wakame-vdc-agents 11.06.0 → 11.12.0

data/lib/dcmgr/vnet/tasks/accept_all_dns.rb

@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      class AcceptAllDNS < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize()
+          super()
+          # Allow DNS traffic to take place
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:outgoing,"-p udp --dport 53 -j ACCEPT")
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:incoming,"-p udp --dport 53 -j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_arp_broadcast.rb

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      class AcceptArpBroadcast < Task
+        include Dcmgr::VNet::Netfilter
+        attr_accessor :hva_ip
+        
+        def initialize(hva_ip,enable_logging = false,log_prefix = nil)
+          super()
+          self.hva_ip = hva_ip
+        
+          # Allow broadcast from the network
+          self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"--protocol arp --arp-mac-dst 00:00:00:00:00:00 #{EbtablesRule.log_arp(log_prefix) if enable_logging} -j ACCEPT")
+          # Allow broadcast from the host
+          self.rules << EbtablesRule.new(:filter,:output,:arp,:outgoing,"--protocol arp --arp-ip-src=#{self.hva_ip} #{EbtablesRule.log_arp(log_prefix) if enable_logging} --arp-mac-dst 00:00:00:00:00:00 -j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_arp_from_friends.rb

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Explicitely allows ARP traffic between "friend" instances
+      # Friends are decided by an Isolator class
+      class AcceptARPFromFriends < Task
+        include Dcmgr::VNet::Netfilter
+        attr_reader :inst_ip
+        attr_reader :friend_ips
+        attr_reader :enable_logging
+        attr_reader :log_prefix
+        
+        def initialize(inst_ip,friend_ips,enable_logging,log_prefix)
+          super()
+          
+          @enable_logging = enable_logging
+          @log_prefix = log_prefix
+          @inst_ip = inst_ip
+          @friend_ips = friend_ips
+          
+          friend_ips.each { |friend_ip|
+            # Log traffic
+            self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"--protocol arp --arp-ip-src #{friend_ip} --arp-ip-dst #{self.inst_ip} --log-ip --log-arp --log-prefix '#{self.log_prefix}'       -j CONTINUE") if self.enable_logging
+            self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"--protocol arp --arp-ip-src #{friend_ip} --arp-ip-dst #{self.inst_ip} -j ACCEPT")
+          }
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_arp_from_gateway.rb

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      class AcceptARPFromGateway < Task
+        include Dcmgr::VNet::Netfilter
+        attr_accessor :gw_ip
+        
+        def initialize(gw_ip,enable_logging = false,log_prefix = nil)
+          super()
+          self.gw_ip = gw_ip
+          # Allow broadcast from the gateway
+          self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"--protocol arp --arp-ip-src=#{self.gw_ip} #{EbtablesRule.log_arp(log_prefix) if enable_logging} -j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_arp_to_host.rb

@@ -0,0 +1,30 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Explicitely allows ARP traffic to take place from the instance to the host
+      class AcceptARPToHost < Task
+        include Dcmgr::VNet::Netfilter
+        attr_reader :enable_logging
+        attr_reader :log_prefix
+        attr_reader :host_ip
+        attr_reader :inst_ip
+        
+        def initialize(host_ip,inst_ip,enable_logging,log_prefix)
+          super()
+          
+          @enable_logging = enable_logging
+          @log_prefix = log_prefix
+          @host_ip = host_ip
+          @inst_ip = inst_ip
+          
+          self.rules << EbtablesRule.new(:filter,:input,:arp,:outgoing,"--protocol arp --arp-ip-src #{self.inst_ip} --arp-ip-dst #{self.host_ip} --log-ip --log-arp --log-prefix '#{self.log_prefix}' -j CONTINUE") if self.enable_logging
+          self.rules << EbtablesRule.new(:filter,:input,:arp,:outgoing,"--protocol arp --arp-ip-src #{self.inst_ip} -j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_ip_from_friends.rb

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Explicitely allows IP traffic between "friend" instances
+      # Friends are determined by an Isolator class
+      class AcceptIpFromFriends < Task
+        include Dcmgr::VNet::Netfilter
+        attr_reader :friend_ips
+        
+        def initialize(friend_ips)
+          super()
+          
+          @friend_ips = friend_ips
+          
+          friend_ips.each { |friend_ip|
+            self.rules << IptablesRule.new(:filter,:forward,nil,:incoming,"-s #{friend_ip} -j ACCEPT")
+          }
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_ip_from_gateway.rb

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Explicitely allows IP traffic between the gateway and the instances
+      class AcceptIpFromGateway < Task
+        include Dcmgr::VNet::Netfilter
+        attr_reader :gateway_ip
+        
+        def initialize(gateway_ip)
+          super()
+          
+          @gateway_ip = gateway_ip
+          
+          self.rules << IptablesRule.new(:filter,:forward,nil,:incoming,"-s #{gateway_ip} -j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_ip_to_anywhere.rb

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Allows any outgoing IP layer traffic from the instance to pass through
+      class AcceptIpToAnywhere < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:filter,:forward,nil,:outgoing,"-j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_related_established.rb

@@ -0,0 +1,45 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Accept related and established connections for tco
+      class AcceptTcpRelatedEstablished < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:filter,:forward,:tcp,:incoming,"-m state --state RELATED,ESTABLISHED -p tcp -j ACCEPT")
+        end
+      end
+      
+      # Accept related and established connections for icmp
+      class AcceptIcmpRelatedEstablished < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:filter,:forward,:icmp,:incoming,"-m state --state RELATED,ESTABLISHED -p icmp -j ACCEPT")
+        end
+      end
+      
+      # Accept established connections for any udp
+      class AcceptUdpEstablished < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:incoming,"-m state --state ESTABLISHED -p udp -j ACCEPT")
+        end
+      end
+    
+      # Accept related and established connaction for any protocol
+      class AcceptRelatedEstablished < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:filter,:forward,nil,:incoming,"-m state --state RELATED,ESTABLISHED -j ACCEPT")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_wakame_dhcp_only.rb

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Allows for DHCP traffic to take place with and only with wakame's DHCP server
+      class AcceptWakameDHCPOnly < Task
+        include Dcmgr::VNet::Netfilter
+        #TODO: allow ARP traffic to DHCP server
+        attr_reader :dhcp_server_ip
+        
+        def initialize(dhcp_server_ip,fport = 67, tport = 68)
+          super()
+          
+          @dhcp_server_ip = dhcp_server_ip
+          
+          # Block DHCP replies that aren't coming from our DHCP server
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:incoming,"-p udp ! -s #{self.dhcp_server_ip} --sport #{fport}:#{tport} -j DROP")
+          
+          # Accept DHCP replies coming from our DHCP server
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:incoming,"-p udp -s #{self.dhcp_server_ip} --sport #{fport}:#{tport} -j ACCEPT")
+          
+          # Drop all non DHCP traffic to our DHCP server
+          [:udp,:tcp,:icmp].each { |protocol|
+            self.rules << IptablesRule.new(:filter,:forward,protocol,:outgoing,"-d #{self.dhcp_server_ip} -p #{protocol} -j DROP")
+          }
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/accept_wakame_dns_only.rb

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Allows for DNS traffic to be exchanged with and only with Wakame's DNS server
+      class AcceptWakameDNSOnly < Task
+        include Dcmgr::VNet::Netfilter
+        #TODO: allow ARP traffic to DNS server
+        attr_reader :dns_server_ip
+        attr_reader :dns_server_port
+        
+        def initialize(dns_server_ip,dns_server_port="53")
+          super()
+          
+          @dns_server_ip = dns_server_ip
+          @dns_server_port = dns_server_port
+          
+          # Allow DNS traffic to take place
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:outgoing,"-p udp -d #{self.dns_server_ip} --dport #{self.dns_server_port} -j ACCEPT")
+          self.rules << IptablesRule.new(:filter,:forward,:udp,:incoming,"-p udp -d #{self.dns_server_ip} --dport #{self.dns_server_port} -j ACCEPT")
+          
+          # Disable any non DNS traffic to DNS server
+          #[:udp,:tcp,:icmp].each { |protocol|
+            #self.rules << IptablesRule.new(:filter,:forward,protocol,:outgoing,"-d #{self.dns_server_ip} -p #{protocol} -j DROP")
+          #}
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/debug_iptables.rb

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # via http://backreference.org/2010/06/11/iptables-debugging/
+      # To debug ipv4 packets.
+      # $ sudo tail -F /var/log/kern.log | grep TRACE:
+      class DebugIptables < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:raw,:output,:icmp,:outgoing,"-p icmp -j TRACE")
+          self.rules << IptablesRule.new(:raw,:prerouting,:icmp,:incoming,"-p icmp -j TRACE")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/drop_arp_forwarding.rb

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Drops all ARP packet forwarding
+      class DropArpForwarding < Task
+        include Dcmgr::VNet::Netfilter
+        attr_reader :enable_logging
+        attr_reader :log_prefix
+        
+        def initialize(enable_logging,log_prefix)
+          super()
+          
+          @enable_logging = enable_logging
+          @log_prefix = log_prefix
+          
+          # Drop forwarding to other instances
+          #self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"--log-level 4 --log-ip --log-arp --log-prefix 'D d_#{self.log_prefix}_arp:' -j CONTINUE") if self.enable_logging
+          self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"#{EbtablesRule.log_arp(self.log_prefix) if self.enable_logging} -j DROP")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/drop_arp_to_host.rb

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Drops all ARP packets coming into the host
+      class DropArpToHost < Task
+        include Dcmgr::VNet::Netfilter
+        attr_reader :enable_logging
+        attr_reader :log_prefix
+        
+        def initialize
+          super()
+          
+          # Drop forwarding to host
+          #self.rules << EbtablesRule.new(:filter,:input,:arp,:outgoing,"--log-level 4 --log-ip --log-arp --log-prefix '#{self.log_prefix}' -j CONTINUE") if self.enable_logging
+          self.rules << EbtablesRule.new(:filter,:input,:arp,:outgoing,"#{EbtablesRule.log_arp(self.log_prefix) if self.enable_logging} -j DROP")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/drop_ip_from_anywhere.rb

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Drop all incoming IP layer traffic
+      class DropIpFromAnywhere < Task
+        include Dcmgr::VNet::Netfilter
+        def initialize
+          super()
+          self.rules << IptablesRule.new(:filter,:forward,nil,:incoming,"-j DROP")
+        end
+      end
+    
+    end
+  end
+end

data/lib/dcmgr/vnet/tasks/drop_ip_spoofing.rb

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+
+module Dcmgr
+  module VNet
+    module Tasks
+    
+      # Disable instances from spoofing another ip address
+      class DropIpSpoofing < Task
+        include Dcmgr::VNet::Netfilter
+        attr_accessor :ip
+        attr_accessor :enable_logging
+        attr_accessor :log_prefix
+        
+        def initialize(ip,enable_logging,log_prefix)
+        super()
+        self.ip = ip
+        self.enable_logging = enable_logging
+        self.log_prefix = log_prefix
+        
+        # Prevent spoofing to the outside world
+        self.rules << EbtablesRule.new(:filter,:forward,:arp,:outgoing,"--protocol arp --arp-ip-src ! #{self.ip} #{EbtablesRule.log_arp(self.log_prefix) if self.enable_logging} -j DROP")
+        # Prevent spoofing to the host
+        self.rules << EbtablesRule.new(:filter,:input,:arp,:outgoing,"--protocol arp --arp-ip-src ! #{self.ip} #{EbtablesRule.log_arp(self.log_prefix) if self.enable_logging} -j DROP")
+        
+        # Prevent the outside world from spoofing to the instance
+        self.rules << EbtablesRule.new(:filter,:forward,:arp,:incoming,"--protocol arp --arp-ip-dst ! #{self.ip} #{EbtablesRule.log_arp(self.log_prefix) if self.enable_logging} -j DROP")
+        # Prevent the host from spoofing to the instance
+        self.rules << EbtablesRule.new(:filter,:output,:arp,:incoming,"--protocol arp --arp-ip-dst ! #{self.ip} #{EbtablesRule.log_arp(self.log_prefix) if self.enable_logging} -j DROP")
+        end
+      end
+    
+    end
+  end
+end