1# Copyright 2021 Google LLC 2# 3# Licensed under the Apache License, Version 2.0 (the "License"); 4# you may not use this file except in compliance with the License. 5# You may obtain a copy of the License at 6# 7# http://www.apache.org/licenses/LICENSE-2.0 8# 9# Unless required by applicable law or agreed to in writing, software 10# distributed under the License is distributed on an "AS IS" BASIS, 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12# See the License for the specific language governing permissions and 13# limitations under the License. 14 15[ -z "${gbmc_br_nft_lib-}" ] || return 16 17source /usr/share/network/lib.sh || exit 18 19gbmc_br_nft_init= 20gbmc_br_nft_pfx= 21 22gbmc_br_nft_update() { 23 printf 'gBMC Bridge input firewall for %s\n' \ 24 "${gbmc_br_nft_pfx:-(deleted)}" >&2 25 26 local contents= 27 contents+='table inet filter {'$'\n' 28 contents+=' chain gbmc_br_int_input {'$'\n' 29 if [ -n "${gbmc_br_nft_pfx-}" ]; then 30 contents+=" ip6 saddr $gbmc_br_nft_pfx" 31 contents+=" ip6 daddr $gbmc_br_nft_pfx accept"$'\n' 32 fi 33 contents+=' }'$'\n' 34 contents+='}'$'\n' 35 36 local rfile=/run/nftables/40-gbmc-br-int.rules 37 mkdir -p -m 755 "$(dirname "$rfile")" 38 printf '%s' "$contents" >"$rfile" 39 40 systemctl reset-failed nftables && systemctl --no-block reload-or-restart nftables || true 41} 42 43gbmc_br_nft_hook() { 44 if [ "$change" = 'init' ]; then 45 gbmc_br_nft_init=1 46 gbmc_br_nft_update 47 # Match only global IP addresses on the bridge that match the BMC prefix 48 # (<mpfx>:fdxx:). So 2002:af4:3480:2248:fd02:6345:3069:9186 would become 49 # a 2002:af4:3480:2248:fd00/76 rule. 50 elif [ "$change" = 'addr' -a "$intf" = 'gbmcbr' -a "$scope" = 'global' ] && 51 [[ "$fam" == 'inet6' && "$flags" != *tentative* ]]; then 52 local ip_bytes=() 53 if ! ip_to_bytes ip_bytes "$ip"; then 54 echo "gBMC Bridge NFT Invalid IP: $ip" >&2 55 return 1 56 fi 57 if (( ip_bytes[8] != 0xfd )); then 58 return 0 59 fi 60 local i 61 for (( i=9; i<16; i++ )); do 62 ip_bytes[$i]=0 63 done 64 pfx="$(ip_bytes_to_str ip_bytes)/76" 65 if [ "$action" = "add" -a "$pfx" != "$gbmc_br_nft_pfx" ]; then 66 gbmc_br_nft_pfx="$pfx" 67 gbmc_br_nft_update 68 fi 69 fi 70} 71 72GBMC_IP_MONITOR_HOOKS+=(gbmc_br_nft_hook) 73 74gbmc_br_nft_lib=1 75