patchpanel/firewall.cc

// Copyright 2017 The ChromiumOS Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "patchpanel/firewall.h"

#include <arpa/inet.h>
#include <linux/capability.h>
#include <netinet/in.h>

#include <string>
#include <string_view>
#include <vector>

#include <base/containers/span.h>
#include <base/functional/bind.h>
#include <base/functional/callback.h>
#include <base/functional/callback_helpers.h>
#include <base/logging.h>
#include <base/notreached.h>
#include <base/strings/strcat.h>
#include <base/strings/string_number_conversions.h>
#include <base/strings/string_util.h>
#include <base/strings/stringprintf.h>

#include "patchpanel/datapath.h"
#include "patchpanel/iptables.h"

namespace patchpanel {

const std::string ProtocolName(Protocol proto) {
  if (proto == ModifyPortRuleRequest::INVALID_PROTOCOL) {
    NOTREACHED() << "Unexpected L4 protocol value";
  }
  return base::ToLowerASCII(ModifyPortRuleRequest::Protocol_Name(proto));
}

Firewall::Firewall() : Firewall(MinijailedProcessRunner::GetInstance()) {}

Firewall::Firewall(MinijailedProcessRunner* process_runner)
    : process_runner_(process_runner) {}

bool Firewall::AddAcceptRules(Protocol protocol,
                              uint16_t port,
                              std::string_view interface) {
  if (port == 0U) {
    LOG(ERROR) << "Port 0 is not a valid port";
    return false;
  }

  if (!AddAcceptRule(IpFamily::kIPv4, protocol, port, interface)) {
    LOG(ERROR) << "Could not add IPv4 ACCEPT rule";
    return false;
  }

  if (!AddAcceptRule(IpFamily::kIPv6, protocol, port, interface)) {
    LOG(ERROR) << "Could not add IPv6 ACCEPT rule";
    DeleteAcceptRule(IpFamily::kIPv4, protocol, port, interface);
    return false;
  }

  return true;
}

bool Firewall::DeleteAcceptRules(Protocol protocol,
                                 uint16_t port,
                                 std::string_view interface) {
  if (port == 0U) {
    LOG(ERROR) << "Port 0 is not a valid port";
    return false;
  }

  bool ip4_success =
      DeleteAcceptRule(IpFamily::kIPv4, protocol, port, interface);
  bool ip6_success =
      DeleteAcceptRule(IpFamily::kIPv6, protocol, port, interface);
  return ip4_success && ip6_success;
}

bool Firewall::AddIpv4ForwardRule(
    Protocol protocol,
    const std::optional<net_base::IPv4Address>& input_ip,
    uint16_t port,
    std::string_view interface,
    const net_base::IPv4Address& dst_ip,
    uint16_t dst_port) {
  if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
                          Iptables::Command::kI)) {
    return false;
  }

  if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port,
                              Iptables::Command::kA)) {
    ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
                       Iptables::Command::kD);
    return false;
  }

  return true;
}

bool Firewall::DeleteIpv4ForwardRule(
    Protocol protocol,
    const std::optional<net_base::IPv4Address>& input_ip,
    uint16_t port,
    std::string_view interface,
    const net_base::IPv4Address& dst_ip,
    uint16_t dst_port) {
  bool success = true;
  if (!ModifyIpv4DNATRule(protocol, input_ip, port, interface, dst_ip, dst_port,
                          Iptables::Command::kD)) {
    success = false;
  }
  if (!ModifyIpv4ForwardChain(protocol, interface, dst_ip, dst_port,
                              Iptables::Command::kD)) {
    success = false;
  }
  return success;
}

bool Firewall::ModifyIpv4DNATRule(
    Protocol protocol,
    const std::optional<net_base::IPv4Address>& input_ip,
    uint16_t port,
    std::string_view interface,
    const net_base::IPv4Address& dst_ip,
    uint16_t dst_port,
    Iptables::Command command) {
  if (port == 0U) {
    LOG(ERROR) << "Port 0 is not a valid port";
    return false;
  }

  if (interface.empty()) {
    LOG(ERROR) << "Interface name should not be empty";
    return false;
  }

  if (dst_port == 0U) {
    LOG(ERROR) << "Destination port 0 is not a valid port";
    return false;
  }

  // Only support deleting existing forwarding rules or inserting rules in the
  // first position: ARC++ generic inbound DNAT rule always need to go last.
  if (command != Iptables::Command::kI && command != Iptables::Command::kD) {
    LOG(ERROR) << "Invalid iptables command '" << command << "'";
    return false;
  }

  std::vector<std::string> argv{
      "-i",
      std::string(interface),
      "-p",  // protocol
      ProtocolName(protocol),
  };
  if (input_ip) {
    argv.insert(argv.end(),
                {"-d", input_ip->ToString()});  // input destination ip
  }
  argv.insert(
      argv.end(),
      {"--dport", std::to_string(port),   // input destination port
       "-j", "DNAT", "--to-destination",  // new output destination ip:port
       base::StrCat({dst_ip.ToString(), ":", std::to_string(dst_port)}), "-w"});

  return RunIptables(IpFamily::kIPv4, Iptables::Table::kNat, command,
                     kIngressPortForwardingChain, argv);
}

bool Firewall::ModifyIpv4ForwardChain(Protocol protocol,
                                      std::string_view interface,
                                      const net_base::IPv4Address& dst_ip,
                                      uint16_t dst_port,
                                      Iptables::Command command) {
  if (interface.empty()) {
    LOG(ERROR) << "Interface name should not be empty";
    return false;
  }

  if (dst_port == 0U) {
    LOG(ERROR) << "Destination port 0 is not a valid port";
    return false;
  }

  // Order does not matter for the FORWARD chain: both -A or -I are possible.
  if (command != Iptables::Command::kA && command != Iptables::Command::kI &&
      command != Iptables::Command::kD) {
    LOG(ERROR) << "Invalid iptables command '" << command << "'";
    return false;
  }

  std::vector<std::string> argv{
      "-i",
      std::string(interface),
      "-p",  // protocol
      ProtocolName(protocol),
      "-d",  // destination ip
      dst_ip.ToString(),
      "--dport",  // destination port
      std::to_string(dst_port),
      "-j",
      "ACCEPT",
      "-w",
  };  // Wait for xtables lock.
  return RunIptables(IpFamily::kIPv4, Iptables::Table::kFilter, command,
                     "FORWARD", argv);
}

bool Firewall::AddLoopbackLockdownRules(Protocol protocol, uint16_t port) {
  if (port == 0U) {
    LOG(ERROR) << "Port 0 is not a valid port";
    return false;
  }

  if (!AddLoopbackLockdownRule(IpFamily::kIPv4, protocol, port)) {
    LOG(ERROR) << "Could not add loopback IPv4 REJECT rule";
    return false;
  }

  if (!AddLoopbackLockdownRule(IpFamily::kIPv6, protocol, port)) {
    LOG(ERROR) << "Could not add loopback IPv6 REJECT rule";
    DeleteLoopbackLockdownRule(IpFamily::kIPv4, protocol, port);
    return false;
  }

  return true;
}

bool Firewall::DeleteLoopbackLockdownRules(Protocol protocol, uint16_t port) {
  if (port == 0U) {
    LOG(ERROR) << "Port 0 is not a valid port";
    return false;
  }

  bool ip4_success =
      DeleteLoopbackLockdownRule(IpFamily::kIPv4, protocol, port);
  bool ip6_success =
      DeleteLoopbackLockdownRule(IpFamily::kIPv6, protocol, port);
  return ip4_success && ip6_success;
}

bool Firewall::AddAcceptRule(IpFamily ip_family,
                             Protocol protocol,
                             uint16_t port,
                             std::string_view interface) {
  return ModifyAcceptRule(ip_family, protocol, port, interface,
                          Iptables::Command::kI);
}

bool Firewall::DeleteAcceptRule(IpFamily ip_family,
                                Protocol protocol,
                                uint16_t port,
                                std::string_view interface) {
  return ModifyAcceptRule(ip_family, protocol, port, interface,
                          Iptables::Command::kD);
}

bool Firewall::ModifyAcceptRule(IpFamily ip_family,
                                Protocol protocol,
                                uint16_t port,
                                std::string_view interface,
                                Iptables::Command command) {
  std::vector<std::string> argv{
      "-p",  // protocol
      ProtocolName(protocol),
      "--dport",  // destination port
      std::to_string(port),
  };
  if (!interface.empty()) {
    argv.insert(argv.end(), {"-i", std::string(interface)});
  }
  argv.insert(argv.end(), {"-j", "ACCEPT", "-w"});

  return RunIptables(ip_family, Iptables::Table::kFilter, command,
                     kIngressPortFirewallChain, argv);
}

bool Firewall::AddLoopbackLockdownRule(IpFamily ip_family,
                                       Protocol protocol,
                                       uint16_t port) {
  return ModifyLoopbackLockdownRule(ip_family, protocol, port,
                                    Iptables::Command::kI);
}

bool Firewall::DeleteLoopbackLockdownRule(IpFamily ip_family,
                                          Protocol protocol,
                                          uint16_t port) {
  return ModifyLoopbackLockdownRule(ip_family, protocol, port,
                                    Iptables::Command::kD);
}

bool Firewall::ModifyLoopbackLockdownRule(IpFamily ip_family,
                                          Protocol protocol,
                                          uint16_t port,
                                          Iptables::Command command) {
  std::vector<std::string> argv{
      "-p",  // protocol
      ProtocolName(protocol),
      "--dport",  // destination port
      std::to_string(port),
      "-o",  // output interface
      "lo",
      "-m",  // match extension
      "owner",
      "!",
      "--uid-owner",
      "chronos",
      "-j",
      "REJECT",
      "-w",  // Wait for xtables lock.
  };

  return RunIptables(ip_family, Iptables::Table::kFilter, command,
                     kEgressPortFirewallChain, argv);
}

bool Firewall::RunIptables(IpFamily ip_family,
                           Iptables::Table table,
                           Iptables::Command command,
                           std::string_view chain,
                           base::span<const std::string> argv) {
  if (ip_family == IpFamily::kIPv4)
    return process_runner_->iptables(table, command, chain, argv, false) == 0;

  if (ip_family == IpFamily::kIPv6)
    return process_runner_->ip6tables(table, command, chain, argv, false) == 0;

  return false;
}

}  // namespace patchpanel