_expr!(cmp == exact)); + if self.negated_oifname { + rule.add_expr(&nft_expr!(cmp != exact)); + } else { + rule.add_expr(&nft_expr!(cmp == exact)); + } } if self.counter { @@ -572,7 +583,8 @@ pub(crate) fn set_masq( batch.add(&nat_chain, nftnl::MsgType::Add); let nat_rule = NatRule { - oifname: Some(ifname.to_string()), + oifname: Some(LOOPBACK_IFACE.to_string()), + negated_oifname: true, counter: true, ..Default::default() } From c542bf9ba53b754f09fec2d3d36041225123c2ee Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 27 Mar 2025 15:21:49 +0100 Subject: [PATCH 29/32] fix tests --- src/enterprise/firewall/dummy/mod.rs | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/src/enterprise/firewall/dummy/mod.rs b/src/enterprise/firewall/dummy/mod.rs index 9638b0bb..5cfbd967 100644 --- a/src/enterprise/firewall/dummy/mod.rs +++ b/src/enterprise/firewall/dummy/mod.rs @@ -6,14 +6,14 @@ use crate::proto; impl FirewallManagementApi for FirewallApi { fn setup( - &self, + &mut self, _default_policy: Option, _priority: Option, ) -> Result<(), FirewallError> { Ok(()) } - fn cleanup(&self) -> Result<(), FirewallError> { + fn cleanup(&mut self) -> Result<(), FirewallError> { Ok(()) } @@ -21,15 +21,25 @@ impl FirewallManagementApi for FirewallApi { Ok(()) } - fn set_masquerade_status(&self, _enabled: bool) -> Result<(), FirewallError> { + fn set_masquerade_status(&mut self, _enabled: bool) -> Result<(), FirewallError> { Ok(()) } - fn add_rules(&self, _rules: Vec) -> Result<(), FirewallError> { + fn add_rules(&mut self, _rules: Vec) -> Result<(), FirewallError> { Ok(()) } - fn add_rule(&self, _rule: FirewallRule) -> Result<(), FirewallError> { + fn add_rule(&mut self, _rule: FirewallRule) -> Result<(), FirewallError> { + Ok(()) + } + + fn begin(&mut self) -> Result<(), FirewallError> { + Ok(()) + } + + fn rollback(&mut self) {} + + fn commit(&mut self) -> Result<(), FirewallError> { Ok(()) } } From 3ea3f05d2950bccc18ee8481c9e73b28939e0883 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 27 Mar 2025 16:23:48 +0100 Subject: [PATCH 30/32] restore workflows --- .github/workflows/build-docker.yml | 19 +++++-------------- .github/workflows/current.yml | 8 +------- 2 files changed, 6 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 349274d4..3e5956d9 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -23,8 +23,7 @@ jobs: - ${{ matrix.runner }} strategy: matrix: - # cpu: [arm64, amd64, arm/v7] - cpu: [arm64, amd64] + cpu: [arm64, amd64, arm/v7] include: - cpu: arm64 runner: ARM64 @@ -32,9 +31,9 @@ jobs: - cpu: amd64 runner: X64 tag: amd64 - # - cpu: arm/v7 - # runner: ARM - # tag: armv7 + - cpu: arm/v7 + runner: ARM + tag: armv7 steps: - name: Checkout uses: actions/checkout@v4 @@ -82,19 +81,11 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Create and push manifests - # run: | - # tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}' - # for tag in ${tags} - # do - # docker manifest rm ${tag} || true - # docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7 - # docker manifest push ${tag} - # done run: | tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}' for tag in ${tags} do docker manifest rm ${tag} || true - docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 + docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7 docker manifest push ${tag} done diff --git a/.github/workflows/current.yml b/.github/workflows/current.yml index f1b5ff5c..f67ce3ef 100644 --- a/.github/workflows/current.yml +++ b/.github/workflows/current.yml @@ -4,7 +4,6 @@ on: branches: - main - dev - - firewall paths-ignore: - "*.md" - "LICENSE" @@ -17,12 +16,7 @@ jobs: build-current: uses: ./.github/workflows/build-docker.yml with: - # tags: | - # type=raw,value=current - # type=ref,event=branch - # type=sha tags: | + type=raw,value=current type=ref,event=branch type=sha - flavor: | - latest=false From ebd740dc32664f00433327cc0dadf20c5d14d4c8 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 27 Mar 2025 16:25:53 +0100 Subject: [PATCH 31/32] update protos --- proto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proto b/proto index 7cc38b09..c10a2c1d 160000 --- a/proto +++ b/proto @@ -1 +1 @@ -Subproject commit 7cc38b099bc12e8257d61988d162097606de4c8e +Subproject commit c10a2c1dcb345172a9a69fff5e1299a4956a3153 From ae5162b54e7991b5ad25fe6e5fe45401497099af Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Thu, 27 Mar 2025 16:30:17 +0100 Subject: [PATCH 32/32] bump version --- Cargo.lock | 2 +- Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 9153b3ec..fb5558e8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -398,7 +398,7 @@ dependencies = [ [[package]] name = "defguard-gateway" -version = "1.2.1" +version = "1.2.2" dependencies = [ "axum", "base64", diff --git a/Cargo.toml b/Cargo.toml index c284be3d..dfb5593b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "defguard-gateway" -version = "1.2.1" +version = "1.2.2" edition = "2021" [dependencies]